GreyhavenHQ
diff --git a/‎.gitignore‎
Lines changed: 10 additions & 0 deletions b/‎.gitignore‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎cmd/greyproxy/cert.go‎
Lines changed: 292 additions & 0 deletions b/‎cmd/greyproxy/cert.go‎
Lines changed: 292 additions & 0 deletions
diff --git a/‎cmd/greyproxy/install.go‎
Lines changed: 10 additions & 0 deletions b/‎cmd/greyproxy/install.go‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎cmd/greyproxy/main.go‎
Lines changed: 4 additions & 0 deletions b/‎cmd/greyproxy/main.go‎
Lines changed: 4 additions & 0 deletions
@@ -31,6 +31,11 @@ _testmain.go
 
 *.bak
 
+# Python
+__pycache__/
+*.pyc
+*.pyo
+
 cmd/greyproxy/greyproxy
 snap
 
@@ -42,4 +47,9 @@ dist/
 /greyproxy.db
 /greyproxy.db-shm
 /greyproxy.db-wal
+/conversation.db
 /greyproxy
+exported_logs/
+/buildrun.sh
+/greyproxy.log
+/greyproxy.reload
@@ -0,0 +1,292 @@
+package main
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"fmt"
+	"math/big"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"time"
+)
+
+func handleCert(args []string) {
+	if len(args) == 0 {
+		fmt.Fprintf(os.Stderr, `Usage: greyproxy cert <command>
+
+Commands:
+  generate    Generate CA certificate and key pair
+  install     Trust the CA certificate on the OS
+  uninstall   Remove the CA certificate from the OS trust store
+
+Options:
+  -f          Force overwrite existing files (generate, install)
+`)
+		os.Exit(1)
+	}
+
+	switch args[0] {
+	case "generate":
+		force := len(args) > 1 && args[1] == "-f"
+		handleCertGenerate(force)
+	case "install":
+		force := len(args) > 1 && args[1] == "-f"
+		handleCertInstall(force)
+	case "uninstall":
+		handleCertUninstall()
+	default:
+		fmt.Fprintf(os.Stderr, "unknown cert command: %s\n", args[0])
+		os.Exit(1)
+	}
+}
+
+func handleCertGenerate(force bool) {
+	dataDir := greyproxyDataHome()
+	certFile := filepath.Join(dataDir, "ca-cert.pem")
+	keyFile := filepath.Join(dataDir, "ca-key.pem")
+
+	if !force {
+		if _, err := os.Stat(certFile); err == nil {
+			fmt.Fprintf(os.Stderr, "CA certificate already exists: %s\nUse -f to overwrite.\n", certFile)
+			os.Exit(1)
+		}
+		if _, err := os.Stat(keyFile); err == nil {
+			fmt.Fprintf(os.Stderr, "CA key already exists: %s\nUse -f to overwrite.\n", keyFile)
+			os.Exit(1)
+		}
+	}
+
+	// Generate ECDSA P-256 key
+	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to generate private key: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Create self-signed CA certificate
+	serialNumber, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to generate serial number: %v\n", err)
+		os.Exit(1)
+	}
+
+	template := &x509.Certificate{
+		SerialNumber: serialNumber,
+		Subject: pkix.Name{
+			CommonName: "Greyproxy CA",
+		},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(10 * 365 * 24 * time.Hour),
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+		MaxPathLen:            0,
+		MaxPathLenZero:        true,
+	}
+
+	certDER, err := x509.CreateCertificate(rand.Reader, template, template, &privateKey.PublicKey, privateKey)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to create certificate: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Ensure data directory exists
+	if err := os.MkdirAll(dataDir, 0700); err != nil {
+		fmt.Fprintf(os.Stderr, "failed to create data directory: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Write certificate
+	certOut, err := os.OpenFile(certFile, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to write certificate: %v\n", err)
+		os.Exit(1)
+	}
+	if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: certDER}); err != nil {
+		certOut.Close()
+		fmt.Fprintf(os.Stderr, "failed to encode certificate: %v\n", err)
+		os.Exit(1)
+	}
+	certOut.Close()
+
+	// Write private key
+	keyBytes, err := x509.MarshalECPrivateKey(privateKey)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to marshal private key: %v\n", err)
+		os.Exit(1)
+	}
+
+	keyOut, err := os.OpenFile(keyFile, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to write key: %v\n", err)
+		os.Exit(1)
+	}
+	if err := pem.Encode(keyOut, &pem.Block{Type: "EC PRIVATE KEY", Bytes: keyBytes}); err != nil {
+		keyOut.Close()
+		fmt.Fprintf(os.Stderr, "failed to encode key: %v\n", err)
+		os.Exit(1)
+	}
+	keyOut.Close()
+
+	fmt.Printf("CA certificate: %s\n", certFile)
+	fmt.Printf("CA private key: %s\n", keyFile)
+	fmt.Println("\nRun 'greyproxy cert install' to trust this CA on your system.")
+}
+
+// linuxCertInstallInfo returns the destination path and update command
+// appropriate for the current Linux distribution.
+func linuxCertInstallInfo() (destPath, updateCmd string) {
+	// Arch Linux, Fedora, RHEL, CentOS, openSUSE use update-ca-trust
+	if _, err := exec.LookPath("update-ca-trust"); err == nil {
+		return "/etc/ca-certificates/trust-source/anchors/greyproxy-ca.crt", "update-ca-trust"
+	}
+	// Debian, Ubuntu, and derivatives use update-ca-certificates
+	return "/usr/local/share/ca-certificates/greyproxy-ca.crt", "update-ca-certificates"
