Pass through MITM to the right hosts

[doroved]

Can you tell me if it is possible to make certain hosts go through MITM proxy, and all other hosts through regular one? I would like not to create fake certificates for unnecessary hosts on the fly, because it is not necessary and will waste resources simply.

[hatoo]

Currently, impossible. It's good idea but I would implement it only if I come up with a simple implementation because it makes things complicated.

[doroved]

Currently, impossible. It's good idea but I would implement it only if I come up with a simple implementation because it makes things complicated.

I implemented it this way, it doesn't look too complicated.

#[derive(Clone)]
/// The main struct to run proxy server
pub struct MitmProxy<C> {
    /// Root certificate to sign fake certificates. You may need to trust this certificate on client application to use HTTPS.
    ///
    /// If None, proxy will just tunnel HTTPS traffic and will not observe HTTPS traffic.
    pub root_cert: Option<C>,
    /// Cache to store generated certificates. If None, cache will not be used.
    /// If root_cert is None, cache will not be used.
    ///
    /// The key of cache is hostname.
    pub cert_cache: Option<Cache<String, CertifiedKeyDer>>,

    /// Whitelist hosts to MITM proxy
    pub whitelist_hosts: Vec<String>,
}

impl<C> MitmProxy<C> {
    /// Create a new MitmProxy
    pub fn new(
        root_cert: Option<C>,
        cache: Option<Cache<String, CertifiedKeyDer>>,
        whitelist_hosts: Vec<String>,
    ) -> Self {
        Self {
            root_cert,
            cert_cache: cache,
            whitelist_hosts,
        }
    }
}

pub fn wrap_service<S>(
    // .....
    async move {
        // Check if the request method is CONNECT
        if req.method() == Method::CONNECT {
            // Attempt to get the authority from the request URI
            let Some(connect_authority) = req.uri().authority().cloned() else {
                tracing::error!(
                    "Bad CONNECT request: {}, Reason: Invalid Authority",
                    req.uri()
                );
                // Return a BAD_REQUEST response if the authority is invalid
                return Ok(no_body(StatusCode::BAD_REQUEST)
                    .map(|b| b.boxed().map_err(|never| match never {}).boxed()));
            };

            // Spawn a new asynchronous task to handle the connection
            tokio::spawn(async move {
                // Attempt to upgrade the connection
                let Ok(client) = hyper::upgrade::on(req).await else {
                    tracing::error!(
                        "Bad CONNECT request: {}, Reason: Invalid Upgrade",
                        connect_authority
                    );
                    return;
                };

                // Extract the host from the connect authority
                let host = connect_authority.host().to_string();

                // Check if the host is in the whitelist
                if proxy.whitelist_hosts.contains(&host) { // <-----------------------------
                    // Here we handle MITM (Man-In-The-Middle) requests
                } else {
                    // Attempt to connect to the server using the provided authority string
                    match TcpStream::connect(connect_authority.as_str()).await {
                        // If the connection is successful, proceed with the following block
                        Ok(mut server) => {
                            // Copy data bidirectionally between the client and the server
                            // `TokioIo::new(client)` wraps the client for asynchronous I/O operations
                            let _ = tokio::io::copy_bidirectional(&mut TokioIo::new(client), &mut server).await;
                        }
                        // If the connection fails, log an error message
                        Err(err) => {
                            tracing::error!("Failed to connect to {}: {}", connect_authority, err);
                        }
                    }
                }
            });
        }
    }
}

And before creating the server, I specify a list of hosts to be processed through MITM

// Define a vector of hosts that are allowed to bypass the proxy
let whitelist_hosts = vec![
    "api.ipify.org".into()
];

// Create a new instance of MitmProxy with the following configurations:
// - The root certificate used to sign fake certificates
// - A cache with a capacity of 128 entries
// - A list of whitelisted hosts
let proxy = MitmProxy::new(
    // This is the root cert that will be used to sign the fake certificates
    Some(root_cert),
    Some(Cache::new(128)),
    whitelist_hosts,
);

[hatoo]

I've realized that we can do it already by the same approach with #67 (comment)