boring-http 2.2.1__tar.gz → 2.3.0__tar.gz

{boring_http-2.2.1 → boring_http-2.3.0}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.3
 Name: boring-http
-Version: 2.2.1
+Version: 2.3.0
 Summary: Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order
-Requires-Dist: boring-ssl2>=1.2.0
-Requires-Dist: ssl2>=2.0.1
+Requires-Dist: boring-ssl2>=1.3.0
+Requires-Dist: ssl2>=2.1.0
 Requires-Python: >=3.14
 Project-URL: Repository, https://github.com/baobien-dev/boring-http
 Description-Content-Type: text/markdown
@@ -42,7 +42,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. `certificate_chain=SigningChain(...)` from `ssl2` presents a client certificate over TCP and QUIC. `check_peer=` is awaited with the peer's chain in DER, leaf first, and its authority after the same checks; raising from it refuses the connection, which is where a key pin goes. Connections are pooled per origin and proxy under `max_connections` and `max_connections_per_host`; one that has served nothing for `max_idle_time` seconds, 90 by default, is closed instead of reused, and `None` keeps it until the server closes it. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
+Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. `certificate_chain=SigningChain(...)` from `ssl2` presents a client certificate over TCP and QUIC. `check_peer=` is awaited with the peer's chain in DER, leaf first, and its authority after the same checks; raising from it refuses the connection, which is where a key pin goes. `key_log="keys.txt"` appends the secrets of every TLS and QUIC handshake in the NSS key log format, for Wireshark. `resolve={("example.com", 443): ("203.0.113.7", 443)}` sends a connection without a proxy to that address instead of resolving the name, while SNI and certificate verification keep the name from the URL. Connections are pooled per origin and proxy under `max_connections` and `max_connections_per_host`; one that has served nothing for `max_idle_time` seconds, 90 by default, is closed instead of reused, and `None` keeps it until the server closes it. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
 
 ## Responses
 

{boring_http-2.2.1 → boring_http-2.3.0}/README.md

@@ -32,7 +32,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. `certificate_chain=SigningChain(...)` from `ssl2` presents a client certificate over TCP and QUIC. `check_peer=` is awaited with the peer's chain in DER, leaf first, and its authority after the same checks; raising from it refuses the connection, which is where a key pin goes. Connections are pooled per origin and proxy under `max_connections` and `max_connections_per_host`; one that has served nothing for `max_idle_time` seconds, 90 by default, is closed instead of reused, and `None` keeps it until the server closes it. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
+Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. `certificate_chain=SigningChain(...)` from `ssl2` presents a client certificate over TCP and QUIC. `check_peer=` is awaited with the peer's chain in DER, leaf first, and its authority after the same checks; raising from it refuses the connection, which is where a key pin goes. `key_log="keys.txt"` appends the secrets of every TLS and QUIC handshake in the NSS key log format, for Wireshark. `resolve={("example.com", 443): ("203.0.113.7", 443)}` sends a connection without a proxy to that address instead of resolving the name, while SNI and certificate verification keep the name from the URL. Connections are pooled per origin and proxy under `max_connections` and `max_connections_per_host`; one that has served nothing for `max_idle_time` seconds, 90 by default, is closed instead of reused, and `None` keeps it until the server closes it. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
 
 ## Responses
 

{boring_http-2.2.1 → boring_http-2.3.0}/pyproject.toml

@@ -1,12 +1,12 @@
 [project]
 name = "boring-http"
-version = "2.2.1"
+version = "2.3.0"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"
 dependencies = [
-    "boring-ssl2>=1.2.0",
-    "ssl2>=2.0.1",
+    "boring-ssl2>=1.3.0",
+    "ssl2>=2.1.0",
 ]
 
 [project.urls]

{boring_http-2.2.1 → boring_http-2.3.0}/pyproject.toml.orig

@@ -1,12 +1,12 @@
 [project]
 name = "boring-http"
-version = "2.2.1"
+version = "2.3.0"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"
 dependencies = [
-    "boring-ssl2>=1.2.0",
-    "ssl2>=2.0.1",
+    "boring-ssl2>=1.3.0",
+    "ssl2>=2.1.0",
 ]
 
 [project.urls]

{boring_http-2.2.1 → boring_http-2.3.0}/src/boring_http/client.py

@@ -1,4 +1,5 @@
 import base64
+import os
 from collections.abc import (
     AsyncGenerator,
     AsyncIterable,
@@ -117,6 +118,8 @@ class Client:
         revocation: Revocation = Revocation.SOFT,
         certificate_chain: SigningChain | None = None,
         check_peer: Callable[[tuple[bytes, ...], str], Awaitable[None]] | None = None,
+        key_log: str | os.PathLike[str] | None = None,
+        resolve: Mapping[tuple[str, int], tuple[str, int]] | None = None,
         cookies: CookieJar | None = None,
         base_url: str | None = None,
         max_connections: int = 100,
@@ -151,6 +154,8 @@ class Client:
         self._revocations = Revocations(revocation, self._fetch_crl)
         self._certificate_chain = certificate_chain
         self._check_peer = check_peer
+        self._key_log = key_log
+        self._resolve = {} if resolve is None else dict(resolve)
         self._base_url = base_url
         self._max_redirects = max_redirects
         self._max_message_size = max_message_size
@@ -475,7 +480,7 @@ class Client:
                 else None
             )
             self._contexts[protocols] = ClientContext(
-                configuration, session_cache=cache
+                configuration, session_cache=cache, key_log=self._key_log
             )
         return self._contexts[protocols]
 
@@ -528,13 +533,19 @@ class Client:
         *,
         http1_only: bool = False,
     ) -> Connection:
+        # a resolve= entry sends a direct connection elsewhere, while the URL's host stays the name sent and verified
+        address = (
+            self._resolve.get(url.address, url.address)
+            if proxy is None
+            else url.address
+        )
         try:
             if quic and self._http3 is not None:
                 memory = self._memory.setdefault(url.address, OriginMemory())
                 client = await QuicClient.connect(
                     self._context((NextProtocol.H3,)),
                     url.host,
-                    url.address,
+                    address,
                     self._http3.transport,
                     version=self._http3.quic_version,
                     proxy=proxy,
@@ -551,11 +562,12 @@ class Client:
             if url.secure:
                 stream = await TLSStream.connect(
                     self._context((NextProtocol.HTTP1,) if http1_only else None),
-                    url.address,
+                    address,
                     proxy=proxy,
                     proxy_context=self._context((NextProtocol.HTTP1,))
                     if proxy is not None and proxy.scheme is ProxyScheme.HTTPS
                     else None,
+                    server_hostname=url.host,
                 )
                 await self._checked(stream, url.authority)
                 if (
@@ -587,7 +599,7 @@ class Client:
                 return Http1Connection(
                     transport, absolute_form=True, proxy_authorization=authorization
                 )
-            tunnel = await TLSStream.tunnel(self._context(), url.address, proxy)
+            tunnel = await TLSStream.tunnel(self._context(), address, proxy)
             return Http1Connection(tunnel.transport, leftover=tunnel.leftover)
         except ProxyError, ConfigurationError, RevocationError:
             raise