5 ms·

mitmproxy dev here, happy to answer questions once I'm back home later! :)

by mhils 4y ago

Avicebron 4y ago
First of all thanks! Not sure if you know any of the Linux maintainers, but if you do I'd love to know how to get in touch with some of them.
- mhils 4y ago
  Are you looking for mitmproxy-on-linux maintainers, or Linux kernel maintainers? You have found the former I suppose, but I'm the wrong person to ask for the latter. :)
  - Avicebron 4y ago
    I was looking for a quick way to update my version from the command line (ubuntu), but --options didn't show anything off hand like an --update/--upgrade. I just briefly skimmed the docs/google for something that would avoid having to reinstall the binary. EDIT: also is there a way to configure the IDE that pops up when I go to edit path? It's vim which is fine, I'm just curious if I can either integrate a custom vim installation or route it to another IDE.
    - mhils 4y ago
      The recommended way to install mitmproxy on Linux is to download new standalone binaries. They are self-contained and can just be dropped into /usr/local/bin. If you want some way to update automatically, use our Docker images, install via pipx (https://docs.mitmproxy.org/stable/overview-installation/#installation-from-the-python-package-index-pypi https://docs.mitmproxy.org/stable/overview-installation/#ins...), or (for Windows users) use the Microsoft Store. > also is there a way to configure the IDE that pops up when I go to edit path? You can set $MITMPROXY_EDITOR or more generally $EDITOR. :)
clumsysmurf 4y ago
Thanks for creating awesome software. Being able to script it with python is amazing. One problem I have been having on MacOS with Android emulator: proxying traffic from the emulator (my own app) will work for about 15 minutes or so... then all traffic ceases to flow, and Emulator / Setting / "AndroidWifi" says limited connectivity. If I forget AndroidWifi access point, re-add it, and restart, it all works again for about 15 minutes. Any ideas how I would debug this?
- mhils 4y ago
  Hard to say without more details. Once you reach that limited connectivity state, do you see anything that stands out in the mitmproxy event log? Feel free to open a thread at https://github.com/mitmproxy/mitmproxy/discussions https://github.com/mitmproxy/mitmproxy/discussions and I'm happy to help a bit more! Also it would be interesting to know if you observe the same thing with our new WireGuard mode. :)
codethief 4y ago
First of all, thank you for all your work on mitmproxy! :) Could you elaborate on how exactly the WireGuard mode works compared to e.g. TLS interception? After all, WG doesn't come with certificate authorities or anything like that.
- mhils 4y ago
  WireGuard mode does not help with interception, it helps with getting traffic into mitmproxy. Put differently, it's a user-friendly alternative to 1. configuring an explicit HTTP proxy in your system settings, or 2. fiddling with iptables on your router and/or your mitmproxy device. The downside of 1) is that it does not work for UDP-based traffic such as DNS and can often be easily bypassed by applications. The downside of 2) is that it's generally fiddly and does not work very well for users with consumer routers (no iptables). In all cases you still need to install a trusted mitmproxy CA for TLS interception, that part does not change with WireGuard mode. :)
  - codethief 4y ago
    Sorry, I'm not following. With e.g. HTTPS traffic all I have to do is make sure that the browser sends all its traffic through 127.0.0.1:8080 and trusts mitmproxy's certificate. In that case, mitmproxy will show me the plaintext traffic. Now, let's say I've set up WireGuard with three peers, i.e. each of these peer's public key appears in my WireGuard config along with an IP address. Now I start sending traffic to one of these IP addresses which WG would normally encrypt and then route directly to the peer in question. How can mitmproxy's WG mode help me here with "getting [the encrypted] traffic into mitmproxy", as you say, and reading the plaintext?
    - mhils 4y ago
      Suppose you have an Android device for which you want to see all traffic. You could configure an HTTP proxy in your system settings, but this does not capture any UDP-based protocols. Additionally, apps may choose to ignore the proxy settings and it's hard to tell if they do. To overcome these shortcomings, we now have WireGuard mode: Mitmproxy spawns a WireGuard server on startup (instead of an HTTP proxy listener). Now you don't set a proxy on your device, but you configure your device to use WireGuard with a config that sends all traffic to mitmproxy. mitmproxy then transparently intercepts all requests that are coming through that WireGuard tunnel (the device still needs to trust the mitmproxy CA). Put differently, instead of using an explicit proxy configuration or something like iptables to route packets to mitmproxy, you use a VPN (WireGuard). The benefits are: - You can intercept/modify UDP, in particular DNS. - You avoid the "apps ignore proxy settings" problem. - On Android specifically, the WireGuard app allows you to only proxy specific apps (not possible with a global proxy config) Does that make more sense now? We also have a bit more documentation at https://docs.mitmproxy.org/stable/concepts-modes/#wireguard-transparent-proxy https://docs.mitmproxy.org/stable/concepts-modes/#wireguard-....
dur-randir 4y ago
I've inadvertently tried this mode yesterday, even before the announcement was made, but found that something weird was going on: - it eats tons and tons of CPU, like this is a common picture 6568 root 20 0 7357216 3.2g 20072 R 109.6 1.3 6:10.60 mitmweb - lots of packets dropped, sometimes at a considerable rate [14:38:33.501] Dropping incoming packet, TCP channel is full. This isn't me running some http-hungry application, just immediately after the phone restart. I'm running mitmproxy 9.0.0 installed through pip on Linux with python 3.9.2. Unfortunately it's not easy for me to try any other mode - i've first tried setting up transparent proxy on MacOS, but ssl bindings crash on M1.
- mhils 4y ago
  This really shouldn't be the case. What kind of client are you using? Could you open an issue over at https://github.com/mitmproxy/mitmproxy/issues https://github.com/mitmproxy/mitmproxy/issues please?
  - dur-randir 4y ago
    Done. Mobile client is the official WireGuard mobile client.

