merge dev into main for v2.2.0-rc.1 re-release

webscan/lib/Eval.go

@@ -508,8 +508,9 @@ func DoRequest(req *http.Request, redirect bool, session *common.ScanSession) (*
 		oResp, err = requestClient(false).Do(req)
 	}
 
-	// 标准TLS连接失败时，尝试国密TLS客户端
-	if err != nil && req.URL.Scheme == "https" {
+	// 标准TLS握手级别失败时，尝试国密TLS客户端
+	// 跳过连接超时、拒绝等非 TLS 相关错误，避免无意义的国密握手尝试
+	if err != nil && req.URL.Scheme == "https" && maybeGMTLSError(err) {
 		if req.GetBody != nil {
 			if body, bodyErr := req.GetBody(); bodyErr == nil {
 				req.Body = body
@@ -682,3 +683,14 @@ func getRespBody(oResp *http.Response) ([]byte, error) {
 
 	return body, nil
 }
+
+func maybeGMTLSError(err error) bool {
+	if err == nil {
+		return false
+	}
+	s := err.Error()
+	return strings.Contains(s, "handshake failure") ||
+		strings.Contains(s, "protocol version") ||
+		strings.Contains(s, "no mutual") ||
+		strings.Contains(s, "cipher suite")
+}

webscan/lib/eval_test.go

@@ -1238,7 +1238,7 @@ func TestDoRequestSkipsNilGMTLSFallback(t *testing.T) {
 	}()
 
 	ClientNoRedirect = &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
-		return nil, errors.New("standard tls failed")
+		return nil, errors.New("tls: handshake failure")
 	})}
 	ClientNoRedirectGM = nil
 
@@ -1261,7 +1261,7 @@ func TestDoRequestReplaysBodyForGMTLSFallback(t *testing.T) {
 
 	ClientNoRedirect = &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
 		_, _ = io.ReadAll(req.Body)
-		return nil, errors.New("standard tls failed")
+		return nil, errors.New("tls: handshake failure")
 	})}
 
 	var gotBody string