Mirrors/chatmail-core
1
0
Fork 0
mirror of https://github.com/chatmail/core.git synced 2026-04-18 05:56:31 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat: use Rustls instead of native TLS for HTTPS requests

Browse Source 
HTTPS requests are used to fetch
remote images in HTML emails,
to fetch autoconfig XML,
to POST requests for `DCACCOUNT:` QR codes
to make OAuth 2 API requests
and to connect to HTTPS proxies.

Rustls is more aggressive than OpenSSL
in deprecating cryptographic algorithms
so we cannot use it for IMAP and SMTP
to avoid breaking compatibility,
but for HTTPS requests listed
above this should not result in problems.

As HTTPS requests use only strict TLS checks,
there is no `strict_tls` argument
in `wrap_rustls` function.

Rustls is already used by iroh,
so this change does not introduce new dependencies.
This commit is contained in:
link2xt
2024-09-21 19:52:25 +00:00
parent 638da904e7
commit 78a0d7501b
6 changed files with 30 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/net/proxy.rs
View File

@@ -20,8 +20,9 @@ use url::Url;
use crate::config::Config;
use crate::context::Context;
use crate::net::connect_tcp;
use crate::net::session::SessionStream;
use crate::net::{connect_tcp, wrap_tls};
use crate::net::tls::wrap_rustls;
use crate::sql::Sql;
/// Default SOCKS5 port according to [RFC 1928](https://tools.ietf.org/html/rfc1928).
@@ -375,7 +376,6 @@ impl ProxyConfig {
}
ProxyConfig::Https(https_config) => {
let load_cache = true;
let strict_tls = true;
let tcp_stream = crate::net::connect_tcp(
context,
&https_config.host,
@@ -383,7 +383,7 @@ impl ProxyConfig {
load_cache,
)
.await?;
let tls_stream = wrap_tls(strict_tls, &https_config.host, &[], tcp_stream).await?;
let tls_stream = wrap_rustls(&https_config.host, &[], tcp_stream).await?;
let auth = if let Some((username, password)) = &https_config.user_password {
Some((username.as_str(), password.as_str()))
} else {