Follow-up from #802 (unknown_host = "inspect").
There is no http.host facet: rules see method, path, query,
headers and body, req.Host is not exposed, and http.headers["Host"]
is empty because http.ReadRequest moves it to req.Host. So a rule on
https.unknown cannot say "allow *.npmjs.org, deny the rest", which
is the obvious use of inspect.
Concrete consequence: the dashboard "Block" button on an inspected
request (cmd/clawpatrol/rulegen.go, httpRuleCondition) generates
endpoint = https.unknown with method + path only, so blocking
GET / on one unknown host blocks GET / on every unknown host, with
no warning in the UI.
Fix: plumb the SNI host into the https facet as http.host (the MITM
already forwards on the SNI, not the agent's Host header), teach
rulegen to include it for https.unknown, and document it in
rules.md.
Follow-up from #802 (
unknown_host = "inspect").There is no
http.hostfacet: rules see method, path, query,headers and body,
req.Hostis not exposed, andhttp.headers["Host"]is empty because
http.ReadRequestmoves it toreq.Host. So a rule onhttps.unknowncannot say "allow*.npmjs.org, deny the rest", whichis the obvious use of inspect.
Concrete consequence: the dashboard "Block" button on an inspected
request (
cmd/clawpatrol/rulegen.go,httpRuleCondition) generatesendpoint = https.unknownwith method + path only, so blockingGET /on one unknown host blocksGET /on every unknown host, withno warning in the UI.
Fix: plumb the SNI host into the https facet as
http.host(the MITMalready forwards on the SNI, not the agent's Host header), teach
rulegento include it forhttps.unknown, and document it inrules.md.