Capture network traffic of http3 quic using eCapture #703

cfc4n · 2024-12-23T15:58:33Z

cfc4n
Dec 23, 2024
Maintainer

Golang TLS

http3 Client

golang code：

Click here to expand/collapse

package main

import (
	"context"
	"crypto/tls"
	"flag"
	"fmt"
	"io"
	"log"
	"net/http"
	"time"

	"github.com/quic-go/quic-go"
	"github.com/quic-go/quic-go/http3"
)

type Config struct {
	url      string
	method   string
	timeout  time.Duration
	insecure bool
	verbose  bool
	headers  []string
}

func main() {
	// 解析命令行参数
	cfg := parseFlags()

	// 创建 HTTP/3 客户端
	client := createHTTP3Client(cfg)
	defer client.Close()

	// 发送请求
	if err := sendRequest(client, cfg); err != nil {
		log.Fatal(err)
	}
}

func parseFlags() *Config {
	cfg := &Config{}

	flag.StringVar(&cfg.url, "url", "", "Target 求URL")
	flag.StringVar(&cfg.method, "method", "GET", "HTTP method方法")
	flag.DurationVar(&cfg.timeout, "timeout", 30*time.Second, "TimeOut间")
	flag.BoolVar(&cfg.insecure, "insecure", false, "InsecureSkipVerify")
	flag.BoolVar(&cfg.verbose, "verbose", false, "显示详细print response息")

	flag.Parse()

	if cfg.url == "" {
		log.Fatal("please set URL")
	}

	return cfg
}

func createHTTP3Client(cfg *Config) *http3.RoundTripper {
	return &http3.RoundTripper{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: cfg.insecure,
		},
		QUICConfig: &quic.Config{
			MaxIdleTimeout:  cfg.timeout,
			KeepAlivePeriod: 10 * time.Second,
		},
	}
}

func sendRequest(client *http3.RoundTripper, cfg *Config) error {
	// 创建 context
	ctx, cancel := context.WithTimeout(context.Background(), cfg.timeout)
	defer cancel()

	// 创建请求
	req, err := http.NewRequestWithContext(ctx, cfg.method, cfg.url, nil)
	if err != nil {
		return fmt.Errorf("创request error: %v", err)
	}

	// 添加默认 headers
	req.Header.Set("User-Agent", "HTTP3-Client/1.0")

	// 发送请求
	if cfg.verbose {
		fmt.Printf("正Method: %s, Url:求到 %s\n", cfg.method, cfg.url)
	}

	start := time.Now()
	resp, err := client.RoundTrip(req)
	if err != nil {
		return fmt.Errorf("Send http request error: %v", err)
	}
	defer resp.Body.Close()

	duration := time.Since(start)

	// 打印响应信息
	printResponse(resp, duration, cfg.verbose)

	return nil
}

func printResponse(resp *http.Response, duration time.Duration, verbose bool) {
	fmt.Printf("\n状态码: %d\n", resp.StatusCode)
	fmt.Printf("协议: %s\n", resp.Proto)
	fmt.Printf("duration: %v\n", duration)

	if verbose {
		fmt.Println("\n响response头:")
		for key, values := range resp.Header {
			for _, value := range values {
				fmt.Printf("%s: %s\n", key, value)
			}
		}
	}

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Printf("读取响read response error: %v\n", err)
		return
	}

	fmt.Printf("\n响Body length: %d bytes\n", len(body))
	if verbose {
		fmt.Printf("\n响response body体:\n%s\n", string(body))
	}
}

Run golang http3 Client

run command ./golang-http3 -url=https://quic.tech:8443 -verbose

Click here to expand/collapse


./golang-http3 -url=https://quic.tech:8443 -verbose
Method: GET, Url: https://quic.tech:8443

Status: 200
Protocol: HTTP/3.0
Duration: 499.811953ms

response:
Server: quiche
Content-Length: 462

Body length: 462 bytes

response body:
<!DOCTYPE html>

<html>
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">

    <link rel="shortcut icon" href="/quic.ico" type="image/x-icon">

    <style>
    img {
        position: absolute;
        margin: auto;
        top: 0;
        left: 0;
        right: 0;
        bottom: 0;
    }
    </style>

    <title>quic.tech</title>
</head>

<body>
    <div class="cont">
        <img src="/quic.svg" />
    </div>
</body>
</html>

view eCapture pcapng

OpenSSL

TODO

yinghli · 2024-12-27T06:27:32Z

yinghli
Dec 27, 2024

Curl with BoringSSL, http3 ecapture testing record

Debian 12. Packet captured in client.

Install curl with boringSSL and http3 support.

brew install cloudflare/homebrew-cloudflare/curl

check curl version with http3 support and libcurl.so.4 file locations(/home/linuxbrew/.linuxbrew/Cellar/curl/8.11.1/lib/libcurl.so.4).

curl -V
curl 8.11.1 (x86_64-pc-linux-gnu) libcurl/8.11.1 BoringSSL zlib/1.3.1 brotli/1.1.0 zstd/1.5.6 libidn2/2.3.7 libssh2/1.11.1 nghttp2/1.64.0 quiche/0.22.0 librtmp/2.3 OpenLDAP/2.6.9
Release-Date: 2024-12-11
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM SPNEGO SSL threadsafe UnixSockets zstd

curl-config --static-libs
/home/linuxbrew/.linuxbrew/Cellar/curl/8.11.1/lib/libcurl.a -L/tmp/curl-20241226-19987-4y3lq8/curl-8.11.1/quiche/quiche/deps/boringssl/src/lib -L/home/linuxbrew/.linuxbrew/Cellar/libssh2/1.11.1/lib -L/home/linuxbrew/.linuxbrew/Cellar/rtmpdump/2.4-20151223_3/lib -L/home/linuxbrew/.linuxbrew/Cellar/openssl@3/3.4.0/lib -L/home/linuxbrew/.linuxbrew/Cellar/libidn2/2.3.7/lib -L/home/linuxbrew/.linuxbrew/Cellar/libnghttp2/1.64.0/lib -L/tmp/curl-20241226-19987-4y3lq8/curl-8.11.1/quiche/target/release -lquiche -lnghttp2 -lidn2 -lrtmp -lz -lssl -lcrypto -lssh2 -lssh2 -lssl -lcrypto -L/home/linuxbrew/.linuxbrew/Cellar/krb5/1.21.3/lib -lgssapi_krb5 -lldap -llber -lzstd -lbrotlidec -lz

Run ecapture with related libssl and ssl-version

sudo ecapture tls -m pcap -i ens3 port 443 --ssl_version="boringssl 1.1.1" --libssl="/home/linuxbrew/.linuxbrew/Cellar/curl/8.11.1/lib/libcurl.so.4"

Run curl with command

curl -svo /dev/null --http3-only  https://www.google.com

Capture completed

Stop ecapture and check default save.pcapng with wireshark.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Capture network traffic of http3 quic using eCapture #703

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 1 comment

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Capture network traffic of http3 quic using eCapture #703

cfc4n Dec 23, 2024 Maintainer

Golang TLS

http3 Client

Run golang http3 Client

view eCapture pcapng

OpenSSL

Replies: 1 comment

yinghli Dec 27, 2024

Curl with BoringSSL, http3 ecapture testing record

Install curl with boringSSL and http3 support.

Run ecapture with related libssl and ssl-version

Run curl with command

Capture completed

cfc4n
Dec 23, 2024
Maintainer

yinghli
Dec 27, 2024