Repository: mitmproxy/mitmproxy

Issue:
Upstream auth for NordVPN does not work
#### Problem Description
Using an upstream authenticated NordVPN proxy does not work. Even though credentials are specified in the command line, the browser still asks for them.

#### Steps to reproduce the behavior:
1. `mitmdump --ssl-insecure --mode "upstream:https://de873.nordvpn.com:89" --upstream-auth "USER:PASS" `
2. `google-chrome --proxy-server="http://localhost:8080"`

```
Proxy server listening at http://*:8080
[::1]:40966: client connect
[::1]:40968: client connect
[::1]:40968: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40966: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40970: client connect
[::1]:40972: client connect
[::1]:40972: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40970: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40974: client connect
[::1]:40974: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40976: client connect
[::1]:40978: client connect
[::1]:40968: POST https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/2.0
 << HTTP/2.0 200 OK 43b
[::1]:40980: client connect
[::1]:40982: client connect
[::1]:40966: GET https://clientservices.googleapis.com/chrome-variations/seed?osname=linux&channel=stable&milestone=92 HTTP/2.0
 << HTTP/2.0 200 OK 24.31k
[::1]:40976: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40978: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40984: client connect
[::1]:40982: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40980: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40986: client connect
[::1]:40988: client connect
[::1]:40984: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40986: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40988: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40974: GET https://ssl.google-analytics.com/ga.js HTTP/2.0
 << HTTP/2.0 200 OK 16.77k
[::1]:40990: client connect
[::1]:40992: client connect
[::1]:40994: client connect
[::1]:40976: GET https://api.github.com/repos/keepassxreboot/keepassxc/releases/latest HTTP/2.0
 << HTTP/2.0 200 OK 3.32k
[::1]:40978: POST https://www.googleapis.com/oauth2/v4/token HTTP/2.0
 << HTTP/2.0 200 OK 1.09k
[::1]:40996: client connect
[::1]:40980: GET https://www.google-analytics.com/analytics.js HTTP/2.0
 << HTTP/2.0 200 OK 19.21k
[::1]:40980: GET https://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=24&utmn=729937857&utmhn=fngmhnnpilhplaeedifhccceomclgfbg&utmcs=UTF-8&utmsr=1920x1080&utmsc=24-bit&utmul… HTTP/2.0
 << HTTP/2.0 302 Found 368b
[::1]:40994: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40990: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40992: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40998: client connect
[::1]:40996: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40984: GET https://cdn.honey.io/standdown-rules.json HTTP/2.0
 << HTTP/2.0 200 OK 16.86k
[::1]:40982: GET https://accounts.google.com/GetCheckConnectionInfo?source=ChromiumBrowser HTTP/2.0
 << HTTP/2.0 200 OK 169b
[::1]:41000: client connect
[::1]:41002: client connect
[::1]:40998: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40988: GET https://safebrowsing.googleapis.com/v4/fullHashes:find?$req=Ch0KDGdvb2dsZWNocm9tZRINOTIuMC40NTE1LjEzMRIbCg0IBxAGGAEiAzAwMTABEMv-CBoCGAZybqRJEhsKDQgFEAYYASIDMDAxMAEQx… HTTP/2.0
 << HTTP/2.0 200 OK 82b
[::1]:41002: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41000: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40990: Client TLS handshake failed. The client disconnected during the handshake. If this happens consistently for d.joinhoney.com, this may indicate that the client does not trust the proxy's certificate.
[::1]:40990: client disconnect
[::1]:40990: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:40992: GET https://d.joinhoney.com/features/pay_now_enabled?serviceName=honey-extension&serviceVersion=13.0.1 HTTP/2.0
 << HTTP/2.0 200 OK 15b
[::1]:40992: GET https://d.joinhoney.com/adb/filter HTTP/2.0
 << HTTP/2.0 200 OK 485b
[::1]:40992: GET https://d.joinhoney.com/features/ext_paypal_heartbeat?serviceName=honey-extension&serviceVersion=13.0.1 HTTP/2.0
 << HTTP/2.0 200 OK 15b
[::1]:41004: client connect
[::1]:41006: client connect
[::1]:41010: client connect
[::1]:41014: client connect
[::1]:40992: GET https://d.joinhoney.com/v3?operationName=ext_getUserInfo&variables=%7B%7D HTTP/2.0
 << HTTP/2.0 401 Unauthorized 26b
[::1]:41004: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40998: GET https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-33054271-5&cid=66718305.1595413759&jid=1562794097&_v=5.7.2&z=729937857 HTTP/2.0
 << HTTP/2.0 200 OK 35b
[::1]:41018: client connect
[::1]:41006: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41014: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41010: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40992: GET https://d.joinhoney.com/extdata/ckdata HTTP/2.0
