From 6263b221c2fef8a43d4c76338613c6b13af72c4d Mon Sep 17 00:00:00 2001
From: Fulton Byrne <fulton.byrne@commercetools.com>
Date: Thu, 15 Aug 2024 18:52:48 -0400
Subject: [PATCH] specify minimum tls version (#94)

* specify minimum tls version

* feat: config supports tls

* add httpOpts to function sigs

* comment TLSVersion

---------

Co-authored-by: Guy Edwards <guyfedwards@gmail.com>
---
 internal/commands/commands.go |  2 +-
 internal/commands/feeds.go    |  4 ++--
 internal/config/config.go     | 24 ++++++++++++++++++------
 internal/config/http.go       | 29 +++++++++++++++++++++++++++++
 internal/rss/rss.go           | 17 ++++++++++++++++-
 5 files changed, 66 insertions(+), 10 deletions(-)
 create mode 100644 internal/config/http.go

diff --git a/internal/commands/commands.go b/internal/commands/commands.go
index 5664dbb..fa5c660 100644
--- a/internal/commands/commands.go
+++ b/internal/commands/commands.go
@@ -179,7 +179,7 @@ func (c Commands) fetchAllFeeds() ([]store.Item, []ErrorItem, error) {
 	for _, feed := range feeds {
 		wg.Add(1)
 
-		go fetchFeed(ch, &wg, feed, c.config.Version)
+		go fetchFeed(ch, &wg, feed, c.config.HTTPOptions, c.config.Version)
 	}
 
 	go func() {
diff --git a/internal/commands/feeds.go b/internal/commands/feeds.go
index 864ec46..f60c188 100644
--- a/internal/commands/feeds.go
+++ b/internal/commands/feeds.go
@@ -96,10 +96,10 @@ func defaultView(items []store.Item) (is []store.Item) {
 	return is
 }
 
-func fetchFeed(ch chan FetchResultError, wg *sync.WaitGroup, feed config.Feed, version string) {
+func fetchFeed(ch chan FetchResultError, wg *sync.WaitGroup, feed config.Feed, httpOpts *config.HTTPOptions, version string) {
 	defer wg.Done()
 
-	r, err := rss.Fetch(feed, version)
+	r, err := rss.Fetch(feed, httpOpts, version)
 
 	if err != nil {
 		ch <- FetchResultError{res: rss.RSS{}, err: err, url: feed.URL}
diff --git a/internal/config/config.go b/internal/config/config.go
index a14fdf1..0ba7911 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -1,6 +1,7 @@
 package config
 
 import (
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"os"
@@ -57,12 +58,13 @@ type Config struct {
 	Pager          string `yaml:"pager,omitempty"`
 	Feeds          []Feed `yaml:"feeds"`
 	// Preview feeds are distinguished from Feeds because we don't want to inadvertenly write those into the config file.
-	PreviewFeeds []Feed    `yaml:"previewfeeds,omitempty"`
-	Backends     *Backends `yaml:"backends,omitempty"`
-	ShowRead     bool      `yaml:"showread,omitempty"`
-	AutoRead     bool      `yaml:"autoread,omitempty"`
-	Openers      []Opener  `yaml:"openers,omitempty"`
-	Theme        Theme     `yaml:"theme,omitempty"`
+	PreviewFeeds []Feed       `yaml:"previewfeeds,omitempty"`
+	Backends     *Backends    `yaml:"backends,omitempty"`
+	ShowRead     bool         `yaml:"showread,omitempty"`
+	AutoRead     bool         `yaml:"autoread,omitempty"`
+	Openers      []Opener     `yaml:"openers,omitempty"`
+	Theme        Theme        `yaml:"theme,omitempty"`
+	HTTPOptions  *HTTPOptions `yaml:"http,omitempty"`
 }
 
 func (c *Config) ToggleShowRead() {
@@ -108,6 +110,9 @@ func New(configPath string, pager string, previewFeeds []string, version string)
 			TitleColor:        "62",
 			FilterColor:       "62",
 		},
+		HTTPOptions: &HTTPOptions{
+			MinTLSVersion: tls.VersionName(tls.VersionTLS12),
+		},
 	}, nil
 }
 
@@ -138,6 +143,13 @@ func (c *Config) Load() error {
 	c.Feeds = fileConfig.Feeds
 	c.Openers = fileConfig.Openers
 
+	if fileConfig.HTTPOptions != nil {
+		if _, err := TLSVersion(fileConfig.HTTPOptions.MinTLSVersion); err != nil {
+			return err
+		}
+		c.HTTPOptions = fileConfig.HTTPOptions
+	}
+
 	if fileConfig.Theme.Glamour != "" {
 		c.Theme.Glamour = fileConfig.Theme.Glamour
 	}
diff --git a/internal/config/http.go b/internal/config/http.go
new file mode 100644
index 0000000..6693981
--- /dev/null
+++ b/internal/config/http.go
@@ -0,0 +1,29 @@
+package config
+
+import (
+	"crypto/tls"
+	"fmt"
+)
+
+// CloudFlare blocks requests unless a minimum TLSVersion is specified.
+var tlsVersions map[string]uint16 = map[string]uint16{
+	"TLS 1.0": tls.VersionTLS10,
+	"TLS 1.1": tls.VersionTLS11,
+	"TLS 1.2": tls.VersionTLS12,
+	"TLS 1.3": tls.VersionTLS13,
+}
+
+type HTTPOptions struct {
+	//MinTLSVersion must be set to one of the strings returned by
+	//tls.VersionName. "TLS 1.2" by default.
+	MinTLSVersion string `yaml:"mintls,omitempty"`
+}
+
+// TLSVersion maps one of a few supported TLS version strings to the corresponding
+// standard TLS library constant so that an HTTP client can be configured.
+func TLSVersion(configStr string) (uint16, error) {
+	if version, ok := tlsVersions[configStr]; ok {
+		return version, nil
+	}
+	return 0, fmt.Errorf("unsupported tls version: %s", configStr)
+}
diff --git a/internal/rss/rss.go b/internal/rss/rss.go
index e2ef36a..d0c6902 100644
--- a/internal/rss/rss.go
+++ b/internal/rss/rss.go
@@ -1,7 +1,9 @@
 package rss
 
 import (
+	"crypto/tls"
 	"fmt"
+	"net/http"
 	"time"
 
 	"github.com/mmcdole/gofeed"
@@ -31,8 +33,21 @@ type RSS struct {
 	Channel Channel `xml:"channel"`
 }
 
-func Fetch(f config.Feed, version string) (RSS, error) {
+func Fetch(f config.Feed, httpOpts *config.HTTPOptions, version string) (RSS, error) {
 	fp := gofeed.NewParser()
+
+	fp.Client = &http.Client{}
+
+	if httpOpts != nil {
+		if version, err := config.TLSVersion(httpOpts.MinTLSVersion); err == nil {
+			fp.Client.Transport = &http.Transport{
+				TLSClientConfig: &tls.Config{
+					MinVersion: version,
+				},
+			}
+		}
+	}
+
 	fp.UserAgent = fmt.Sprintf("nom/%s", version)
 
 	feed, err := fp.ParseURL(f.URL)