Windows Client: `native-tls` Fails with TLS 1.3-Only Endpoints (e.g., Cloudflare Minimum TLS 1.3)

Description:

The RustDesk client on Windows, which uses reqwest with the native-tls backend (relying on SChannel), appears to fail when connecting to HTTPS endpoints that strictly enforce TLS 1.3. This can occur, for example, when the RustDesk Pro API (port 21114) is proxied through a service like Cloudflare where the "Minimum TLS Version" is set to "TLS 1.3".

Notably, the same test programs (both native-tls and rustls-tls versions) run without any issues on Debian 12, successfully connecting to all test endpoints including https://tls13.1d.pw/. This further points to a Windows-specific SChannel limitation.

Scenario Illustrating the Issue (My Test Environment on Windows):

1. A RustDesk Server Pro is deployed.
2. The RustDesk Pro API endpoint (e.g., https_yourdomain_com:21114) is proxied through Cloudflare's CDN.
3. Within Cloudflare's SSL/TLS settings for the domain, the "Minimum TLS Version" is set to "TLS 1.3".
4. A RustDesk client running on Windows attempts to connect to this Cloudflare-proxied API endpoint.
5. The client fails to establish the HTTPS connection, likely due to SChannel limitations.

Steps to Reproduce & Findings (using minimal test programs on Windows):

To isolate this, I created two minimal test programs using the same reqwest fork (git = "https://github.com/rustdesk-org/reqwest", commit 9cb758c9fb2f4edc62eb790acfd45a6a3da21ed3) and Rust version (1.75.0). Both programs attempt to make a GET request to https://tls13.1d.pw/, a public site that effectively operates as a TLS 1.3-only endpoint, similar to how Cloudflare would behave with "Minimum TLS Version: 1.3". They also make a POST request to https://httpbin.org/post for general connectivity testing.

1. Test Program 1: Using native-tls for reqwest

   • reqwest configured with features = ["json", "native-tls", "gzip"].

   • Result on Windows:

     • Successfully connected to https://httpbin.org/post.
     • Failed to connect to https://tls13.1d.pw/.
       Error: The function requested is not supported (os error -2146893054) (SChannel's SEC_E_UNSUPPORTED_FUNCTION).
   • Click to expand Full Output for `reqwest_example_native_tls.exe` (Windows)

     --- Reqwest Test with native-tls (Windows Build) ---
     Sending POST request to: https://httpbin.org/post
     Payload: SysInfoRequest { client_id: "test_client_4075", timestamp: 1747495030514, data_payload: [44, 207, 243, 11, 219, 224, 215, 34, 117, 48, 92, 223, 151, 88, 48, 23, 243, 96, 8], random_value: 2475823319 }
     
     Response Status: 200 OK
     Response Headers:
       date: "Sat, 17 May 2025 15:17:10 GMT"
       content-type: "application/json"
       content-length: "910"
       connection: "keep-alive"
       server: "gunicorn/19.9.0"
       access-control-allow-origin: "*"
       access-control-allow-credentials: "true"
     
     Parsed Response Body (from httpbin.org):
     HttpBinResponse {
         args: Object {},
         data: "{\"client_id\":\"test_client_4075\",\"timestamp\":1747495030514,\"data_payload\":[44,207,243,11,219,224,215,34,117,48,92,223,151,88,48,23,243,96,8],\"random_value\":2475823319}",
         files: Object {},
         form: Object {},
         headers: Object {
             "Accept": String("*/*"),
             "Accept-Encoding": String("gzip"),
             "Content-Length": String("166"),
             "Content-Type": String("application/json"),
             "Host": String("httpbin.org"),
             "X-Amzn-Trace-Id": String("Root=1-6828a876-565eac9c22d3b46e563b4fb3"),
         },
         json: SysInfoRequest {
             client_id: "test_client_4075",
             timestamp: 1747495030514,
             data_payload: [
                 44,
                 207,
                 243,
                 11,
                 219,
                 224,
                 215,
                 34,
                 117,
                 48,
                 92,
                 223,
                 151,
                 88,
                 48,
                 23,
                 243,
                 96,
                 8,
             ],
             random_value: 2475823319,
         },
         origin: "13.91.68.67",
         url: "https://httpbin.org/post",
     }
     
     SUCCESS: Sent and received matching client_id.
     
     --- Testing GET against known TLS 1.3 site (tls13.1d.pw) ---
     Failed to connect to tls13.1d.pw: error sending request for url (https://tls13.1d.pw/): error trying to connect: The function requested is not supported (os error -2146893054)
     Caused by: error trying to connect: The function requested is not supported (os error -2146893054)
     

2. Test Program 2: Using rustls-tls for reqwest

   • reqwest configured with features = ["json", "rustls-tls", "rustls-tls-native-roots", "gzip"].

