请求host不匹配时重新生成证书

core_vpn/src/mitm.rs

@@ -1,8 +1,8 @@
-use crate::cert::build_tls_acceptor;
 use crate::mut_qstring::MutQString;
 use crate::tun::{BorrowedTunIo, RewindStream};
 use crate::{error, info, warn};
 use bytes::Bytes;
+use http::Uri;
 use http_body_util::{BodyExt, Full};
 use hyper::body::Incoming;
 use hyper_util::rt::TokioIo;
@@ -14,13 +14,13 @@ use std::net::SocketAddr;
 use std::os::fd::RawFd;
 use std::sync::{Arc, Mutex as StdMutex, OnceLock};
 use std::time::Duration;
-use http::Uri;
 use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
 use tokio::net::UdpSocket;
 use tokio::task::JoinSet;
 use tokio_rustls::StartHandshake;
 use tokio_util::sync::CancellationToken;
 use tun_rs::BorrowedAsyncDevice;
+use crate::acceptor::build_tls_acceptor;
 
 static ROOT_STORE: OnceLock<Arc<RootCertStore>> = OnceLock::new();
 
@@ -145,12 +145,11 @@ where
         return passthrough_cancel_wrapped(io, dst, None, upstream, &cancel).await;
     };
 
-    // 崩溃上报之类的域名直接拒绝，不建立上游连接
-    if let Some(host) = sni.as_deref() {
-        if is_blocked_host(host) {
-            warn!("blocked host {host} ({dst:?}), connection rejected");
-            return Ok(());
-        }
+    if let Some(host) = sni.as_deref()
+        && is_blocked_host(host)
+    {
+        warn!("blocked host {host} ({dst:?}), connection rejected");
+        return Ok(());
     }
 
     let host_matched = sni
@@ -382,7 +381,6 @@ fn force_full_mysekai(uri: &Uri) -> Option<Uri> {
     Uri::try_from(format!("{}?{}", uri.path(), query).as_str()).ok()
 }
 
-
 #[derive(serde::Deserialize, Debug, Clone)]
 pub struct StepSpec {
     pub id: String,
@@ -450,9 +448,16 @@ impl ProxyConfig {
             None
         } else {
             let pass = url.password().unwrap_or("");
-            Some(base64_encode(format!("{}:{}", url.username(), pass).as_bytes()))
+            Some(base64_encode(
+                format!("{}:{}", url.username(), pass).as_bytes(),
+            ))
         };
-        Ok(Some(Self { tls, host, port, auth }))
+        Ok(Some(Self {
+            tls,
+            host,
+            port,
+            auth,
+        }))
     }
 }
 
@@ -473,7 +478,9 @@ struct Upstream {
 
 impl Upstream {
     fn new(proxy: Option<ProxyConfig>) -> Self {
-        Self { proxy: proxy.map(Arc::new) }
+        Self {
+            proxy: proxy.map(Arc::new),
+        }
     }
 
     async fn connect(&self, dst: SocketAddr, host: Option<&str>) -> anyhow::Result<UpstreamIo> {
@@ -571,7 +578,7 @@ pub async fn run_session(
     let mut ip_stack = ipstack::IpStack::new(ipstack_config, tun_io);
     let mut bridge_tasks = JoinSet::new();
 
-    let tls_acceptor = build_tls_acceptor();
+    let tls_acceptor = build_tls_acceptor(target_hosts.clone());
     let upstream = Upstream::new(proxy);
 
     loop {