[draft] mitm-df: NameConstraints-scoped CA + file keystore (foundation)

[myleshorton]

Draft — first slice of engineering#3482 (MITM-DomainFronting outbound for lantern-box). Posting early as a marker; not for review yet.

What's here

The foundational crypto piece — a CA generator whose RFC 5280 NameConstraints extension cryptographically restricts the DNS names it can sign for. This lands first, before any of the outbound machinery that uses it, because the security model rests on it and the package is independent enough to review in isolation.

• `internal/mitmca/ca.go` — `CA` struct, `GenerateCA`, `LoadCA`, `SignLeaf`. Includes a Go-side pre-check rejecting out-of-subtree SNIs before the signer is touched (the cryptographic enforcement happens via the cert's `NameConstraints` extension; this is defense-in-depth for verifiers that don't enforce it).
• `internal/mitmca/keystore.go` — `KeyStore` interface and the cross-platform `FileKeyStore` (PKCS#8 PEM, mode 0600, atomic rename). Hardware-backed implementations (Secure Enclave / Android StrongBox / TPM) satisfy the same interface and land in follow-ups behind build tags.
• `internal/mitmca/ca_test.go` — table-driven coverage for the gotchas (`notexample.com` vs subtree `example.com`, `example.com.evil.com` not under `example.com`), unconstrained-CA rejection on `Load`, fresh-vs-reloaded sign equivalence, POSIX mode bits, idempotent `Erase`.
• `docs/mitm-df/architecture.md` — design doc covering the full feature: component map, package layout, public Go types, sing-box outbound config schema, end-to-end request flow, the security properties as enforced by this code, the implementation order.

Not yet here (follow-ups, in rough order)

1. `internal/mitmdf` — the outbound itself: TLS termination, fronts table, SPKI pinner, audit log, session loop.
2. `option/mitmdf.go` — sing-box config schema for `type="mitm-df"`.
3. Hardware-backed keystores: `keystore_darwin.go` (Secure Enclave), `keystore_android.go` (StrongBox), `keystore_windows.go` (TPM/NCrypt), `keystore_linux.go` (TPM via PKCS#11 if available).
4. Flutter UI: opt-in toggle, per-platform CA install flow, audit-log viewer.
5. Cross-repo: config-server push channel for fronts updates, weekly validation CI, kill-switch flag.

Why `NameConstraints`

The user installs a personal root CA. If unconstrained, it can sign certs for any domain — banks, government, healthcare, anything. `NameConstraints` cryptographically restricts the CA to a fixed list of DNS subtrees. On any verifier that enforces it (Chrome, Firefox, Android API 30+, iOS 13+, modern Safari/Windows), the CA is incapable of producing a fraudulent cert for any domain outside that list — even if the private key is exfiltrated. That converts the threat model from "unbounded MITM authority" to "scoped MITM authority for ~10 named CDN families."

See engineering#3482 (security comment) for the full threat-model walk and the explanation of why on-the-wire SNI byte-swap doesn't work (TLS transcript HMAC binding).

Test plan

• `go test ./internal/mitmca/...` passes locally
• `go vet ./internal/mitmca/...` clean
• `go build ./...` (whole repo) clean
• Reviewer sanity-check the subtree-matching corner cases in `permits()`
• Confirm Go stdlib `x509.Verify` enforces our `NameConstraints` (the `TestSignLeaf_VerifiesUnderCAPool` test catches the happy path; the rejection path is a future test once we have a way to mint a non-permitted leaf bypassing our own check)

🤖 Generated with Claude Code

[garmr-ulfr]

@myleshorton FYI I already had Claude implement a MITM outbound to replicate what's missing
https://wdynhnkxvsdx.slack.com/archives/C054ZBXNVE0/p1778789570280169?thread_ts=1778774452.953679&cid=C054ZBXNVE0. I haven't pushed anything yet though.

[myleshorton]

Oh sweet!! Yeah the only interesting thing my planning on this uncovered is the NameConstraints RFC so we can specify a targeted set of domains we can generate certs for.

[garmr-ulfr]

Part of the mitmca package is actually what I was missing and some of it is actually better than what my Claude did regarding CA. I'm having Claude now rebase on this and update the outbound to use it. When it's done I'll create a PR to merge into here.