Support sni_hostname extension with SOCKS proxy.

CHANGELOG.md

@@ -6,6 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## Unreleased
 
+- Handle `sni_hostname` extension with SOCKS proxy. (#774)
 - Change the type of `Extensions` from `Mapping[Str, Any]` to `MutableMapping[Str, Any]`. (#762)
 - Handle HTTP/1.1 half-closed connections gracefully. (#641)
 

httpcore/_async/socks_proxy.py

@@ -216,6 +216,7 @@ def __init__(
 
     async def handle_async_request(self, request: Request) -> Response:
         timeouts = request.extensions.get("timeout", {})
+        sni_hostname = request.extensions.get("sni_hostname", None)
         timeout = timeouts.get("connect", None)
 
         async with self._connect_lock:
@@ -258,7 +259,8 @@ async def handle_async_request(self, request: Request) -> Response:
 
                         kwargs = {
                             "ssl_context": ssl_context,
-                            "server_hostname": self._remote_origin.host.decode("ascii"),
+                            "server_hostname": sni_hostname
+                            or self._remote_origin.host.decode("ascii"),
                             "timeout": timeout,
                         }
                         async with Trace("start_tls", logger, request, kwargs) as trace:

httpcore/_sync/socks_proxy.py

@@ -216,6 +216,7 @@ def __init__(
 
     def handle_request(self, request: Request) -> Response:
         timeouts = request.extensions.get("timeout", {})
+        sni_hostname = request.extensions.get("sni_hostname", None)
         timeout = timeouts.get("connect", None)
 
         with self._connect_lock:
@@ -258,7 +259,8 @@ def handle_request(self, request: Request) -> Response:
 
                         kwargs = {
                             "ssl_context": ssl_context,
-                            "server_hostname": self._remote_origin.host.decode("ascii"),
+                            "server_hostname": sni_hostname
+                            or self._remote_origin.host.decode("ascii"),
                             "timeout": timeout,
                         }
                         with Trace("start_tls", logger, request, kwargs) as trace:

tests/_async/test_socks_proxy.py

@@ -191,3 +191,66 @@ async def test_socks5_request_incorrect_auth():
         assert str(exc_info.value) == "Invalid username/password"
 
         assert not proxy.connections
+
+
+@pytest.mark.anyio
+async def test_socks5_sni_hostname():
+    """
+    Send an HTTP request via a SOCKS proxy utilizing `sni_hostname` extension.
+    """
+    network_backend = httpcore.AsyncMockBackend(
+        [
+            # The initial socks CONNECT
+            #   v5 NOAUTH
+            b"\x05\x00",
+            #   v5 SUC RSV IP4 127  .0  .0  .1     :80
+            b"\x05\x00\x00\x01\xff\x00\x00\x01\x00\x50",
+            # The actual response from the remote server
+            b"HTTP/1.1 200 OK\r\n",
+            b"Content-Type: plain/text\r\n",
+            b"Content-Length: 13\r\n",
+            b"\r\n",
+            b"Hello, world!",
+        ]
+    )
+
+    async with httpcore.AsyncSOCKSProxy(
+        proxy_url="socks5://localhost:8080/",
+        network_backend=network_backend,
+    ) as proxy:
+        # Sending an intial request, which once complete will return to the pool, IDLE.
+        async with proxy.stream(
+            "GET",
+            "https://93.184.216.34/",
+            headers=[(b"Host", "example.com")],
+            extensions={"sni_hostname": "example.com"},
+        ) as response:
+            info = [repr(c) for c in proxy.connections]
+            assert info == [
+                "<AsyncSocks5Connection ['https://93.184.216.34:443', HTTP/1.1, ACTIVE, Request Count: 1]>"
+            ]
+            await response.aread()
+
+        assert response.status == 200
+        assert response.content == b"Hello, world!"
+        info = [repr(c) for c in proxy.connections]
+        assert info == [
+            "<AsyncSocks5Connection ['https://93.184.216.34:443', HTTP/1.1, IDLE, Request Count: 1]>"
+        ]
+        assert proxy.connections[0].is_idle()
+        assert proxy.connections[0].is_available()
+        assert not proxy.connections[0].is_closed()
+
+        # A connection on a tunneled proxy can only handle HTTPS requests to the same origin.
+        assert not proxy.connections[0].can_handle_request(
+            httpcore.Origin(b"http", b"93.184.216.34", 80)
+        )
+        assert not proxy.connections[0].can_handle_request(
+            httpcore.Origin(b"http", b"other.com", 80)
+        )
+        assert proxy.connections[0].can_handle_request(
+            httpcore.Origin(b"https", b"93.184.216.34", 443)
+        )
+        assert not proxy.connections[0].can_handle_request(
+            httpcore.Origin(b"https", b"other.com", 443)
+        )

tests/_sync/test_socks_proxy.py

@@ -191,3 +191,66 @@ def test_socks5_request_incorrect_auth():
         assert str(exc_info.value) == "Invalid username/password"
 
         assert not proxy.connections
+
+
+
+def test_socks5_sni_hostname():
+    """
+    Send an HTTP request via a SOCKS proxy utilizing `sni_hostname` extension.
+    """
+    network_backend = httpcore.MockBackend(
+        [
+            # The initial socks CONNECT
+            #   v5 NOAUTH
+            b"\x05\x00",
+            #   v5 SUC RSV IP4 127  .0  .0  .1     :80
+            b"\x05\x00\x00\x01\xff\x00\x00\x01\x00\x50",
+            # The actual response from the remote server
+            b"HTTP/1.1 200 OK\r\n",
+            b"Content-Type: plain/text\r\n",
+            b"Content-Length: 13\r\n",
+            b"\r\n",
+            b"Hello, world!",
+        ]
+    )
+
+    with httpcore.SOCKSProxy(
+        proxy_url="socks5://localhost:8080/",
+        network_backend=network_backend,
+    ) as proxy:
+        # Sending an intial request, which once complete will return to the pool, IDLE.
+        with proxy.stream(
+            "GET",
+            "https://93.184.216.34/",
+            headers=[(b"Host", "example.com")],
+            extensions={"sni_hostname": "example.com"},
+        ) as response:
+            info = [repr(c) for c in proxy.connections]
+            assert info == [
+                "<Socks5Connection ['https://93.184.216.34:443', HTTP/1.1, ACTIVE, Request Count: 1]>"
+            ]
+            response.read()
+
+        assert response.status == 200
+        assert response.content == b"Hello, world!"
+        info = [repr(c) for c in proxy.connections]
+        assert info == [
+            "<Socks5Connection ['https://93.184.216.34:443', HTTP/1.1, IDLE, Request Count: 1]>"
+        ]
+        assert proxy.connections[0].is_idle()
+        assert proxy.connections[0].is_available()
+        assert not proxy.connections[0].is_closed()
+
+        # A connection on a tunneled proxy can only handle HTTPS requests to the same origin.
+        assert not proxy.connections[0].can_handle_request(
+            httpcore.Origin(b"http", b"93.184.216.34", 80)
+        )
+        assert not proxy.connections[0].can_handle_request(
+            httpcore.Origin(b"http", b"other.com", 80)
+        )
+        assert proxy.connections[0].can_handle_request(
+            httpcore.Origin(b"https", b"93.184.216.34", 443)
+        )
+        assert not proxy.connections[0].can_handle_request(
+            httpcore.Origin(b"https", b"other.com", 443)
+        )