a158774364
The list of TLS versions was added by
8bd2b6eb138ace3408a03c78ecc339fc35b19f10 when hackney version was
pinned to 1.15.2. Later hackney version was upgraded
(166455c88441b22455d996ed528ed4804514a3c0) but the list of TLS
versions wasn't removed. From the hackney point of view, this list has
been replaced by the OTP defaults since 0.16.0
(734694ea4e24f267864c459a2f050e943adc6694).
It looks like the same issue already occurred before:
0cb7b0ea8477bdd7af2e5e9071843be5b8623dff.
A way to test this issue (where example.com is an ActivityPub site
which uses TLSv1.3 only):
$ PLEROMA_CONFIG_PATH=/path/to/config.exs pleroma start_iex
Erlang/OTP 22 [erts-10.7.2.16] [source] [64-bit] [smp:2:2] [ds:2:2:10] [async-threads:1] [hipe]
Erlang/OTP 22 [erts-10.7.2.16] [source] [64-bit] [smp:2:2] [ds:2:2:10] [async-threads:1] [hipe]
Interactive Elixir (1.10.4) - press Ctrl+C to exit (type h() ENTER for help)
iex(pleroma@127.0.0.1)2> Pleroma.Object.Fetcher.fetch_and_contain_remote_object_from_id("https://example.com/@/Nick/")
{:error,
{:tls_alert,
{:protocol_version,
'TLS client: In state hello received SERVER ALERT: Fatal - Protocol Version\n'}}}
With this patch, the output is the expected one:
iex(pleroma@127.0.0.1)3> Pleroma.Object.Fetcher.fetch_and_contain_remote_object_from_id("https://example.com/@/Nick/")
{:error,
{:ok,
%{
"@context" => [
"https://www.w3.org/ns/activitystreams",
"https://w3id.org/security/v1",
%{
"Emoji" => "toot:Emoji",
"Hashtag" => "as:Hashtag",
"atomUri" => "ostatus:atomUri",
"conversation" => "ostatus:conversation",
"featured" => "toot:featured",
"focalPoint" => %{"@container" => "@list", "@id" => "toot:focalPoint"},
"inReplyToAtomUri" => "ostatus:inReplyToAtomUri",
"manuallyApprovesFollowers" => "as:manuallyApprovesFollowers",
"movedTo" => "as:movedTo",
"ostatus" => "http://ostatus.org#",
"sensitive" => "as:sensitive",
"toot" => "http://joinmastodon.org/ns#"
}
],
"endpoints" => %{"sharedInbox" => "https://example.com/inbox"},
"followers" => "https://example.com/@/Nick/followers",
"following" => nil,
"icon" => %{
"type" => "Image",
"url" => "https://example.com/static/media/[...].png"
},
"id" => "https://example.com/@/Nick/",
"inbox" => "https://example.com/@/Nick/inbox",
"liked" => nil,
"name" => "Nick",
"outbox" => "https://example.com/@/Nick/outbox",
"preferredUsername" => "Nick",
"publicKey" => %{
"id" => "https://example.com/@/Nick/#main-key",
"owner" => "https://example.com/@/Nick/",
"publicKeyPem" => "[...]
},
"summary" => "",
"type" => "Person",
"url" => "https://example.com/@/Nick/"
}}
A way to test the reverse proxy bits of this issue (where example.com allows TLSv1.3 only):
iex(pleroma@127.0.0.1)1> Pleroma.ReverseProxy.Client.Hackney.request("GET", "https://example.com", [], [])
{:error,
{:tls_alert,
{:protocol_version,
'TLS client: In state hello received SERVER ALERT: Fatal - Protocol Version\n'}}}
![https://example.com/static/media/[...].png](https://example.com/static/media/[...].png){kind=link}
37 lines
928 B
Elixir
37 lines
928 B
Elixir
# Pleroma: A lightweight social networking server
|
|
# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
defmodule Pleroma.HTTP.AdapterHelper.Hackney do
|
|
@behaviour Pleroma.HTTP.AdapterHelper
|
|
|
|
@defaults [
|
|
follow_redirect: true,
|
|
force_redirect: true
|
|
]
|
|
|
|
@spec options(keyword(), URI.t()) :: keyword()
|
|
def options(connection_opts \\ [], %URI{} = uri) do
|
|
proxy = Pleroma.Config.get([:http, :proxy_url])
|
|
|
|
config_opts = Pleroma.Config.get([:http, :adapter], [])
|
|
|
|
@defaults
|
|
|> Keyword.merge(config_opts)
|
|
|> Keyword.merge(connection_opts)
|
|
|> add_scheme_opts(uri)
|
|
|> maybe_add_with_body()
|
|
|> Pleroma.HTTP.AdapterHelper.maybe_add_proxy(proxy)
|
|
end
|
|
|
|
defp add_scheme_opts(opts, _), do: opts
|
|
|
|
defp maybe_add_with_body(opts) do
|
|
if opts[:max_body] do
|
|
Keyword.put(opts, :with_body, true)
|
|
else
|
|
opts
|
|
end
|
|
end
|
|
end
|