issue with transparent proxying: Invalid HTTP request form (expected: absolute, got: relative)

Hi,

I am trying to setup mitmproxy as a transparent proxy.

I have a VPN network with internal IP 10.0.0.1/24. The proxy box is on 10.0.0.100. I want to transparently redirect client HTTP traffic on the VPN through the proxy. Each client should have its own proxy. Example:

sudo iptables -t nat -A PREROUTING -i ppp4 -p tcp --dport 80 -j DNAT --to-destination 10.0.0.100:6262
sudo iptables -t nat -A PREROUTING -i ppp4 -p tcp --dport 443 -j DNAT --to-destination 10.0.0.100:6262

This successfully redirects client traffic on ppp4 to the proxy. However, mitmproxy logs show:

10.0.0.108:60222: HttpError('Invalid HTTP request form (expected: absolute, got: relative)',)

I also see:

11.0.0.108:60225: HttpError("Bad HTTP request line:                                                                                
'\\x16\\x03\\x00\\x003\\x01\\x00\\x00/\\x03\\x00U\\xef\\x02+\\xb0^RE\\xa8\\xf0{\\xf3m\\xd8-\\x18\\xbaV\\x8a\\xa2\\xa0\\n'",)

I am starting mitmproxy with the command:

mitmproxy -p 6262 --host

The client has the mitmproxy root CA installed.

Am I trying to do something impossible? Am I missing a critical step?

[milesrichardson]

Thanks, that seems to help. However, now I’m seeing hundreds of requests per second to the website address I try to access on the client device. All requests return 502 with an HTML error in the response body 'ProxyError(NetLibError('Error connecting to "10.0.0.100": [Errno 24] Too many open files',),)'. I do not see this error in the console.

The device an iPhone. I suspect this has to do with apple captive portal detection?

[mhils]

Thanks for the detailed report. Looks like you actually need to instruct mitmproxy to run in transparent mode: mitmproxy -T.