+}
+
+func isCertInstalled() bool {
+	switch runtime.GOOS {
+	case "darwin":
+		err := exec.Command("security", "find-certificate", "-c", "Greyproxy CA").Run()
+		return err == nil
+	case "linux":
+		destPath, _ := linuxCertInstallInfo()
+		_, err := os.Stat(destPath)
+		return err == nil
+	default:
+		return false
+	}
+}
+
+func certInstallLocation() string {
+	switch runtime.GOOS {
+	case "darwin":
+		return "/Library/Keychains/System.keychain"
+	case "linux":
+		destPath, _ := linuxCertInstallInfo()
+		return destPath
+	default:
+		return "(unknown)"
+	}
+}
+
+func handleCertInstall(force bool) {
+	certFile := filepath.Join(greyproxyDataHome(), "ca-cert.pem")
+
+	if _, err := os.Stat(certFile); os.IsNotExist(err) {
+		fmt.Fprintf(os.Stderr, "CA certificate not found: %s\nRun 'greyproxy cert generate' first.\n", certFile)
+		os.Exit(1)
+	}
+
+	if !force && isCertInstalled() {
+		fmt.Fprintf(os.Stderr, "CA certificate is already installed at %s\nUse -f to overwrite.\n", certInstallLocation())
+		os.Exit(1)
+	}
+
+	switch runtime.GOOS {
+	case "darwin":
+		// Remove any existing Greyproxy CA cert to avoid errSecDuplicateItem (-25294)
+		exec.Command("security", "delete-certificate", "-c", "Greyproxy CA").Run()
+
+		fmt.Println("Installing CA certificate into system trust store (requires sudo)...")
+		cmd := exec.Command("sudo", "security", "add-trusted-cert",
+			"-d", "-r", "trustRoot",
+			"-k", "/Library/Keychains/System.keychain",
+			certFile,
+		)
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		cmd.Stdin = os.Stdin
+		if err := cmd.Run(); err != nil {
+			fmt.Fprintf(os.Stderr, "\nAutomatic install failed. Please run manually:\n\n")
+			fmt.Fprintf(os.Stderr, "  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain \"%s\"\n\n", certFile)
+			os.Exit(1)
+		}
+		fmt.Printf("CA certificate installed and trusted in %s\n", certInstallLocation())
+
+	case "linux":
+		destPath, updateCmd := linuxCertInstallInfo()
+		fmt.Println("Installing CA certificate into system trust store (requires sudo)...")
+		cpCmd := exec.Command("sudo", "cp", certFile, destPath)
+		cpCmd.Stdout = os.Stdout
+		cpCmd.Stderr = os.Stderr
+		cpCmd.Stdin = os.Stdin
+		if err := cpCmd.Run(); err != nil {
+			fmt.Fprintf(os.Stderr, "\nAutomatic install failed. Please run manually:\n\n")
+			fmt.Fprintf(os.Stderr, "  sudo cp %s %s\n", certFile, destPath)
+			fmt.Fprintf(os.Stderr, "  sudo %s\n\n", updateCmd)
+			os.Exit(1)
+		}
+		updCmd := exec.Command("sudo", updateCmd)
+		updCmd.Stdout = os.Stdout
+		updCmd.Stderr = os.Stderr
+		updCmd.Stdin = os.Stdin
+		if err := updCmd.Run(); err != nil {
+			fmt.Fprintf(os.Stderr, "\nCertificate copied but trust update failed. Please run manually:\n\n")
+			fmt.Fprintf(os.Stderr, "  sudo %s\n\n", updateCmd)
+			os.Exit(1)
+		}
+		fmt.Printf("CA certificate installed and trusted at %s\n", destPath)
+
+	default:
+		fmt.Printf("CA certificate is at: %s\n", certFile)
+		fmt.Printf("Please install it manually in your OS trust store.\n")
+	}
+}
+
+func handleCertUninstall() {
+	switch runtime.GOOS {
+	case "darwin":
+		if !isCertInstalled() {
+			fmt.Println("CA certificate is not installed in the system trust store.")
+			return
+		}
+		fmt.Println("Removing CA certificate from system trust store...")
+		cmd := exec.Command("security", "delete-certificate", "-c", "Greyproxy CA")
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		if err := cmd.Run(); err != nil {
+			fmt.Fprintf(os.Stderr, "\nAutomatic removal failed. Please run manually:\n\n")
+			fmt.Fprintf(os.Stderr, "  security delete-certificate -c \"Greyproxy CA\"\n\n")
+			os.Exit(1)
+		}
+		fmt.Println("CA certificate removed from system trust store.")
+
+	case "linux":
+		destPath, updateCmd := linuxCertInstallInfo()
+		if _, err := os.Stat(destPath); os.IsNotExist(err) {
+			fmt.Println("CA certificate is not installed in the system trust store.")
+			return
+		}
+		fmt.Println("Removing CA certificate from system trust store (requires sudo)...")
+		rmCmd := exec.Command("sudo", "rm", destPath)
+		rmCmd.Stdout = os.Stdout
+		rmCmd.Stderr = os.Stderr
+		rmCmd.Stdin = os.Stdin
+		if err := rmCmd.Run(); err != nil {
+			fmt.Fprintf(os.Stderr, "\nAutomatic removal failed. Please run manually:\n\n")
+			fmt.Fprintf(os.Stderr, "  sudo rm %s\n", destPath)
+			fmt.Fprintf(os.Stderr, "  sudo %s\n\n", updateCmd)
+			os.Exit(1)
+		}
+		updCmd := exec.Command("sudo", updateCmd)
+		updCmd.Stdout = os.Stdout
+		updCmd.Stderr = os.Stderr
+		updCmd.Stdin = os.Stdin
+		if err := updCmd.Run(); err != nil {
+			fmt.Fprintf(os.Stderr, "\nCertificate removed but trust update failed. Please run manually:\n\n")
+			fmt.Fprintf(os.Stderr, "  sudo %s\n\n", updateCmd)
+			os.Exit(1)
+		}
+		fmt.Printf("CA certificate removed from %s\n", destPath)
+
+	default:
+		fmt.Println("Please remove the Greyproxy CA certificate manually from your OS trust store.")
+	}
+}
@@ -249,10 +249,15 @@ func handleUninstall(args []string) {
 	binDst := installBinPath()
 	label := serviceLabel()
 