 << HTTP/2.0 200 OK 2b
[::1]:41018: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41020: client connect
[::1]:41024: client connect
[::1]:41026: client connect
[::1]:41028: client connect
[::1]:41020: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40992: GET https://d.joinhoney.com/v3?operationName=ext_getExperiments&variables=%7B%22platform%22%3A%22ext%22%2C%22archived%22%3Afalse%7D HTTP/2.0
 << HTTP/2.0 200 OK 34.17k
[::1]:40992: GET https://d.joinhoney.com/v3?operationName=checkout_getURLObservationRemoteConfig&variables=%7B%7D HTTP/2.0
 << HTTP/2.0 200 OK 130b
[::1]:41024: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41028: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41026: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41030: client connect
[::1]:40972: Unable to establish TLS connection with server (Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required). Trying to establish TLS with client anyway.
[::1]:40986: Unable to establish TLS connection with server (Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required). Trying to establish TLS with client anyway.
[::1]:40972: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:40986: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:40970: Unable to establish TLS connection with server (Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required). Trying to establish TLS with client anyway.
[::1]:40994: Unable to establish TLS connection with server (Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required). Trying to establish TLS with client anyway.
[::1]:40996: Unable to establish TLS connection with server (Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required). Trying to establish TLS with client anyway.
[::1]:41006: GET https://clients2.google.com/service/update2/crx?os=linux&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=92.0.4515.131&lang=en-US&ac… HTTP/2.0
 << HTTP/2.0 200 OK 448b
[::1]:41002: Unable to establish TLS connection with server (Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required). Trying to establish TLS with client anyway.
[::1]:40986: client disconnect
[::1]:40970: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:40994: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:40996: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41002: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:40994: client disconnect
[::1]:41010: mitmproxy has crashed!
Traceback (most recent call last):
  File "/home/torstein/anaconda3/lib/python3.8/site-packages/mitmproxy/proxy/server.py", line 282, in server_event
    assert command.connection not in self.transports
AssertionError

[::1]:41030: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41014: POST https://android.clients.google.com/c2dm/register3 HTTP/2.0
 << HTTP/2.0 200 OK 158b
[::1]:41014: POST https://android.clients.google.com/checkin HTTP/2.0
 << HTTP/2.0 200 OK 397b
[::1]:40996: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41002: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40972: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40970: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41004: GET https://history.paypal.com/targeting/set-plugin?src=honey
          << 200 OK 59b
[::1]:41028: client disconnect
[::1]:41028: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41026: client disconnect
[::1]:41026: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41014: POST https://android.clients.google.com/c2dm/register3 HTTP/2.0
 << HTTP/2.0 200 OK 167b
[::1]:41014: POST https://android.clients.google.com/c2dm/register3 HTTP/2.0
 << HTTP/2.0 200 OK 168b
[::1]:41020: POST https://s.joinhoney.com/ev/ext000001 HTTP/2.0
 << HTTP/2.0 200 OK 2b
[::1]:41020: POST https://s.joinhoney.com/evs HTTP/2.0
 << HTTP/2.0 200 OK 2b
[::1]:41030: Unable to establish TLS connection with server (Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required). Trying to establish TLS with client anyway.
[::1]:41000: Unable to establish TLS connection with server (Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required). Trying to establish TLS with client anyway.
[::1]:40970: GET https://www.httpbin.org/ip HTTP/2.0
 << Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required
[::1]:40972: POST https://safebrowsing.google.com/safebrowsing/clientreport/realtime HTTP/2.0
 << Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required
[::1]:40996: POST https://oauthaccountmanager.googleapis.com/v1/issuetoken HTTP/2.0
 << Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required
[::1]:41002: GET https://accounts.youtube.com/accounts/CheckConnection?chromeCheckConnection=1&v=284156175 HTTP/2.0
 << Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required
