Documentation
¶
Index ¶
- Constants
- Variables
- func CAExists(dir string) bool
- func CanInstallTrust() bool
- func ClientEnv(addr string, ca *CA) string
- func Curl(f *Flow) string
- func HAR(flows []*Flow, creatorVersion string) ([]byte, error)
- func InstallTrust(ctx context.Context, ca *CA) error
- func LANAddrs() []string
- func MatchHost(pats []string, host string) bool
- func RemoveCA(dir string) error
- func RemoveTrust(ctx context.Context, ca *CA) error
- type CA
- func (ca *CA) CertDER() []byte
- func (ca *CA) CertPEM() []byte
- func (ca *CA) CertPath() string
- func (ca *CA) Fingerprint() string
- func (ca *CA) GetCert(host string) (*tls.Certificate, error)
- func (ca *CA) GetRootCA() *x509.Certificate
- func (ca *CA) Name() string
- func (ca *CA) NotAfter() time.Time
- func (ca *CA) TrustedByOS() (bool, error)
- type Config
- type Flow
- type Kind
- type Service
- func (s *Service) Addr() string
- func (s *Service) CA() (*CA, error)
- func (s *Service) CADir() string
- func (s *Service) ClientAddrs() []string
- func (s *Service) DeleteCA() error
- func (s *Service) EnsureCA() (*CA, error)
- func (s *Service) LastError() error
- func (s *Service) Paused() bool
- func (s *Service) RegenerateCA() (*CA, error)
- func (s *Service) Running() bool
- func (s *Service) ServeCertSite(w http.ResponseWriter, r *http.Request)
- func (s *Service) SetIgnoreHosts(hosts []string)
- func (s *Service) SetPaused(v bool)
- func (s *Service) SetWake(fn func())
- func (s *Service) Start(cfg Config) error
- func (s *Service) Stop() error
- func (s *Service) Store() *Store
- type State
- type Store
- func (s *Store) Add(f *Flow) uint64
- func (s *Store) Bytes() int64
- func (s *Store) Clear()
- func (s *Store) Get(id uint64) (*Flow, bool)
- func (s *Store) Len() int
- func (s *Store) Remove(ids map[uint64]bool)
- func (s *Store) SetLimits(maxFlows int, maxBytes int64)
- func (s *Store) SetOnChange(fn func())
- func (s *Store) Snapshot() []*Flow
- func (s *Store) Update(id uint64, fn func(f *Flow))
- func (s *Store) Version() uint64
- type SystemProxy
- type TrustStep
Constants ¶
const ( DefaultListenAddr = "127.0.0.1:9090" // DefaultMaxBody is the largest body kept per request or response; // larger bodies stream through uncaptured. DefaultMaxBody int64 = 10 << 20 )
const CertSiteHost = "chapar.mitm"
CertSiteHost is the made-up host that serves the CA download page to any client sending its traffic through the proxy.
const DefaultMaxBytes int64 = 256 << 20
DefaultMaxBytes is how many body bytes the store keeps before dropping the oldest flows.
const DefaultMaxFlows = 5000
DefaultMaxFlows is how many flows the store keeps before dropping the oldest.
Variables ¶
var ErrManualTrust = errors.New("install the certificate manually on this system")
ErrManualTrust means this OS has no automatic install; show the steps from TrustSteps instead.
var ErrSystemProxyUnknown = errors.New("system proxy setting can't be read on this system")
ErrSystemProxyUnknown means this OS's setting can't be read.
Functions ¶
func CanInstallTrust ¶
func CanInstallTrust() bool
CanInstallTrust reports whether InstallTrust works on this OS.
func ClientEnv ¶
ClientEnv is a shell snippet that points CLI tools at the proxy and makes them trust the CA without touching the OS store.
func Curl ¶
Curl returns a shell command that sends the flow's request again. Every value is single-quoted, so it pastes safely into sh, bash and zsh. A binary body is piped in through base64.
func HAR ¶
HAR encodes flows as a HAR 1.2 log. Pending flows and tunnels that were not decrypted are left out: they have no request or response to show. Bodies are the decoded ones Chapar kept; a binary body is base64.
func InstallTrust ¶
InstallTrust adds the CA to the user's trust store. On macOS it adds it to the login keychain as a trusted root, which makes macOS ask for the user's password. It blocks until the user answers.
func LANAddrs ¶
func LANAddrs() []string
LANAddrs lists this machine's IPv4 addresses on active non-loopback interfaces, the ones other devices can reach.
