httptap

Based on how it works it cannot run as non-root even in principle. https://github.com/monasticacademy/httptap?tab=readme-ov-fil... Correction: the readme claims it will work without requiring root, but it does need to manage network namespaces, which afaik may only be available to root users depending on system configuration. > To run httptap you do not need to be the root user. ... It makes use of linux-specific system calls -- in particular network namespaces ...

Very nice. The README section makes it appear as if it's a group's work. I'm just noting that the code of httptap is authored by a single person (@alexflint) https://github.com/monasticacademy/httptap/graphs/contributo...

1. Yes. The following commit taught httptap how to configure Java processes to use its CA cert: https://github.com/monasticacademy/httptap/commit/4288a89504... 2. How it works is explained in the last two paragraphs of the "How It Works" section of the readme: > When a client makes an HTTPS request, it asks the server for evidence that it is who it says it is. If the server has a certificate signed by a certificate authority, it can use that certificate to prove that it is who it says it is. The client will only accept such a certificate if it trusts the certificate authority that signed the certificate. Operating systems, web browsers, and many other pieces of software come with a list of a few hundred certificate authorities that they trust. Many of these pieces of software have ways for users to add additional certificate authorities t

It's a genius idea to run the process in a isolated network namespace! I'm more interested in the HTTPS part. I see that it sets some common environment variables [1] to instruct the program to use the CA bundle in the temporary directory. This seems to pose a similar issue like all the variants of `http_proxy`: the program may simply choose to ignore the variable. I see it also mounts an overlay fs for `/etc/resolv.conf` [2]. Does it help if httptap mounts `/etc/ca-certificates` directory with the temporary CA bundle? [1] https://github.com/monasticacademy/httptap/blob/cb92ee3acfb2... [2] https://github.com/monasticacademy/httptap/blob/cb92ee3acfb2...

Agreed! So there isn't any interface for modifying requests/responses at present, but it's definitely possible given the underlying approach. If you consider [this line of code](https://github.com/monasticacademy/httptap/blob/main/http.go...) where you have an HTTP request parsed from the <command> that ran and are about to send it out to the public internet: you could modify the request (or the response that is received a few lines further) in just the way that you would modify a normal http.Request in Go.

Yeah, for other readers who are looking at this thread, the connection is just that this (httptap) is a Monastic Academy project, and what that means is that there is a group of people living on 123 acres in Vermont according to a fairly traditional Buddhist monastic structure (though we are not ordained monks), and during the day we work on a number of technology and non-technology projects together. The link to the readme that sevg posted above is a good overview: https://github.com/monasticacademy/httptap?tab=readme-ov-fil...

This looks great! The GitHub profile points to https://www.monasticacademy.org/about which I have no particular opinion on but it did leave me wondering what the connection is between their monastic training retreat and their projects on GitHub. Edit: Oh, I didn’t go to the bottom of the readme https://github.com/monasticacademy/httptap?tab=readme-ov-fil...