[::1]:41030: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41000: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:40970: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:40972: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:40996: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41002: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41030: client disconnect
[::1]:41018: POST https://update.googleapis.com/service/update2/json?cup2key=11:2131373072&cup2hreq=29bddc46f920bab8cdb45419334543ebc8858a931a2ab51559eb45e9275fee6d HTTP/2.0
 << HTTP/2.0 200 OK 3.28k
[::1]:41032: client connect
[::1]:41032: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41000: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40978: POST https://www.googleapis.com/oauth2/v4/token HTTP/2.0
 << HTTP/2.0 200 OK 353b
[::1]:40970: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:40978: POST https://www.googleapis.com/oauth2/v4/token HTTP/2.0
 << HTTP/2.0 200 OK 347b
[::1]:41034: client connect
[::1]:41036: client connect
[::1]:41036: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41034: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41038: client connect
[::1]:41042: client connect
[::1]:41044: client connect
[::1]:41046: client connect
[::1]:41048: client connect
[::1]:41024: Unable to establish TLS connection with server (Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required). Trying to establish TLS with client anyway.
[::1]:41024: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41024: client disconnect
[::1]:41046: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41042: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41038: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41048: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41044: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41032: GET https://clients2.googleusercontent.com/crx/blobs/Acy1k0aSwbfD1gHSR7DV9HG6UjXpqJ2bHXPyin3BM_eq0vJ9e-NXxb_8MMsXjQi1WL90l1aSTEL5cV_4yM0t8ZMgoVqdMxVLqvQABx44nreL68p0xAUc… HTTP/2.0
 << HTTP/2.0 200 OK 46.56k
[::1]:41018: POST https://update.googleapis.com/service/update2/json HTTP/2.0
 << HTTP/2.0 200 OK 170b
[::1]:41044: Client TLS handshake failed. The client disconnected during the handshake. If this happens consistently for firebaseperusertopics-pa.googleapis.com, this may indicate that the client does not trust the proxy's certificate.
[::1]:41044: client disconnect
[::1]:41044: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41042: client disconnect
[::1]:41042: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:40970: GET https://www.httpbin.org/favicon.ico HTTP/2.0
 << HTTP/2.0 404 Not Found 233b
[::1]:41046: client disconnect
[::1]:41046: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 97b
[::1]:41038: client disconnect
[::1]:41038: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 91b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 100b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 100b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 97b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 96b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 99b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 104b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 98b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 102b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 94b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 103b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 105b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 96b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 93b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 104b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 108b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 113b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 102b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 98b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 106b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 97b
[::1]:41048: POST https://firebaseperusertopics-pa.googleapis.com/v1/perusertopics/8181035976/rel/topics/?subscriber_token=dnsZI3fGpQw:APA91bFhWoT0CyXu5VQdog5Eua5Q03RTEv6ysrCPpUJ54aiJ… HTTP/2.0
 << HTTP/2.0 200 OK 99b
[::1]:41000: GET https://accounts.doubleclick.net/CheckConnection?chromeCheckConnection=1&v=1819058658 HTTP/2.0
 << Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required
[::1]:41000: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:40984: GET https://cdn.honey.io/experiments.json HTTP/2.0
 << HTTP/2.0 200 OK 111.32k
[::1]:41036: Unable to establish TLS connection with server (Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required). Trying to establish TLS with client anyway.
[::1]:41036: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41034: Unable to establish TLS connection with server (Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required). Trying to establish TLS with client anyway.
[::1]:41036: client disconnect
[::1]:41034: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41050: client connect
