Reverse proxy mode for mitmproxy

[hessu]

I've added a little bit of code which enables a reverse proxy mode for mitmproxy. This pull request contains two commits to bring that to the master.

When run with the option "-R localhost:80", mitmproxy will accept a non-proxy-mode HTTP request ("GET / HTTP/1.0"), set scheme to http and host/port to localhost:80, and the proxy connection will then be made to the correct server.

The code still assumes that the client will transmit the correct Host: header that the upstream/origin server will accept as it's own (name-based virtual hosts), and will not tamper with that header, but that can probably be "fixed" elsewhere if needed.

I have not even tried to figure out how this copes with https, sorry for my ignorance. But it should still be useful for many - it's a very handy tool for debugging client requests when you have access to the server (or a box in between) but it'd be hard to add proxy configuration to the client.

[cortesi]

Thanks for this Heikki. I've got some ideas for extending this to support HTTPS and authentication - reverse proxying is a useful feature that's been on my todo list.

[jessesanford]

What exactly would be the lifting needed to get this to work with https? I would be willing to hack it out if you point me in the right direction.

[cortesi]

I'd say the following needs to be done:

• Add a --listen-ssl option that tells mitmproxy to use SSL for the listening socket. The core changes needed will be in proxy.py, and should actually be pretty trivial. To make this as easy as possible (and avoid having to make other deep changes to mitmproxy, and also get us closer to full transparent proxying), you should use ssl.wrap_socket to "convert" connections to SSL after the client has actually connected, rather than change the bound socket to SSL.
• Add a --listen-cert option that specifies a path to a certificate to be passed to the ssl.wrap_socket call. Again, core changes are in proxy.py and should be reasonably trivial.

Hit me up by email or drop by on the IRC channel if you do want to work on this, and need more pointers.

[jessesanford]

I actually hacked together a version in erlang/otp that does reverse proxying of both ssl and normal tcp sockets. Did the job nicely but certainly not feature rich enough to replace the work you have done here. I will circle back when I get some more free time though and see if I can hack out your suggestions above. It would be a nice contribution and I do like this software.