New Feature: TLS Transport

[fortuna]

We have added an experimental TLS package with TLS wrapper and diale. You can find the documentation at https://pkg.go.dev/github.com/Jigsaw-Code/outline-sdk/x/tls

It allows you to specify separate domain for SNI and domain validation. For example:

func TestHostSelector(t *testing.T) {
	sd, err := NewStreamDialer(&transport.TCPStreamDialer{},
		IfHostPort("dns.google", 0, WithSNI("decoy.example.com")),
		IfHostPort("www.youtube.com", 0, WithSNI("notyoutube.com")),
	)
	require.NoError(t, err)

	conn, err := sd.Dial(context.Background(), "dns.google:443")
	require.NoError(t, err)
	tlsConn := conn.(streamConn)
	require.Equal(t, "decoy.example.com", tlsConn.ConnectionState().ServerName)
	conn.Close()

	conn, err = sd.Dial(context.Background(), "www.youtube.com:443")
	require.NoError(t, err)
	tlsConn = conn.(streamConn)
	require.Equal(t, "notyoutube.com", tlsConn.ConnectionState().ServerName)
	conn.Close()
}

Check out the tests for more examples.

The config package also supports it. You can run a local proxy that does SOCKS5-over-TLS with:

go run github.com/Jigsaw-Code/outline-sdk/x/examples/http2transport  -transport "tls|socks5:[host:port]"  -localAddr localhost:8080

You can resolve using DNS-over-TLS with:

go run github.com/Jigsaw-Code/outline-sdk/x/examples/resolve -tcp -transport "split:2|tls:sni=decoy.com" -type a -resolver dns.google:853 www.example.com

There's also a certname parameter for the certificate validation domain.