[::1]:41052: client connect
[::1]:41054: client connect
[::1]:41034: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41052: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41050: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41054: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41052: HEAD http://smctajrvnogvwb/
          << 407 Proxy Authentication Required 0b
[::1]:41052: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41052: client disconnect
[::1]:41050: HEAD http://albefeg/
          << 407 Proxy Authentication Required 0b
[::1]:41050: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41054: HEAD http://kiradqwtwzyikhb/
          << 407 Proxy Authentication Required 0b
[::1]:41054: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41050: client disconnect
[::1]:41054: client disconnect
[::1]:41034: POST https://clients4.google.com/chrome-sync/command/?client=Google+Chrome&client_id=8Y%2Bn4uCpr7joqrFhFEAVdw%3D%3D HTTP/2.0
 << HTTP/2.0 200 OK 21.75k
[::1]:40968: POST https://accounts.google.com/oauth/multilogin?source=ChromiumAccountReconcilorDice&reuseCookies=1&externalCcResult=doubleclick:null,youtube:null HTTP/2.0
 << HTTP/2.0 200 OK 1.16k
[::1]:40968: POST https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/2.0
 << HTTP/2.0 200 OK 197b
[::1]:41014: POST https://android.clients.google.com/c2dm/register3 HTTP/2.0
 << HTTP/2.0 200 OK 166b
[::1]:41014: POST https://android.clients.google.com/c2dm/register3 HTTP/2.0
 << HTTP/2.0 200 OK 166b
[::1]:41034: POST https://clients4.google.com/chrome-sync/command/?client=Google+Chrome&client_id=8Y%2Bn4uCpr7joqrFhFEAVdw%3D%3D HTTP/2.0
 << HTTP/2.0 200 OK 125.57k
[::1]:41034: POST https://clients4.google.com/chrome-sync/command/?client=Google+Chrome&client_id=8Y%2Bn4uCpr7joqrFhFEAVdw%3D%3D HTTP/2.0
 << HTTP/2.0 200 OK 31.34k
[::1]:41006: GET https://clients2.google.com/service/update2/crx?os=linux&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=92.0.4515.131&lang=en-US&ac… HTTP/2.0
 << HTTP/2.0 200 OK 448b
[::1]:41034: POST https://clients4.google.com/chrome-sync/command/?client=Google+Chrome&client_id=8Y%2Bn4uCpr7joqrFhFEAVdw%3D%3D HTTP/2.0
 << HTTP/2.0 200 OK 354b
[::1]:41034: POST https://clients4.google.com/chrome-sync/command/?client=Google+Chrome&client_id=8Y%2Bn4uCpr7joqrFhFEAVdw%3D%3D HTTP/2.0
 << HTTP/2.0 200 OK 898b
[::1]:40992: GET https://d.joinhoney.com/v3?operationName=ext_getSupportedDomains&variables=%7B%7D HTTP/2.0
 << HTTP/2.0 200 OK 1.81m
[::1]:41056: client connect
[::1]:41056: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41056: Unable to establish TLS connection with server (Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required). Trying to establish TLS with client anyway.
[::1]:41056: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41056: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41058: client connect
[::1]:41058: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41058: GET http://www.httpbin.org/ip
          << 407 Proxy Authentication Required 4.96k
[::1]:41058: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41058: client disconnect
[::1]:41060: client connect
[::1]:41056: GET https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=http%3A%2F%2Fwww.httpbin.org%2Fip&oit=3&cp=4&url=https%3A%2F%2Fwww.httpbin.o… HTTP/2.0
 << Upstream proxy de873.nordvpn.com:89 refused HTTP CONNECT request: 407 Proxy Authentication Required
[::1]:41056: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41060: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41060: GET http://www.httpbin.org/ip
          << 407 Proxy Authentication Required 4.96k
[::1]:41060: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41060: client disconnect
[::1]:41062: client connect
[::1]:41062: server connect de873.nordvpn.com (185.220.70.210:89)
[::1]:41062: client disconnect
[::1]:41062: Server TLS handshake failed. connection closed
[::1]:41062: GET http://www.httpbin.org/favicon.ico
 << connection closed
[::1]:41062: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:40988: client disconnect
[::1]:40972: client disconnect
[::1]:40988: server disconnect de873.nordvpn.com (185.220.70.210:89)
[::1]:41034: POST https://clients4.google.com/chrome-sync/command/?client=Google+Chrome&client_id=8Y%2Bn4uCpr7joqrFhFEAVdw%3D%3D HTTP/2.0
 << stream reset by client (CANCEL)
[::1]:40968: client disconnect
[::1]:40974: client disconnect
[::1]:40978: client disconnect
[::1]:41032: GET https://clients2.googleusercontent.com/crx/blobs/Acy1k0Yj5Kgw06-BW554OtkZlHd2iS5w3YnDgN37ZTR5xhCFn0NBbk9nxgZxGRWMRGPYBdDgjgGeKPafBs-NTzCmAxfbMoV4EhecM8j60dkC4KElemE4… HTTP/2.0
 << HTTP/2.0 200 OK (content missing)
 << peer closed connection
[::1]:40982: client disconnect
[::1]:40976: client disconnect
[::1]:40980: client disconnect
[::1]:40984: client disconnect
[::1]:40992: client disconnect
[::1]:40998: client disconnect

