tls insecure option how to support?

[gaoxiaowei]

Obfuscation protocol: WS over TLS
The domain name certificate we use in VPS is from self signed SLL certificate, how to support it? thank you

[eycorsican]

I'm just a little bit uncomfortable with this dangerous option, but I think I'll accept a pr which implements this.

[gaoxiaowei]

I looked at the code and found that there was insecure in stream.rs, but it was just commented out. To solve this problem, I tried to modify the following code and debug it, and found it worked. however, the processing logic may be imperfect, expect the author to update this feature soon,thanks.

1, I fork the code to my git repo: https://github.com/gaoxiaowei/leaf

2. Cargo.toml introduces rustls, dangerous_configuration

3. Modified config.proto and generated internal/config.rs with protoc (due to the problem of the protoc version, the generated config.rs could not be compiled, so I manually modified config.rs)
   TLSOutboundSettings adds the insecure parameter:
   message TlsOutboundSettings {
   string server_name = 1;
   repeated string alpn = 2;
   bool insecure=3;
   }

4、modified stream.rs, open the InsecureVerifier authentication logic

5. json/config.rs add insecure to the transfer of parameters

6. tcp.rs add insecure to the transfer of parameters

[eycorsican]

You should also make this option available in the openssl variant, and have the code properly formatted, then you're ready for a pr.

You should generate code from .proto files with make proto-gen.

[gaoxiaowei]

about openssl variant my modify the stream.rs ,I don't know if it's true, because I can't verify it.thanks！

`
#[cfg(feature = "openssl-tls")]
pub mod wrapper {
use std::pin::Pin;
use std::sync::Once;

use openssl::ssl::{Ssl, SslConnector, SslMethod};
use tokio_openssl::SslStream;

use super::*;
pub async fn wrap_tls<S>(
    stream: S,
    domain: &str,
    alpns: Vec<String>,
    insecure: bool,
) -> Result<Box<dyn ProxyStream>>
where
    S: 'static + AsyncRead + AsyncWrite + Unpin + Sync + Send,
{
    {
        static ONCE: Once = Once::new();
        ONCE.call_once(openssl_probe::init_ssl_cert_env_vars);
    }

    let mut builder = SslConnector::builder(SslMethod::tls())
        .map_err(|e| anyhow!(format!("create tls builder failed: {}", e)))?;

    if alpns.len() > 0 {
        let wire = alpns
            .into_iter()
            .map(|a| [&[a.len() as u8], a.as_bytes()].concat())
            .collect::<Vec<Vec<u8>>>()
            .concat();
        builder
            .set_alpn_protos(&wire)
            .map_err(|e| anyhow!(format!("set alpn failed: {}", e)))?;
    }
    trace!("stream openssl-tls:wrap_tls option {}", insecure);
    let connector = builder.build();
    let mut ssl =
        Ssl::new(connector.context()).map_err(|_| anyhow!(format!("new tls stream failed")))?;
    ssl.set_hostname(domain)
        .map_err(|_| anyhow!(format!("set tls hostname failed")))?;

     if insecure {
         ssl.set_verify(SslVerifyMode::NONE);
     }

    let mut stream =
        SslStream::new(ssl, stream).map_err(|_| anyhow!(format!("new tls stream failed")))?;
    Pin::new(&mut stream)
        .connect()
        .map_err(|e| {
            println!("{}", e);
            anyhow!(format!("connect tls stream failed"))
        })
        .await?;
    Ok(Box::new(SimpleProxyStream(stream)))
}

}
`