Unblock security dependency updates and retire Bullseye

.github/workflows/main.yml

@@ -76,10 +76,10 @@ jobs:
             platform: windows
           - image: ubuntu-latest
             platform: linux-x86_64
-            container: debian:11  # Old version so we get oldest glibc possible.
+            container: debian:12  # Bookworm is the oldest supported Debian release.
           - image: ubuntu-24.04-arm
             platform: linux-arm64
-            container: debian:11  # Old version so we get oldest glibc possible.
+            container: debian:12  # Bookworm is the oldest supported Debian release.
     runs-on: ${{ matrix.image }}
     container:
       image: ${{ matrix.container }}

CHANGELOG.md

@@ -7,6 +7,8 @@
 
 ## Unreleased: mitmproxy next
 
+- Build Linux standalone binaries on Debian 12 (Bookworm), raising the supported glibc baseline from 2.31 to 2.36.
+  ([#5](https://github.com/citusdata/mitmproxy/pull/5), @ihalatci)
 - Fix contentview detection for XML files that start with CRLF.
   ([#8243](https://github.com/mitmproxy/mitmproxy/pull/8243), @ADiTyaRaj8969)
 - mitmweb: Fix the filter input losing half-typed text on unrelated parent re-renders.

mitmproxy/net/tls.py

@@ -77,12 +77,11 @@ def is_supported_version(version: Version):
     # Without SECLEVEL, recent OpenSSL versions forbid old TLS versions.
     # https://github.com/pyca/cryptography/issues/9523
     client_ctx.set_cipher_list(b"@SECLEVEL=0:ALL")
-    client_ctx.set_min_proto_version(version.value)
-    client_ctx.set_max_proto_version(version.value)
-    client_conn = SSL.Connection(client_ctx)
-    client_conn.set_connect_state()
-
     try:
+        client_ctx.set_min_proto_version(version.value)
+        client_ctx.set_max_proto_version(version.value)
+        client_conn = SSL.Connection(client_ctx)
+        client_conn.set_connect_state()
         client_conn.recv(4096)
     except SSL.WantReadError:
         return True

pyproject.toml

@@ -37,22 +37,22 @@ dependencies = [
     "bcrypt>=5.0.0,<=5.0.0",
     "Brotli>=1.0,<=1.2.0",
     "certifi>=2019.9.11",  # no upper bound here to get latest CA bundle
-    "cryptography>=42.0,<=48.1",  # relaxed upper bound here to get security fixes
+    "cryptography>=42.0,<=50.0.0",  # relaxed upper bound here to get security fixes
     "flask>=3.0,<=3.1.3",
     "h11>=0.16.0,<=0.16.0",
-    "h2>=4.3.0,<=4.3.0",
+    "h2>=4.3.0,<=4.4.1",
     "hyperframe>=6.0,<=6.1.0",
     "kaitaistruct>=0.10,<=0.11",
     "ldap3>=2.8,<=2.9.1",
     "mitmproxy_rs>=0.12.6,<0.13",  # relaxed upper bound here: we control this
-    "msgpack>=1.0.0,<=1.1.2",
+    "msgpack>=1.0.0,<=1.2.1",
     "pydivert>=2.0.3,<=2.1.0; sys_platform == 'win32'",
     "pyOpenSSL>=24.3,<=27.0.0",
     "pyparsing>=2.4.2,<=3.3.2",
     "pyperclip>=1.9.0,<=1.11.0",
     "ruamel.yaml>=0.18.10,<=0.19.1",
     "sortedcontainers>=2.3,<=2.4.0",
-    "tornado>=6.5.0,<=6.5.5",
+    "tornado>=6.5.0,<=6.5.8",
     "typing-extensions>=4.13.2,<=4.14; python_version < '3.13'",
     "urwid>=2.6.14,<=4.0.0",
     "wsproto>=1.0,<=1.3.2",

test/mitmproxy/net/test_tls.py

@@ -1,4 +1,5 @@
 from pathlib import Path
+from unittest import mock
 
 import pytest
 from cryptography.hazmat.primitives.asymmetric import ec
@@ -15,6 +16,13 @@ def test_supported(version):
     assert tls.is_supported_version(version) == expected_support
 
 
+@pytest.mark.parametrize("method", ["set_min_proto_version", "set_max_proto_version"])
+def test_supported_protocol_configuration_error(method):
+    with mock.patch.object(SSL.Context, method, side_effect=SSL.Error) as set_version:
+        assert tls.is_supported_version.__wrapped__(tls.Version.UNBOUNDED) is False
+    set_version.assert_called_once_with(tls.Version.UNBOUNDED.value)
+
+
 def test_make_master_secret_logger():
     assert tls.make_master_secret_logger(None) is None
     assert isinstance(tls.make_master_secret_logger("filepath"), tls.MasterSecretLogger)