Add tests covering TLS impersonation

Author: pimterry

test/distributables-test/unix.sh

@@ -32,6 +32,12 @@ echo "\nCan start a Mockttp server"?
 curl $CURL_OPTIONS "$WITH_ORIGIN" "$AS_JSON" 'http://127.0.0.1:45456/start' \
     --data '{"plugins":{"http":{"options":{"cors":false,"suggestChanges":false,"http2":"fallback","https":{"tlsPassthrough":[]}}},"webrtc":{}}}'
 
+echo "\nIs TLS fingerprint mirroring available?"
+# The UI turns mirroring on for every passthrough rule, but it needs tls-impersonate: an
+# optional native module that the bundle requires externally, so it's easily lost when
+# packaging. Resolve it exactly as the bundle does, and check the native addon loads.
+./httptoolkit-server/bin/node -e "if (!require(require.resolve('tls-impersonate', { paths: ['./httptoolkit-server/bundle'] })).isSupported()) { console.error('TLS fingerprint mirroring is unavailable in this build'); process.exit(1); }"
+
 echo "\nCan query the API server version?"
 curl $CURL_OPTIONS "$WITH_ORIGIN" http://127.0.0.1:45457/version
 

test/distributables-test/windows.bat

@@ -45,6 +45,14 @@ curl %CURL_OPTIONS% %WITH_ORIGIN% %AS_JSON% -X POST "http://127.0.0.1:45456/star
   --data "{\"plugins\":{\"http\":{\"options\":{\"cors\":false,\"suggestChanges\":false,\"http2\":\"fallback\",\"https\":{\"tlsPassthrough\":[]}}},\"webrtc\":{}}}" ^
   || goto :error`
 
+echo:
+echo:
+echo Is TLS fingerprint mirroring available?
+REM The UI turns mirroring on for every passthrough rule, but it needs tls-impersonate: an
+REM optional native module that the bundle requires externally, so it's easily lost when
+REM packaging. Resolve it exactly as the bundle does, and check the native addon loads.
+.\httptoolkit-server\bin\node.exe -e "if (!require(require.resolve('tls-impersonate', { paths: ['./httptoolkit-server/bundle'] })).isSupported()) { console.error('TLS fingerprint mirroring is unavailable in this build'); process.exit(1); }" || goto :error
+
 echo:
 echo:
 echo Can query the API server version?

test/integration/e2e-api-test.spec.ts

@@ -1,5 +1,6 @@
 import * as _ from 'lodash';
 import { spawn, execFile, ChildProcess } from 'child_process';
+import * as https from 'https';
 import * as path from 'path';
 
 import { delay } from '@httptoolkit/util';
@@ -57,6 +58,22 @@ const hasExited = (process: ChildProcess) => {
         process.signalCode !== null;
 };
 
+// Reports the TLS fingerprint of the client hello it received:
+const FINGERPRINT_HOST = 'https://testserver.host';
+const FINGERPRINT_PATH = '/tls/fingerprint';
+
+// Check the fingerprint when sending a custom cipher list (should be custom fingerprint)
+const getSeenFingerprint = async (url: string) => {
+    const response = await fetch(url, {
+        agent: new https.Agent({
+            rejectUnauthorized: false, // Mockttp intercepts this with its own CA
+            ciphers: 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:AES256-SHA'
+        })
+    });
+    const { ja4 } = await response.json() as { ja4: string };
+    return ja4;
+};
+
 describe('End-to-end server API test', function () {
     // Timeout needs to be long, as first test runs (e.g. in CI) generate
     // fresh certificates, which can take a little while.
@@ -490,4 +507,43 @@ describe('End-to-end server API test', function () {
             expect(_.omit(responseEvents[3], 'timestamp')).to.deep.equal({ type: 'response-end' });
         });
     })
+
+    // This verifies that tls-impersonate (bundled native module) is working correctly: 
+    describe('mirroring TLS fingerprints upstream', () => {
+
+        const mockttp = getRemote({
+            adminServerUrl: 'http://localhost:45456',
+            client: {
+                // Pretend to be a browser on the real site:
+                headers: { origin: 'https://app.httptoolkit.tech' }
+            }
+        });
+
+        beforeEach(() => mockttp.start());
+        afterEach(() => mockttp.stop());
+
+        const getUpstreamFingerprint = async (mirrorTlsFingerprint: boolean) => {
+            await mockttp.forAnyRequest().thenForwardTo(FINGERPRINT_HOST, { mirrorTlsFingerprint });
+            return getSeenFingerprint(
+                mockttp.url.replace('http:', 'https:') + FINGERPRINT_PATH
+            );
+        };
+
+        it('reproduces our fingerprint upstream', async () => {
+            expect(await getUpstreamFingerprint(true)).to.equal(
+                await getSeenFingerprint(FINGERPRINT_HOST + FINGERPRINT_PATH),
+                "Upstream JA4 should match our own - if it doesn't, the tls-impersonate " +
+                'native module is probably missing from this build'
+            );
+        });
+
+        it('sends its own fingerprint when mirroring is off', async () => {
+            // Confirms the test above can't pass for trivial reasons:
+            expect(await getUpstreamFingerprint(false)).not.to.equal(
+                await getSeenFingerprint(FINGERPRINT_HOST + FINGERPRINT_PATH)
+            );
+        });
+
+    });
+
 });