Client error in server replay mode with large flow

[christoph-blessing]

Problem Description

Curl throws an error when running mitmdump in server replay mode and downloading a large file. The error is: curl: (56) Recv failure: Connection reset by peer This also happens with wget and downloading smaller files from the same server works fine.

Steps to reproduce the behavior:

1. Run mitmdump saving intercepted flows to file:
   mitmdump --save-stream-file=Isabelle2024_linux.tar.gz.mitm

2. Download large file:
   curl --proxy http://127.0.0.1:8080 --location https://isabelle.in.tum.de/dist/Isabelle2024_linux.tar.gz > Isabelle2024_linux.tar.gz

3. Restart mitmdump it in server replay mode:
   mitmdump --server-replay Isabelle2024_linux.tar.gz.mitm

4. Try download again:
   curl --proxy http://127.0.0.1:8080 --location https://isabelle.in.tum.de/dist/Isabelle2024_linux.tar.gz > Isabelle2024_linux.tar.gz

System Information

Mitmproxy: 12.0.0.dev (+2, commit 35bcadd)
Python:    3.12.8
OpenSSL:   OpenSSL 3.4.1 11 Feb 2025
Platform:  Linux-6.13.2-x86_64-with-glibc2.40

Checklist

• This bug affects the latest mitmproxy release.

[mhils]

Do you see any errors in mitmproxy/mitmdump? Does this also affect plaintext HTTP? If yes, does Wireshark show anything that sticks out?

[christoph-blessing]

No errors.

This is the mitmdump output in the failure case:

(.venv) ~/projects/mitmproxy: mitmdump --server-replay Isabelle2024_linux.tar.gz.mitm
[17:05:46.871] HTTP(S) proxy listening at *:8080.
[17:06:17.176][127.0.0.1:43080] client connect
[17:06:17.217][127.0.0.1:43080] server connect isabelle.in.tum.de:443 ([2a09:80c0:46::82]:443)
127.0.0.1:43080: GET https://isabelle.in.tum.de/dist/Isabelle2024_linux.tar.gz HTTP/2.0
[replay] << HTTP/2.0 200 OK 659m

And this in the success case:

(.venv) ~/projects/mitmproxy: mitmdump --server-replay isabelle_fonts-20211004.tar.gz.mitm
[17:10:11.127] HTTP(S) proxy listening at *:8080.
[17:10:26.621][127.0.0.1:38358] client connect
[17:10:26.663][127.0.0.1:38358] server connect isabelle.in.tum.de:443 ([2a09:80c0:46::82]:443)
127.0.0.1:38358: GET https://isabelle.in.tum.de/dist/contrib/isabelle_fonts-20211004.tar.gz HTTP/2.0
[replay] << HTTP/2.0 200 OK 3.1m
[17:10:26.731][127.0.0.1:38358] client disconnect
[17:10:26.732][127.0.0.1:38358] server disconnect isabelle.in.tum.de:443 ([2a09:80c0:46::82]:443)

[mhils]

A related question would be if this still happens with http2=false.

[christoph-blessing]

Testing with http2=false

Start mitmdump:

(.venv) ~/projects/mitmproxy: mitmdump --save-stream-file 'Isabelle2024_linux.tar.gz-no-http2.mitm' --set=http2=false
[17:34:12.662] HTTP(S) proxy listening at *:8080.
[17:34:31.087][127.0.0.1:44058] client connect
[17:34:31.164][127.0.0.1:44058] server connect isabelle.in.tum.de:443 ([2a09:80c0:46::82]:443)
127.0.0.1:44058: GET https://isabelle.in.tum.de/dist/Isabelle2024_linux.tar.gz
              << 200 OK 659m
[17:34:41.797][127.0.0.1:44058] client disconnect
[17:34:41.797][127.0.0.1:44058] server disconnect isabelle.in.tum.de:443 ([2a09:80c0:46::82]:443)

Download file:

projects/mitmproxy: curl --proxy http://127.0.0.1:8080 --location https://isabelle.in.tum.de/dist/Isabelle2024_linux.tar.gz > isabelle.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  659M  100  659M    0     0  61.5M      0  0:00:10  0:00:10 --:--:--  145M

Restart for server replay:

(.venv) ~/projects/mitmproxy: mitmdump --server-replay Isabelle2024_linux.tar.gz-no-http2.mitm --set=http2=false
[17:36:01.621] HTTP(S) proxy listening at *:8080.
[17:36:11.108][127.0.0.1:38910] client connect
[17:36:11.189][127.0.0.1:38910] server connect isabelle.in.tum.de:443 ([2a09:80c0:46::82]:443)
127.0.0.1:38910: GET https://isabelle.in.tum.de/dist/Isabelle2024_linux.tar.gz
[replay]      << 200 OK 659m

Download again:

~/projects/mitmproxy: curl --proxy http://127.0.0.1:8080 --location https://isabelle.in.tum.de/dist/Isabelle2024_linux.tar.gz > isabelle.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  1  659M    1 11.8M    0     0  3357k      0  0:03:21  0:00:03  0:03:18 3356k
curl: (56) OpenSSL SSL_read: SSL_ERROR_SYSCALL, errno 0

[christoph-blessing]

Using --http1.1 with curl leads to a successful replay.

[mhils]

Thanks, super helpful. Can you confirm that --set keepserving fixes the issue for you as well?

[christoph-blessing]

Actually I tried it a few more times now with --http1.1 and now curl gives me this error every time:
curl: (56) OpenSSL SSL_read: SSL_ERROR_SYSCALL, errno 0

I could have sworn it was working the first time though...

[christoph-blessing]

Okay but just using --set keepserving really seems to fix it.

[christoph-blessing]

So the problem was that mitmproxy would close the connection after replaying the last flow before all the data had been transferred, correct?

[mhils]

So the problem was that mitmproxy would close the connection after replaying the last flow before all the data had been transferred, correct?

Yes, correct. #7571 has a fix!