aboutsummaryrefslogtreecommitdiffstats
path: root/docs/transparent.rst
diff options
context:
space:
mode:
authorAldo Cortesi <aldo@nullcube.com>2018-02-22 17:21:34 +1300
committerAldo Cortesi <aldo@nullcube.com>2018-02-22 18:07:58 +1300
commit982508d30f887b4fe8b2a855792ae1e33f378222 (patch)
tree9d749a57929a950f0e177a9bf4d6cd7d9a88c16b /docs/transparent.rst
parent1cacefa104626e4e0df5ffb2aa8b0c6f16b615b2 (diff)
downloadmitmproxy-982508d30f887b4fe8b2a855792ae1e33f378222.tar.gz
mitmproxy-982508d30f887b4fe8b2a855792ae1e33f378222.tar.bz2
mitmproxy-982508d30f887b4fe8b2a855792ae1e33f378222.zip
All new documentation
This patch does a lot. - Ditch sphinx in favor of hugo. This gives us complete control of the layout and presentation of our docs. Henceforth, docs will be hosted on our website rather than ReadTheDocs. - Create a simple, clean doc layout and theme. - Remove large parts of the documentaion. I've ditched anything that was a) woefully out of date, b) too detailed, or c) too hard to maintain in the long term. - Huge updates to the docs themselves: completely rewrite addons documentation, add docs for core concepts like commands and options, and revise and tweak a lot of the existing docs. With this patch, we're also changing the way we publish and maintain the docs. From now on, we don't publish docs for every release. Instead, the website will contain ONE set of docs for each major release. The online docs will be updated if needed as minor releases are made. Docs are free to improve during minor releases, but anything that changes behaviour sufficiently to require a doc change warrants a new major release. This also leaves us free to progressively update and improve docs out of step with our release cadence. With this new scheme, I feel CI over the docs is less important. I've removed it for now, but won't object if someone wants to add it back in.
Diffstat (limited to 'docs/transparent.rst')
-rw-r--r--docs/transparent.rst53
1 files changed, 0 insertions, 53 deletions
diff --git a/docs/transparent.rst b/docs/transparent.rst
deleted file mode 100644
index 889079af..00000000
--- a/docs/transparent.rst
+++ /dev/null
@@ -1,53 +0,0 @@
-.. _transparent:
-
-====================
-Transparent Proxying
-====================
-
-When a transparent proxy is used, traffic is redirected into a proxy at the
-network layer, without any client configuration being required. This makes
-transparent proxying ideal for those situations where you can't change client
-behaviour - proxy-oblivious Android applications being a common example.
-
-To set up transparent proxying, we need two new components. The first is a
-redirection mechanism that transparently reroutes a TCP connection destined for
-a server on the Internet to a listening proxy server. This usually takes the
-form of a firewall on the same host as the proxy server - iptables_ on Linux
-or pf_ on OSX. When the proxy receives a redirected connection, it sees a vanilla
-HTTP request, without a host specification. This is where the second new component
-comes in - a host module that allows us to query the redirector for the original
-destination of the TCP connection.
-
-At the moment, mitmproxy supports transparent proxying on OSX Lion and above,
-and all current flavors of Linux.
-
-Fully transparent mode
-======================
-
-By default mitmproxy will use its own local ip address for its server-side connections.
-In case this isn't desired, the --spoof-source-address argument can be used to
-use the client's ip address for server-side connections. The following config is
-required for this mode to work::
-
- CLIENT_NET=192.168.1.0/24
- TABLE_ID=100
- MARK=1
-
- echo "$TABLE_ID mitmproxy" >> /etc/iproute2/rt_tables
- iptables -t mangle -A PREROUTING -d $CLIENT_NET -j MARK --set-mark $MARK
- iptables -t nat -A PREROUTING -p tcp -s $CLIENT_NET --match multiport --dports 80,443 -j REDIRECT --to-port 8080
-
- ip rule add fwmark $MARK lookup $TABLE_ID
- ip route add local $CLIENT_NET dev lo table $TABLE_ID
-
-This mode does require root privileges though. There's a wrapper in the examples directory
-called 'mitmproxy_shim.c', which will enable you to use this mode with dropped priviliges.
-It can be used as follows::
-
- gcc examples/complex/full_transparency_shim.c -o mitmproxy_shim -lcap
- sudo chown root:root mitmproxy_shim
- sudo chmod u+s mitmproxy_shim
- ./mitmproxy_shim $(which mitmproxy) -T --spoof-source-address
-
-.. _iptables: http://www.netfilter.org/
-.. _pf: https://en.wikipedia.org/wiki/PF_\(firewall\)