Match-and-replace: header rewrite rules

Implements build-order step 6, scoped to headers only for this pass -
see PLAN.md for why bodies are a separate problem (request-body capture
currently depends on streaming straight through, which a body-rewriting
rule would have to interrupt; deciding what "exact" means for a
rule-modified request needs its own pass, not a rushed add-on to this
one).

internal/rules: Rule type and ApplyHeaders, which serializes a Header
map to a raw "Name: value\r\n" block, runs enabled rules' match/replace
over that text, and reparses it - operating on text rather than
per-value substitution is what lets a rule add or remove a header, not
just rewrite one, matching how Burp's header match/replace works.
Invalid rule output (bad regex, unparseable result) leaves the header
map untouched rather than corrupting the request.

internal/store: rules table + CRUD. internal/proxy: forward() fetches
enabled rules for each scope and applies them to outReq.Header /
resp.Header, positioned so the existing capture/history pipeline is
untouched - request_raw keeps showing what the client actually sent and
response_raw what the origin actually sent, while the wire itself
reflects the rules. Deliberate split: match-and-replace transforms
traffic, it doesn't rewrite the audit trail. internal/ipc gains
rules_list/rules_save/rules_delete/rules_toggle. cmd/mitmux gains a
rules view ('m' from history) with add/edit/delete/toggle and a small
form (name, match, replace, scope, regex).

Verified live against real external traffic, not just local echoes:
a request-scope rule rewriting User-Agent, confirmed via httpbin.org's
own header echo that the origin received the rewritten value while curl
sent the real one; a response-scope rule rewriting the Server header,
confirmed the client actually received the rewritten value; disabling a
rule confirmed via a follow-up request that it stops applying; and
throughout, history continued showing the pre-rule original on both
sides, confirming the capture/transform split holds.

1 files changed, 34 insertions, 0 deletions

diff --git a/internal/proxy/proxy.go b/internal/proxy/proxy.go
index 014c601..3b2d50d 100644
--- a/internal/proxy/proxy.go
+++ b/internal/proxy/proxy.go
@@ -35,6 +35,7 @@ import (
 	"golang.org/x/net/http2"
 
 	"mitmux/internal/ca"
+	"mitmux/internal/rules"
 	"mitmux/internal/store"
 )
 
@@ -244,6 +245,17 @@ func (s *Server) forward(dial dialer, scheme, hostname string, w http.ResponseWr
 	outReq.URL.Host = hostname
 	outReq.RequestURI = ""
 	stripHopByHop(outReq.Header)
+	// Header rules are applied to outReq only, after cloning and header
+	// stripping - history's request_raw keeps showing what the client
+	// actually sent (clientTee/reqBodyCap already capture from r, not
+	// outReq), while what actually reaches the upstream server reflects
+	// the rules. That split is deliberate: match-and-replace is a wire
+	// transform, not a rewrite of the audit trail.
+	if reqRules, err := s.enabledRules("request"); err != nil {
+		log.Printf("load request rules: %v", err)
+	} else if len(reqRules) > 0 {
+		outReq.Header = rules.ApplyHeaders(outReq.Header, reqRules)
+	}
 
 	// Only needed when the client leg isn't tee-captured (HTTP/2): tee
 	// the body as it streams through so the reconstructed capture isn't
@@ -297,6 +309,17 @@ func (s *Server) forward(dial dialer, scheme, hostname string, w http.ResponseWr
 		resp.Body = io.NopCloser(respBodyCap)
 	}
 
+	// Same split as the request side: response_raw keeps reflecting what
+	// the origin server actually sent (captured below, from upstreamTee
+	// or respBodyCap, both already wired to resp.Body independent of
+	// resp.Header), while the client actually receives the rule-modified
+	// headers.
+	if respRules, err := s.enabledRules("response"); err != nil {
+		log.Printf("load response rules: %v", err)
+	} else if len(respRules) > 0 {
+		resp.Header = rules.ApplyHeaders(resp.Header, respRules)
+	}
+
 	stripHopByHop(resp.Header)
 	for k, vv := range resp.Header {
 		for _, v := range vv {
@@ -317,6 +340,17 @@ func (s *Server) forward(dial dialer, scheme, hostname string, w http.ResponseWr
 	s.record(started, duration, scheme, hostname, r, reqRaw, reqExact, respRaw, respExact, resp.StatusCode, "")
 }
 
+// enabledRules fetches the current enabled match-and-replace rules for
+// scope ("request" or "response") fresh from the store on every call -
+// simple and always current, and cheap enough (a local, in-process
+// SQLite query) not to bother caching for how this is actually used.
+func (s *Server) enabledRules(scope string) ([]rules.Rule, error) {
+	if s.store == nil {
+		return nil, nil
+	}
+	return s.store.EnabledRules(scope)
+}
+
 // record stores one history entry and notifies OnEntry.
 func (s *Server) record(started time.Time, duration time.Duration, scheme, host string, r *http.Request,
 	reqRaw []byte, reqExact bool, respRaw []byte, respExact bool, status int, errMsg string) {