update ciphers

cherry-picked from redlib-org#510

Author: uhthomas

Cargo.lock

@@ -57,6 +57,7 @@ bincode = "1.3.3"
 base2048 = "2.0.2"
 revision = "0.10.0"
 tokio-socks = "0.5.2"
+rustls = "0.21.12"
 
 
 [dev-dependencies]

Cargo.toml

@@ -4,7 +4,7 @@ use futures_lite::future::block_on;
 use futures_lite::{future::Boxed, FutureExt};
 use hyper::header::HeaderValue;
 use hyper::{body, body::Buf, header, Body, Client, Method, Request, Response, Uri};
-use hyper_rustls::HttpsConnector;
+use hyper_rustls::{ConfigBuilderExt, HttpsConnector};
 use libflate::gzip;
 use log::{error, trace, warn};
 use once_cell::sync::Lazy;
@@ -32,7 +32,30 @@ const ALTERNATIVE_REDDIT_URL_BASE_HOST: &str = "www.reddit.com";
 pub static HTTPS_CONNECTOR: Lazy<HttpsConnector<ProxyConnector>> = Lazy::new(|| {
 	let proxy_connector = ProxyConnector::new();
 	hyper_rustls::HttpsConnectorBuilder::new()
-		.with_native_roots()
+		.with_tls_config(
+			rustls::ClientConfig::builder()
+				// These are the Firefox 145.0 cipher suite,
+				// minus the suites missing forward-secrecy support,
+				// in the same order.
+				// https://github.com/redlib-org/redlib/issues/446#issuecomment-3609306592
+				.with_cipher_suites(&[
+					rustls::cipher_suite::TLS13_AES_256_GCM_SHA384,
+					rustls::cipher_suite::TLS13_AES_128_GCM_SHA256,
+					rustls::cipher_suite::TLS13_CHACHA20_POLY1305_SHA256,
+					rustls::cipher_suite::TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+					rustls::cipher_suite::TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+					rustls::cipher_suite::TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+					rustls::cipher_suite::TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
+					rustls::cipher_suite::TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+					rustls::cipher_suite::TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+				])
+				// .with_safe_default_cipher_suites()
+				.with_safe_default_kx_groups()
+				.with_safe_default_protocol_versions()
+				.unwrap()
+				.with_native_roots()
+				.with_no_client_auth(),
+		)
 		.https_only()
 		.enable_http2()
 		.wrap_connector(proxy_connector)
@@ -512,9 +535,9 @@ pub async fn rate_limit_check() -> Result<(), String> {
 	Ok(())
 }
 
+use crate::proxy::ProxyConnector;
 #[cfg(test)]
 use {crate::config::get_setting, sealed_test::prelude::*};
-use crate::proxy::ProxyConnector;
 
 #[tokio::test(flavor = "multi_thread")]
 async fn test_rate_limit_check() {