support to intercept mTLS protected traffics.

[fungaren]

Description

Currently we have options.client_certs as a per-site config to enable mTLS. However, when mitmproxy is working as a reverse proxy for a single server, there is no way for us to generate client certificates for each client.

This is a very common scenario in kubernetes clusters. The kube-apiserver is a REST server wtih RBAC enabled, where mTLS is used to indicate the user/client.

Currently mitmproxy have addons/tlsconfig.py, which is a good start point. But some configs are hard coded, other addons cannot override then. This commit also add a hook for tls_start_server & tls_start_client to override any config of the ssl context.

Last but not least, to generate a valid client certificate, we must add CLIENT_AUTH to ExtendedKeyUsage.

Checklist

• I have updated tests where applicable.
• I have added an entry to the CHANGELOG.

[mhils]

Thanks for the PR and the detailed explanation! This is a great contribution for contrib/, but I'm a bit hesistant to add callbacks here. See detailed comments below. 😃

[mhils]

Thanks! Please ignore the Codacy check, I'm in the process of setting that up properly.

[fungaren]

If the client didn't provide the client certificate, the server may refuse the connection, so it would be better to abort the connection. But I can not to find a way to achieve it. Is there any way to close the connection immediately in tls_start_server?

And, I found that even I never set the client certificate, it still provided a client cert for the server, so the server accepted the request:

        if client_certs and len(client_certs) > 0:
            # do something with SSL.context to use the client cert
        else:
            logging.info("tls_start_server: no client cert")

            def monkey_no_client_cert(context: SSL.Context, server: connection.Server):
                pass
            tlsconfig.use_client_cert = monkey_no_client_cert

        super().tls_start_server(data)

After browsing the codes (takes me about two days 😢) I finally found the reason is the LRU cache applied to create_proxy_server_context leads to the SSL context reuse.

https://github.com/mitmproxy/mitmproxy/blob/v8.1.1/mitmproxy/net/tls.py#L119

Currently the only way to address the problem is to create a new context by myself:

        if client_certs and len(client_certs) > 0:
            # do something with SSL.context to use the client cert
        else:
            logging.info("tls_start_server: no client cert")

            data.ssl_conn = SSL.Connection(SSL.Context(SSL.TLS_CLIENT_METHOD))
            data.ssl_conn.set_connect_state()
            return

[fungaren]

@mhils Hi, will you accept the PR?