Adding HTTP/3 Support

cmd/offat/flag.go

@@ -38,6 +38,7 @@ type FlagConfig struct {
 	OutputFilePath    *string
 
 	HTTP2 *bool
+	HTTP3 *bool
 }
 
 // Custom type for headers

cmd/offat/main.go

@@ -72,6 +72,7 @@ func main() {
 	config.AvoidImmuneFilter = flag.Bool("ai", true, "does not filter immune endpoint from results if used. usage: -ai=true/false")
 
 	config.HTTP2 = flag.Bool("http2", false, "enable HTTP/2 support")
+	config.HTTP3 = flag.Bool("http3", false, "enable HTTP/3 support")
 
 	flag.Parse()
 
@@ -118,6 +119,8 @@ func main() {
 	var hc c.ClientInterface // changed hc to interface
 	if config.HTTP2 != nil && *config.HTTP2 {
 		hc = http.NewConfigHttp2(config.RequestsPerSecond, config.SkipTlsVerification, config.Proxy)
+	} else if config.HTTP3 != nil && *config.HTTP3 {
+		hc = http.NewConfigHttp3(config.RequestsPerSecond, config.SkipTlsVerification, config.Proxy)
 	} else {
 		httpCfg := http.NewConfig(config.RequestsPerSecond, config.SkipTlsVerification, config.Proxy)
 		hc = http.NewHttp(httpCfg).Client.FHClient

go.mod

@@ -7,13 +7,27 @@ require (
 	github.com/getkin/kin-openapi v0.127.0
 	github.com/k0kubun/go-ansi v0.0.0-20180517002512-3bf9e2903213
 	github.com/olekukonko/tablewriter v0.0.5
+	github.com/quic-go/quic-go v0.48.1
 	github.com/rs/zerolog v1.33.0
 	github.com/schollz/progressbar/v3 v3.14.6
 	github.com/valyala/fasthttp v1.55.0
 	golang.org/x/term v0.24.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
+require (
+	github.com/francoispqt/gojay v1.2.13 // indirect
+	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
+	github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect
+	github.com/onsi/ginkgo/v2 v2.9.5 // indirect
+	github.com/quic-go/qpack v0.5.1 // indirect
+	go.uber.org/mock v0.4.0 // indirect
+	golang.org/x/crypto v0.27.0 // indirect
+	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 // indirect
+	golang.org/x/mod v0.17.0 // indirect
+	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
+)
+
 require (
 	github.com/andybalholm/brotli v1.1.0 // indirect
 	github.com/bytedance/gopkg v0.1.1 // indirect

pkg/http/http2.go

@@ -1,114 +1,15 @@
 package http
 
 import (
-	"bytes"
 	"crypto/tls"
-	"fmt"
-	"io"
 	"net/http"
 	"net/url"
 	"time"
 
-	"github.com/dmdhrumilmistry/fasthttpclient/client"
-	"github.com/li-jin-gou/http2curl"
 	"github.com/rs/zerolog/log"
 	"golang.org/x/net/http2"
-	"golang.org/x/time/rate"
 )
 
