add a ssl_context option to fingerprint - to allow the developer to override the automatically created ssl_context

aiohttp/client_reqrep.py

@@ -60,7 +60,7 @@ class Fingerprint:
         32: sha256,
     }
 
-    def __init__(self, fingerprint):
+    def __init__(self, fingerprint, ssl_context=None):
         digestlen = len(fingerprint)
         hashfunc = self.HASHFUNC_BY_DIGESTLEN.get(digestlen)
         if not hashfunc:
@@ -70,11 +70,16 @@ def __init__(self, fingerprint):
                              'not supported. Use sha256.')
         self._hashfunc = hashfunc
         self._fingerprint = fingerprint
+        self._ssl_context = ssl_context
 
     @property
     def fingerprint(self):
         return self._fingerprint
 
+    @property
+    def ssl_context(self):
+        return self._ssl_context
+
     def check(self, transport):
         if not transport.get_extra_info('sslcontext'):
             return

aiohttp/connector.py

@@ -754,10 +754,17 @@ def _make_ssl_context(verified):
     def _get_ssl_context(self, req):
         """Logic to get the correct SSL context
 
-        0. if req.ssl is false, return None
+        0. if req.is_ssl() is false, return None
 
         1. if ssl_context is specified in req, use it
         2. if _ssl_context is specified in self, use it
+
+            for both we first check the following:
+            1. if it an instance of ssl.SSLContext, use it
+            2. if it an instance of aiohttp.Fingerprint, has a specified ssl_context which is also a ssl.SSLContext
+                instance, use it
+            3. fallback to a newly generated SSL Context without verification
+
         3. otherwise:
             1. if verify_ssl is not specified in req, use self.ssl_context
                (will generate a default context according to self.verify_ssl)
@@ -771,12 +778,18 @@ def _get_ssl_context(self, req):
             sslcontext = req.ssl
             if isinstance(sslcontext, ssl.SSLContext):
                 return sslcontext
+            if not (not isinstance(sslcontext, Fingerprint) or not (sslcontext.ssl_context is not None) or not isinstance(
+                    sslcontext.ssl_context, ssl.SSLContext)):
+                return sslcontext.ssl_context
             if sslcontext is not None:
                 # not verified or fingerprinted
                 return self._make_ssl_context(False)
             sslcontext = self._ssl
             if isinstance(sslcontext, ssl.SSLContext):
                 return sslcontext
+            if not (not isinstance(sslcontext, Fingerprint) or not (sslcontext.ssl_context is not None) or not isinstance(
+                    sslcontext.ssl_context, ssl.SSLContext)):
+                return sslcontext.ssl_context
             if sslcontext is not None:
                 # not verified or fingerprinted
                 return self._make_ssl_context(False)