Merge d48bfc9298 into 32291c9ad2

litellm/llms/openai/common_utils.py

@@ -32,6 +32,7 @@ from litellm.llms.custom_httpx.http_handler import (
     AsyncHTTPHandler,
     get_ssl_configuration,
 )
+from litellm.types.llms.custom_http import VerifyTypes
 
 
 def _get_client_init_params(cls: type) -> tuple[str, ...]:
@@ -268,6 +269,7 @@ class BaseOpenAILLM:
             "max_retries",
             "organization",
             "api_base",
+            "ssl_verify",
         )
         openai_client_fields: Final = (
             BaseOpenAILLM.get_openai_client_initialization_param_fields(client_type=client_type)
@@ -293,6 +295,7 @@ class BaseOpenAILLM:
     @staticmethod
     def _get_async_http_client(
         shared_session: Optional["ClientSession"] = None,
+        ssl_verify: VerifyTypes | None = None,
     ) -> httpx.AsyncClient | None:
         if litellm.aclient_session is not None:
             return litellm.aclient_session
@@ -303,7 +306,7 @@ class BaseOpenAILLM:
             return httpx.AsyncClient(transport=MockOpenAITransport())
 
         # Get unified SSL configuration
-        ssl_config: Final = get_ssl_configuration()
+        ssl_config: Final = get_ssl_configuration(ssl_verify=ssl_verify)
 
         return httpx.AsyncClient(
             verify=ssl_config,
@@ -316,7 +319,7 @@ class BaseOpenAILLM:
         )
 
     @staticmethod
-    def _get_sync_http_client() -> httpx.Client | None:
+    def _get_sync_http_client(ssl_verify: VerifyTypes | None = None) -> httpx.Client | None:
         if litellm.client_session is not None:
             return litellm.client_session
 
@@ -326,7 +329,7 @@ class BaseOpenAILLM:
             return httpx.Client(transport=MockOpenAITransport())
 
         # Get unified SSL configuration
-        ssl_config: Final = get_ssl_configuration()
+        ssl_config: Final = get_ssl_configuration(ssl_verify=ssl_verify)
 
         return httpx.Client(
             verify=ssl_config,

litellm/llms/openai/openai.py

@@ -27,6 +27,7 @@ from litellm.litellm_core_utils.logging_utils import speech_request_body, track_
 from litellm.llms.base_llm.base_model_iterator import BaseModelResponseIterator
 from litellm.llms.base_llm.chat.transformation import BaseConfig, BaseLLMException
 from litellm.llms.bedrock.chat.invoke_handler import MockResponseIterator
+from litellm.types.llms.custom_http import VerifyTypes
 from litellm.types.utils import (
     EmbeddingResponse,
     ImageResponse,
@@ -348,6 +349,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
         organization: str | None = None,
         client: OpenAI | AsyncOpenAI | None = None,
         shared_session: Optional["ClientSession"] = None,
+        ssl_verify: VerifyTypes | None = None,
     ) -> OpenAI | AsyncOpenAI | None:
         client_initialization_params: Final[dict] = locals()
         if client is None:
@@ -365,9 +367,9 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
                 if isinstance(cached_client, OpenAI) or isinstance(cached_client, AsyncOpenAI):
                     return cached_client
             http_client: Final[httpx.Client | httpx.AsyncClient | None] = (
-                OpenAIChatCompletion._get_async_http_client(shared_session=shared_session)
+                OpenAIChatCompletion._get_async_http_client(shared_session=shared_session, ssl_verify=ssl_verify)
                 if is_async
-                else OpenAIChatCompletion._get_sync_http_client()
+                else OpenAIChatCompletion._get_sync_http_client(ssl_verify=ssl_verify)
             )
             if is_async:
                 _new_client: OpenAI | AsyncOpenAI = AsyncOpenAI(
@@ -694,6 +696,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
                                 drop_params=drop_params,
                                 fake_stream=fake_stream,
                                 shared_session=shared_session,
+                                ssl_verify=litellm_params.get("ssl_verify"),
                             )
 
                     data = provider_config.transform_request(
@@ -717,6 +720,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
                             max_retries=max_retries,
                             organization=organization,
                             stream_options=stream_options,
+                            ssl_verify=litellm_params.get("ssl_verify"),
                         )
                     else:
                         if not isinstance(max_retries, int):
@@ -730,6 +734,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
                             max_retries=max_retries,
                             organization=organization,
                             client=client,
+                            ssl_verify=litellm_params.get("ssl_verify"),
                         )
 
                         ## LOGGING
@@ -850,6 +855,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
         stream_options: dict | None = None,
         fake_stream: bool = False,
         shared_session: Optional["ClientSession"] = None,
+        ssl_verify: VerifyTypes | None = None,
     ):
         response = None
         data = await provider_config.async_transform_request(
@@ -871,6 +877,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
                     organization=organization,
                     client=client,
                     shared_session=shared_session,
+                    ssl_verify=ssl_verify,
                 )
 
