func (h *tlsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	if h.listener == nil {
		h.next.ServeHTTP(w, r)
		return
	}
	h.listener.helloInfosMu.RLock()
	info := h.listener.helloInfos[r.RemoteAddr]
	h.listener.helloInfosMu.RUnlock()
	ua := r.Header.Get("User-Agent")
	uaHash := telemetry.FastHash([]byte(ua))
	go telemetry.AppendUnique("tls_client_hello_ua:"+caskettls.ClientHelloInfo(info).Key(), uaHash)
	var checked, mitm bool
	if r.Header.Get("X-BlueCoat-Via") != "" ||  
		r.Header.Get("X-FCCKV2") != "" ||  
		info.advertisesHeartbeatSupport() {  
		checked = true
		mitm = true
	} else if strings.Contains(ua, "Edge") || strings.Contains(ua, "MSIE") ||
		strings.Contains(ua, "Trident") {
		checked = true
		mitm = !info.looksLikeEdge()
	} else if strings.Contains(ua, "Chrome") {
		checked = true
		mitm = !info.looksLikeChrome()
	} else if strings.Contains(ua, "CriOS") {
		checked = true
		mitm = !info.looksLikeChrome() && !info.looksLikeSafari()
	} else if strings.Contains(ua, "Firefox") {
		checked = true
		if strings.Contains(ua, "Windows") {
			ver := getVersion(ua, "Firefox")
			if ver == 45.0 || ver == 52.0 {
				mitm = !info.looksLikeTor()
			} else {
				mitm = !info.looksLikeFirefox()
			}
		} else {
			mitm = !info.looksLikeFirefox()
		}
	} else if strings.Contains(ua, "Safari") {
		checked = true
		mitm = !info.looksLikeSafari()
	}
	if checked {
		r = r.WithContext(context.WithValue(r.Context(), MitmCtxKey, mitm))
		if mitm {
			go telemetry.AppendUnique("http_mitm", "likely")
		} else {
			go telemetry.AppendUnique("http_mitm", "unlikely")
		}
	} else {
		go telemetry.AppendUnique("http_mitm", "unknown")
	}
	if mitm && h.closeOnMITM {
		r.Close = true
		return
	}
	h.next.ServeHTTP(w, r)
}
ServeHTTP checks the User-Agent. For the four main browsers (Chrome,
Edge, Firefox, and Safari) indicated by the User-Agent, the properties
of the TLS Client Hello will be compared. The context value "mitm" will
be set to a value indicating if it is likely that the underlying TLS
connection is being intercepted.

Note that due to Microsoft's decision to intentionally make IE/Edge
user agents obscure (and look like other browsers), this may offer
less accuracy for IE/Edge clients.

This MITM detection capability is based on research done by Durumeric,
Halderman, et. al. in "The Security Impact of HTTPS Interception" (NDSS '17):
https://jhalderm.com/pub/papers/interception-ndss17.pdf
package httpserver
import (
	"bytes"
	"context"
	"crypto/tls"
	"io"
	"net"
	"net/http"
	"strconv"
	"strings"
	"sync"
	"github.com/tmpim/casket/caskettls"
	"github.com/tmpim/casket/telemetry"
)
type tlsHandler struct {
	next        http.Handler
	listener    *tlsHelloListener
	closeOnMITM bool  
}