+	certInstalled := isCertInstalled()
+
 	fmt.Printf("Ready to uninstall greyproxy. This will:\n")
 	fmt.Printf("  1. Stop the greyproxy service\n")
 	fmt.Printf("  2. Remove the %s\n", label)
 	fmt.Printf("  3. Remove %s\n", binDst)
+	if certInstalled {
+		fmt.Printf("  4. Remove CA certificate from system trust store\n")
+	}
 
 	if !force {
 		fmt.Printf("\nProceed? [Y/n] ")
@@ -284,6 +289,11 @@ func handleUninstall(args []string) {
 		os.Exit(1)
 	}
 	fmt.Printf("Removed %s\n", binDst)
+
+	// 4. Remove CA certificate from trust store
+	if certInstalled {
+		handleCertUninstall()
+	}
 }
 
 func copyBinary(src, dst string) error {
 
@@ -142,6 +142,9 @@ func main() {
 	case "uninstall":
 		handleUninstall(os.Args[2:])
 
+	case "cert":
+		handleCert(os.Args[2:])
+
 	case "-V", "--version":
 		fmt.Fprintf(os.Stdout, "greyproxy %s (%s %s/%s)\n  built:  %s\n  commit: %s\n",
 			version, runtime.Version(), runtime.GOOS, runtime.GOARCH, buildTime, gitCommit)
@@ -159,6 +162,7 @@ Usage: greyproxy <command>
 
 Commands:
   serve       Run the proxy server in foreground
+  cert        Manage MITM CA certificate (generate/install/uninstall)
   install     Install binary and register as a background service [-f]
   uninstall   Stop service, remove registration and binary [-f]
   service     Manage the OS service (start/stop/restart/status/...)