   • Result on Windows:

     • Successfully connected to https://httpbin.org/post.
     • Successfully connected to https://tls13.1d.pw/ (HTTP 200 OK).
   • Click to expand Full Output for `reqwest_example_rustls.exe` (Windows)

     --- Reqwest Test with rustls-tls (Windows Build) ---
     Sending POST request to: https://httpbin.org/post
     Payload: SysInfoRequest { client_id: "test_client_3925", timestamp: 1747494883972, data_payload: [142, 161, 67, 141, 106, 80, 194, 5, 244, 234, 51, 192, 194, 66, 191, 105, 136, 66, 185, 190, 190, 218, 144, 152, 197, 140, 15, 103, 177, 153, 84, 171, 203, 37, 42, 42, 230, 18, 156, 178, 121, 208, 217, 84], random_value: 210242973 }
     
     Response Status: 200 OK
     Response Headers:
       date: "Sat, 17 May 2025 15:14:44 GMT"
       content-type: "application/json"
       content-length: "1302"
       server: "gunicorn/19.9.0"
       access-control-allow-origin: "*"
       access-control-allow-credentials: "true"
     
     Parsed Response Body (from httpbin.org):
     HttpBinResponse {
         args: Object {},
         data: "{\"client_id\":\"test_client_3925\",\"timestamp\":1747494883972,\"data_payload\":[142,161,67,141,106,80,194,5,244,234,51,192,194,66,191,105,136,66,185,190,190,218,144,152,197,140,15,103,177,153,84,171,203,37,42,42,230,18,156,178,121,208,217,84],\"random_value\":210242973}",
         files: Object {},
         form: Object {},
         headers: Object {
             "Accept": String("*/*"),
             "Accept-Encoding": String("gzip"),
             "Content-Length": String("262"),
             "Content-Type": String("application/json"),
             "Host": String("httpbin.org"),
             "X-Amzn-Trace-Id": String("Root=1-6828a7e4-716bb13a774ab317575b8907"),
         },
         json: SysInfoRequest {
             client_id: "test_client_3925",
             timestamp: 1747494883972,
             data_payload: [
                 142,
                 161,
                 67,
                 141,
                 106,
                 80,
                 194,
                 5,
                 244,
                 234,
                 51,
                 192,
                 194,
                 66,
                 191,
                 105,
                 136,
                 66,
                 185,
                 190,
                 190,
                 218,
                 144,
                 152,
                 197,
                 140,
                 15,
                 103,
                 177,
                 153,
                 84,
                 171,
                 203,
                 37,
                 42,
                 42,
                 230,
                 18,
                 156,
                 178,
                 121,
                 208,
                 217,
                 84,
             ],
             random_value: 210242973,
         },
         origin: "13.91.68.67",
         url: "https://httpbin.org/post",
     }
     
     SUCCESS: Sent and received matching client_id.
     
     --- Testing GET against known TLS 1.3 site (tls13.1d.pw) ---
     Status for tls13.1d.pw: 200 OK
     Connected to tls13.1d.pw, but response unexpected.
     Body (first 200 chars):
     <!DOCTYPE html><html><head><link rel="stylesheet" href="/assets/styles.css" /><title>TLS 1.3 connection test server at tls13.1d.pw</title></head><body>
     
     <h1>TLS 1.3 Connection Test Server at tls13.1d.
     

The attached ZIP file contains the source code for these test programs and the pre-compiled Windows executables. You can try to reproduce the issue by compiling the code yourself if you prefer.

Analysis:

The rustls-tls backend successfully connects, indicating the network and server are fine. The native-tls (SChannel) failure on Windows suggests an incompatibility with strictly configured TLS 1.3 endpoints on some Windows systems.

RustDesk's Cargo.toml specifies native-tls for Windows:

[target.'cfg(any(target_os = "macos", target_os = "windows"))'.dependencies]
reqwest = { git = "https://github.com/rustdesk-org/reqwest", features = ["native-tls", ...], default-features=false }

This makes Windows clients susceptible to this SChannel limitation when connecting to RustDesk Pro APIs proxied via services like Cloudflare enforcing "Minimum TLS Version: 1.3".

Potential Impact on RustDesk Pro Users:

Windows clients may be unable to use RustDesk Pro features reliant on API communication if their self-hosted API is behind a CDN or reverse proxy strictly enforcing TLS 1.3 (a common security measure).

Possible Discussion Points / Considerations:

1. Is this SChannel behavior with strict TLS 1.3 endpoints a known cause of connection issues for Windows clients?
2. Could an alternative build of RustDesk for Windows using rustls-tls be provided for affected users?
3. Guidance for users configuring CDNs like Cloudflare: be aware of potential SChannel issues on client machines if setting "Minimum TLS Version" to "1.3", and consider "TLS 1.2" as a more compatible minimum if problems arise.

Thank you.

Environment (for tests):

• OS: GitHub Actions Windows Server 2022 (runner: windows-2022), accessed via installed VSCode Server.
  • Windows Product Name: Windows Server 2022 Datacenter
  • Windows Edition ID: ServerDatacenter
  • OS Version (from Get-ComputerInfo): 2009
  • Product Name (Registry): Windows Server 2022 Datacenter
  • Display Version (Registry): 21H2
  • Current Build (Registry): 20348
  • UBR (Build Revision): 3561
  • Full OS Build (Calculated): 20348.3561
  • System Type: 64-bit / x64-based PC
• Rustc: 1.75.0
• reqwest (fork): git = "https://github.com/rustdesk-org/reqwest", commit 9cb758c9fb2f4edc62eb790acfd45a6a3da21ed3

---

Attachments:

• rust_tls_test_workspace_windows.zip

Start with the Windows-specific reqwest dependency in Cargo.toml and compare it with the attached native-tls and rustls test programs. Reproduce the TLS 1.3-only endpoint failure on the stated Windows environment, then establish the intended client behavior and an agreed scope for resolving or documenting the limitation.