SSL/TLS requirements

[szepeviktor]

Hello!
I use these wget options to download stuff.

wget --secure-protocol=TLSv1_3 --max-redirect=1 --retry-on-host-error --retry-connrefused --tries=3

I think all of these can be told to lychee except minimum TLS version.

Do you plan to support that?

[mre]

Yeah, good idea.
Some of it is already supported.

We have

• --max-redirects, which defaults to 5
• --max-retries, which defaults to 3

We are missing

• --retry-on-host-error: I'm undecided about that one. The docs say: Consider host errors, such as “Temporary failure in name resolution”, as non-fatal, transient errors”. From my experience, DNS errors are usually not resolved within a couple seconds in between retries, so maybe the use for that is limited?
• --retry-connrefused: Same here; connection issues are rarely transient, from what I saw.

For reference, our retry handling is at https://github.com/lycheeverse/lychee/blob/master/hee-lib/src/retry.rs.

In regard to the TLS version, did I understand correctly that you'd like to have a way to specify the TLS version?

We can discuss the missing options.

[szepeviktor]

you'd like to have a way to specify the TLS version?

I'd like to count only TLSv1.3 compatible webservers as valid links.
Apache httpd supports it 5 years ago.

[mre]

Interesting use-case

[mre]

I'm not against adding support for that, but I will not add it myself. I'd appreciate a pull request, though.
The way I currently think about it would be to add --min-tls arg, which supports constants such as --min-tls=TLSv1_3. We could reuse the wget naming conventions for the variants if it makes sense. Open for suggestions.

[szepeviktor]

All right.
For me a Hello World is impossible in Rust as I do not know the syntax.

[HU90m]

The implementation isn't too complicated.

There is, however, one hicup: reqwest::ClientBuilder::min_tls_version states the following.

A value of tls::Version::TLS_1_3 will cause an error with the native-tls/default-tls backend. This does not mean the version isn’t supported, just that it can’t be set as a minimum due to technical limitations.

Looking at seanmonstar/reqwest#1315, it appears this is because native-tls doesn't allow one to specify the use of TLSv1_3, and so it can't be set as the minimum version.

[mre]

Good progress. I don't know what we could do with TLS 1.3. Maybe we print an error with nativetls and support it with rustls?