diff options
Diffstat (limited to 'internal/proxy/proxy.go')
| -rw-r--r-- | internal/proxy/proxy.go | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/internal/proxy/proxy.go b/internal/proxy/proxy.go index 2e80ed2..523ca01 100644 --- a/internal/proxy/proxy.go +++ b/internal/proxy/proxy.go @@ -31,6 +31,7 @@ import ( "net" "net/http" "net/url" + "strings" "sync" "time" @@ -611,6 +612,10 @@ func (s *Server) handleHTTP(w http.ResponseWriter, r *http.Request) { http.Error(w, "mitmux: request must use absolute-form URI (configure as a proxy, not a target)", http.StatusBadRequest) return } + if isCertDownloadHost(r.URL.Host) { + s.serveCACert(w) + return + } host := r.URL.Host dial := func(ctx context.Context) (net.Conn, string, error) { return dialUpstreamPlain(ctx, host, s.UpstreamProxy) @@ -618,6 +623,40 @@ func (s *Server) handleHTTP(w http.ResponseWriter, r *http.Request) { s.forward(dial, r.URL.Scheme, r.URL.Host, w, r) } +// certDownloadHost is a magic hostname mitmux intercepts and answers +// itself, serving its own CA certificate - reachable over plain HTTP +// from any client configured to use mitmux as its proxy, including a +// mobile browser, which otherwise has no easy way to get a file onto +// the device to trust as a CA at all. Deliberately not a real, +// resolvable domain (".cert" isn't a registered TLD) so it can never +// collide with an actual site someone meant to visit - the same idea +// as mitmproxy's own http://mitm.it/, arrived at independently rather +// than reusing their domain. HTTP only, on purpose: fetching this over +// HTTPS would require the client to already trust mitmux's CA to MITM +// that very connection - exactly the chicken-and-egg problem this page +// exists to solve, so intercepting it on the CONNECT/TLS path wouldn't +// make sense and isn't attempted. +const certDownloadHost = "mitmux.cert" + +func isCertDownloadHost(hostPort string) bool { + host := hostPort + if h, _, err := net.SplitHostPort(hostPort); err == nil { + host = h + } + return strings.EqualFold(host, certDownloadHost) +} + +// serveCACert answers with the CA certificate as a download. The +// content type (application/x-x509-ca-cert) is what makes iOS and +// Android offer to install it as a trusted certificate directly from +// the browser's download prompt, rather than just saving a plain file. +func (s *Server) serveCACert(w http.ResponseWriter) { + w.Header().Set("Content-Type", "application/x-x509-ca-cert") + w.Header().Set("Content-Disposition", `attachment; filename="mitmux-ca.pem"`) + w.WriteHeader(http.StatusOK) + w.Write(s.ca.CertPEM) +} + func stripHopByHop(h http.Header) { for _, k := range hopByHopHeaders { h.Del(k) |