Disable SSL switch

proxy/bridge.py

@@ -201,7 +201,8 @@ async def _cfproxy_worker_fallback(reader, writer, relay_init, label,
 
             try:
                 ws = await RawWebSocket.connect(worker_domain, worker_domain,
-                                                timeout=10.0, path=path)
+                                                timeout=10.0, path=path, 
+                                                secure=not proxy_config.disable_secure)
                 break
             except Exception as exc:
                 cf_worker_pool.report_failure(worker_domain, exc)
@@ -234,7 +235,8 @@ async def _cfproxy_fallback(reader, writer, relay_init, label,
     for base_domain in balancer.get_domains_for_dc(dc):
         domain = f'kws{dc}.{base_domain}'
         try:
-            ws = await RawWebSocket.connect(domain, domain, timeout=10.0)
+            ws = await RawWebSocket.connect(domain, domain, timeout=10.0, 
+                                            secure=not proxy_config.disable_secure)
             chosen_domain = base_domain
             break
         except Exception as exc:

proxy/config.py

@@ -70,6 +70,7 @@ class ProxyConfig:
     fallback_cfproxy: bool = True
     cfproxy_user_domains: List[str] = field(default_factory=list)
     cfproxy_worker_domains: List[str] = field(default_factory=list)
+    disable_secure: bool = False
     fake_tls_domain: str = ''
     proxy_protocol: bool = False
     force_test_dc: bool = False

proxy/pool.py

@@ -289,7 +289,8 @@ class _CfWorkerPool:
         for worker_domain in self.available_domains(worker_domains):
             try:
                 ws = await RawWebSocket.connect(
-                    worker_domain, worker_domain, timeout=8, path=path)
+                    worker_domain, worker_domain, timeout=8, path=path,
+                    secure=not proxy_config.disable_secure)
                 return ws, worker_domain
             except Exception as exc:
                 self.report_failure(worker_domain, exc)

proxy/raw_websocket.py

@@ -22,9 +22,8 @@ _st_H = struct.Struct('>H')
 _st_Q = struct.Struct('>Q')
 
 _ssl_ctx = ssl.create_default_context()
-_ssl_ctx.check_hostname = False
-_ssl_ctx.verify_mode = ssl.CERT_NONE
-
+_ssl_ctx_fronting = ssl.create_default_context()
+_ssl_ctx_fronting.check_hostname = False
 
 class WsHandshakeError(Exception):
     def __init__(self, status_code: int, status_line: str,
@@ -87,14 +86,25 @@ class RawWebSocket:
     @staticmethod
     async def connect(host: str, domain: str, timeout: float = 10.0,
                       path: str = '/apiws', *,
-                      sni: Optional[str] = None) -> 'RawWebSocket':
+                      sni: Optional[str] = None, secure = True) -> 'RawWebSocket':
+        ssl = _ssl_ctx_fronting if sni else _ssl_ctx
+        print(f"Connecting to {host} with secure={secure}, sni={sni}, path={path}")
+
         if sni is None:
             sni = domain
 
         reader, writer = await asyncio.wait_for(
-            asyncio.open_connection(host, 443, ssl=_ssl_ctx,
-                                    server_hostname=sni),
-            timeout=min(timeout, 10))
+            (
+                asyncio.open_connection(
+                    host, 443,
+                    ssl=ssl,
+                    server_hostname=sni,
+                )
+                if secure
+                else asyncio.open_connection(host, 80)
+            ),
+            timeout=min(timeout, 10),
+        )
         
         set_sock_opts(writer.transport, proxy_config.buffer_size)
 

proxy/tg_ws_proxy.py

@@ -531,6 +531,8 @@ async def _run(stop_event: Optional[asyncio.Event] = None):
     if proxy_config.cfproxy_worker_domains:
         log.info("  CF worker:     enabled (%s)",
                  ", ".join(proxy_config.cfproxy_worker_domains))
+    if proxy_config.disable_secure:
+        log.info("  No secure:     enabled (port 80 for CF proxy/worker)")
     log.info("=" * 60)
     log.info("  Connect:")
     if ftls:
@@ -673,6 +675,8 @@ def main():
                          'repeatable for multiple domains)')
     ap.add_argument('--no-cfproxy', action='store_true',
                     help='Disable Cloudflare proxy fallback')
+    ap.add_argument('--no-secure', action='store_true',
+                        help='Use 80 port for CF-proxy and CF-worker connections')
     ap.add_argument('--fake-tls-domain', type=str, default='',
                     metavar='DOMAIN',
                     help='Enable Fake TLS (ee-secret) masking with the given '
@@ -724,6 +728,7 @@ def main():
     proxy_config.fallback_cfproxy = not args.no_cfproxy
     proxy_config.cfproxy_user_domains = coerce_domain_list(args.cfproxy_domain)
     proxy_config.cfproxy_worker_domains = coerce_domain_list(args.cfproxy_worker_domain)
+    proxy_config.disable_secure = args.no_secure
     proxy_config.fake_tls_domain = args.fake_tls_domain.strip()
     proxy_config.proxy_protocol = args.proxy_protocol
     proxy_config.force_test_dc = args.force_test_dc