[draft] mitm-df: outbound (TLS termination, fronts table, audit log)

[garmr-ulfr]

Summary

Stacked on top of #262. Once #262 lands, this PR introduces the actual mitm-df outbound that uses the foundation's name-constrained CA.

• TCP outbound registered as "mitm-df". DialContext returns the user side of an in-memory net.Pipe — no listening port.
• tls.Server with GetCertificate callback driven by the actual ClientHello SNI (not the router-supplied destination), so a sniff/routing mismatch can't mint the wrong leaf. Callback runs: deny-list check → fronts lookup → audit record → mitmca.CA.SignLeaf(sni).
• Fronts table maps user SNIs to fronted_sni / verify_san / optional redirect_addr. Match semantics: exact-or-strict-subdomain (vercel.app matches *.vercel.app but not notvercel.app or vercel.app.evil.com).
• JSONL audit log records every decision (allow, deny, no-match, error) with {ts, sni, fronted_sni, decision, reason}. Empty audit_log_path disables.
• Egress uTLS uses HelloCustom + ApplyPreset so the user's negotiated ALPN is the only one offered to the front. Named uTLS presets (HelloChrome_Auto, etc.) bake an ALPN extension into the replayed ClientHello that overrides Config.NextProtos; HelloCustom is the only path that inherits cleanly. Without this, every fronted flow would leak [h2, http/1.1] regardless of the inner request shape — breaks h1-only flows like googlevideo / alive.github.com.
• CA auto-generated on first boot at the configured ca.cert_path / ca.key_path if absent (delegates to mitmca.GenerateCA); reloaded on subsequent boots via mitmca.LoadCA which refuses certs without NameConstraints.

Files

• option/mitmdf.go — MITMDFOutboundOptions + nested MITMDFCAOptions / MITMDFFrontEntry.
• protocol/mitmdf/
  • outbound.go — registration, NewOutbound, DialContext, the serve goroutine, the GetCertificate callback, CA bootstrap, verifyFrontSAN callback for the egress.
  • fronts.go — FrontEntry parsing, suffix-aware matcher, deny-list match.
  • audit.go — append-only JSONL with sync.Mutex, nil-safe.
  • utls_preset.go — preset map + HelloCustom/ApplyPreset ALPN-rewrite helper.
  • fronts_test.go, audit_test.go — unit coverage.
• test/e2e/mitmdf_test.go — TestMITMDFE2E (full pipeline through an in-process fronting server: leaf chains to local CA, captured egress SNI = front, captured egress ALPN = [h2], bytes round-trip, audit allow) + TestMITMDFDenyList (deny-list path: no mint, audit deny).
• testdata/options/mitmdf_client.json — example config; passes lantern-box check.
• constant/proxy.go, protocol/register.go, go.mod — type constant, registration, utls promoted to direct dep.

Out of scope (follow-ups)

• Hardware-backed KeyStore (keystore_macos.go, keystore_android.go, …) — the KeyStore interface is already in place on the foundation branch; per-platform variants behind build tags.
• SPKI pinning to known CDN intermediates (pinner.go per architecture doc).
• Config-server kill switch + weekly fronts validation CI — cross-repo.
• Per-platform trust-store install commands for the CA.
• Old-platform refusal (Android < 9, Windows < 10).
• Leaf-cert cache (mitmca mints per-handshake; ECDSA P-256 keygen is cheap).

Test plan

• go build ./...
• go vet ./...
• go test ./protocol/mitmdf/... ./internal/mitmca/...
• go test ./test/e2e/ -run TestMITMDF -v
• lantern-box check --config testdata/options/mitmdf_client.json — generates a CA at the configured paths with PermittedDNSDomainsCritical: true, CA:TRUE pathlen:0, key mode 0600.

🤖 Generated with Claude Code