2025-12-25 upload
This commit is contained in:
“shengyudong”
249
venv/Lib/site-packages/mitmproxy/options.py
Normal file
249
venv/Lib/site-packages/mitmproxy/options.py
Normal file
@@ -0,0 +1,249 @@
|
||||
from collections.abc import Sequence
|
||||
from typing import Optional
|
||||
|
||||
from mitmproxy import optmanager
|
||||
|
||||
CONF_DIR = "~/.mitmproxy"
|
||||
CONF_BASENAME = "mitmproxy"
|
||||
CONTENT_VIEW_LINES_CUTOFF = 512
|
||||
KEY_SIZE = 2048
|
||||
|
||||
|
||||
class Options(optmanager.OptManager):
|
||||
def __init__(self, **kwargs) -> None:
|
||||
super().__init__()
|
||||
self.add_option(
|
||||
"server", bool, True, "Start a proxy server. Enabled by default."
|
||||
)
|
||||
self.add_option(
|
||||
"showhost",
|
||||
bool,
|
||||
False,
|
||||
"""Use the Host header to construct URLs for display.
|
||||
|
||||
This option is disabled by default because malicious apps may send misleading host headers to evade
|
||||
your analysis. If this is not a concern, enable this options for better flow display.""",
|
||||
)
|
||||
self.add_option(
|
||||
"show_ignored_hosts",
|
||||
bool,
|
||||
False,
|
||||
"""
|
||||
Record ignored flows in the UI even if we do not perform TLS interception.
|
||||
This option will keep ignored flows' contents in memory, which can greatly increase memory usage.
|
||||
A future release will fix this issue, record ignored flows by default, and remove this option.
|
||||
""",
|
||||
)
|
||||
|
||||
# Proxy options
|
||||
self.add_option(
|
||||
"add_upstream_certs_to_client_chain",
|
||||
bool,
|
||||
False,
|
||||
"""
|
||||
Add all certificates of the upstream server to the certificate chain
|
||||
that will be served to the proxy client, as extras.
|
||||
""",
|
||||
)
|
||||
self.add_option(
|
||||
"confdir",
|
||||
str,
|
||||
CONF_DIR,
|
||||
"Location of the default mitmproxy configuration files.",
|
||||
)
|
||||
self.add_option(
|
||||
"certs",
|
||||
Sequence[str],
|
||||
[],
|
||||
"""
|
||||
SSL certificates of the form "[domain=]path". The domain may include
|
||||
a wildcard, and is equal to "*" if not specified. The file at path
|
||||
is a certificate in PEM format. If a private key is included in the
|
||||
PEM, it is used, else the default key in the conf dir is used. The
|
||||
PEM file should contain the full certificate chain, with the leaf
|
||||
certificate as the first entry.
|
||||
""",
|
||||
)
|
||||
self.add_option(
|
||||
"cert_passphrase",
|
||||
Optional[str],
|
||||
None,
|
||||
"""
|
||||
Passphrase for decrypting the private key provided in the --cert option.
|
||||
|
||||
Note that passing cert_passphrase on the command line makes your passphrase visible in your system's
|
||||
process list. Specify it in config.yaml to avoid this.
|
||||
""",
|
||||
)
|
||||
self.add_option(
|
||||
"client_certs", Optional[str], None, "Client certificate file or directory."
|
||||
)
|
||||
self.add_option(
|
||||
"ignore_hosts",
|
||||
Sequence[str],
|
||||
[],
|
||||
"""
|
||||
Ignore host and forward all traffic without processing it. In
|
||||
transparent mode, it is recommended to use an IP address (range),
|
||||
not the hostname. In regular mode, only SSL traffic is ignored and
|
||||
the hostname should be used. The supplied value is interpreted as a
|
||||
regular expression and matched on the ip or the hostname.
|
||||
""",
|
||||
)
|
||||
self.add_option("allow_hosts", Sequence[str], [], "Opposite of --ignore-hosts.")
|
||||
self.add_option(
|
||||
"listen_host",
|
||||
str,
|
||||
"",
|
||||
"Address to bind proxy server(s) to (may be overridden for individual modes, see `mode`).",
|
||||
)
|
||||
self.add_option(
|
||||
"listen_port",
|
||||
Optional[int],
|
||||
None,
|
||||
"Port to bind proxy server(s) to (may be overridden for individual modes, see `mode`). "
|
||||
"By default, the port is mode-specific. The default regular HTTP proxy spawns on port 8080.",
|
||||
)
|
||||
self.add_option(
|
||||
"mode",
|
||||
Sequence[str],
|
||||
["regular"],
|
||||
"""
|
||||
The proxy server type(s) to spawn. Can be passed multiple times.
|
||||
|
||||
Mitmproxy supports "regular" (HTTP), "local", "transparent", "socks5", "reverse:SPEC",
|
||||
"upstream:SPEC", and "wireguard[:PATH]" proxy servers. For reverse and upstream proxy modes, SPEC
|
||||
is host specification in the form of "http[s]://host[:port]". For WireGuard mode, PATH may point to
|
||||
a file containing key material. If no such file exists, it will be created on startup.
