id: tcp-block-message-length-threshold
name: Block oversized TCP messages
protocol: tcp
description: Cuts off client messages that exceed a fixed size threshold.
category: tcp
family: tcp-hardening
tags:
- length-limit
- tcp
- block
action: block
summary: Cuts off client messages that exceed a fixed size threshold.
behavior: Checks every client TCP message size, logs the offending length, drops the
  message, and kills the flow when the threshold is hit.
source_url: https://docs.mitmproxy.org/stable/addons/examples/
code: |
  import logging

  from mitmproxy import tcp

  MAX_MESSAGE_BYTES = 4096


  def tcp_message(flow: tcp.TCPFlow) -> None:
      message = flow.messages[-1]
      if not message.from_client:
          return
      size = len(message.content)
      if size > MAX_MESSAGE_BYTES:
          logging.warning(
              "[tcp-block-message-length-threshold] blocked message size=%d",
              size,
          )
          message.drop()
          flow.kill()