mitmwrap

#!/usr/bin/env bash

# have a mitmproxy running before on 127.0.0.1:8080

set -eu -o pipefail

host="${MITMWRAP_HOST-127.0.0.1}"
port="${MITMWRAP_PORT-8080}"

proxychains=0
for arg in "$@"; do
    case "$arg" in
        --proxychains) proxychains=1; shift ;;
        --) shift; break ;;
    esac
done

if (( proxychains )); then
    file="$(mktemp)"
    trap 'code="$?"; rm -f -- "$file"; exit "$code"' EXIT
    export PROXYCHAINS_CONF_FILE="$file"
    cat <<EOF >"$file"
proxy_dns
quiet_mode
[ProxyList]
http $host $port
EOF
    cmd=(proxychains4 -q "$@")
else
    for proxy in http_proxy https_proxy HTTP_PROXY HTTPS_PROXY; do
        export "$proxy=$host:$port"
    done
    cmd=("$@")
fi

# thanks https://github.com/lincheney/ffcli/blob/ac89f62ae7039fb0fcdb77fd09203b413ac2d2f3/ffcli.py#L581-L587
cert="$HOME"/.mitmproxy/mitmproxy-ca-cert.cer
for var in AWS_CA_BUNDLE CURL_CA_BUNDLE SSL_CERT_FILE NODE_EXTRA_CA_CERTS REQUESTS_CA_BUNDLE GIT_SSL_CAINFO; do
    export "$var=$cert"
done

bwrap --dev-bind / / --ro-bind "$cert" "$(readlink -f /etc/ssl/certs/ca-certificates.crt)" --ro-bind "$cert" "$(readlink -f "$(python3 -m certifi)")" -- "${cmd[@]}"