Fix client for HTTPS endpoints with Python 3.12

benchmark/requirements.txt

@@ -1,4 +1,4 @@
-aiohttp==3.8.2
+aiohttp==3.10.3
 # Blacksheep depends upon essentials_openapi which is pinned to pyyaml==5.4.1
 # and pyyaml>5.3.1 is broken for cython 3
 # See https://github.com/yaml/pyyaml/issues/724#issuecomment-1638587228

proxy/common/constants.py

@@ -161,7 +161,9 @@ def _env_threadless_compliant() -> bool:
 DEFAULT_WAIT_FOR_TASKS_TIMEOUT = 1 / 1000
 DEFAULT_INACTIVE_CONN_CLEANUP_TIMEOUT = 1   # in seconds
 DEFAULT_SSL_CONTEXT_OPTIONS = (
-    ssl.OP_NO_SSLv2 | ssl.OP_NO_SSLv3 | ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
+    ssl.OP_NO_COMPRESSION
+    if sys.version_info >= (3, 11)
+    else (ssl.OP_NO_SSLv2 | ssl.OP_NO_SSLv3 | ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1)
 )
 
 DEFAULT_DEVTOOLS_DOC_URL = 'http://proxy'

proxy/http/client.py

@@ -9,11 +9,20 @@
     :license: BSD, see LICENSE for more details.
 """
 import ssl
+import logging
 from typing import Optional
 
+import certifi
+
 from .parser import HttpParser, httpParserTypes
+from ..common.types import TcpOrTlsSocket
 from ..common.utils import build_http_request, new_socket_connection
-from ..common.constants import HTTPS_PROTO, DEFAULT_TIMEOUT
+from ..common.constants import (
+    HTTPS_PROTO, DEFAULT_TIMEOUT, DEFAULT_SSL_CONTEXT_OPTIONS,
+)
+
+
+logger = logging.getLogger(__name__)
 
 
 def client(
@@ -25,34 +34,37 @@
     conn_close: bool = True,
     scheme: bytes = HTTPS_PROTO,
     timeout: float = DEFAULT_TIMEOUT,
+    content_type: bytes = b'application/x-www-form-urlencoded',
 ) -> Optional[HttpParser]:
     """Makes a request to remote registry endpoint"""
     request = build_http_request(
         method=method,
         url=path,
         headers={
             b'Host': host,
-            b'Content-Type': b'application/x-www-form-urlencoded',
+            b'Content-Type': content_type,
         },
         body=body,
         conn_close=conn_close,
     )
     try:
         conn = new_socket_connection((host.decode(), port))
-    except ConnectionRefusedError:
+    except ConnectionRefusedError as exc:
+        logger.exception('Connection refused', exc_info=exc)
         return None
-    try:
-        sock = (
-            ssl.wrap_socket(sock=conn, ssl_version=ssl.PROTOCOL_TLSv1_2)
-            if scheme == HTTPS_PROTO
-            else conn
-        )
-    except Exception:
-        conn.close()
-        return None
-    parser = HttpParser(
-        httpParserTypes.RESPONSE_PARSER,
-    )
+    sock: TcpOrTlsSocket = conn
+    if scheme == HTTPS_PROTO:
+        try:
+            ctx = ssl.SSLContext(protocol=(ssl.PROTOCOL_TLS_CLIENT))
+            ctx.options |= DEFAULT_SSL_CONTEXT_OPTIONS
+            ctx.verify_mode = ssl.CERT_REQUIRED
+            ctx.load_verify_locations(cafile=certifi.where())
+            sock = ctx.wrap_socket(conn, server_hostname=host.decode())
+        except Exception as exc:
+            logger.exception('Unable to wrap', exc_info=exc)
+            conn.close()
+            return None
+    parser = HttpParser(httpParserTypes.RESPONSE_PARSER)
     sock.settimeout(timeout)
     try:
         sock.sendall(request)

tests/http/test_client.py

@@ -0,0 +1,28 @@
+# -*- coding: utf-8 -*-
+"""
+    proxy.py
+    ~~~~~~~~
+    ⚡⚡⚡ Fast, Lightweight, Pluggable, TLS interception capable proxy server focused on
+    Network monitoring, controls & Application development, testing, debugging.
+
+    :copyright: (c) 2013-present by Abhinav Singh and contributors.
+    :license: BSD, see LICENSE for more details.
+"""
+import unittest
+
+from proxy.http.client import client
+
+
+class TestClient(unittest.TestCase):
+
+    def test_client(self) -> None:
+        response = client(
+            host=b'google.com',
+            port=443,
+            scheme=b'https',
+            path=b'/',
+            method=b'GET',
+            content_type=b'text/html',
+        )
+        assert response is not None
+        self.assertEqual(response.code, b'301')