ref!: supply a full *tls.Config for each connection

cmd/sclient/main.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"crypto/tls"
 	"flag"
 	"fmt"
 	"os"
@@ -79,12 +80,16 @@ func main() {
 	}
 
 	sclient := &sclient.Tunnel{
-		RemotePort:         443,
+		RemotePort:   443,
-		LocalAddress:       "localhost",
+		LocalAddress: "localhost",
-		InsecureSkipVerify: insecure,
+		Silent:       silent,
-		ServerName:         servername,
+		GetTLSConfig: func() *tls.Config {
-		Silent:             silent,
+			return &tls.Config{
-		NextProtos:         alpns,
+				ServerName:         servername,
+				NextProtos:         alpns,
+				InsecureSkipVerify: insecure,
+			}
+		},
 	}
 
 	remote := strings.Split(remotestr, ":")

sclient.go

@@ -12,26 +12,19 @@ import (
 
 // Tunnel specifies which remote encrypted connection to make available as a plain connection locally.
 type Tunnel struct {
-	RemoteAddress      string
+	RemoteAddress string
-	RemotePort         int
+	RemotePort    int
-	LocalAddress       string
+	LocalAddress  string
-	LocalPort          int
+	LocalPort     int
-	InsecureSkipVerify bool
+	GetTLSConfig  func() *tls.Config
-	NextProtos         []string
+	Silent        bool
-	ServerName         string
-	Silent             bool
 }
 
 // DialAndListen will create a test TLS connection to the remote address and then
 // begin listening locally. Each local connection will result in a separate remote connection.
 func (t *Tunnel) DialAndListen() error {
 	remote := t.RemoteAddress + ":" + strconv.Itoa(t.RemotePort)
-	conn, err := tls.Dial("tcp", remote,
+	conn, err := tls.Dial("tcp", remote, t.GetTLSConfig())
-		&tls.Config{
-			ServerName:         t.ServerName,
-			InsecureSkipVerify: t.InsecureSkipVerify,
-			NextProtos:         t.NextProtos,
-		})
 
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "[warn] '%s' may not be accepting connections: %s\n", remote, err)
@@ -142,11 +135,7 @@ func pipe(r netReadWriteCloser, w netReadWriteCloser, t string) {
 }
 
 func (t *Tunnel) handleConnection(remote string, conn netReadWriteCloser) {
-	sclient, err := tls.Dial("tcp", remote,
+	sclient, err := tls.Dial("tcp", remote, t.GetTLSConfig())
-		&tls.Config{
-			ServerName:         t.ServerName,
-			InsecureSkipVerify: t.InsecureSkipVerify,
-		})
 
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "[error] (remote) %s\n", err)