|
||||
|
||||
You may append `@listen_port` or `@listen_host:listen_port` to override `listen_host` or `listen_port` for
|
||||
a specific proxy mode. Features such as client playback will use the first mode to determine
|
||||
which upstream server to use.
|
||||
""",
|
||||
)
|
||||
self.add_option(
|
||||
"upstream_cert",
|
||||
bool,
|
||||
True,
|
||||
"Connect to upstream server to look up certificate details.",
|
||||
)
|
||||
|
||||
self.add_option(
|
||||
"http2",
|
||||
bool,
|
||||
True,
|
||||
"Enable/disable HTTP/2 support. HTTP/2 support is enabled by default.",
|
||||
)
|
||||
self.add_option(
|
||||
"http2_ping_keepalive",
|
||||
int,
|
||||
58,
|
||||
"""
|
||||
Send a PING frame if an HTTP/2 connection is idle for more than
|
||||
the specified number of seconds to prevent the remote site from closing it.
|
||||
Set to 0 to disable this feature.
|
||||
""",
|
||||
)
|
||||
self.add_option(
|
||||
"http3",
|
||||
bool,
|
||||
True,
|
||||
"Enable/disable support for QUIC and HTTP/3. Enabled by default.",
|
||||
)
|
||||
self.add_option(
|
||||
"http_connect_send_host_header",
|
||||
bool,
|
||||
True,
|
||||
"Include host header with CONNECT requests. Enabled by default.",
|
||||
)
|
||||
self.add_option(
|
||||
"websocket",
|
||||
bool,
|
||||
True,
|
||||
"Enable/disable WebSocket support. "
|
||||
"WebSocket support is enabled by default.",
|
||||
)
|
||||
self.add_option(
|
||||
"rawtcp",
|
||||
bool,
|
||||
True,
|
||||
"Enable/disable raw TCP connections. "
|
||||
"TCP connections are enabled by default. ",
|
||||
)
|
||||
self.add_option(
|
||||
"ssl_insecure",
|
||||
bool,
|
||||
False,
|
||||
"""Do not verify upstream server SSL/TLS certificates.
|
||||
|
||||
If this option is enabled, certificate validation is skipped and mitmproxy itself will be vulnerable to
|
||||
TLS interception.""",
|
||||
)
|
||||
self.add_option(
|
||||
"ssl_verify_upstream_trusted_confdir",
|
||||
Optional[str],
|
||||
None,
|
||||
"""
|
||||
Path to a directory of trusted CA certificates for upstream server
|
||||
verification prepared using the c_rehash tool.
|
||||
""",
|
||||
)
|
||||
self.add_option(
|
||||
"ssl_verify_upstream_trusted_ca",
|
||||
Optional[str],
|
||||
None,
|
||||
"Path to a PEM formatted trusted CA certificate.",
|
||||
)
|
||||
self.add_option(
|
||||
"tcp_hosts",
|
||||
Sequence[str],
|
||||
[],
|
||||
"""
|
||||
Generic TCP SSL proxy mode for all hosts that match the pattern.
|
||||
Similar to --ignore-hosts, but SSL connections are intercepted.
|
||||
The communication contents are printed to the log in verbose mode.
|
||||
""",
|
||||
)
|
||||
self.add_option(
|
||||
"udp_hosts",
|
||||
Sequence[str],
|
||||
[],
|
||||
"""
|
||||
Generic UDP SSL proxy mode for all hosts that match the pattern.
|
||||
Similar to --ignore-hosts, but SSL connections are intercepted.
|
||||
The communication contents are printed to the log in verbose mode.
|
||||
""",
|
||||
)
|
||||
self.add_option(
|
||||
"content_view_lines_cutoff",
|
||||
int,
|
||||
CONTENT_VIEW_LINES_CUTOFF,
|
||||
"""
|
||||
Flow content view lines limit. Limit is enabled by default to
|
||||
speedup flows browsing.
|
||||
""",
|
||||
)
|
||||
self.add_option(
|
||||
"key_size",
|
||||
int,
|
||||
KEY_SIZE,
|
||||
"""
|
||||
TLS key size for certificates and CA.
|
||||
""",
|
||||
)
|
||||
self.add_option(
|
||||
"protobuf_definitions",
|
||||
Optional[str],
|
||||
None,
|
||||
"Path to a .proto file that's used to resolve Protobuf field names when pretty-printing.",
|
||||
)
|
||||
self.add_option(
|
||||
"tcp_timeout",
|
||||
int,
|
||||
600,
|
||||
"""
|
||||
Timeout in seconds for inactive TCP connections. Connections will be closed after this period of inactivity.
|
||||
""",
|
||||
)
|
||||
|
||||
self.update(**kwargs)
|
||||
Reference in New Issue
Block a user