Add CONNECT support in transparent mode #7985
Open
+367
−21
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Enable handling of CONNECT requests in transparent mode for upstream proxy scenarios. Removes artificial validation blocking CONNECT and adds proper tunnel establishment. Includes optional allow_transparent_tunnel_inspection setting to choose between passthrough (default) and full TLS interception modes. Addresses: mitmproxy#6786
Contributor
|
Hi! I'm I would like to apply some automated changes to this pull request, but it looks like I don't have the necessary permissions to do so. To get this pull request into a mergeable state, please do one of the following two things:
|
…ly added option not generated by _options_gen.ts
…nnect with inspection - to improve test coverage
9781e3f to
99e5033
Compare
Author
|
Hi, just checking whether this needs anything else from my side. Happy to adjust if required. |
…allow 0.13.x versions
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Enable handling of CONNECT requests in transparent mode for upstream proxy scenarios. Removes artificial validation blocking CONNECT and adds proper tunnel establishment.
Adds a new (optional) boolean cmdline option
allow_transparent_tunnel_inspectionto choose between passthrough (default) and full MitM/TLS decryption/interception modes.Fixes: #3845
Potentially fixes: #6309
Addresses: #2813
Addresses: #6786
The new (PROXY CONNECT in transparent mode) sequence diagram
sequenceDiagram participant Client participant HttpStream participant UpstreamProxy participant ChildLayer Note over HttpStream: handle_connect_transparent() Client->>HttpStream: CONNECT Note over HttpStream: HttpConnectHook (addon event) HttpStream->>UpstreamProxy: RequestHeaders(end_stream=True) HttpStream->>UpstreamProxy: RequestEndOfMessage HttpStream->>ChildLayer: Create child_layer (not started)<br/>(NextLayer if inspection, TCPLayer if passthrough) Note over HttpStream: server_state = state_wait_for_tunnel_connect_response_headers Note over HttpStream: state_wait_for_tunnel_connect_response_headers() UpstreamProxy->>HttpStream: ResponseHeaders HttpStream->>Client: ResponseHeaders (forwarded) alt end_stream=True Note over HttpStream: → handle_tunnel_response_complete() else end_stream=False Note over HttpStream: → state_consume_tunnel_connect_response_body end Note over HttpStream: state_consume_tunnel_connect_response_body() UpstreamProxy->>HttpStream: ResponseData HttpStream->>Client: ResponseData (forwarded) Note right of HttpStream: (captured in response_body_buf) UpstreamProxy->>HttpStream: ResponseEndOfMessage Note right of HttpStream: (captures full body to flow.response.data.content) Note over HttpStream: → handle_tunnel_response_complete() Note over HttpStream: handle_tunnel_response_complete() alt SUCCESS (200-299) Note over HttpStream: HttpConnectedHook (addon event) Note over HttpStream: Activate passthrough mode (_handle_event = passthrough) Note over HttpStream: client_state = state_done Note over HttpStream: server_state = state_done HttpStream->>ChildLayer: Start child_layer (tunnel active)<br/>(TCPLayer for passthrough OR NextLayer for TLS inspection) HttpStream->>Client: ResponseEndOfMessage Note over Client,ChildLayer: TUNNEL ESTABLISHED - Traffic flows through child layer else ERROR (4xx/5xx) Note over HttpStream: HttpConnectErrorHook (addon event) Note over HttpStream: client_state = state_errored Note over HttpStream: server_state = state_errored Note over HttpStream: flow.live = False HttpStream->>Client: ResponseEndOfMessage Note over Client,ChildLayer: TUNNEL FAILED - child_layer created but never started endChecklist
Tested with direct connections (no proxy)
Tested with proxy, proxy+basic Auth, proxy+Kerberos
I have updated tests where applicable.
I have added an entry to the CHANGELOG.