Support for HTTPS proxy (HTTP proxy over SSL)?

[synchronizing]

Wondering if python-socks has support for HTTPS proxy (HTTP proxy over SSL).

To clarify, I do not mean an HTTP proxy that supports CONNECT. I'm specifically speaking on HTTP proxy over SSL. In other words, directly on connection with a proxy the client begins the SSL/TLS handshake (before ever sending any HTTP request - nested SSL tunneling can happen thereafter if need be).

I briefly went through the code and did not see this implementation - wondering if I missed something.

Thank you!

[romis2012]

Secure proxy connections are not supported officially.

The reason is that not all the backends we use support "TLS in TLS" connections. See also these issues: #4, romis2012/aiohttp-socks#25 and these discussions: https://bugs.python.org/issue37179, aio-libs/aiohttp#2722, aio-libs/aiohttp#6044, encode/httpx#1434, encode/httpcore#254

But if you are using asyncio and uvloop there is undocumented (experimental) API

from python_socks.async_.asyncio.ext import Proxy
...

async def fetch():
    proxy_ssl = ssl.SSLContext(ssl.PROTOCOL_TLS)
    proxy_ssl.verify_mode = ssl.CERT_REQUIRED
    proxy_ssl.load_verify_locations(...)

    dest_ssl = ssl.create_default_context()

    proxy = Proxy.from_url('http://127.0.0.1:7774', proxy_ssl=proxy_ssl)

    stream = await proxy.connect(dest_host='check-host.net', dest_port=443, dest_ssl=dest_ssl)

    request = (
        b'GET /ip HTTP/1.1\r\n'
        b'Host: check-host.net\r\n'
        b'Connection: close\r\n\r\n'
    )

    await stream.write_all(request)
    response = await stream.read()
    print(response)

import uvloop
uvloop.install()
asyncio.run(fetch())

[synchronizing]

Thank you for linking all the relevant issues - makes complete sense now. It seems like Andrew has ported uvloops implementation over to asyncio on cpython#17975, and we should see support for SSL-in-SSL within 3.10. 🤞🏼

For the meantime, I can work with the example you have given. Thank you for the help - closing the issue.

[romis2012]

Anyio backend was added in version 2.x. Anyio has its own TLS-in-TLS support. So the code below should work in both asyncio (without uvloop) and trio:

from python_socks.async_.anyio import Proxy
...

async def fetch():
    proxy_ssl = ssl.SSLContext(ssl.PROTOCOL_TLS)
    proxy_ssl.verify_mode = ssl.CERT_REQUIRED
    proxy_ssl.load_verify_locations(...)

    dest_ssl = ssl.create_default_context()

    proxy = Proxy.from_url('http://127.0.0.1:7774', proxy_ssl=proxy_ssl)

    stream = await proxy.connect(dest_host='check-host.net', dest_port=443, dest_ssl=dest_ssl)

    request = (
        b'GET /ip HTTP/1.1\r\n'
        b'Host: check-host.net\r\n'
        b'Connection: close\r\n\r\n'
    )

    await stream.write_all(request)
    response = await stream.read()
    print(response)


asyncio.run(fetch())
# or
# trio.run(fetch)

[synchronizing]

I'll take a look into AnyIO, thank you for the share & the code example.