Types ¶
type CA ¶
type CA struct {
// contains filtered or unexported fields
}
CA is the root certificate the proxy signs per-host certificates with. It satisfies go-mitmproxy's cert.CA interface.
func LoadOrCreateCA ¶
LoadOrCreateCA loads the CA in dir, creating one when none exists.
func (*CA) Fingerprint ¶
Fingerprint is the SHA-256 of the certificate as colon-separated hex.
func (*CA) GetCert ¶
func (ca *CA) GetCert(host string) (*tls.Certificate, error)
GetCert returns a certificate for host signed by the CA.
func (*CA) GetRootCA ¶
func (ca *CA) GetRootCA() *x509.Certificate
GetRootCA returns the CA certificate.
func (*CA) TrustedByOS ¶
TrustedByOS reports whether the OS trust store accepts certificates this CA issues. It verifies a fresh leaf against the system roots, which on macOS and Windows asks the platform verifier, so keychain trust settings count. Any verify error means "not trusted": the platform verifiers don't report an untrusted root as one error type.
type Config ¶
type Config struct {
ListenAddr string
MaxFlows int
// MaxMemoryBytes caps the bodies kept across all flows.
MaxMemoryBytes int64
MaxBodyBytes int64
// IgnoreHosts are passed through without decrypting. "example.com"
// also covers its subdomains; "*" patterns use path.Match.
IgnoreHosts []string
}
Config is how the proxy runs.
type Flow ¶
type Flow struct {
ID uint64
Start time.Time
End time.Time
State State
Error string
Method string
URL string
Scheme string
Host string // without port
Port string
Path string // path and query
Proto string
ReqHeader http.Header
ReqBody []byte
// ReqStreamed is set when the body was larger than the capture
// limit and passed through without being kept.
ReqStreamed bool
Status int
RespHeader http.Header
// RespBody is decoded (gzip, br, deflate, zstd removed).
RespBody []byte
RespSize int64 // bytes on the wire, before decoding
RespStreamed bool
Kind Kind
// Tunnel marks a CONNECT that was passed through without decrypting.
Tunnel bool
ClientAddr string
App string
}
Flow is one captured request and its response. A published Flow is never modified: the store swaps in a new value instead, so the UI can read a snapshot without locking.
type Kind ¶
type Kind string
Kind groups flows by content for the page's filter chips.
const ( KindJSON Kind = "json" KindXML Kind = "xml" KindHTML Kind = "html" KindCSS Kind = "css" KindJS Kind = "js" KindImage Kind = "image" KindMedia Kind = "media" KindFont Kind = "font" KindForm Kind = "form" KindText Kind = "text" KindWS Kind = "ws" KindTunnel Kind = "tunnel" KindOther Kind = "other" )
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service owns the proxy server, its CA and the captured flows.
func NewService ¶
NewService returns a stopped proxy keeping its CA in caDir.
func (*Service) CA ¶
CA returns the CA, loading it from disk on first use. It does not create one; see EnsureCA.
func (*Service) ClientAddrs ¶
ClientAddrs lists the host:port addresses clients can reach the proxy at, or nil when it is stopped. Listening on every interface, that is this machine's network addresses first, then loopback; a wildcard address like [::]:9090 is no use to someone setting up a phone.
func (*Service) RegenerateCA ¶
RegenerateCA replaces the CA with a new one. A running proxy signs with the new CA from its next connection on.
func (*Service) ServeCertSite ¶
func (s *Service) ServeCertSite(w http.ResponseWriter, r *http.Request)
ServeCertSite serves the CA download page: "/" is the page, and "/ca.pem", "/ca.crt" and "/ca.cer" are the certificate.
func (*Service) SetIgnoreHosts ¶
SetIgnoreHosts changes the passthrough list of a running proxy.
func (*Service) SetPaused ¶
SetPaused stops or resumes recording new flows; traffic keeps flowing through the proxy either way.
func (*Service) SetWake ¶
func (s *Service) SetWake(fn func())
SetWake registers fn to run (from any goroutine) when state changes.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store keeps captured flows in memory, oldest first, up to a number of flows and a total body size.
func (*Store) SetLimits ¶
SetLimits changes how many flows and how many body bytes the store keeps, dropping the oldest flows if needed. Values <= 0 use the defaults.
func (*Store) SetOnChange ¶
func (s *Store) SetOnChange(fn func())
SetOnChange registers fn to run after each change, from the goroutine that made it. It must not block.
func (*Store) Snapshot ¶
Snapshot returns the flows held, oldest first. The slice is a copy; the flows themselves are shared and must not be modified.
type SystemProxy ¶
SystemProxy is the OS-wide HTTPS proxy setting. Chapar only reads it.
func ReadSystemProxy ¶
func ReadSystemProxy() (SystemProxy, error)
ReadSystemProxy returns the OS-wide HTTPS proxy setting.
func (SystemProxy) PointsTo ¶
func (sp SystemProxy) PointsTo(port int) bool
PointsTo reports whether the setting sends traffic to a proxy on this machine at port.