Keyboard interrupts bugger up Queues in some way, which causes a traceback on
exit in many of our tools. The issue seems easiest to reproduce with binary
builds on OSX.
This commit fixes netlib's optional (turned off by default)
certificate verification, which previously did not validate the
cert's host name. As it turns out, verifying the connection's host
name on an intercepting proxy is not really straightforward - if
we receive a connection in transparent mode without SNI, we have no
clue which hosts the client intends to connect to. There are two
basic approaches to solve this problem:
1. Exactly mirror the host names presented by the server in the
spoofed certificate presented to the client.
2. Require the client to send the TLS Server Name Indication
extension. While this does not work with older clients,
we can validate the hostname on the proxy.
Approach 1 is problematic in mitmproxy's use case, as we may want
to deliberately divert connections without the client's knowledge.
As a consequence, we opt for approach 2. While mitmproxy does now
require a SNI value to be sent by the client if certificate
verification is turned on, we retain our ability to present
certificates to the client which are accepted with a maximum
likelihood.
Bash (and many other shells) provide a nifty feature in "anonymous pipe" or "anonymous fifo" whereby the output of a subshell may be treated as a simple file by the parent shell: http://unix.stackexchange.com/a/156088
Unfortunately, libmproxy complains because that "file" is not a regular file, as os.path.isfile checks, e.g. giving the error "Not a file: /dev/fd/11". This patch is intended to provide for the following use-case:
```
mitmdump -s <(echo "def response(context, flow):\n flow.response.headers['newheader'] = [`hostname`]")
```
where `hostname` may be replaced with a more complicated lookup.
