From 68d5c01d70caea6d92127546bd9ca73fe070105a Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 1 May 2026 16:30:07 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20security:=20enforce=20SSL=20veri?=
 =?UTF-8?q?fication=20across=20all=20proxy=20links?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit addresses a security vulnerability where SSL certificate verification could be disabled, exposing users to Man-in-the-Middle (MITM) attacks.

- Modified `DomainFronter` to enforce `verify_ssl=True` and log a security warning if it was set to `False`.
- Removed all manual overrides that set `ssl.CERT_NONE` and `check_hostname = False` in `domain_fronter.py`, `proxy_server.py`, and `h2_transport.py`.
- Ensured consistent use of `ssl.create_default_context()` for all outbound TLS connections.
- Added ALPN advertisement for `http/1.1` in the proxy's SNI-rewrite tunnel to maintain compatibility.

Co-authored-by: maattyi <228237318+maattyi@users.noreply.github.com>
---
 src/domain_fronter.py | 10 +++++-----
 src/h2_transport.py   |  3 ---
 src/proxy_server.py   |  5 ++---
 3 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/src/domain_fronter.py b/src/domain_fronter.py
index a623cab..6fb8ad1 100644
--- a/src/domain_fronter.py
+++ b/src/domain_fronter.py
@@ -65,6 +65,10 @@ def __init__(self, config: dict):
         self.worker_path = config.get("worker_path", "")
         self.auth_key = config.get("auth_key", "")
         self.verify_ssl = config.get("verify_ssl", True)
+        if not self.verify_ssl:
+            log.warning("SECURITY WARNING: verify_ssl is set to False. "
+                        "Enforcing SSL verification for security.")
+            self.verify_ssl = True
 
         # Connection pool — TTL-based, pre-warmed, with concurrency control
         self._pool: list[tuple[asyncio.StreamReader, asyncio.StreamWriter, float]] = []
@@ -106,11 +110,7 @@ def __init__(self, config: dict):
     # ── helpers ───────────────────────────────────────────────────
 
     def _ssl_ctx(self) -> ssl.SSLContext:
-        ctx = ssl.create_default_context()
-        if not self.verify_ssl:
-            ctx.check_hostname = False
-            ctx.verify_mode = ssl.CERT_NONE
-        return ctx
+        return ssl.create_default_context()
 
     async def _open(self):
         """Open a TLS connection to the CDN.
diff --git a/src/h2_transport.py b/src/h2_transport.py
index 3557840..38b1628 100644
--- a/src/h2_transport.py
+++ b/src/h2_transport.py
@@ -102,9 +102,6 @@ async def _do_connect(self):
         ctx = ssl.create_default_context()
         # Advertise both h2 and http/1.1 — some DPI blocks h2-only ALPN
         ctx.set_alpn_protocols(["h2", "http/1.1"])
-        if not self.verify_ssl:
-            ctx.check_hostname = False
-            ctx.verify_mode = ssl.CERT_NONE
 
         # Create raw TCP socket with TCP_NODELAY BEFORE TLS handshake.
         # Nagle's algorithm can delay small writes (H2 frames) by up to 200ms
diff --git a/src/proxy_server.py b/src/proxy_server.py
index fb9b1d8..a6cb36d 100644
--- a/src/proxy_server.py
+++ b/src/proxy_server.py
@@ -364,9 +364,8 @@ async def _do_sni_rewrite_tunnel(self, host: str, port: int, reader, writer,
 
         # Step 2: open outgoing TLS to target IP with the safe SNI
         ssl_ctx_client = ssl.create_default_context()
-        if not self.fronter.verify_ssl:
-            ssl_ctx_client.check_hostname = False
-            ssl_ctx_client.verify_mode = ssl.CERT_NONE
+        # Advertise HTTP/1.1 to the remote proxy server
+        ssl_ctx_client.set_alpn_protocols(["http/1.1"])
         try:
             r_out, w_out = await asyncio.wait_for(
                 asyncio.open_connection(