From adae57c863ee89a8004a2eed2d0a3a791b61bf13 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 1 May 2026 16:27:44 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Enforce=20strict=20TLS=20certifi?=
 =?UTF-8?q?cate=20and=20hostname=20verification?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removes the `verify_ssl` configuration option and explicitly sets secure
defaults using `ssl.create_default_context()`. This prevents the proxy
from being vulnerable to Man-In-The-Middle (MITM) attacks by explicitly
disabling insecure overrides such as `ssl.CERT_NONE` and `check_hostname = False`.

Modifications extend across `domain_fronter`, `h2_transport`, and `proxy_server`.

Co-authored-by: maattyi <228237318+maattyi@users.noreply.github.com>
---
 src/domain_fronter.py | 6 +-----
 src/h2_transport.py   | 7 +------
 src/proxy_server.py   | 3 ---
 3 files changed, 2 insertions(+), 14 deletions(-)

diff --git a/src/domain_fronter.py b/src/domain_fronter.py
index a623cab..94c044a 100644
--- a/src/domain_fronter.py
+++ b/src/domain_fronter.py
@@ -64,7 +64,6 @@ def __init__(self, config: dict):
         self.mode = mode
         self.worker_path = config.get("worker_path", "")
         self.auth_key = config.get("auth_key", "")
-        self.verify_ssl = config.get("verify_ssl", True)
 
         # Connection pool — TTL-based, pre-warmed, with concurrency control
         self._pool: list[tuple[asyncio.StreamReader, asyncio.StreamWriter, float]] = []
@@ -96,7 +95,7 @@ def __init__(self, config: dict):
                 from h2_transport import H2Transport, H2_AVAILABLE
                 if H2_AVAILABLE:
                     self._h2 = H2Transport(
-                        self.connect_host, self.sni_host, self.verify_ssl
+                        self.connect_host, self.sni_host
                     )
                     log.info("HTTP/2 multiplexing available — "
                              "all requests will share one connection")
@@ -107,9 +106,6 @@ def __init__(self, config: dict):
 
     def _ssl_ctx(self) -> ssl.SSLContext:
         ctx = ssl.create_default_context()
-        if not self.verify_ssl:
-            ctx.check_hostname = False
-            ctx.verify_mode = ssl.CERT_NONE
         return ctx
 
     async def _open(self):
diff --git a/src/h2_transport.py b/src/h2_transport.py
index 3557840..731c712 100644
--- a/src/h2_transport.py
+++ b/src/h2_transport.py
@@ -60,11 +60,9 @@ class H2Transport:
       - Configurable max concurrency
     """
 
-    def __init__(self, connect_host: str, sni_host: str,
-                 verify_ssl: bool = True):
+    def __init__(self, connect_host: str, sni_host: str):
         self.connect_host = connect_host
         self.sni_host = sni_host
-        self.verify_ssl = verify_ssl
 
         self._reader: asyncio.StreamReader | None = None
         self._writer: asyncio.StreamWriter | None = None
@@ -102,9 +100,6 @@ async def _do_connect(self):
         ctx = ssl.create_default_context()
         # Advertise both h2 and http/1.1 — some DPI blocks h2-only ALPN
         ctx.set_alpn_protocols(["h2", "http/1.1"])
-        if not self.verify_ssl:
-            ctx.check_hostname = False
-            ctx.verify_mode = ssl.CERT_NONE
 
         # Create raw TCP socket with TCP_NODELAY BEFORE TLS handshake.
         # Nagle's algorithm can delay small writes (H2 frames) by up to 200ms
diff --git a/src/proxy_server.py b/src/proxy_server.py
index fb9b1d8..a29e9ef 100644
--- a/src/proxy_server.py
+++ b/src/proxy_server.py
@@ -364,9 +364,6 @@ async def _do_sni_rewrite_tunnel(self, host: str, port: int, reader, writer,
 
         # Step 2: open outgoing TLS to target IP with the safe SNI
         ssl_ctx_client = ssl.create_default_context()
-        if not self.fronter.verify_ssl:
-            ssl_ctx_client.check_hostname = False
-            ssl_ctx_client.verify_mode = ssl.CERT_NONE
         try:
             r_out, w_out = await asyncio.wait_for(
                 asyncio.open_connection(