diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 53ac689270..79ba7c3df3 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -76,10 +76,10 @@ jobs: platform: windows - image: ubuntu-latest platform: linux-x86_64 - container: debian:11 # Old version so we get oldest glibc possible. + container: debian:12 # Bookworm is the oldest supported Debian release. - image: ubuntu-24.04-arm platform: linux-arm64 - container: debian:11 # Old version so we get oldest glibc possible. + container: debian:12 # Bookworm is the oldest supported Debian release. runs-on: ${{ matrix.image }} container: image: ${{ matrix.container }} diff --git a/CHANGELOG.md b/CHANGELOG.md index ba8bb13d7f..5ab9cff581 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,8 @@ ## Unreleased: mitmproxy next +- Build Linux standalone binaries on Debian 12 (Bookworm), raising the supported glibc baseline from 2.31 to 2.36. + ([#5](https://github.com/citusdata/mitmproxy/pull/5), @ihalatci) - Fix contentview detection for XML files that start with CRLF. ([#8243](https://github.com/mitmproxy/mitmproxy/pull/8243), @ADiTyaRaj8969) - mitmweb: Fix the filter input losing half-typed text on unrelated parent re-renders. diff --git a/mitmproxy/net/tls.py b/mitmproxy/net/tls.py index 14c0553ca2..ee4502295f 100644 --- a/mitmproxy/net/tls.py +++ b/mitmproxy/net/tls.py @@ -77,12 +77,11 @@ def is_supported_version(version: Version): # Without SECLEVEL, recent OpenSSL versions forbid old TLS versions. # https://github.com/pyca/cryptography/issues/9523 client_ctx.set_cipher_list(b"@SECLEVEL=0:ALL") - client_ctx.set_min_proto_version(version.value) - client_ctx.set_max_proto_version(version.value) - client_conn = SSL.Connection(client_ctx) - client_conn.set_connect_state() - try: + client_ctx.set_min_proto_version(version.value) + client_ctx.set_max_proto_version(version.value) + client_conn = SSL.Connection(client_ctx) + client_conn.set_connect_state() client_conn.recv(4096) except SSL.WantReadError: return True diff --git a/pyproject.toml b/pyproject.toml index ab0583f302..537d3156b9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -37,22 +37,22 @@ dependencies = [ "bcrypt>=5.0.0,<=5.0.0", "Brotli>=1.0,<=1.2.0", "certifi>=2019.9.11", # no upper bound here to get latest CA bundle - "cryptography>=42.0,<=48.1", # relaxed upper bound here to get security fixes + "cryptography>=42.0,<=50.0.0", # relaxed upper bound here to get security fixes "flask>=3.0,<=3.1.3", "h11>=0.16.0,<=0.16.0", - "h2>=4.3.0,<=4.3.0", + "h2>=4.3.0,<=4.4.1", "hyperframe>=6.0,<=6.1.0", "kaitaistruct>=0.10,<=0.11", "ldap3>=2.8,<=2.9.1", "mitmproxy_rs>=0.12.6,<0.13", # relaxed upper bound here: we control this - "msgpack>=1.0.0,<=1.1.2", + "msgpack>=1.0.0,<=1.2.1", "pydivert>=2.0.3,<=2.1.0; sys_platform == 'win32'", "pyOpenSSL>=24.3,<=27.0.0", "pyparsing>=2.4.2,<=3.3.2", "pyperclip>=1.9.0,<=1.11.0", "ruamel.yaml>=0.18.10,<=0.19.1", "sortedcontainers>=2.3,<=2.4.0", - "tornado>=6.5.0,<=6.5.5", + "tornado>=6.5.0,<=6.5.8", "typing-extensions>=4.13.2,<=4.14; python_version < '3.13'", "urwid>=2.6.14,<=4.0.0", "wsproto>=1.0,<=1.3.2", diff --git a/test/mitmproxy/net/test_tls.py b/test/mitmproxy/net/test_tls.py index 8359e4a9dc..6df1c2f446 100644 --- a/test/mitmproxy/net/test_tls.py +++ b/test/mitmproxy/net/test_tls.py @@ -1,4 +1,5 @@ from pathlib import Path +from unittest import mock import pytest from cryptography.hazmat.primitives.asymmetric import ec @@ -15,6 +16,13 @@ def test_supported(version): assert tls.is_supported_version(version) == expected_support +@pytest.mark.parametrize("method", ["set_min_proto_version", "set_max_proto_version"]) +def test_supported_protocol_configuration_error(method): + with mock.patch.object(SSL.Context, method, side_effect=SSL.Error) as set_version: + assert tls.is_supported_version.__wrapped__(tls.Version.UNBOUNDED) is False + set_version.assert_called_once_with(tls.Version.UNBOUNDED.value) + + def test_make_master_secret_logger(): assert tls.make_master_secret_logger(None) is None assert isinstance(tls.make_master_secret_logger("filepath"), tls.MasterSecretLogger) diff --git a/uv.lock b/uv.lock index b8ff15b990..9a3d7ec606 100644 --- a/uv.lock +++ b/uv.lock @@ -1035,15 +1035,15 @@ requires-dist = [ { name = "bcrypt", specifier = "<=5.0.0,>=5.0.0" }, { name = "brotli", specifier = ">=1.0,<=1.2.0" }, { name = "certifi", specifier = ">=2019.9.11" }, - { name = "cryptography", specifier = ">=42.0,<=48.1" }, + { name = "cryptography", specifier = ">=42.0,<=50.0.0" }, { name = "flask", specifier = ">=3.0,<=3.1.3" }, { name = "h11", specifier = "<=0.16.0,>=0.16.0" }, - { name = "h2", specifier = "<=4.3.0,>=4.3.0" }, + { name = "h2", specifier = ">=4.3.0,<=4.4.1" }, { name = "hyperframe", specifier = ">=6.0,<=6.1.0" }, { name = "kaitaistruct", specifier = ">=0.10,<=0.11" }, { name = "ldap3", specifier = ">=2.8,<=2.9.1" }, { name = "mitmproxy-rs", specifier = ">=0.12.6,<0.13" }, - { name = "msgpack", specifier = ">=1.0.0,<=1.1.2" }, + { name = "msgpack", specifier = ">=1.0.0,<=1.2.1" }, { name = "publicsuffix2", specifier = ">=2.20190812,<=2.20191221" }, { name = "pydivert", marker = "sys_platform == 'win32'", specifier = ">=2.0.3,<=2.1.0" }, { name = "pyopenssl", specifier = ">=24.3,<=27.0.0" }, @@ -1051,7 +1051,7 @@ requires-dist = [ { name = "pyperclip", specifier = ">=1.9.0,<=1.11.0" }, { name = "ruamel-yaml", specifier = ">=0.18.10,<=0.19.1" }, { name = "sortedcontainers", specifier = ">=2.3,<=2.4.0" }, - { name = "tornado", specifier = ">=6.5.0,<=6.5.5" }, + { name = "tornado", specifier = ">=6.5.0,<=6.5.8" }, { name = "typing-extensions", marker = "python_full_version < '3.13'", specifier = ">=4.13.2,<=4.14" }, { name = "urwid", specifier = ">=2.6.14,<=4.0.0" }, { name = "wsproto", specifier = ">=1.0,<=1.3.2" },