diff --git a/docs/index.rst b/docs/index.rst index 8ba14f547..a4e37e713 100644 --- a/docs/index.rst +++ b/docs/index.rst @@ -47,6 +47,7 @@ transparent transparent/linux transparent/osx + transparent/openbsd .. toctree:: :hidden: diff --git a/docs/transparent/openbsd.rst b/docs/transparent/openbsd.rst new file mode 100644 index 000000000..3d315f7ce --- /dev/null +++ b/docs/transparent/openbsd.rst @@ -0,0 +1,53 @@ +.. _openbsd: + +OpenBSD +======= + + 1. :ref:`Install the mitmproxy certificate on the test device ` + + 2. Enable IP forwarding: + + >>> sudo sysctl -w net.inet.ip.forwarding=1 + + 3. Place the following two lines in **/etc/pf.conf**: + + .. code-block:: none + + mitm_if = "re2" + pass in quick proto tcp from $mitm_if to port { 80, 443 } divert-to 127.0.0.1 port 8080 + + These rules tell pf to divert all traffic from ``$mitm_if`` destined for + port 80 or 443 to the local mitmproxy instance running on port 8080. You + should replace ``$mitm_if`` value with the interface on which your test + device will appear. + + 4. Configure pf with the rules: + + >>> doas pfctl -f /etc/pf.conf + + 5. And now enable it: + + >>> doas pfctl -e + + 6. Fire up mitmproxy. You probably want a command like this: + + >>> mitmproxy -T --host + + The ``-T`` flag turns on transparent mode, and the ``--host`` + argument tells mitmproxy to use the value of the Host header for URL display. + + 7. Finally, configure your test device to use the host on which mitmproxy is + running as the default gateway. + +.. note:: + + Note that the **divert-to** rules in the pf.conf given above only apply to + inbound traffic. **This means that they will NOT redirect traffic coming + from the box running pf itself.** We can't distinguish between an outbound + connection from a non-mitmproxy app, and an outbound connection from + mitmproxy itself - if you want to intercept your traffic, you should use an + external host to run mitmproxy. Nonetheless, pf is flexible to cater for a + range of creative possibilities, like intercepting traffic emanating from + VMs. See the **pf.conf** man page for more. + +.. _pf: http://man.openbsd.org/OpenBSD-current/man5/pf.conf.5 diff --git a/docs/transparent/osx.rst b/docs/transparent/osx.rst index 46f0e2df5..40e91fac1 100644 --- a/docs/transparent/osx.rst +++ b/docs/transparent/osx.rst @@ -63,7 +63,7 @@ Note that this means we don't support transparent mode for earlier versions of O running pf itself.** We can't distinguish between an outbound connection from a non-mitmproxy app, and an outbound connection from mitmproxy itself - if you want to intercept your OSX traffic, you should use an external host to run - mitmproxy. None the less, pf is flexible to cater for a range of creative + mitmproxy. Nonetheless, pf is flexible to cater for a range of creative possibilities, like intercepting traffic emanating from VMs. See the **pf.conf** man page for more. diff --git a/mitmproxy/platform/__init__.py b/mitmproxy/platform/__init__.py index 48d49425c..61946ec4e 100644 --- a/mitmproxy/platform/__init__.py +++ b/mitmproxy/platform/__init__.py @@ -25,6 +25,10 @@ elif sys.platform == "darwin" or sys.platform.startswith("freebsd"): from . import osx original_addr = osx.original_addr # noqa +elif sys.platform.startswith("openbsd"): + from . import openbsd + + original_addr = openbsd.original_addr # noqa elif sys.platform == "win32": from . import windows diff --git a/mitmproxy/platform/openbsd.py b/mitmproxy/platform/openbsd.py new file mode 100644 index 000000000..e8f5ff8ee --- /dev/null +++ b/mitmproxy/platform/openbsd.py @@ -0,0 +1,2 @@ +def original_addr(csock): + return csock.getsockname()