From 07c64d71fa256e45dd1c1c32516d63288a078e84 Mon Sep 17 00:00:00 2001 From: BlackRockCity Date: Tue, 25 Aug 2026 00:29:09 -0600 Subject: [PATCH] Fix explicit HTTPS port handling for reverse proxies This change makes sure the script keeps using port 443 when that is the port you specified, instead of accidentally switching to port 555. This is important when a reverse proxy receives the connection on port 443 and then forwards it to the local server on port 555. Technically, the change keeps two forms of the local API address: one that preserves the explicitly configured port for the mitmproxy addon, and a second, normalized HTTPS address used only for the preflight check. This prevents normalization of the preflight URL from altering the port information later used to route intercepted traffic. Tested successfully with HAProxy on pfSense listening on port 443 and forwarding to the local Roborock server on port 555. --- mitm_redirect.py | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/mitm_redirect.py b/mitm_redirect.py index 9e390b3..7d1ca01 100644 --- a/mitm_redirect.py +++ b/mitm_redirect.py @@ -694,7 +694,17 @@ def _rewrite_value(text: str) -> str: args.local_api, fallback_port=DEFAULT_LOCAL_API_PORT, ) - local_api = _format_authority(local_api_host, local_api_port, default_port=443) + # Preserve an explicit API port in the value passed to the mitmproxy addon. + # This prevents an explicitly supplied :443 from being lost and later + # falling back to DEFAULT_LOCAL_API_PORT (555) inside the addon. + local_api = _format_authority(local_api_host, local_api_port) + + # For direct HTTPS requests made by this launcher (preflight), normalize + # the standard HTTPS port out of the URL authority. This still connects to + # TCP 443, but avoids sending an explicit Host: hostname:443 header, which + # can trigger HAProxy routing quirks in some configurations. + local_api_http = _format_authority(local_api_host, local_api_port, default_port=443) + local_mqtt_host, local_mqtt_port = _parse_endpoint( args.local_mqtt or "", fallback_host=local_api_host, @@ -725,11 +735,11 @@ def _rewrite_value(text: str) -> str: if local_sync_secret: try: - _preflight_sync_endpoint(local_api, local_sync_secret) + _preflight_sync_endpoint(local_api_http, local_sync_secret) except SyncEndpointError as exc: print(f"[SYNC] refusing to start mitmweb: {exc}", file=sys.stderr) sys.exit(2) - print(f"[SYNC] verified protocol auth sync endpoint via {_sync_callback_url(local_api)}") + print(f"[SYNC] verified protocol auth sync endpoint via {_sync_callback_url(local_api_http)}") else: print("[SYNC] protocol auth session sync disabled: no sync secret configured")