From c2443f27ef5a844f045c038c7689d217d1dbf0c4 Mon Sep 17 00:00:00 2001 From: srdusr <99972264+srdusr@users.noreply.github.com> Date: Mon, 23 Sep 2024 21:33:00 +0200 Subject: Match-and-replace: header rewrite rules Implements build-order step 6, scoped to headers only for this pass - see PLAN.md for why bodies are a separate problem (request-body capture currently depends on streaming straight through, which a body-rewriting rule would have to interrupt; deciding what "exact" means for a rule-modified request needs its own pass, not a rushed add-on to this one). internal/rules: Rule type and ApplyHeaders, which serializes a Header map to a raw "Name: value\r\n" block, runs enabled rules' match/replace over that text, and reparses it - operating on text rather than per-value substitution is what lets a rule add or remove a header, not just rewrite one, matching how Burp's header match/replace works. Invalid rule output (bad regex, unparseable result) leaves the header map untouched rather than corrupting the request. internal/store: rules table + CRUD. internal/proxy: forward() fetches enabled rules for each scope and applies them to outReq.Header / resp.Header, positioned so the existing capture/history pipeline is untouched - request_raw keeps showing what the client actually sent and response_raw what the origin actually sent, while the wire itself reflects the rules. Deliberate split: match-and-replace transforms traffic, it doesn't rewrite the audit trail. internal/ipc gains rules_list/rules_save/rules_delete/rules_toggle. cmd/mitmux gains a rules view ('m' from history) with add/edit/delete/toggle and a small form (name, match, replace, scope, regex). Verified live against real external traffic, not just local echoes: a request-scope rule rewriting User-Agent, confirmed via httpbin.org's own header echo that the origin received the rewritten value while curl sent the real one; a response-scope rule rewriting the Server header, confirmed the client actually received the rewritten value; disabling a rule confirmed via a follow-up request that it stops applying; and throughout, history continued showing the pre-rule original on both sides, confirming the capture/transform split holds. --- internal/proxy/proxy.go | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) (limited to 'internal/proxy') diff --git a/internal/proxy/proxy.go b/internal/proxy/proxy.go index 014c601..3b2d50d 100644 --- a/internal/proxy/proxy.go +++ b/internal/proxy/proxy.go @@ -35,6 +35,7 @@ import ( "golang.org/x/net/http2" "mitmux/internal/ca" + "mitmux/internal/rules" "mitmux/internal/store" ) @@ -244,6 +245,17 @@ func (s *Server) forward(dial dialer, scheme, hostname string, w http.ResponseWr outReq.URL.Host = hostname outReq.RequestURI = "" stripHopByHop(outReq.Header) + // Header rules are applied to outReq only, after cloning and header + // stripping - history's request_raw keeps showing what the client + // actually sent (clientTee/reqBodyCap already capture from r, not + // outReq), while what actually reaches the upstream server reflects + // the rules. That split is deliberate: match-and-replace is a wire + // transform, not a rewrite of the audit trail. + if reqRules, err := s.enabledRules("request"); err != nil { + log.Printf("load request rules: %v", err) + } else if len(reqRules) > 0 { + outReq.Header = rules.ApplyHeaders(outReq.Header, reqRules) + } // Only needed when the client leg isn't tee-captured (HTTP/2): tee // the body as it streams through so the reconstructed capture isn't @@ -297,6 +309,17 @@ func (s *Server) forward(dial dialer, scheme, hostname string, w http.ResponseWr resp.Body = io.NopCloser(respBodyCap) } + // Same split as the request side: response_raw keeps reflecting what + // the origin server actually sent (captured below, from upstreamTee + // or respBodyCap, both already wired to resp.Body independent of + // resp.Header), while the client actually receives the rule-modified + // headers. + if respRules, err := s.enabledRules("response"); err != nil { + log.Printf("load response rules: %v", err) + } else if len(respRules) > 0 { + resp.Header = rules.ApplyHeaders(resp.Header, respRules) + } + stripHopByHop(resp.Header) for k, vv := range resp.Header { for _, v := range vv { @@ -317,6 +340,17 @@ func (s *Server) forward(dial dialer, scheme, hostname string, w http.ResponseWr s.record(started, duration, scheme, hostname, r, reqRaw, reqExact, respRaw, respExact, resp.StatusCode, "") } +// enabledRules fetches the current enabled match-and-replace rules for +// scope ("request" or "response") fresh from the store on every call - +// simple and always current, and cheap enough (a local, in-process +// SQLite query) not to bother caching for how this is actually used. +func (s *Server) enabledRules(scope string) ([]rules.Rule, error) { + if s.store == nil { + return nil, nil + } + return s.store.EnabledRules(scope) +} + // record stores one history entry and notifies OnEntry. func (s *Server) record(started time.Time, duration time.Duration, scheme, host string, r *http.Request, reqRaw []byte, reqExact bool, respRaw []byte, respExact bool, status int, errMsg string) { -- cgit v1.2.3