                 ## LOGGING
@@ -966,6 +973,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
         max_retries=None,
         headers=None,
         stream_options: dict | None = None,
+        ssl_verify: VerifyTypes | None = None,
     ):
         data["stream"] = True
         data.update(self.get_stream_options(stream_options=stream_options, api_base=api_base))
@@ -979,6 +987,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
             max_retries=max_retries,
             organization=organization,
             client=client,
+            ssl_verify=ssl_verify,
         )
         ## LOGGING
         logging_obj.pre_call(
@@ -1051,6 +1060,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
                     organization=organization,
                     client=client,
                     shared_session=shared_session,
+                    ssl_verify=litellm_params.get("ssl_verify"),
                 )
                 ## LOGGING
                 logging_obj.pre_call(

tests/test_litellm/llms/openai/test_openai_common_utils.py

@@ -1,10 +1,9 @@
-from unittest.mock import MagicMock, call, patch
+from unittest.mock import MagicMock, patch
 
 import httpx
 import openai
 import pytest
 
-
 import litellm
 from litellm.litellm_core_utils.token_counter import token_counter
 from litellm.llms.openai.common_utils import BaseOpenAILLM
@@ -83,11 +82,7 @@ async def test_openai_client_reuse(function_name, is_async, args):
     """
 
     # Determine which client class to mock based on whether the test is async
-    client_path = (
-        "litellm.llms.openai.openai.AsyncOpenAI"
-        if is_async
-        else "litellm.llms.openai.openai.OpenAI"
-    )
+    client_path = "litellm.llms.openai.openai.AsyncOpenAI" if is_async else "litellm.llms.openai.openai.OpenAI"
 
     # Create the appropriate patches
     with (
@@ -97,9 +92,7 @@ async def test_openai_client_reuse(function_name, is_async, args):
     ):
         # Setup the mock to return None first time (cache miss) then a client for subsequent calls
         mock_client = MagicMock()
-        mock_get_cache.side_effect = [None] + [
-            mock_client
-        ] * 9  # First call returns None, rest return the mock client
+        mock_get_cache.side_effect = [None] + [mock_client] * 9  # First call returns None, rest return the mock client
 
         # Make 10 API calls
         for _ in range(10):
@@ -117,9 +110,9 @@ async def test_openai_client_reuse(function_name, is_async, args):
                 pass
 
         # Verify client was created only once
-        assert (
-            mock_client_class.call_count == 1
-        ), f"{'Async' if is_async else ''}OpenAI client should be created only once"
+        assert mock_client_class.call_count == 1, (
+            f"{'Async' if is_async else ''}OpenAI client should be created only once"
+        )
 
         # Verify the client was cached
         assert mock_set_cache.call_count == 1, "Client should be cached once"
@@ -143,12 +136,8 @@ def test_precomputed_init_params_match_inspect_signature():
         _OPENAI_INIT_PARAMS,
     )
 
-    expected_openai = tuple(
-        p for p in inspect.signature(OpenAI.__init__).parameters if p != "self"
-    )
-    expected_azure = tuple(
-        p for p in inspect.signature(AzureOpenAI.__init__).parameters if p != "self"
-    )
+    expected_openai = tuple(p for p in inspect.signature(OpenAI.__init__).parameters if p != "self")
+    expected_azure = tuple(p for p in inspect.signature(AzureOpenAI.__init__).parameters if p != "self")
 
     assert _OPENAI_INIT_PARAMS == expected_openai
     assert _AZURE_OPENAI_INIT_PARAMS == expected_azure
@@ -174,6 +163,60 @@ def test_get_openai_client_cache_key(client_type):
     assert "api_key=sk-test" in key
 
 
+def test_get_openai_client_cache_key_includes_ssl_verify():
+    first_key = BaseOpenAILLM.get_openai_client_cache_key(
+        client_initialization_params={"api_key": "sk-test", "ssl_verify": "/tmp/first-ca.pem"},
+        client_type="openai",
+    )
+    second_key = BaseOpenAILLM.get_openai_client_cache_key(
+        client_initialization_params={"api_key": "sk-test", "ssl_verify": "/tmp/second-ca.pem"},
+        client_type="openai",
+    )
+
+    assert first_key != second_key
+
+
+def test_get_sync_http_client_uses_per_call_ssl_verify(monkeypatch):
+    monkeypatch.setattr(litellm, "client_session", None)
+    monkeypatch.setattr(litellm, "network_mock", False)
+    result = BaseOpenAILLM._get_sync_http_client(ssl_verify=False)
+
+    assert result is not None
+    assert result._transport._pool._ssl_context.check_hostname is False
+    result.close()
+
+
+@pytest.mark.asyncio
+async def test_get_async_http_client_uses_per_call_ssl_verify(monkeypatch):
+    monkeypatch.setattr(litellm, "aclient_session", None)
+    monkeypatch.setattr(litellm, "network_mock", False)
+    result = BaseOpenAILLM._get_async_http_client(ssl_verify=False)
+
+    assert result is not None
+    assert result._transport._ssl_verify is False
+    await result.aclose()
+
+
+def test_openai_client_uses_per_call_ssl_verify(monkeypatch):
+    from litellm.caching.llm_caching_handler import LLMClientCache
+    from litellm.llms.openai.openai import OpenAIChatCompletion
+
+    monkeypatch.setattr(litellm, "client_session", None)
+    monkeypatch.setattr(litellm, "network_mock", False)
+    monkeypatch.setattr(litellm, "in_memory_llm_clients_cache", LLMClientCache())
+    client = OpenAIChatCompletion()._get_openai_client(
+        is_async=False,
+        api_key="sk-test",
+        api_base="https://example.test/v1",
+        max_retries=2,
+        ssl_verify=False,
+    )
+
+    assert client is not None
+    assert client._client._transport._pool._ssl_context.check_hostname is False
+    client.close()
+
+
 def test_evicting_a_client_built_on_the_callers_session_leaves_that_session_open(monkeypatch):
     """`litellm.aclient_session` belongs to the caller, who goes on using it.