Mitmproxy 10: First Bits of HTTP/3!

2023-08-04 07:42:29

We’re comfortable to announce the discharge of mitmproxy 10, a free and open supply interactive HTTPS proxy.
This launch introduces experimental help for QUIC and HTTP/3 reverse proxies,
setting the stage for additional work on HTTP/3!

1, 2, … HTTP/3!

With HTTP/3 turning into more and more widespread, we’re excited to be the primary
debugging proxy to supply (experimental) help.
Whereas this performance is proscribed to reverse proxies for now, we’re wanting
ahead to getting some early suggestions and following up with clear interception
later this 12 months.

Beginning with this launch, it’s potential to run mitmproxy as an HTTP/3 server:

$ mitmproxy --mode reverse:http3://mitmproxy.org
$ curl --http3-only https://localhost:8080

Working the command above will make mitmproxy hear for UDP packets on port 8080,
parse them as HTTP/3 over QUIC, after which set up an HTTP/3 connection upstream as nicely.
Manuel Meitinger laid the QUIC and HTTP/3
foundations for this final 12 months throughout Google Summer season of Code,
and after quite a lot of testing, we’re lastly able to ship issues.

Observe that we’re nonetheless working with bleeding-edge options right here. Your cURL construct
seemingly gained’t have an --http3-only flag but. Chromium-based browsers and Firefox
usually anticipate an HTTP/2 -> HTTP/3 improve path, which we nonetheless have to help correctly.
Working each TCP and UDP HTTP proxies concurrently with
--mode reverse:http3://mitmproxy.org --mode reverse:https://mitmproxy.org
form of works, however we nonetheless want to enhance each reliability and UX right here going ahead.

Peeking into QUIC Streams

mitmproxy can now additionally proxy the uncooked QUIC transport protocol, on which HTTP/3 relies on.
This can be significantly helpful for builders who’re debugging their HTTP/3 implementations
or different QUIC-based protocols. By configuring a reverse proxy to quic://mitmproxy.org
(as an alternative of http3://... within the instance above), mitmproxy will proxy QUIC immediately,
not deciphering it as HTTP/3:

$ mitmdump --mode reverse:quic://mitmproxy.org --set flow_detail=3 
  --set dumper_default_contentview=hex
[19:34:09.876] reverse proxy to quic://mitmproxy.org listening at *:8080.
[19:34:11.845][127.0.0.1:53786] shopper join
[19:34:11.889][127.0.0.1:53786] server join mitmproxy.org:443 (18.155.129.5:443)
127.0.0.1:53786 -> quic stream 2 -> mitmproxy -> quic stream 2 -> mitmproxy.org:443

    0000000000 00 04 0d 06 ff ff ff ff ff ff ff ff 01 00 07 00   ................

The instance above then turns into a bit extra readable if we pretty-print the uncooked HTTP/3 body:

$ mitmdump --mode reverse:quic://mitmproxy.org --set flow_detail=3 
  --set dumper_default_contentview=http3
[19:36:06.040] reverse proxy to quic://mitmproxy.org listening at *:8080.
[19:36:08.660][127.0.0.1:54903] shopper join
[19:36:08.712][127.0.0.1:54903] server join mitmproxy.org:443 (18.155.129.5:443)
127.0.0.1:54903 -> quic stream 2 -> mitmproxy -> quic stream 2 -> mitmproxy.org:443

    Management Stream

    SETTINGS Body
    MAX_FIELD_SECTION_SIZE:   0x3fffffffffffffff
    QPACK_MAX_TABLE_CAPACITY: 0x0
    QPACK_BLOCKED_STREAMS:    0x0

Final however not least, if you happen to want to debug your connections in WireShark, mitmproxy’s
QUIC proxying additionally helps SSLKEYLOGFILE.
This lets you decrypt QUIC visitors in WireShark for functions that don’t help SSLKEYLOGFILE
natively.

This launch is delivered to you by… NLnet!

We’re very comfortable to announce that this launch kicks off a sequence of releases supported by the
NGI0 Entrust fund, a fund established by NLnet with monetary help
from the European Fee’s Next Generation Internet programme. ????

We now have at all times been very cautious about accepting funding for mitmproxy.
Be assured that this has not modified. We gained’t be including telemetry, there gained’t be adverts on the web site,
and we gained’t take VC funding subsequent. 🙂

Full Changelog

Add experimental help for HTTP/3 and QUIC.
(#5435, @meitinger)
ASGI/WSGI apps can now hear on all ports for a particular hostname.
This makes it easier to just accept each HTTP and HTTPS.
(#5725, @mhils)
Add replay.server.add command for including flows to server replay buffer
(#5851, @italankin)
Take away string escaping in uncooked view.
(#5470, @stephenspol)
Updating Request.port now additionally updates the Host header if current.
This aligns with Request.host, which already does this.
(#5908, @sujaldev)
Repair enhancing of multipart HTTP requests from the CLI.
(#5148, @mhils)
Add documentation on utilizing Magisk module for intercepting visitors in Android manufacturing builds.
(#5924, @Jurrie)
Repair a bug the place the route indicator within the message stream view could be within the incorrect route.
(#5921, @konradh)
Repair a bug the place peername could be None in tls_passthrough script, which might make it not working.
(#5904, @truebit)
the esc key can now be used to exit the present view
(#6087, @sujaldev)
focus-follow shortcut will now work in move view context too.
(#6088, @sujaldev)
Repair a bug the place a server connection timeout would trigger requests to be issued with a incorrect SNI in reverse proxy mode.
(#6148, @mhils)
The server_replay_nopop possibility has been renamed to server_replay_reuse to keep away from complicated double-negation.
(#6084, @prady0t, @Semnodime)
Add zstd to legitimate gRPC encoding schemes.
(#6188, @tsaaristo)
For reverse proxy immediately accessed by way of IP handle, the IP handle is now included
as a topic within the generated certificates.
(#6202, @mhils)
Allow legacy SSL join when connecting to server if the ssl_insecure flag is about.
(#6281, @DurandA)
Change wording within the http-reply-from-proxy.py example.
(#6117, @Semnodime)
Added choice to specify an elliptic curve for key alternate between mitmproxy <-> server
(#6170, @Mike-Ki-ASD)
Add “Prettier” code linting software to mitmweb.
(#5985, @alexgershberg)
When logging exceptions, present your entire exception object to log handlers
(#6295, @mhils)
mitmproxy now requires Python 3.10 or above.
(#5954, @mhils)

Deprecations

The onboarding_port possibility has been eliminated. The onboarding app now responds
to all requests for the hostname laid out in onboarding_host.
connection.Shopper and connection.Server now settle for key phrase arguments solely.
This can be a breaking change for customized addons that use these courses immediately.

Source Link