blitz-net TLS policy

HTTPS uses the ps-rustcrypto 0.4 base provider, supplied by the sibling ps-rustls-rustcrypto checkout through a path dependency. The provider is explicit and does not inherit a process crypto default. Its fallback feature is disabled.

The TLS offer contains exactly these suites:

• TLS13_CHACHA20_POLY1305_SHA256
• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

Certificate verification and TLS handshake signatures use ECDSA P-256/P-384 and Ed25519 only. The ECC-only verifier checks keys throughout the presented chain and restricts trust anchors to ECC keys. Native trust anchors remain the trust source; public-root chains must also satisfy Certificate Transparency. RSA certificate signatures are not verified.

A connection that fails this policy is terminal. There is no second connection with weaker algorithms. A peer that offers only RSA or AES cannot complete TLS. h2 remains first in ALPN, followed by http/1.1. HTTP/1.1 connection limits, timeouts and framing are unchanged.

Policy refusals are available as blitz_traits::platform::FetchError::TlsPolicy(TlsPolicyError) and blitz_net::ProviderError::TlsPolicy(TlsPolicyError). The error type is re-exported by blitz_net. For resource loads whose callback has no error channel, the TLS transport logs the refusal. connection_stats() exposes completed handshakes, refusal counts and the latest typed policy refusal.

A server's TLS alert 40 or 71 does not identify which algorithm it requires. PeerRejectedAlgorithms { alert } reports the observed alert and the ECDSA/Ed25519 plus ChaCha20-Poly1305 profile that was rejected. It names the RSA/AES prohibition without claiming to distinguish RSA-only from AES-only. An unoffered cipher selection produces CipherSuite; an unadvertised TLS signature produces HandshakeSignature; an RSA key in a chain produces RsaCertificateChain. Other certificate-key and certificate-signature refusals have their own variants. Ordinary I/O, unrelated TLS failures and CT failures retain their existing diagnostics.

The former rsa_fallback_state export and HostStats.fallbacks and HostStats.last_rsa_fallback fields are removed. Callers should use HostStats.last_tls_policy_error and HostStats.handshakes.

deny-crypto.toml is separate from the Linux headless system-library policy in deny.toml. It includes GUI packages and all targets and rejects both named RSA/AES crates and providers that bundle those implementations. Invoke the existing cargo-deny tool with cargo deny --all-features check --config deny-crypto.toml bans when resolving the workspace graph. This policy is not yet wired into the existing manual CI workflow. Any CI checkout consuming the path dependency must supply ps-rustls-rustcrypto beside ps-blitz.

Request cancellation

The issuer owns a blitz_traits::net::AbortController and attaches a clone of its public signal to each Request or FetchRequest. Calling AbortController::abort(self) wakes all pending operations on that signal. AbortSignal::cancelled() returns an AbortWaiter future; dropping the waiter removes its registration. No timer or socket activity is needed to observe cancellation. Dropping a controller alone does not abort it.

Provider::fetch_async and fetch_response_async return ProviderError::Abort on abort. Provider::fetch_platform_async returns FetchError::Abort and retains status, headers and HTTP error responses. These async entry points own their transport futures; dropping an unfinished future sends HTTP/2 RST_STREAM CANCEL for its active stream. The connection driver remains shared with other requests.

NetProvider::fetch, FetchProvider::fetch and Provider::fetch_with_callback drop the handler without calling it when the request is aborted before completion. Callers must retire their own pending-resource bookkeeping when cancelling a document. Completion that has already been delivered is not undone by a later abort.

Only complete response bodies reach the private cache. Cancellation before mutation admission skips the mutation; an admitted metadata commit holds the cache gate and runs to completion even if its caller is dropped. Cancellation is not a cache failure and does not disable the cache.

WSS transport belongs to the embedder. Race its owned HTTP/1.1 upgrade future against signal.cancelled() and drop the upgrade future on abort to close its socket. The same waiter can govern an established WebSocket. There is no WebSocket entry point in this crate. This release adds no HTTP/1.1 configuration or protocol-selection changes.