Server replay https still go to upstream proxy but http not

[yejianfengblue]

Problem Description

I start mitmdump with an upstream proxy. Replay http request doesn't go to upstream proxy as expected, but replay https request still goes to upstream proxy. Did I do something wrong?

Steps to reproduce the behavior:

1. Create a file to save stream

touch mitmproxy_cache

2. start mitmdump with upstream proxy and save stream to file

mitmdump --mode "upstream:http://localhost:8889" --listen-port 30000 --save-stream-file mitmproxy_cache

3. curl http twice. I don't know why the first response isn't writen to the file

curl --proxy http://localhost:30000 --insecure http://example.com

127.0.0.1:60134: client connect
127.0.0.1:60134: server connect localhost:8889 (127.0.0.1:8889)
127.0.0.1:60134: GET http://example.com/
              << 200 OK 1.23k
127.0.0.1:60134: client disconnect
127.0.0.1:60134: server disconnect localhost:8889 (127.0.0.1:8889)

4. curl https

curl --proxy http://localhost:30000 --insecure https://example.com

127.0.0.1:60144: client connect
127.0.0.1:60144: server connect localhost:8889 (127.0.0.1:8889)
127.0.0.1:60144: GET https://example.com/ HTTP/2.0
     << HTTP/2.0 200 OK 1.23k
127.0.0.1:60144: client disconnect
127.0.0.1:60144: server disconnect localhost:8889 (127.0.0.1:8889)

Now I have this file
mitmproxy_cache.zip

5. restart mitmdump with upstream proxy and server replay

mitmdump --mode "upstream:http://localhost:8889" --listen-port 30000 --server-replay mitmproxy_cache --server-replay-nopop

6. curl http is replayed and traffic doesn't go to upstream proxy. See the indication [replay]

curl --proxy http://localhost:30000 --insecure http://example.com

127.0.0.1:60334: client connect
127.0.0.1:60334: GET http://example.com/
[replay]      << 200 OK 1.23k
127.0.0.1:60334: client disconnect

7. curl https is replayed but traffic also go to upstream proxy. See the indication [replay] and server connect localhost:8889

curl --proxy http://localhost:30000 --insecure https://example.com

127.0.0.1:60380: client connect
127.0.0.1:60380: server connect localhost:8889 (127.0.0.1:8889)
127.0.0.1:60380: GET https://example.com/ HTTP/2.0
[replay] << HTTP/2.0 200 OK 1.23k
127.0.0.1:60380: client disconnect
127.0.0.1:60380: server disconnect localhost:8889 (127.0.0.1:8889)

System Information

Mitmproxy: 7.0.4
Python: 3.9.7
OpenSSL: OpenSSL 1.1.1m 14 Dec 2021
Platform: Linux-5.10.68-1-MANJARO-x86_64-with-glibc2.33

[yejianfengblue]

I try a https link whose response is a large file. A connection is established with upstream proxy but the large file is not downloaded from upstream proxy. The large file response is replayed from the replay file.

Although I can't understand why there is still a connection to upstream proxy for https request, the behavior that real traffic doesn't go to upstream proxy already fulfill my requirement.

[mhils]

We don't know in advance if a response can be served locally. For HTTPS connections, mitmproxy thus connects upstream to determine whether HTTP/2 is supported and what the certificate look like. You can change that by setting connection_strategy to lazy and upstream_cert to false. If you do this, you shouldn't see any upstream connection.

[yejianfengblue]

Yes. Thank you.

mitmdump --mode "upstream:http://localhost:8889" --listen-port 30000 --server-replay-nopop --server-replay mitmproxy_cache --set connection_strategy=lazy --set upstream_cert=false