-type ThrottledTransport struct {
-	roundTripperWrap http.RoundTripper
-	ratelimiter      *rate.Limiter
-}
-
-type CustomClient struct {
-	Requests  []*client.Request
-	Responses []*client.ConcurrentResponse
-	Client    *http.Client
-}
-
-func GetResponseHeaders(resp *http.Response) map[string]string {
-	headers := make(map[string]string)
-	for header, value := range resp.Header {
-		headers[header] = value[0]
-	}
-	return headers
-}
-
-func SetRequestBody(body interface{}, req *http.Request) error {
-	if body == nil {
-		return nil
-	}
-
-	bodyBytes, ok := body.([]byte)
-	if !ok {
-		return fmt.Errorf("body only supports []byte type")
-	} else {
-		req.Body = io.NopCloser(bytes.NewReader(bodyBytes))
-	}
-	return nil
-}
-
-func (c *CustomClient) Do(uri string, method string, queryParams any, headers any, reqBody any) (*client.Response, error) {
-	req, err := http.NewRequest(method, uri, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	queryParamsMap, ok := queryParams.(map[string]string)
-	if !ok && queryParams != nil {
-		return nil, fmt.Errorf("queryParams must be a map[string]string")
-	} else {
-		for key, value := range queryParamsMap {
-			req.Header.Add(key, value)
-		}
-	}
-
-	err = SetRequestBody(reqBody, req)
-	if err != nil {
-		return nil, err
-	}
-
-	curlCmd := "error generating curl command"
-	curlCmdObj, err := http2curl.GetCurlCommand(req)
-	if err == nil {
-		curlCmd = curlCmdObj.String()
-	}
-
-	now := time.Now()
-	resp, err := c.Client.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	elapsed := time.Since(now)
-
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, err
-	}
-	respHeaders := GetResponseHeaders(resp)
-	statusCode := resp.StatusCode
-
-	return &client.Response{StatusCode: statusCode, Body: body, Headers: respHeaders, CurlCommand: curlCmd, TimeElapsed: elapsed}, nil
-}
-
-// RoundTrip method implements the rate limiting logic for HTTP requests
-func (c *ThrottledTransport) RoundTrip(r *http.Request) (*http.Response, error) {
-	err := c.ratelimiter.Wait(r.Context()) // This is a blocking call. Honors the rate limit
-	if err != nil {
-		return nil, err
-	}
-	return c.roundTripperWrap.RoundTrip(r)
-}
-
-// NewThrottledTransport wraps the provided transport with a rate limiter
-func NewThrottledTransport(limitPeriod time.Duration, requestCount int, transportWrap http.RoundTripper) http.RoundTripper {
-	return &ThrottledTransport{
-		roundTripperWrap: transportWrap,
-		ratelimiter:      rate.NewLimiter(rate.Every(limitPeriod), requestCount),
-	}
-}
-
 func NewConfigHttp2(requestsPerSecond *int, skipTlsVerification *bool, proxy *string) *CustomClient {
 	tlsConfig := &tls.Config{
 		InsecureSkipVerify: *skipTlsVerification,

pkg/http/http3.go

@@ -0,0 +1,52 @@
+package http
+
+import (
+	"crypto/tls"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/quic-go/quic-go/qlog"
+	"github.com/rs/zerolog/log"
+)
+
+func NewConfigHttp3(requestsPerSecond *int, skipTlsVerification *bool, proxy *string) *CustomClient {
+	tlsConfig := &tls.Config{
+		InsecureSkipVerify: *skipTlsVerification,
+		MinVersion:         tls.VersionTLS12,
+		CipherSuites: []uint16{
+			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
+			tls.TLS_AES_128_GCM_SHA256,       // TLS 1.3
+			tls.TLS_AES_256_GCM_SHA384,       // TLS 1.3
+			tls.TLS_CHACHA20_POLY1305_SHA256, // TLS 1.3
+		},
+		PreferServerCipherSuites: true,
+	}
+
+	var transport *http3.Transport
+	if *proxy != "" {
+		log.Error().Msgf("Cannot use proxy with HTTP/3")
+		os.Exit(1)
+	} else {
+		transport = &http3.Transport{
+			TLSClientConfig: tlsConfig,
+			QUICConfig: &quic.Config{
+				Tracer: qlog.DefaultConnectionTracer,
+			},
+		}
+	}
+
+	rateLimitedTransport := NewThrottledTransport(1*time.Second, *requestsPerSecond, transport)
+
+	client := http.Client{
+		Transport: rateLimitedTransport,
+	}
+
+	return &CustomClient{
+		Client: &client,
+	}
+}