mitmproxy dev here, happy to answer questions once I'm back home later! :)

by mhils 4y ago

mitmproxy dev here, happy to answer questions once I'm back home later! :)

First of all thanks! Not sure if you know any of the Linux maintainers, but if you do I'd love to know how to get in touch with some of them.

mhils 4y ago
Are you looking for mitmproxy-on-linux maintainers, or Linux kernel maintainers? You have found the former I suppose, but I'm the wrong person to ask for the latter. :)
- Avicebron 4y ago
  I was looking for a quick way to update my version from the command line (ubuntu), but --options didn't show anything off hand like an --update/--upgrade. I just briefly skimmed the docs/google for something that would avoid having to reinstall the binary. EDIT: also is there a way to configure the IDE that pops up when I go to edit path? It's vim which is fine, I'm just curious if I can either integrate a custom vim installation or route it to another IDE.
  - mhils 4y ago
    The recommended way to install mitmproxy on Linux is to download new standalone binaries. They are self-contained and can just be dropped into /usr/local/bin. If you want some way to update automatically, use our Docker images, install via pipx (https://docs.mitmproxy.org/stable/overview-installation/#installation-from-the-python-package-index-pypi https://docs.mitmproxy.org/stable/overview-installation/#ins...), or (for Windows users) use the Microsoft Store. > also is there a way to configure the IDE that pops up when I go to edit path? You can set $MITMPROXY_EDITOR or more generally $EDITOR. :)

clumsysmurf 4y ago

Thanks for creating awesome software. Being able to script it with python is amazing. One problem I have been having on MacOS with Android emulator: proxying traffic from the emulator (my own app) will work for about 15 minutes or so... then all traffic ceases to flow, and Emulator / Setting / "AndroidWifi" says limited connectivity. If I forget AndroidWifi access point, re-add it, and restart, it all works again for about 15 minutes. Any ideas how I would debug this?

