mitmproxy报Bad HTTP request line错误：客户端无前置0却被检测到

Let me break down what's happening here and how to fix it:

First, the core issue: mitmproxy is treating your TLS Client Hello as an invalid HTTP request, and the error shows a leading \x00 byte that you don't see when testing against your Python server. This is almost certainly not a mitmproxy bug, but a mismatch between how Schannel interacts with mitmproxy vs. your simple Python server, or a minor configuration quirk in mitmproxy.

What's likely causing this? #

• HTTP/1.0 vs HTTP/1.1 mismatch
  Your client sends a CONNECT request using HTTP/1.0, and while mitmproxy supports HTTP/1.0, its tunnel mode handling for older HTTP versions can have edge cases. Your Python server is a minimal implementation that doesn't parse HTTP strictly, so it ignores any subtle state mismatches that mitmproxy catches.

• Mitmproxy adds extra response headers
  Unlike your Python server, mitmproxy automatically adds headers like Proxy-Agent: mitmproxy/<version> to its 200 Connection established response. Schannel might interpret this extra header differently, leading to it sending an unexpected leading null byte before the Client Hello.

• Schannel's legacy SSL compatibility
  Win32 Schannel has built-in support for older SSL/TLS versions (like SSLv2) for compatibility. In some cases, it might send a tiny legacy handshake prefix (including a null byte) before the standard TLS 1.2+/1.3 Client Hello when talking to proxies it doesn't recognize.

Steps to fix this: #

1. Upgrade mitmproxy to the latest version
   Older versions had bugs in HTTP/1.0 tunnel handling. Grab the latest release and test again—this alone might resolve the issue.

2. Force your client to use HTTP/1.1 for the CONNECT request
   Modify your Win32 client to send CONNECT www.example.com:443 HTTP/1.1\r\nHost: www.example.com:443\r\n\r\n instead of HTTP/1.0. Mitmproxy's HTTP/1.1 tunnel handling is more robust, and this should prevent it from misinterpreting the subsequent TLS traffic.

3. Modify mitmproxy to match your Python server's response
   Use a simple mitmproxy script to strip extra headers from the CONNECT response, making it identical to your Python server's output. Create a script fix_connect.py:

   from mitmproxy import http
   
   def response(flow: http.HTTPFlow) -> None:
       if flow.request.method == "CONNECT":
           flow.response.headers.clear()
           flow.response.headers["Connection"] = "established"
   

   Run mitmproxy with mitmproxy -s fix_connect.py and test again. This removes any extra headers mitmproxy adds, ensuring Schannel sees the exact same response as your Python server.

4. Disable HTTP/2 support in mitmproxy
   Sometimes HTTP/2 negotiation can interfere with tunnel mode. Run mitmproxy with mitmproxy --no-http2 to rule this out.

5. Verify traffic with Wireshark
   Capture the traffic between your client and mitmproxy to confirm whether the leading null byte is actually being sent by Schannel, or if it's an artifact of mitmproxy's parsing. If the null byte is present in the Wireshark capture, you may need to adjust Schannel's settings (e.g., disable SSLv2 compatibility via Group Policy or registry edits).

Final note #

This is a common edge case with Win32 Schannel's proxy interactions, not a fundamental flaw in mitmproxy. By aligning your client's HTTP version, matching proxy responses, or adjusting mitmproxy's configuration, you should be able to successfully capture and analyze the TLS traffic.

内容的提问来源于stack exchange，提问作者MartinR20