Make mitm work as a transparent proxy

.gitignore

@@ -0,0 +1 @@
+*.pem

cert.go

@@ -11,6 +11,7 @@ import (
 	"errors"
 	"fmt"
 	"math/big"
+	"net"
 	"time"
 )
 
@@ -27,46 +28,8 @@ const (
 	leafUsage = caUsage
 )
 
-func genCert(ca *tls.Certificate, names []string) (*tls.Certificate, error) {
-	now := time.Now().Add(-1 * time.Hour).UTC()
-	if !ca.Leaf.IsCA {
-		return nil, errors.New("CA cert is not a CA")
-	}
-	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
-	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
-	if err != nil {
-		return nil, fmt.Errorf("failed to generate serial number: %s", err)
-	}
-	tmpl := &x509.Certificate{
-		SerialNumber:          serialNumber,
-		Subject:               pkix.Name{CommonName: names[0]},
-		NotBefore:             now,
-		NotAfter:              now.Add(leafMaxAge),
-		KeyUsage:              leafUsage,
-		BasicConstraintsValid: true,
-		DNSNames:              names,
-		SignatureAlgorithm:    x509.ECDSAWithSHA512,
-	}
-	key, err := genKeyPair()
-	if err != nil {
-		return nil, err
-	}
-	x, err := x509.CreateCertificate(rand.Reader, tmpl, ca.Leaf, key.Public(), ca.PrivateKey)
-	if err != nil {
-		return nil, err
-	}
-	cert := new(tls.Certificate)
-	cert.Certificate = append(cert.Certificate, x)
-	cert.PrivateKey = key
-	cert.Leaf, _ = x509.ParseCertificate(x)
-	return cert, nil
-}
-
-func genKeyPair() (*ecdsa.PrivateKey, error) {
-	return ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
-}
-
-func GenCA(name string) (certPEM, keyPEM []byte, err error) {
+// GenerateCA generates a CA cert and key pair.
+func GenerateCA(name string) (certPEM, keyPEM []byte, err error) {
 	now := time.Now().UTC()
 	tmpl := &x509.Certificate{
 		SerialNumber:          big.NewInt(1),
@@ -101,3 +64,51 @@ func GenCA(name string) (certPEM, keyPEM []byte, err error) {
 	})
 	return
 }
+
+// GenerateCert generates a leaf cert from ca.
+func GenerateCert(ca *tls.Certificate, hosts ...string) (*tls.Certificate, error) {
+	now := time.Now().Add(-1 * time.Hour).UTC()
+	if !ca.Leaf.IsCA {
+		return nil, errors.New("CA cert is not a CA")
+	}
+	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate serial number: %s", err)
+	}
+	template := &x509.Certificate{
+		SerialNumber:          serialNumber,
+		Subject:               pkix.Name{CommonName: hosts[0]},
+		NotBefore:             now,
+		NotAfter:              now.Add(leafMaxAge),
+		KeyUsage:              leafUsage,
+		BasicConstraintsValid: true,
+		SignatureAlgorithm:    x509.ECDSAWithSHA512,
+	}
+
+	for _, h := range hosts {
+		if ip := net.ParseIP(h); ip != nil {
+			template.IPAddresses = append(template.IPAddresses, ip)
+		} else {
+			template.DNSNames = append(template.DNSNames, h)
+		}
+	}
+
+	key, err := genKeyPair()
+	if err != nil {
+		return nil, err
+	}
+	x, err := x509.CreateCertificate(rand.Reader, template, ca.Leaf, key.Public(), ca.PrivateKey)
+	if err != nil {
+		return nil, err
+	}
+	cert := new(tls.Certificate)
+	cert.Certificate = append(cert.Certificate, x)
+	cert.PrivateKey = key
+	cert.Leaf, _ = x509.ParseCertificate(x)
+	return cert, nil
+}
+
+func genKeyPair() (*ecdsa.PrivateKey, error) {
+	return ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+}