diff --git a/ylong_http_client/src/async_impl/connector/mod.rs b/ylong_http_client/src/async_impl/connector/mod.rs index 963921cd805d6dd600447a720c4f5b6ab1c72087..73ae085cea1e73a25e5322fed598cd202f75bf5a 100644 --- a/ylong_http_client/src/async_impl/connector/mod.rs +++ b/ylong_http_client/src/async_impl/connector/mod.rs @@ -63,21 +63,19 @@ async fn tcp_stream(addr: &str) -> Result { .map_err(|e| { #[cfg(target_os = "linux")] if format!("{}", e).contains("failed to lookup address information") { - return HttpClientError::from_dns_error(crate::ErrorKind::Connect, e) + return HttpClientError::from_dns_error(crate::ErrorKind::Connect, e); } #[cfg(target_os = "windows")] if let Some(code) = e.raw_os_error() { if (0x2329..=0x26B2).contains(&code) || code == 0x2AF9 { - return HttpClientError::from_dns_error(crate::ErrorKind::Connect, e) + return HttpClientError::from_dns_error(crate::ErrorKind::Connect, e); } } HttpClientError::from_io_error(crate::ErrorKind::Connect, e) }) .and_then(|stream| match stream.set_nodelay(true) { Ok(()) => Ok(stream), - Err(e) => { - err_from_io!(Connect, e) - } + Err(e) => err_from_io!(Connect, e), }) } diff --git a/ylong_http_client/src/util/c_openssl/ffi/ssl.rs b/ylong_http_client/src/util/c_openssl/ffi/ssl.rs index 09baff8690a3b72cf83f44a5ba4f7a6b8a6eb55a..8b3ab8b1f7ba0c3fb308e9a69d608b7e73834982 100644 --- a/ylong_http_client/src/util/c_openssl/ffi/ssl.rs +++ b/ylong_http_client/src/util/c_openssl/ffi/ssl.rs @@ -125,6 +125,7 @@ extern "C" { callback: extern "C" fn(*mut X509_STORE_CTX, *mut c_void) -> c_int, arg: *mut c_void, ); + } /// This is the main SSL/TLS structure which is created by a server or client diff --git a/ylong_http_client/src/util/c_openssl/ssl/ctx.rs b/ylong_http_client/src/util/c_openssl/ssl/ctx.rs index 13fbd4cb59964c19b978c1ea95c0588996d5e11a..bd46f66b898deec4a872f47c3c83ea957226a244 100644 --- a/ylong_http_client/src/util/c_openssl/ssl/ctx.rs +++ b/ylong_http_client/src/util/c_openssl/ssl/ctx.rs @@ -37,6 +37,7 @@ use crate::util::config::tls::DefaultCertVerifier; const SSL_CTRL_SET_MIN_PROTO_VERSION: c_int = 123; const SSL_CTRL_SET_MAX_PROTO_VERSION: c_int = 124; +const SSL_CTRL_SET_SIGALGS_LIST: c_int = 98; foreign_type!( type CStruct = SSL_CTX; @@ -91,8 +92,9 @@ impl SslContextBuilder { let mut builder = Self::from_ptr(ptr); builder.set_verify(SSL_VERIFY_PEER); builder.set_cipher_list( - "DEFAULT:!aNULL:!eNULL:!MD5:!3DES:!DES:!RC4:!IDEA:!SEED:!aDSS:!SRP:!PSK", + "DEFAULT:!aNULL:!eNULL:!MD5:!3DES:!DES:!RC4:!IDEA:!SEED:!aDSS:!SRP:!PSK:!SHA1:!CBC", )?; + builder.set_sigalgs_list()?; Ok(builder) } @@ -266,4 +268,46 @@ impl SslContextBuilder { let ptr = self.as_ptr_mut(); unsafe { X509StoreRef::from_ptr_mut(SSL_CTX_get_cert_store(ptr)) } } + + pub(crate) fn set_sigalgs_list(&mut self) -> Result<(), ErrorStack> { + // Allowed signature algorithms: + // ecdsa_secp256r1_sha256 (0x0403) + // ecdsa_secp384r1_sha384 (0x0503) + // ecdsa_secp521r1_sha512 (0x0603) + // ed25519 (0x0807) + // ed448 (0x0808) + // rsa_pss_pss_sha256 (0x0809) + // rsa_pss_pss_sha384 (0x080a) + // rsa_pss_pss_sha512 (0x080b) + // rsa_pss_rsae_sha256 (0x0804) + // rsa_pss_rsae_sha384 (0x0805) + // rsa_pss_rsae_sha512 (0x0806) + // rsa_pkcs1_sha256 (0x0401) + // rsa_pkcs1_sha384 (0x0501) + // rsa_pkcs1_sha512 (0x0601) + // SHA256 DSA (0x0402) + // SHA384 DSA (0x0502) + // SHA512 DSA (0x0602) + const SUPPORT_SIGNATURE_ALGORITHMS: &str = "\ + ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:\ + ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:\ + rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:\ + rsa_pss_rsae_sha512:rsa_pkcs1_sha256:rsa_pkcs1_sha384:rsa_pkcs1_sha512:DSA+SHA256:DSA+SHA384:DSA+SHA512"; + let list = match CString::new(SUPPORT_SIGNATURE_ALGORITHMS) { + Ok(cstr) => cstr, + Err(_) => return Err(ErrorStack::get()), + }; + + let ptr = self.as_ptr_mut(); + + check_ret(unsafe { + SSL_CTX_ctrl( + ptr, + SSL_CTRL_SET_SIGALGS_LIST, + 0, + list.as_ptr() as *const c_void as *mut c_void, + ) + } as c_int) + .map(|_| ()) + } } diff --git a/ylong_http_client/src/util/h2/streams.rs b/ylong_http_client/src/util/h2/streams.rs index 304b617bb9ae32b1c2f15644a42fb50ee8b5c4ac..fad3f9505d50588e853822808a1b1ade77555fe9 100644 --- a/ylong_http_client/src/util/h2/streams.rs +++ b/ylong_http_client/src/util/h2/streams.rs @@ -226,7 +226,6 @@ impl Streams { stream.send_window.increase_size(excess)?; } for id in self.pending_stream_window.iter() { - // self.push_back_pending_send(*id); self.pending_send.push_back(*id); } self.pending_stream_window.clear();