feat(ohttp): forward ingress OHTTP over TLS to a gateway

[imlk0]

Summary

Adds ingress-side ohttp.tls (bool) + ohttp.tls_ca_certs (list of PEM file paths) config so the ingress wraps its OHTTP-encrypted POST in HTTPS (https://host:port/path) when tls: true, terminating at a TLS-terminating gateway in front of the egress. Default (null/omitted/false) keeps plain http:// — additive and backward compatible.

Motivation: a TLS-terminating gateway (e.g. an HTTPS load balancer) may sit in front of the egress. The ingress must post the OHTTP ciphertext to the gateway over HTTPS so the gateway can terminate TLS before forwarding the raw OHTTP-over-HTTP bytes to the egress.

The scheme lives on the OHTTP forwarding layer (not the endpoint), so it covers every ingress mode (Mapping / HttpProxy / Socks5 / Netfilter / Hook).

Changes

• tng/src/config/ingress.rs — OHttpArgs.tls: Option<bool> + tls_ca_certs: Vec<String>. tls_ca_certs is #[cfg(not(wasm))]: a browser has no filesystem, so the field does not exist on wasm; providing it in a wasm config is a parse error (deny_unknown_fields). New serde unit tests for defaults + round-trip.
• tng/src/tunnel/ingress/protocol/ohttp/security/mod.rs — scheme_from_tls(Option<bool>) -> &'static str (Some(true)⇒"https", else "http"); build_ohttp_http_client builds the reqwest client and (native) loads CAs via reqwest::Certificate::from_pem_bundle with fail-fast with_context labels at ingress startup; wasm builds a plain client (browser controls TLS). construct_base_url emits {scheme}://{authority}{path}. Errors preserve the chain (no string-formatting); logging uses ?error structured form. Unit tests for CA-loading success / missing-path / malformed-PEM / no-CA.
• tng-testsuite — AppType::TlsTcpProxy TLS-terminating raw-TCP proxy fixture (tokio-rustls acceptor + bidirectional tokio::io::copy) mirroring load_balancer.rs; embedded webpki-compliant CA/server/key PEMs in tests/ohttp/tls_fixtures.rs (critical CA:TRUE+certSign+SKI/AKI on the CA; CA:FALSE+digitalSignature/keyEncipherment+serverAuth+SANs on the server). Dev-deps: tokio-rustls, rustls-pemfile, tempfile.
• End-to-end test tests/ohttp/ohttp_tls.rs::test_ohttp_forwarded_over_tls — no_ra on both sides, inserts the TlsTcpProxy between ingress and egress, and proves the full path: client → ingress (TLS-wrapped OHTTP POST to https://192.168.1.1:20002) → gateway (TLS termination) → plain TCP 127.0.0.1:20001 (egress mapping-in) → egress OHTTP decap → backend. Passes.
• docs/configuration.md + docs/configuration_zh.md — document both fields (bilingual).
• CLAUDE.md — ban hard-wrapping prose in human-readable Markdown.

Verification

• cargo fmt --check clean.
• cargo clippy -p tng -p tng-testsuite --all-targets Finished (no new warnings from this change; pre-existing tokio::spawn disallowed-method lints are consistent across all existing app/*.rs fixtures).
• cargo build -p tng -p tng-testsuite --tests EXIT 0.
• cargo test -p tng --lib security:: → 65 passed.
• cargo test -p tng-testsuite --test ohttp_tls → 1 passed (e2e).

Compatibility

Additive only — new optional fields with backward-compatible defaults. No existing config/endpoint/protocol breaks. Not logged in version_compatibility.md (no breaking change).

[shankailun-aliyun]

@imlk0 ，您好，您的请求已接收，请耐心等待结果。

[shankailun-aliyun]

@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。

[codecov]

Codecov Report

❌ Patch coverage is 82.03883% with 37 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
tng-testsuite/src/task/app/tls_tcp_proxy.rs	72.13%	11 Missing and 6 partials ⚠️
.../src/tunnel/ingress/protocol/ohttp/security/mod.rs	87.82%	10 Missing and 4 partials ⚠️
tng/src/config/ingress.rs	79.16%	1 Missing and 4 partials ⚠️
tng-testsuite/src/task/app/mod.rs	50.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!