250 lines
8.6 KiB
Python
250 lines
8.6 KiB
Python
|
from collections.abc import Sequence
|
||
|
|
from typing import Optional
|
||
|
|
|
||
|
|
from mitmproxy import optmanager
|
||
|
|
|
||
|
|
CONF_DIR = "~/.mitmproxy"
|
||
|
|
CONF_BASENAME = "mitmproxy"
|
||
|
|
CONTENT_VIEW_LINES_CUTOFF = 512
|
||
|
|
KEY_SIZE = 2048
|
||
|
|
|
||
|
|
|
||
|
|
class Options(optmanager.OptManager):
|
||
|
|
def __init__(self, **kwargs) -> None:
|
||
|
|
super().__init__()
|
||
|
|
self.add_option(
|
||
|
|
"server", bool, True, "Start a proxy server. Enabled by default."
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"showhost",
|
||
|
|
bool,
|
||
|
|
False,
|
||
|
|
"""Use the Host header to construct URLs for display.
|
||
|
|
|
||
|
|
This option is disabled by default because malicious apps may send misleading host headers to evade
|
||
|
|
your analysis. If this is not a concern, enable this options for better flow display.""",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"show_ignored_hosts",
|
||
|
|
bool,
|
||
|
|
False,
|
||
|
|
"""
|
||
|
|
Record ignored flows in the UI even if we do not perform TLS interception.
|
||
|
|
This option will keep ignored flows' contents in memory, which can greatly increase memory usage.
|
||
|
|
A future release will fix this issue, record ignored flows by default, and remove this option.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
|
||
|
|
# Proxy options
|
||
|
|
self.add_option(
|
||
|
|
"add_upstream_certs_to_client_chain",
|
||
|
|
bool,
|
||
|
|
False,
|
||
|
|
"""
|
||
|
|
Add all certificates of the upstream server to the certificate chain
|
||
|
|
that will be served to the proxy client, as extras.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"confdir",
|
||
|
|
str,
|
||
|
|
CONF_DIR,
|
||
|
|
"Location of the default mitmproxy configuration files.",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"certs",
|
||
|
|
Sequence[str],
|
||
|
|
[],
|
||
|
|
"""
|
||
|
|
SSL certificates of the form "[domain=]path". The domain may include
|
||
|
|
a wildcard, and is equal to "*" if not specified. The file at path
|
||
|
|
is a certificate in PEM format. If a private key is included in the
|
||
|
|
PEM, it is used, else the default key in the conf dir is used. The
|
||
|
|
PEM file should contain the full certificate chain, with the leaf
|
||
|
|
certificate as the first entry.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"cert_passphrase",
|
||
|
|
Optional[str],
|
||
|
|
None,
|
||
|
|
"""
|
||
|
|
Passphrase for decrypting the private key provided in the --cert option.
|
||
|
|
|
||
|
|
Note that passing cert_passphrase on the command line makes your passphrase visible in your system's
|
||
|
|
process list. Specify it in config.yaml to avoid this.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"client_certs", Optional[str], None, "Client certificate file or directory."
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"ignore_hosts",
|
||
|
|
Sequence[str],
|
||
|
|
[],
|
||
|
|
"""
|
||
|
|
Ignore host and forward all traffic without processing it. In
|
||
|
|
transparent mode, it is recommended to use an IP address (range),
|
||
|
|
not the hostname. In regular mode, only SSL traffic is ignored and
|
||
|
|
the hostname should be used. The supplied value is interpreted as a
|
||
|
|
regular expression and matched on the ip or the hostname.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
self.add_option("allow_hosts", Sequence[str], [], "Opposite of --ignore-hosts.")
|
||
|
|
self.add_option(
|
||
|
|
"listen_host",
|
||
|
|
str,
|
||
|
|
"",
|
||
|
|
"Address to bind proxy server(s) to (may be overridden for individual modes, see `mode`).",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"listen_port",
|
||
|
|
Optional[int],
|
||
|
|
None,
|
||
|
|
"Port to bind proxy server(s) to (may be overridden for individual modes, see `mode`). "
|
||
|
|
"By default, the port is mode-specific. The default regular HTTP proxy spawns on port 8080.",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"mode",
|
||
|
|
Sequence[str],
|
||
|
|
["regular"],
|
||
|
|
"""
|
||
|
|
The proxy server type(s) to spawn. Can be passed multiple times.
