CWE-295: 7 of 9 transports unconditionally skip TLS/SSH host verification (InsecureSkipVerify=true)

Summary

gost's 9 transport protocols have a systematic TLS/SSH certificate verification bypass. 7 transports unconditionally accept any certificate or host key even when the user sets secure=true in their configuration.

Affected Transports

Transport	File	Issue
TLS / mTLS	tls.go:30,131	InsecureSkipVerify: true unconditional
WS / mWS	ws.go:216,326	InsecureSkipVerify: true unconditional
SSH Forward / SSH Tunnel	ssh.go:225,339	InsecureIgnoreHostKey() unconditional
Socks5 TLS	socks.go:1867	InsecureSkipVerify unconditional
DNS-over-TLS/HTTPS	resolver.go:83,97,803	No verification
QUIC	quic.go:108-109	Silent fallback to insecure when TLSConfig is nil

Only HTTP2 and gRPC transports properly respect user TLS settings.

Root Cause

cmd/gost/route.go:179-185 — the user's secure=true configuration option is systematically ignored by 5 transports due to a disconnect between the configuration layer and transport layer.

Remediation

• Remove hardcoded InsecureSkipVerify: true from all transports
• Wire route.go secure flag through to each transport's TLS config
• If self-signed certs are needed, add a --insecure flag with security warning