mhils 4y ago
Hard to say without more details. Once you reach that limited connectivity state, do you see anything that stands out in the mitmproxy event log? Feel free to open a thread at https://github.com/mitmproxy/mitmproxy/discussions https://github.com/mitmproxy/mitmproxy/discussions and I'm happy to help a bit more! Also it would be interesting to know if you observe the same thing with our new WireGuard mode. :)

codethief 4y ago

First of all, thank you for all your work on mitmproxy! :) Could you elaborate on how exactly the WireGuard mode works compared to e.g. TLS interception? After all, WG doesn't come with certificate authorities or anything like that.

mhils 4y ago
WireGuard mode does not help with interception, it helps with getting traffic into mitmproxy. Put differently, it's a user-friendly alternative to 1. configuring an explicit HTTP proxy in your system settings, or 2. fiddling with iptables on your router and/or your mitmproxy device. The downside of 1) is that it does not work for UDP-based traffic such as DNS and can often be easily bypassed by applications. The downside of 2) is that it's generally fiddly and does not work very well for users with consumer routers (no iptables). In all cases you still need to install a trusted mitmproxy CA for TLS interception, that part does not change with WireGuard mode. :)
- codethief 4y ago
  Sorry, I'm not following. With e.g. HTTPS traffic all I have to do is make sure that the browser sends all its traffic through 127.0.0.1:8080 and trusts mitmproxy's certificate. In that case, mitmproxy will show me the plaintext traffic. Now, let's say I've set up WireGuard with three peers, i.e. each of these peer's public key appears in my WireGuard config along with an IP address. Now I start sending traffic to one of these IP addresses which WG would normally encrypt and then route directly to the peer in question. How can mitmproxy's WG mode help me here with "getting [the encrypted] traffic into mitmproxy", as you say, and reading the plaintext?
  - mhils 4y ago
    Suppose you have an Android device for which you want to see all traffic. You could configure an HTTP proxy in your system settings, but this does not capture any UDP-based protocols. Additionally, apps may choose to ignore the proxy settings and it's hard to tell if they do. To overcome these shortcomings, we now have WireGuard mode: Mitmproxy spawns a WireGuard server on startup (instead of an HTTP proxy listener). Now you don't set a proxy on your device, but you configure your device to use WireGuard with a config that sends all traffic to mitmproxy. mitmproxy then transparently intercepts all requests that are coming through that WireGuard tunnel (the device still needs to trust the mitmproxy CA). Put differently, instead of using an explicit proxy configuration or something like iptables to route packets to mitmproxy, you use a VPN (WireGuard). The benefits are: - You can intercept/modify UDP, in particular DNS. - You avoid the "apps ignore proxy settings" problem. - On Android specifically, the WireGuard app allows you to only proxy specific apps (not possible with a global proxy config) Does that make more sense now? We also have a bit more documentation at https://docs.mitmproxy.org/stable/concepts-modes/#wireguard-transparent-proxy https://docs.mitmproxy.org/stable/concepts-modes/#wireguard-....

dur-randir 4y ago

I've inadvertently tried this mode yesterday, even before the announcement was made, but found that something weird was going on: - it eats tons and tons of CPU, like this is a common picture 6568 root 20 0 7357216 3.2g 20072 R 109.6 1.3 6:10.60 mitmweb - lots of packets dropped, sometimes at a considerable rate [14:38:33.501] Dropping incoming packet, TCP channel is full. This isn't me running some http-hungry application, just immediately after the phone restart. I'm running mitmproxy 9.0.0 installed through pip on Linux with python 3.9.2. Unfortunately it's not easy for me to try any other mode - i've first tried setting up transparent proxy on MacOS, but ssl bindings crash on M1.

mhils 4y ago
This really shouldn't be the case. What kind of client are you using? Could you open an issue over at https://github.com/mitmproxy/mitmproxy/issues https://github.com/mitmproxy/mitmproxy/issues please?
- dur-randir 4y ago
  Done. Mobile client is the official WireGuard mobile client.