|
||
|
|
|
||
|
|
Mitmproxy supports "regular" (HTTP), "local", "transparent", "socks5", "reverse:SPEC",
|
||
|
|
"upstream:SPEC", and "wireguard[:PATH]" proxy servers. For reverse and upstream proxy modes, SPEC
|
||
|
|
is host specification in the form of "http[s]://host[:port]". For WireGuard mode, PATH may point to
|
||
|
|
a file containing key material. If no such file exists, it will be created on startup.
|
||
|
|
|
||
|
|
You may append `@listen_port` or `@listen_host:listen_port` to override `listen_host` or `listen_port` for
|
||
|
|
a specific proxy mode. Features such as client playback will use the first mode to determine
|
||
|
|
which upstream server to use.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"upstream_cert",
|
||
|
|
bool,
|
||
|
|
True,
|
||
|
|
"Connect to upstream server to look up certificate details.",
|
||
|
|
)
|
||
|
|
|
||
|
|
self.add_option(
|
||
|
|
"http2",
|
||
|
|
bool,
|
||
|
|
True,
|
||
|
|
"Enable/disable HTTP/2 support. HTTP/2 support is enabled by default.",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"http2_ping_keepalive",
|
||
|
|
int,
|
||
|
|
58,
|
||
|
|
"""
|
||
|
|
Send a PING frame if an HTTP/2 connection is idle for more than
|
||
|
|
the specified number of seconds to prevent the remote site from closing it.
|
||
|
|
Set to 0 to disable this feature.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"http3",
|
||
|
|
bool,
|
||
|
|
True,
|
||
|
|
"Enable/disable support for QUIC and HTTP/3. Enabled by default.",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"http_connect_send_host_header",
|
||
|
|
bool,
|
||
|
|
True,
|
||
|
|
"Include host header with CONNECT requests. Enabled by default.",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"websocket",
|
||
|
|
bool,
|
||
|
|
True,
|
||
|
|
"Enable/disable WebSocket support. "
|
||
|
|
"WebSocket support is enabled by default.",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"rawtcp",
|
||
|
|
bool,
|
||
|
|
True,
|
||
|
|
"Enable/disable raw TCP connections. "
|
||
|
|
"TCP connections are enabled by default. ",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"ssl_insecure",
|
||
|
|
bool,
|
||
|
|
False,
|
||
|
|
"""Do not verify upstream server SSL/TLS certificates.
|
||
|
|
|
||
|
|
If this option is enabled, certificate validation is skipped and mitmproxy itself will be vulnerable to
|
||
|
|
TLS interception.""",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"ssl_verify_upstream_trusted_confdir",
|
||
|
|
Optional[str],
|
||
|
|
None,
|
||
|
|
"""
|
||
|
|
Path to a directory of trusted CA certificates for upstream server
|
||
|
|
verification prepared using the c_rehash tool.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"ssl_verify_upstream_trusted_ca",
|
||
|
|
Optional[str],
|
||
|
|
None,
|
||
|
|
"Path to a PEM formatted trusted CA certificate.",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"tcp_hosts",
|
||
|
|
Sequence[str],
|
||
|
|
[],
|
||
|
|
"""
|
||
|
|
Generic TCP SSL proxy mode for all hosts that match the pattern.
|
||
|
|
Similar to --ignore-hosts, but SSL connections are intercepted.
|
||
|
|
The communication contents are printed to the log in verbose mode.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"udp_hosts",
|
||
|
|
Sequence[str],
|
||
|
|
[],
|
||
|
|
"""
|
||
|
|
Generic UDP SSL proxy mode for all hosts that match the pattern.
|
||
|
|
Similar to --ignore-hosts, but SSL connections are intercepted.
|
||
|
|
The communication contents are printed to the log in verbose mode.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"content_view_lines_cutoff",
|
||
|
|
int,
|
||
|
|
CONTENT_VIEW_LINES_CUTOFF,
|
||
|
|
"""
|
||
|
|
Flow content view lines limit. Limit is enabled by default to
|
||
|
|
speedup flows browsing.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"key_size",
|
||
|
|
int,
|
||
|
|
KEY_SIZE,
|
||
|
|
"""
|
||
|
|
TLS key size for certificates and CA.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"protobuf_definitions",
|
||
|
|
Optional[str],
|
||
|
|
None,
|
||
|
|
"Path to a .proto file that's used to resolve Protobuf field names when pretty-printing.",
|
||
|
|
)
|
||
|
|
self.add_option(
|
||
|
|
"tcp_timeout",
|
||
|
|
int,
|
||
|
|
600,
|
||
|
|
"""
|
||
|
|
Timeout in seconds for inactive TCP connections. Connections will be closed after this period of inactivity.
|
||
|
|
""",
|
||
|
|
)
|
||
|
|
|
||
|
|
self.update(**kwargs)
|