mitmproxy

• bump cryptography dependency
• bump pyparsing dependency
• HTTP/2: use header normalization from hyper-h2

• HTTP/2 is now enabled by default.
• Add transparent proxy support for OpenBSD.
• Check the mitmproxy CA for expiration and warn the user to regenerate it if necessary.
• Image Content Views: Images are now parsed with Kaitai Struct (kaitai.io) instead of Pillow. This simplifies installation, reduces binary size, and allows parsing in pure Python.
• Testing: Tremendous improvements, enforced 100% individual coverage for large parts of the codebase, increased overall coverage.
• A myriad of other small improvements and bugfixes throughout the project.

• Fix compatibility with Python 3.5.0

• Fix compatibility with Python 3.6

This is a bugfix-only release. All users are advised to update. :smiley:

• Fix crash on shutdown (#1620)
• Fix client replay (#1666)
• Constrain h2 version (#1671)

0.18 will be the last release that supports both Python 2 and 3.5+. The next release will support Python 3.5+ only.

• Python 3 Compatibility for mitmproxy and pathod (Shadab Zafar, GSoC 2016)
• Major improvements to mitmweb (Clemens Brunner & Jason Hao, GSoC 2016)
• Internal Core Refactor: Separation of most features into isolated Addons
• Initial Support for WebSockets
• Improved HTTP/2 Support
• Reverse Proxy Mode now automatically adjusts host headers and TLS Server Name Indication
• Improved HAR export
• Improved export functionality for curl, python code, raw http etc.
• Flow URLs are now truncated in the console for better visibility
• New filters for TCP, HTTP and marked flows.
• Mitmproxy now handles comma-separated Cookie headers
• Merge mitmproxy and pathod documentation
• Mitmdump now sanitizes its console output to not include control characters
• Improved message body handling for HTTP messages:
  • .raw_content provides the message body as seen on the wire
  • .content provides the decompressed body (e.g. un-gzipped)
  • .text provides the body decompressed and decoded body
• New HTTP Message getters/setters for cookies and form contents.
• Add ability to view only marked flows in mitmproxy
• Improved Script Reloader (Always use polling, watch for whole directory)
• Use tox for testing
• Unicode support for tnetstrings
• Add dumpfile converters for mitmproxy versions 0.11 and 0.12
• Numerous bugfixes

• Simplify repository and release structure. mitmproxy now comes as a single package, including netlib and pathod.
• Rename the Python package from libmproxy to mitmproxy.
• New option to add server certs to client chain (CVE-2016-2402, John Kozyrakis)
• Enable HTTP/2 by default (Thomas Kriechbaumer)
• Improved HAR extractor (Shadab Zafar)
• Add icon for OSX and Windows binaries
• Add content view for query parameters (Will Coster)
• Initial work on Python 3 compatibility
• locust.io export (Zohar Lorberbaum)
• Fix XSS vulnerability in HTTP errors (Will Coster)
• Numerous bugfixes and minor improvements

• Completely revised HTTP2 implementation based on hyper-h2 (Thomas Kriechbaumer)
• Export flows as cURL command, Python code or raw HTTP (Shadab Zafar)
• Fixed compatibility with the Android Emulator (Will Coster)
• Script Reloader: Inline scripts are reloaded automatically if modified (Matthew Shao)
• Inline script hooks for TCP mode (Michael J. Bazzinotti)
• Add default ciphers to support iOS9 App Transport Security (Jorge Villacorta)
• Basic Authentication for mitmweb (Guillem Anguera)
• Exempt connections from interception based on TLS Server Name Indication (David Weinstein)
• Provide Python Wheels for faster installation
• Numerous bugfixes and minor improvements

• Support for loading and converting older dumpfile formats (0.13 and up)
• Content views for inline script (@chrisczub)
• Better handling of empty header values (Benjamin Lee/@bltb)
• Fix a gnarly memory leak in mitmdump
• A number of bugfixes and small improvements

• Upstream certificate validation. See the --verify-upstream-cert, --upstream-trusted-confdir and --upstream-trusted-ca parameters. Thanks to Kyle Morton (github.com/kyle-m) for his work on this.
• Add HTTP transparent proxy mode. This uses the host headers from HTTP traffic (rather than SNI and IP address information from the OS) to implement perform transparent proxying. Thanks to github.com/ijiro123 for this feature.
• Add ~src and ~dst REGEX filters, allowing matching on source and destination addresses in the form of <IP>:<Port>
• mitmproxy console: change g/G keyboard shortcuts to match less. Thanks to Jose Luis Honorato (github.com/jlhonora).
• mitmproxy console: Flow marking and unmarking. Marked flows are not deleted when the flow list is cleared. Thanks to Jake Drahos (github.com/drahosj).
• mitmproxy console: add marking of flows
• Remove the certforward feature. It was added to allow exploitation of #gotofail, which is no longer a common vulnerability. Permitting this hugely increased the complexity of packaging and distributing mitmproxy.

