36 lines
990 B
YAML
36 lines
990 B
YAML
id: tcp-block-message-length-threshold
|
|
name: Block oversized TCP messages
|
|
protocol: tcp
|
|
description: Cuts off client messages that exceed a fixed size threshold.
|
|
category: tcp
|
|
family: tcp-hardening
|
|
tags:
|
|
- length-limit
|
|
- tcp
|
|
- block
|
|
action: block
|
|
summary: Cuts off client messages that exceed a fixed size threshold.
|
|
behavior: Checks every client TCP message size, logs the offending length, drops the
|
|
message, and kills the flow when the threshold is hit.
|
|
source_url: https://docs.mitmproxy.org/stable/addons/examples/
|
|
code: |
|
|
import logging
|
|
|
|
from mitmproxy import tcp
|
|
|
|
MAX_MESSAGE_BYTES = 4096
|
|
|
|
|
|
def tcp_message(flow: tcp.TCPFlow) -> None:
|
|
message = flow.messages[-1]
|
|
if not message.from_client:
|
|
return
|
|
size = len(message.content)
|
|
if size > MAX_MESSAGE_BYTES:
|
|
logging.warning(
|
|
"[tcp-block-message-length-threshold] blocked message size=%d",
|
|
size,
|
|
)
|
|
message.drop()
|
|
flow.kill()
|