WIP implementation of TLS min version see lycheeverse#1232

HU90m · Sep 4, 2023 · 84a7d5c · 84a7d5c
1 parent 7fe5ce2
commit 84a7d5c
Show file tree

Hide file tree

Showing 3 changed files with 38 additions and 2 deletions.
diff --git a/lychee-bin/src/client.rs b/lychee-bin/src/client.rs
@@ -77,6 +77,7 @@ pub(crate) fn create(cfg: &Config, cookie_jar: Option<&Arc<CookieStoreMutex>>) -
         .accepted(accepted)
         .require_https(cfg.require_https)
         .cookie_jar(cookie_jar.cloned())
+        .min_tls_version(cfg.min_tls)
         .include_fragments(cfg.include_fragments)
         .build()
         .client()

diff --git a/lychee-bin/src/options.rs b/lychee-bin/src/options.rs
@@ -2,12 +2,14 @@ use crate::archive::Archive;
 use crate::parse::{parse_base, parse_statuscodes};
 use crate::verbosity::Verbosity;
 use anyhow::{anyhow, Context, Error, Result};
-use clap::{arg, builder::TypedValueParser, Parser};
+use clap::{arg, Parser, builder::{TypedValueParser, PossibleValuesParser}};
+
 use const_format::{concatcp, formatcp};
 use lychee_lib::{
     Base, BasicAuthSelector, Input, DEFAULT_MAX_REDIRECTS, DEFAULT_MAX_RETRIES,
     DEFAULT_RETRY_WAIT_TIME_SECS, DEFAULT_TIMEOUT_SECS, DEFAULT_USER_AGENT,
 };
+use reqwest::tls;
 use secrecy::{ExposeSecret, SecretString};
 use serde::Deserialize;
 use std::path::Path;
@@ -44,6 +46,22 @@ const HELP_MSG_CONFIG_FILE: &str = formatcp!(
 const TIMEOUT_STR: &str = concatcp!(DEFAULT_TIMEOUT_SECS);
 const RETRY_WAIT_TIME_STR: &str = concatcp!(DEFAULT_RETRY_WAIT_TIME_SECS);
 
+const TLS_VERSIONS: [&'static str; 4] = [
+    "TLSv1_0",
+    "TLSv1_1",
+    "TLSv1_2",
+    "TLSv1_3",
+];
+fn tls_from_str(ver: impl AsRef<str>) -> Option<tls::Version> {
+    match ver.as_ref() {
+        "TLSv1_0" => Some(tls::Version::TLS_1_0),
+        "TLSv1_1" => Some(tls::Version::TLS_1_1),
+        "TLSv1_2" => Some(tls::Version::TLS_1_2),
+        "TLSv1_3" => Some(tls::Version::TLS_1_3),
+        _ => None,
+    }
+}
+
 #[derive(Debug, Deserialize, Default, Clone)]
 pub(crate) enum Format {
     #[default]
@@ -209,6 +227,17 @@ pub(crate) struct Config {
     #[serde(default = "max_retries")]
     pub(crate) max_retries: u64,
 
+    // Minimum TLS Version
+    #[arg(
+        long,
+        default_value = "TLSv1_0",
+        value_parser=PossibleValuesParser::new(TLS_VERSIONS).map(tls_from_str),
+    )]
+    #[serde(
+        skip,
+    )]
+    pub(crate) min_tls: tls::Version,
+
     /// Maximum number of concurrent network requests
     #[arg(long, default_value = &MAX_CONCURRENCY_STR)]
     #[serde(default = "max_concurrency")]

diff --git a/lychee-lib/src/client.rs b/lychee-lib/src/client.rs
@@ -25,7 +25,7 @@ use http::{
 use log::{debug, warn};
 use octocrab::Octocrab;
 use regex::RegexSet;
-use reqwest::{header, redirect, Url};
+use reqwest::{header, redirect, tls, Url};
 use reqwest_cookie_store::CookieStoreMutex;
 use secrecy::{ExposeSecret, SecretString};
 use typed_builder::TypedBuilder;
@@ -195,6 +195,9 @@ pub struct ClientBuilder {
     #[builder(default = DEFAULT_MAX_RETRIES)]
     max_retries: u64,
 
+    /// Minimum accepted TLS version.
+    min_tls_version: Option<tls::Version>,
+
     /// User-agent used for checking links.
     ///
     /// Defaults to [`DEFAULT_USER_AGENT`].
@@ -342,6 +345,9 @@ impl ClientBuilder {
         if let Some(cookie_jar) = self.cookie_jar {
             builder = builder.cookie_provider(cookie_jar);
         }
+        if let Some(min_tls) = self.min_tls_version {
+            builder = builder.min_tls_version(min_tls);
+        }
 
         let reqwest_client = match self.timeout {
             Some(t) => builder.timeout(t),