pkg/http/http3_test.go

@@ -0,0 +1,32 @@
+package http_test
+
+import (
+	"testing"
+
+	c "github.com/dmdhrumilmistry/fasthttpclient/client"
+	"github.com/owasp-offat/offat/pkg/http"
+	"github.com/valyala/fasthttp"
+)
+
+func TestHttp3Client(t *testing.T) {
+	// http2 client
+	requestsPerSecond := 10
+	skipTlsVerification := false
+	proxy := ""
+	hc := http.NewConfigHttp3(&requestsPerSecond, &skipTlsVerification, &proxy)
+
+	url := "https://cloudflare-quic.com/" // This is a QUIC enabled website
+	hc.Requests = append(hc.Requests, c.NewRequest(url, fasthttp.MethodGet, nil, nil, nil))
+	hc.Requests = append(hc.Requests, c.NewRequest(url, fasthttp.MethodGet, nil, nil, nil))
+
+	t.Run("Concurrent Requests Test", func(t *testing.T) {
+		hc.Responses = c.MakeConcurrentRequests(hc.Requests, hc)
+
+		for _, connResp := range hc.Responses {
+			if connResp.Error != nil {
+				t.Fatalf("failed to make concurrent request: %v\n", connResp.Error)
+			}
+		}
+	})
+
+}

pkg/http/structs.go

@@ -1,8 +1,16 @@
 package http
 
 import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
 	"github.com/dmdhrumilmistry/fasthttpclient/client"
+	"github.com/li-jin-gou/http2curl"
 	"github.com/valyala/fasthttp"
+	"golang.org/x/time/rate"
 )
 
 type Config struct {
@@ -16,3 +24,97 @@ type Http struct {
 	Config    *Config
 	Client    *client.RateLimitedClient
 }
+
+type ThrottledTransport struct {
+	roundTripperWrap http.RoundTripper
+	ratelimiter      *rate.Limiter
+}
+
+type CustomClient struct {
+	Requests  []*client.Request
+	Responses []*client.ConcurrentResponse
+	Client    *http.Client
+}
+
+func GetResponseHeaders(resp *http.Response) map[string]string {
+	headers := make(map[string]string)
+	for header, value := range resp.Header {
+		headers[header] = value[0]
+	}
+	return headers
+}
+
+func SetRequestBody(body interface{}, req *http.Request) error {
+	if body == nil {
+		return nil
+	}
+
+	bodyBytes, ok := body.([]byte)
+	if !ok {
+		return fmt.Errorf("body only supports []byte type")
+	} else {
+		req.Body = io.NopCloser(bytes.NewReader(bodyBytes))
+	}
+	return nil
+}
+
+func (c *CustomClient) Do(uri string, method string, queryParams any, headers any, reqBody any) (*client.Response, error) {
+	req, err := http.NewRequest(method, uri, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	queryParamsMap, ok := queryParams.(map[string]string)
+	if !ok && queryParams != nil {
+		return nil, fmt.Errorf("queryParams must be a map[string]string")
+	} else {
+		for key, value := range queryParamsMap {
+			req.Header.Add(key, value)
+		}
+	}
+
+	err = SetRequestBody(reqBody, req)
+	if err != nil {
+		return nil, err
+	}
+
+	curlCmd := "error generating curl command"
+	curlCmdObj, err := http2curl.GetCurlCommand(req)
+	if err == nil {
+		curlCmd = curlCmdObj.String()
+	}
+
+	now := time.Now()
+	resp, err := c.Client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	elapsed := time.Since(now)
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	respHeaders := GetResponseHeaders(resp)
+	statusCode := resp.StatusCode
+
+	// fmt.Println("Response Protocol: ", resp.Proto)
+	return &client.Response{StatusCode: statusCode, Body: body, Headers: respHeaders, CurlCommand: curlCmd, TimeElapsed: elapsed}, nil
+}
+
+// RoundTrip method implements the rate limiting logic for HTTP requests
+func (c *ThrottledTransport) RoundTrip(r *http.Request) (*http.Response, error) {
+	err := c.ratelimiter.Wait(r.Context()) // This is a blocking call. Honors the rate limit
+	if err != nil {
+		return nil, err
+	}
+	return c.roundTripperWrap.RoundTrip(r)
+}
+
+// NewThrottledTransport wraps the provided transport with a rate limiter
+func NewThrottledTransport(limitPeriod time.Duration, requestCount int, transportWrap http.RoundTripper) http.RoundTripper {
+	return &ThrottledTransport{
+		roundTripperWrap: transportWrap,
+		ratelimiter:      rate.NewLimiter(rate.Every(limitPeriod), requestCount),
+	}
+}