```

#### System Information
```
mitmdump --version                                                                                                                         (base) 3.7m
Mitmproxy: 7.0.0
Python:    3.8.8
OpenSSL:   OpenSSL 1.1.1i  8 Dec 2020
Platform:  Linux-5.12.15-200.fc33.x86_64-x86_64-with-glibc2.10
```


Discussion:
Thanks! This is much more useful already. It looks like some requests are getting through, while we get `407 Proxy Authentication Required` for others? Can you confirm this? If so, a full debug log with `-vvv --set proxy_debug` would be tremendously helpful. Feel free to shoot it by email if it contains potententially sensitive data. Upstream auth works fine for me locally, I can't reproduce this yet.

Resolving patch:
diff --git a/mitmproxy/addons/tlsconfig.py b/mitmproxy/addons/tlsconfig.py
--- a/mitmproxy/addons/tlsconfig.py
+++ b/mitmproxy/addons/tlsconfig.py
@@ -106,17 +106,10 @@ def load(self, loader):
 
     def tls_clienthello(self, tls_clienthello: tls.ClientHelloData):
         conn_context = tls_clienthello.context
-        only_non_http_alpns = (
-                conn_context.client.alpn_offers and
-                all(x not in tls.HTTP_ALPNS for x in conn_context.client.alpn_offers)
-        )
         tls_clienthello.establish_server_tls_first = conn_context.server.tls and (
                 ctx.options.connection_strategy == "eager" or
                 ctx.options.add_upstream_certs_to_client_chain or
-                ctx.options.upstream_cert and (
-                        only_non_http_alpns or
-                        not conn_context.client.sni
-                )
+                ctx.options.upstream_cert
         )
 
     def tls_start_client(self, tls_start: tls.TlsStartData) -> None:
@@ -288,7 +281,7 @@ def get_cert(self, conn_context: context.Context) -> certs.CertStoreEntry:
         organization: Optional[str] = None
 
