From 23c8ab359c2108654d57176e233d2c099b398f31 Mon Sep 17 00:00:00 2001
From: srdusr <99972264+srdusr@users.noreply.github.com>
Date: Tue, 16 Jun 2026 22:57:00 +0200
Subject: Client (mutual-TLS) certificates

Adds internal/clientcert: a cert/key pair matched to hosts by the same
substring-or-regex pattern model as scope.Rule, so mitmux can present
a client certificate on an upstream TLS handshake that requires one -
the previous behavior was a hard handshake failure with no way to
authenticate. Wired into both places mitmux dials an https:// upstream
over its own TLS client connection: proxy.go's handleConnect (live
proxied traffic) and repeat.go's dialForRepeat (Repeater/Intruder
resends), both through a new Server.clientCertFor(host) helper.

Stored in a new client_certs table, mirroring the existing scope_rules
persistence pattern. The TUI (`t` from history) is add-only like
scope, for the same reason: delete and re-add covers changing
anything, and it's a rarely-touched, low-cardinality list. The add
form takes cert/key file paths and reads them once at save time - PEM
content, not the path, is what's stored and later presented, so a
cert keeps working even if the original file moves afterward.

Verified live against a real mutual-TLS-requiring origin server:
without a matching cert the handshake correctly fails; with one
configured, the origin receives it and the request succeeds; toggling
it off reproduces the failure, confirming the enable/disable path
works end to end.
---
 internal/clientcert/clientcert_test.go | 111 +++++++++++++++++++++++++++++++++
 1 file changed, 111 insertions(+)
 create mode 100644 internal/clientcert/clientcert_test.go

(limited to 'internal/clientcert/clientcert_test.go')

diff --git a/internal/clientcert/clientcert_test.go b/internal/clientcert/clientcert_test.go
new file mode 100644
index 0000000..712562b
--- /dev/null
+++ b/internal/clientcert/clientcert_test.go
@@ -0,0 +1,111 @@
+package clientcert
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"testing"
+	"time"
+)
+
+// selfSignedPEM generates a throwaway self-signed cert/key pair entirely
+// in memory (crypto/tls + crypto/x509 stdlib only) rather than shelling
+// out to openssl or checking in a fixture - keeps the test hermetic and
+// portable.
+func selfSignedPEM(t *testing.T) (certPEM, keyPEM []byte) {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("generate key: %v", err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "test"},
+		NotBefore:    time.Now(),
+		NotAfter:     time.Now().Add(time.Hour),
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatalf("create certificate: %v", err)
+	}
+	keyDER, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		t.Fatalf("marshal key: %v", err)
+	}
+	var certBuf, keyBuf bytes.Buffer
+	pem.Encode(&certBuf, &pem.Block{Type: "CERTIFICATE", Bytes: der})
+	pem.Encode(&keyBuf, &pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})
+	return certBuf.Bytes(), keyBuf.Bytes()
+}
+
+func TestFindForExactMatch(t *testing.T) {
+	certs := []Cert{{ID: 1, Enabled: true, Pattern: "internal.example.com"}}
+	got := FindFor(certs, "internal.example.com")
+	if got == nil || got.ID != 1 {
+		t.Errorf("got %+v, want match on id 1", got)
+	}
+}
+
+func TestFindForSubstringMatch(t *testing.T) {
+	certs := []Cert{{ID: 1, Enabled: true, Pattern: "example.com"}}
+	if FindFor(certs, "api.example.com") == nil {
+		t.Error("expected subdomain to match by substring, same convention as scope.Rule")
+	}
+}
+
+func TestFindForRegex(t *testing.T) {
+	certs := []Cert{{ID: 1, Enabled: true, Pattern: `^api-\d+\.example\.com$`, IsRegex: true}}
+	if FindFor(certs, "api-42.example.com") == nil {
+		t.Error("expected regex pattern to match")
+	}
+	if FindFor(certs, "api-x.example.com") != nil {
+		t.Error("expected regex pattern not to match a non-numeric suffix")
+	}
+}
+
+func TestFindForSkipsDisabled(t *testing.T) {
+	certs := []Cert{{ID: 1, Enabled: false, Pattern: "example.com"}}
+	if FindFor(certs, "example.com") != nil {
+		t.Error("expected a disabled cert not to match")
+	}
+}
+
+func TestFindForNoMatch(t *testing.T) {
+	certs := []Cert{{ID: 1, Enabled: true, Pattern: "example.com"}}
+	if FindFor(certs, "other.org") != nil {
+		t.Error("expected no match for an unrelated host")
+	}
+}
+
+func TestFindForFirstMatchWins(t *testing.T) {
+	certs := []Cert{
+		{ID: 1, Enabled: true, Pattern: "example.com"},
+		{ID: 2, Enabled: true, Pattern: "example.com"},
+	}
+	got := FindFor(certs, "example.com")
+	if got == nil || got.ID != 1 {
+		t.Errorf("got %+v, want the first matching cert (id 1)", got)
+	}
+}
+
+func TestTLSCertificateValidPair(t *testing.T) {
+	certPEM, keyPEM := selfSignedPEM(t)
+	c := Cert{Name: "test", CertPEM: certPEM, KeyPEM: keyPEM}
+	if _, err := c.TLSCertificate(); err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
+func TestTLSCertificateMismatchedPairErrors(t *testing.T) {
+	certPEM, _ := selfSignedPEM(t)
+	_, otherKeyPEM := selfSignedPEM(t)
+	c := Cert{Name: "test", CertPEM: certPEM, KeyPEM: otherKeyPEM}
+	if _, err := c.TLSCertificate(); err == nil {
+		t.Error("expected an error pairing a cert with a key that doesn't match it")
+	}
+}
-- 
cgit v1.2.3