{"action":"created","issue":{"url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/3024","repository_url":"https://api.github.com/repos/mitmproxy/mitmproxy","labels_url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/3024/labels{/name}","comments_url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/3024/comments","events_url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/3024/events","html_url":"https://github.com/mitmproxy/mitmproxy/issues/3024","id":310081670,"number":3024,"title":"allow_remote=false does not prevent remote access","user":{"login":"vfaronov","id":300211,"avatar_url":"https://avatars0.githubusercontent.com/u/300211?v=4","gravatar_id":"","url":"https://api.github.com/users/vfaronov","html_url":"https://github.com/vfaronov","followers_url":"https://api.github.com/users/vfaronov/followers","following_url":"https://api.github.com/users/vfaronov/following{/other_user}","gists_url":"https://api.github.com/users/vfaronov/gists{/gist_id}","starred_url":"https://api.github.com/users/vfaronov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vfaronov/subscriptions","organizations_url":"https://api.github.com/users/vfaronov/orgs","repos_url":"https://api.github.com/users/vfaronov/repos","events_url":"https://api.github.com/users/vfaronov/events{/privacy}","received_events_url":"https://api.github.com/users/vfaronov/received_events","type":"User","site_admin":false},"labels":[{"id":429899720,"url":"https://api.github.com/repos/mitmproxy/mitmproxy/labels/area/addons","name":"area/addons","color":"fef2c0","default":false},{"id":79336502,"url":"https://api.github.com/repos/mitmproxy/mitmproxy/labels/kind/bug","name":"kind/bug","color":"d93f0b","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-03-30T14:37:01Z","updated_at":"2018-05-05T11:18:52Z","closed_at":null,"author_association":"NONE","body":"##### Steps to reproduce the problem:\r\n\r\n1. Run mitmproxy on a publicly routable host, with default configuration including `listen_host=\"\"`, `listen_port=8080`, and `allow_remote=false`.\r\n2. From a host on a different network, send a request through that instance of mitmproxy, e.g. with `curl --proxy http://your-host.example:8080`\r\n\r\nThe default `allow_remote=false` should prevent this request from succeeding. However, it is served by mitmproxy just fine.\r\n\r\n##### Any other comments? What have you tried so far?\r\n\r\nI have a laptop sitting in the “DMZ” of a home router, which is globally IPv4 routable. I also have a VPS which is globally IPv4 routable. Both the laptop and the VPS are running Ubuntu 16.04 “Xenial Xerus”. I can reproduce the problem with mitmproxy running on the VPS and curl on the laptop, as well as vice-versa.\r\n\r\nBoth tcpdump and mitmproxy’s own Details pane show the request as originating from a remote network.\r\n\r\nI only noticed this because I saw strange flows in a mitmproxy instance that I spun up on the laptop.\r\n\r\n##### System information\r\n\r\nMitmproxy: 3.0.3 binary\r\nPython:    3.5.2\r\nOpenSSL:   OpenSSL 1.1.0g  2 Nov 2017\r\nPlatform:  Linux-4.4.0-116-generic-x86_64-with-debian-stretch-sid\r\n"},"comment":{"url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/comments/386798269","html_url":"https://github.com/mitmproxy/mitmproxy/issues/3024#issuecomment-386798269","issue_url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/3024","id":386798269,"user":{"login":"Kriechi","id":114300,"avatar_url":"https://avatars1.githubusercontent.com/u/114300?v=4","gravatar_id":"","url":"https://api.github.com/users/Kriechi","html_url":"https://github.com/Kriechi","followers_url":"https://api.github.com/users/Kriechi/followers","following_url":"https://api.github.com/users/Kriechi/following{/other_user}","gists_url":"https://api.github.com/users/Kriechi/gists{/gist_id}","starred_url":"https://api.github.com/users/Kriechi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kriechi/subscriptions","organizations_url":"https://api.github.com/users/Kriechi/orgs","repos_url":"https://api.github.com/users/Kriechi/repos","events_url":"https://api.github.com/users/Kriechi/events{/privacy}","received_events_url":"https://api.github.com/users/Kriechi/received_events","type":"User","site_admin":false},"created_at":"2018-05-05T11:18:52Z","updated_at":"2018-05-05T11:18:52Z","author_association":"OWNER","body":"Looks like the check fails because IPv4 source addresses get mapped into IPv6 address with `::ffff:<IPv4>`, and then it apparently becomes a private address range in https://github.com/python/cpython/blob/10b134a07c898c2fbc5fd3582503680a54ed80a2/Lib/ipaddress.py#L2258."}}
{"actor":{"display_login":"Kriechi"}}