         # Use upstream certificate if available.
-        if conn_context.server.certificate_list:
+        if ctx.options.upstream_cert and conn_context.server.certificate_list:
             upstream_cert = conn_context.server.certificate_list[0]
             try:
                 # a bit clunky: access to .cn can fail, see https://github.com/mitmproxy/mitmproxy/issues/4713
diff --git a/mitmproxy/addons/upstream_auth.py b/mitmproxy/addons/upstream_auth.py
--- a/mitmproxy/addons/upstream_auth.py
+++ b/mitmproxy/addons/upstream_auth.py
@@ -51,7 +51,7 @@ def http_connect_upstream(self, f: http.HTTPFlow):
 
     def requestheaders(self, f: http.HTTPFlow):
         if self.auth:
-            if f.mode == "upstream" and not f.server_conn.via:
+            if ctx.options.mode.startswith("upstream") and f.request.scheme == "http":
                 f.request.headers["Proxy-Authorization"] = self.auth
             elif ctx.options.mode.startswith("reverse"):
                 f.request.headers["Authorization"] = self.auth
diff --git a/mitmproxy/proxy/server.py b/mitmproxy/proxy/server.py
--- a/mitmproxy/proxy/server.py
+++ b/mitmproxy/proxy/server.py
@@ -173,7 +173,7 @@ async def open_connection(self, command: commands.OpenConnection) -> None:
 
                 assert command.connection.peername
                 if command.connection.address[0] != command.connection.peername[0]:
-                    addr = f"{command.connection.address[0]} ({human.format_address(command.connection.peername)})"
+                    addr = f"{human.format_address(command.connection.address)} ({human.format_address(command.connection.peername)})"
                 else:
                     addr = human.format_address(command.connection.address)
                 self.log(f"server connect {addr}")


Test patch:
diff --git a/mitmproxy/test/tflow.py b/mitmproxy/test/tflow.py
--- a/mitmproxy/test/tflow.py
+++ b/mitmproxy/test/tflow.py
@@ -10,7 +10,7 @@
 from wsproto.frame_protocol import Opcode
 
 
-def ttcpflow(client_conn=True, server_conn=True, messages=True, err=None):
+def ttcpflow(client_conn=True, server_conn=True, messages=True, err=None) -> tcp.TCPFlow:
     if client_conn is True:
         client_conn = tclient_conn()
     if server_conn is True:
@@ -91,7 +91,7 @@ def twebsocketflow(messages=True, err=None, close_code=None, close_reason='') ->
     return flow
 
 
-def tflow(client_conn=True, server_conn=True, req=True, resp=None, err=None):
+def tflow(client_conn=True, server_conn=True, req=True, resp=None, err=None) -> http.HTTPFlow:
     """
     @type client_conn: bool | None | mitmproxy.proxy.connection.ClientConnection
     @type server_conn: bool | None | mitmproxy.proxy.connection.ServerConnection
@@ -126,7 +126,7 @@ def __init__(self, client_conn, server_conn, live=None):
         super().__init__("dummy", client_conn, server_conn, live)
 
 
-def tdummyflow(client_conn=True, server_conn=True, err=None):
+def tdummyflow(client_conn=True, server_conn=True, err=None) -> DummyFlow:
     if client_conn is True:
         client_conn = tclient_conn()
     if server_conn is True:
diff --git a/test/mitmproxy/addons/test_upstream_auth.py b/test/mitmproxy/addons/test_upstream_auth.py
--- a/test/mitmproxy/addons/test_upstream_auth.py
+++ b/test/mitmproxy/addons/test_upstream_auth.py
@@ -33,20 +33,18 @@ def test_simple():
         tctx.configure(up, upstream_auth="foo:bar")
 
         f = tflow.tflow()
-        f.mode = "upstream"
-        up.requestheaders(f)
+        up.http_connect_upstream(f)
         assert "proxy-authorization" in f.request.headers
 
         f = tflow.tflow()
         up.requestheaders(f)
         assert "proxy-authorization" not in f.request.headers
+        assert "authorization" not in f.request.headers
+
+        tctx.configure(up, mode="upstream:127.0.0.1")
+        up.requestheaders(f)
+        assert "proxy-authorization" in f.request.headers
 
         tctx.configure(up, mode="reverse:127.0.0.1")
-        f = tflow.tflow()
-        f.mode = "transparent"
         up.requestheaders(f)
         assert "authorization" in f.request.headers
-
-        f = tflow.tflow()
-        up.http_connect_upstream(f)
-        assert "proxy-authorization" in f.request.headers