1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
|
from typing import Optional, Sequence
from mitmproxy import optmanager
from mitmproxy.net import tls
log_verbosity = [
"error",
"warn",
"info",
"alert",
"debug",
]
CA_DIR = "~/.mitmproxy"
LISTEN_PORT = 8080
class Options(optmanager.OptManager):
if False:
# This provides type hints for IDEs (e.g. PyCharm) and mypy.
# Autogenerated using test/helper_tools/typehints_for_options.py
add_upstream_certs_to_client_chain = None # type: bool
body_size_limit = None # type: Optional[str]
cadir = None # type: str
certs = None # type: Sequence[str]
ciphers_client = None # type: Optional[str]
ciphers_server = None # type: Optional[str]
client_certs = None # type: Optional[str]
http2 = None # type: bool
http2_priority = None # type: bool
ignore_hosts = None # type: Sequence[str]
keep_host_header = None # type: bool
listen_host = None # type: str
listen_port = None # type: int
mode = None # type: str
rawtcp = None # type: bool
server = None # type: bool
showhost = None # type: bool
spoof_source_address = None # type: bool
ssl_insecure = None # type: bool
ssl_verify_upstream_trusted_ca = None # type: Optional[str]
ssl_verify_upstream_trusted_cadir = None # type: Optional[str]
ssl_version_client = None # type: str
ssl_version_server = None # type: str
tcp_hosts = None # type: Sequence[str]
upstream_bind_address = None # type: str
upstream_cert = None # type: bool
websocket = None # type: bool
# FIXME: Options that must be migrated to addons, but are complicated
# because they're used by more than one addon, or because they're
# embedded in the core code somehow.
verbosity = None # type: str
view_filter = None # type: Optional[str]
def __init__(self, **kwargs) -> None:
super().__init__()
self.add_option(
"server", bool, True,
"Start a proxy server. Enabled by default."
)
self.add_option(
"showhost", bool, False,
"Use the Host header to construct URLs for display."
)
self.add_option(
"verbosity", str, 'info',
"Log verbosity.",
choices=log_verbosity
)
# Proxy options
self.add_option(
"add_upstream_certs_to_client_chain", bool, False,
"""
Add all certificates of the upstream server to the certificate chain
that will be served to the proxy client, as extras.
"""
)
self.add_option(
"body_size_limit", Optional[str], None,
"""
Byte size limit of HTTP request and response bodies. Understands
k/m/g suffixes, i.e. 3m for 3 megabytes.
"""
)
self.add_option(
"cadir", str, CA_DIR,
"Location of the default mitmproxy CA files."
)
self.add_option(
"certs", Sequence[str], [],
"""
SSL certificates of the form "[domain=]path". The domain may include
a wildcard, and is equal to "*" if not specified. The file at path
is a certificate in PEM format. If a private key is included in the
PEM, it is used, else the default key in the conf dir is used. The
PEM file should contain the full certificate chain, with the leaf
certificate as the first entry.
"""
)
self.add_option(
"ciphers_client", Optional[str], None,
"Set supported ciphers for client connections using OpenSSL syntax."
)
self.add_option(
"ciphers_server", Optional[str], None,
"Set supported ciphers for server connections using OpenSSL syntax."
)
self.add_option(
"client_certs", Optional[str], None,
"Client certificate file or directory."
)
self.add_option(
"ignore_hosts", Sequence[str], [],
"""
Ignore host and forward all traffic without processing it. In
transparent mode, it is recommended to use an IP address (range),
not the hostname. In regular mode, only SSL traffic is ignored and
the hostname should be used. The supplied value is interpreted as a
regular expression and matched on the ip or the hostname.
"""
)
self.add_option(
"listen_host", str, "",
"Address to bind proxy to."
)
self.add_option(
"listen_port", int, LISTEN_PORT,
"Proxy service port."
)
self.add_option(
"upstream_bind_address", str, "",
"Address to bind upstream requests to."
)
self.add_option(
"mode", str, "regular",
"""
Mode can be "regular", "transparent", "socks5", "reverse:SPEC",
or "upstream:SPEC". For reverse and upstream proxy modes, SPEC
is host specification in the form of "http[s]://host[:port]".
"""
)
self.add_option(
"upstream_cert", bool, True,
"Connect to upstream server to look up certificate details."
)
self.add_option(
"keep_host_header", bool, False,
"""
Reverse Proxy: Keep the original host header instead of rewriting it
to the reverse proxy target.
"""
)
self.add_option(
"http2", bool, True,
"Enable/disable HTTP/2 support. "
"HTTP/2 support is enabled by default.",
)
self.add_option(
"http2_priority", bool, False,
"""
PRIORITY forwarding for HTTP/2 connections. Disabled by default to ensure compatibility
with misbehaving servers.
"""
)
self.add_option(
"websocket", bool, True,
"Enable/disable WebSocket support. "
"WebSocket support is enabled by default.",
)
self.add_option(
"rawtcp", bool, False,
"Enable/disable experimental raw TCP support. TCP connections starting with non-ascii "
"bytes are treated as if they would match tcp_hosts. The heuristic is very rough, use "
"with caution. Disabled by default. "
)
self.add_option(
"spoof_source_address", bool, False,
"""
Use the client's IP for server-side connections. Combine with
--upstream-bind-address to spoof a fixed source address.
"""
)
self.add_option(
"ssl_version_client", str, "secure",
"""
Set supported SSL/TLS versions for client connections. SSLv2, SSLv3
and 'all' are INSECURE. Defaults to secure, which is TLS1.0+.
""",
choices=list(tls.VERSION_CHOICES.keys()),
)
self.add_option(
"ssl_version_server", str, "secure",
"""
Set supported SSL/TLS versions for server connections. SSLv2, SSLv3
and 'all' are INSECURE. Defaults to secure, which is TLS1.0+.
""",
choices=list(tls.VERSION_CHOICES.keys()),
)
self.add_option(
"ssl_insecure", bool, False,
"Do not verify upstream server SSL/TLS certificates."
)
self.add_option(
"ssl_verify_upstream_trusted_cadir", Optional[str], None,
"""
Path to a directory of trusted CA certificates for upstream server
verification prepared using the c_rehash tool.
"""
)
self.add_option(
"ssl_verify_upstream_trusted_ca", Optional[str], None,
"Path to a PEM formatted trusted CA certificate."
)
self.add_option(
"tcp_hosts", Sequence[str], [],
"""
Generic TCP SSL proxy mode for all hosts that match the pattern.
Similar to --ignore, but SSL connections are intercepted. The
communication contents are printed to the log in verbose mode.
"""
)
self.add_option(
"view_filter", Optional[str], None,
"Limit which flows are displayed."
)
self.update(**kwargs)
|
