FilesExpand file tree

 language

/

options.py

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

165 lines (155 loc) · 5.94 KB

 language

/

options.py

Copy path

Top

File metadata and controls

• Code
• Blame

165 lines (155 loc) · 5.94 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

from typing import Optional, Sequence

from mitmproxy import optmanager

from mitmproxy.net import tls

CONF_DIR = "~/.mitmproxy"

LISTEN_PORT = 8080

class Options(optmanager.OptManager):

def __init__(self, **kwargs) -> None:

super().__init__()

self.add_option(

"server", bool, True,

"Start a proxy server. Enabled by default."

)

self.add_option(

"showhost", bool, False,

"Use the Host header to construct URLs for display."

)

# Proxy options

self.add_option(

"add_upstream_certs_to_client_chain", bool, False,

"""

Add all certificates of the upstream server to the certificate chain

that will be served to the proxy client, as extras.

"""

)

self.add_option(

"confdir", str, CONF_DIR,

"Location of the default mitmproxy configuration files."

)

self.add_option(

"certs", Sequence[str], [],

"""

SSL certificates of the form "[domain=]path". The domain may include

a wildcard, and is equal to "*" if not specified. The file at path

is a certificate in PEM format. If a private key is included in the

PEM, it is used, else the default key in the conf dir is used. The

PEM file should contain the full certificate chain, with the leaf

certificate as the first entry.

"""

)

self.add_option(

"ciphers_client", Optional[str], None,

"Set supported ciphers for client connections using OpenSSL syntax."

)

self.add_option(

"ciphers_server", Optional[str], None,

"Set supported ciphers for server connections using OpenSSL syntax."

)

self.add_option(

"client_certs", Optional[str], None,

"Client certificate file or directory."

)

self.add_option(

"ignore_hosts", Sequence[str], [],

"""

Ignore host and forward all traffic without processing it. In

transparent mode, it is recommended to use an IP address (range),

not the hostname. In regular mode, only SSL traffic is ignored and

the hostname should be used. The supplied value is interpreted as a

regular expression and matched on the ip or the hostname.

"""

)

self.add_option(

"listen_host", str, "",

"Address to bind proxy to."

)

self.add_option(

"listen_port", int, LISTEN_PORT,

"Proxy service port."

)

self.add_option(

"upstream_bind_address", str, "",

"Address to bind upstream requests to."

)

self.add_option(

"mode", str, "regular",

"""

Mode can be "regular", "transparent", "socks5", "reverse:SPEC",

or "upstream:SPEC". For reverse and upstream proxy modes, SPEC

is host specification in the form of "http[s]://host[:port]".

"""

)

self.add_option(

"upstream_cert", bool, True,

"Connect to upstream server to look up certificate details."

)

self.add_option(

"http2", bool, True,

"Enable/disable HTTP/2 support. "

"HTTP/2 support is enabled by default.",

)

self.add_option(

"http2_priority", bool, False,

"""

PRIORITY forwarding for HTTP/2 connections. Disabled by default to ensure compatibility

with misbehaving servers.

"""

)

self.add_option(

"websocket", bool, True,

"Enable/disable WebSocket support. "

"WebSocket support is enabled by default.",

)

self.add_option(

"rawtcp", bool, False,

"Enable/disable experimental raw TCP support. TCP connections starting with non-ascii "

"bytes are treated as if they would match tcp_hosts. The heuristic is very rough, use "

"with caution. Disabled by default. "

)

self.add_option(

"spoof_source_address", bool, False,

"""

Use the client's IP for server-side connections. Combine with

--upstream-bind-address to spoof a fixed source address.

"""

)

self.add_option(

"ssl_version_client", str, "secure",

"""

Set supported SSL/TLS versions for client connections. SSLv2, SSLv3

and 'all' are INSECURE. Defaults to secure, which is TLS1.0+.

""",

choices=list(tls.VERSION_CHOICES.keys()),

)

self.add_option(

"ssl_version_server", str, "secure",

"""

Set supported SSL/TLS versions for server connections. SSLv2, SSLv3

and 'all' are INSECURE. Defaults to secure, which is TLS1.0+.

""",

choices=list(tls.VERSION_CHOICES.keys()),

)

self.add_option(

"ssl_insecure", bool, False,

"Do not verify upstream server SSL/TLS certificates."

)

self.add_option(

"ssl_verify_upstream_trusted_confdir", Optional[str], None,

"""

Path to a directory of trusted CA certificates for upstream server

verification prepared using the c_rehash tool.

"""

)

self.add_option(

"ssl_verify_upstream_trusted_ca", Optional[str], None,

"Path to a PEM formatted trusted CA certificate."

)

self.add_option(

"tcp_hosts", Sequence[str], [],

"""

Generic TCP SSL proxy mode for all hosts that match the pattern.

Similar to --ignore, but SSL connections are intercepted. The

communication contents are printed to the log in verbose mode.

"""

)

self.update(**kwargs)