Module filter 

Proxy filtering and modification system

This module provides sophisticated request/response filtering and modification capabilities for the MITM proxy.

Certificate Modes

The proxy supports three certificate modes:

1. Generate - Generate a self-signed CA certificate on-demand for full MITM
2. LoadFromFile - Load CA certificate from specified path for full MITM
3. None - No MITM, pass-through origin certificates (allow/block only)

Full MITM Mode (Generate or LoadFromFile)

When a certificate is configured:

• HTTPS traffic is decrypted and re-encrypted
• LLM sees: method, URL, path, headers, body content
• LLM can: pass, block, or modify (headers, URL, body)
• HTTP traffic is also fully inspectable and modifiable

Pass-Through Mode (None)

When no certificate is configured:

• HTTPS traffic passes through with origin certificate (no decryption)
• LLM sees: destination host, destination port, SNI (Server Name Indication)
• LLM can: allow or block only (no modifications possible)
• HTTP traffic is still fully inspectable and modifiable (no TLS involved)

Structs

FullRequestInfo

Full request information available in MITM mode

FullResponseInfo

Full response information available in MITM mode

HttpsConnectionFilter

Filter configuration for intercepting HTTPS connections (pass-through mode)

HttpsConnectionInfo

Information available to LLM for HTTPS connection (pass-through mode)

ProxyFilterConfig

Complete proxy filter configuration

RegexReplacement

Regex-based text replacement

RequestFilter

Filter configuration for intercepting requests

ResponseFilter

Filter configuration for intercepting responses

Enums

CertificateMode

Certificate mode for MITM proxy

FilterMode

Filter mode determines behavior when no filters match

HttpsConnectionAction

Actions available for HTTPS connections in pass-through mode (no MITM)

RequestAction

Actions that can be taken on a filtered request

ResponseAction

Actions that can be taken on a filtered response

Constants

FRAMING_HEADERS

Headers the proxy frames itself when it rewrites a message. A model-added Content-Length beside the one the proxy computes, or a Transfer-Encoding: chunked over a body the proxy writes whole, is the ambiguity request-smuggling and response-desync attacks are built on, so neither may be added through headers (remove_headers may still name them).

Functions

check_header_name

A header name is an RFC 9110 token.

check_header_value

A header value carries no CR, LF or other control character (HTAB excepted).

check_modify_headers

Every added header is a token with a control-free value and is not a framing header.

check_query_params

Every query name and value passes check_request_target_part.

check_request_target_part

A piece of the request target (new_path, a query name or value) carries no whitespace or control character: the request line is space-delimited and CRLF-terminated, so either would end the line early.