• mitmproxy console: mouse interaction - scroll in the flow list, click on flow to view, click to switch between tabs.
• Update our crypto defaults: SHA256, 2048 bit RSA, 4096 bit DH parameters.
• BUGFIX: crash under some circumstances when copying to clipboard.
• BUGFIX: occasional crash when deleting flows.

• Configuration files - mitmproxy.conf, mitmdump.conf, common.conf in the .mitmproxy directory.
• Better handling of servers that reject connections that are not SNI.
• Many other small bugfixes and improvements.

• Bug fixes: connection leaks some crashes

• Performance improvements for mitmproxy console
• SOCKS5 proxy mode allows mitmproxy to act as a SOCKS5 proxy server
• Data streaming for response bodies exceeding a threshold (bradpeabody@gmail.com)
• Ignore hosts or IP addresses, forwarding both HTTP and HTTPS traffic untouched
• Finer-grained control of traffic replay, including options to ignore contents or parameters when matching flows (marcelo.glezer@gmail.com)
• Pass arguments to inline scripts
• Configurable size limit on HTTP request and response bodies
• Per-domain specification of interception certificates and keys (see --cert option)
• Certificate forwarding, relaying upstream SSL certificates verbatim (see --cert-forward)
• Search and highlighting for HTTP request and response bodies in mitmproxy console (pedro@worcel.com)
• Transparent proxy support on Windows
• Improved error messages and logging
• Support for FreeBSD in transparent mode, using pf (zbrdge@gmail.com)
• Content view mode for WBXML (davidshaw835@air-watch.com)
• Better documentation, with a new section on proxy modes
• Generic TCP proxy mode
• Countless bugfixes and other small improvements
• pathod: Hugely improved SSL support, including dynamic generation of certificates using the mitproxy cacert

• Support for multiple scripts and multiple script arguments
• Easy certificate install through the in-proxy web app, which is now enabled by default
• Forward proxy mode, that forwards proxy requests to an upstream HTTP server
• Reverse proxy now works with SSL
• Search within a request/response using the "/" and "n" shortcut keys
• A view that beatifies CSS files if cssutils is available
• Bug fix, documentation improvements, and more.

• Improvements to the mitmproxywrapper.py helper script for OSX.
• Don't take minor version into account when checking for serialized file compatibility.
• Fix a bug causing resource exhaustion under some circumstances for SSL connections.
• Revamp the way we store interception certificates. We used to store these on disk, they're now in-memory. This fixes a race condition related to cert handling, and improves compatibility with Windows, where the rules governing permitted file names are weird, resulting in errors for some valid IDNA-encoded names.
• Display transfer rates for responses in the flow list.
• Many other small bugfixes and improvements.

• Use "correct" case for Content-Type headers added by mitmproxy.
• Make UTF environment detection more robust.
• Improved MIME-type detection for viewers.
• Always read files in binary mode (Windows compatibility fix).
• Some developer documentation.

• Upstream certs mode is now the default.
• Add a WSGI container that lets you host in-proxy web applications.
• Full transparent proxy support for Linux and OSX.
• Introduce netlib, a common codebase for mitmproxy and pathod (http://github.com/cortesi/netlib).
• Full support for SNI.
• Color palettes for mitmproxy, tailored for light and dark terminal backgrounds.
• Stream flows to file as responses arrive with the "W" shortcut in mitmproxy.
• Extend the filter language, including ~d domain match operator, ~a to match asset flows (js, images, css).
• Follow mode in mitmproxy ("F" shortcut) to "tail" flows as they arrive.
• --dummy-certs option to specify and preserve the dummy certificate directory.
• Server replay from the current captured buffer.
• Huge improvements in content views. We now have viewers for AMF, HTML, JSON, Javascript, images, XML, URL-encoded forms, as well as hexadecimal and raw views.
• Add Set Headers, analogous to replacement hooks. Defines headers that are set on flows, based on a matching pattern.
• A graphical editor for path components in mitmproxy.
• A small set of standard user-agent strings, which can be used easily in the header editor.
• Proxy authentication to limit access to mitmproxy
• pathod: Proxy mode. You can now configure clients to use pathod as an HTTP/S proxy.
• pathoc: Proxy support, including using CONNECT to tunnel directly to targets.
• pathoc: client certificate support.
• pathod: API improvements, bugfixes.

• Detailed tutorial for Android interception. Some features that land in this release have finally made reliable Android interception possible.
• Upstream-cert mode, which uses information from the upstream server to generate interception certificates.
• Replacement patterns that let you easily do global replacements in flows matching filter patterns. Can be specified on the command-line, or edited interactively.
• Much more sophisticated and usable pretty printing of request bodies. Support for auto-indentation of Javascript, inspection of image EXIF data, and more.
• Details view for flows, showing connection and SSL cert information (X keyboard shortcut).
• Server certificates are now stored and serialized in saved traffic for later analysis. This means that the 0.8 serialization format is NOT compatible with 0.7.
• Many other improvements, including bugfixes, and expanded scripting API, and more sophisticated certificate handling.