Upgrade to Pro — share decks privately, control downloads, hide ads and more …

HTTP2とHTTPヘッダインジェクションについて

yasulib
August 29, 2015

 HTTP2とHTTPヘッダインジェクションについて

すみだセキュリティ勉強会 2015#2
2015/08/29

yasulib

August 29, 2015
Tweet

More Decks by yasulib

Other Decks in Technology

Transcript

  1. HTTP/2とは • HTTP/1.1の後継バージョン 皆さんご存知HTTP/1.1 GET / HTTP/1.1 Host: 192.168.11.104 User-Agent:

    Mozilla/5.0 (Windows NT 6.1; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: ja,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Connection: keep-alive HTTP/1.1 200 OK Date: Tue, 14 Jul 2015 02:26:34 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips Content-Length: 96 (一部省略) <html> <head> <title>hello, http2</title> </head> <body> This is test page. </body> </html> 4
  2. HTTP/1.1を見直す理由 • 冗長 効率化してより速く!(サイズだけじゃないけど) 5 GET / HTTP/1.1 Host: 192.168.11.104

    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: ja,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Connection: keep-alive HTTP/1.1 200 OK Date: Tue, 14 Jul 2015 02:26:34 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips Last-Modified: Mon, 25 May 2015 00:31:58 GMT ETag: "60-516dd2341ed5b" Accept-Ranges: bytes Content-Length: 96 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 <html> <head> <title>hello, http2</title> </head> <body> This is test page. </body> </html> HTTP/1.1 ..............dPRI * HTTP/2.0 SM ..............d.................................d............................................%. %... ........A...¥.<[email protected].*/*.z..i....W.............R..... .v..i...R..Jk..¥... .96X..~V......a..i~..Je.......p-¥..b..l..z...jh.......q..m.1h...`..... <html> <head> <title>hello, http2</title> </head> <body> This is test page. </body> </html> .......................... HTTP/2 (nghttpdを使用) 00000000 47 45 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a |GET / HTTP/1.1..| 00000010 48 6f 73 74 3a 20 31 39 32 2e 31 36 38 2e 31 31 |Host: 192.168.11| 00000020 2e 31 30 34 0d 0a 55 73 65 72 2d 41 67 65 6e 74 |.104..User-Agent| 00000030 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 |: Mozilla/5.0 (W| 00000040 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 20 57 |indows NT 6.1; W| 00000050 4f 57 36 34 3b 20 72 76 3a 33 39 2e 30 29 20 47 |OW64; rv:39.0) G| 00000060 65 63 6b 6f 2f 32 30 31 30 30 31 30 31 20 46 69 |ecko/20100101 Fi| 00000070 72 65 66 6f 78 2f 33 39 2e 30 0d 0a 41 63 63 65 |refox/39.0..Acce| 00000080 70 74 3a 20 74 65 78 74 2f 68 74 6d 6c 2c 61 70 |pt: text/html,ap| 00000090 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b |plication/xhtml+| 000000a0 78 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f |xml,application/| 000000b0 78 6d 6c 3b 71 3d 30 2e 39 2c 2a 2f 2a 3b 71 3d |xml;q=0.9,*/*;q=| 000000c0 30 2e 38 0d 0a 41 63 63 65 70 74 2d 4c 61 6e 67 |0.8..Accept-Lang| 000000d0 75 61 67 65 3a 20 6a 61 2c 65 6e 2d 55 53 3b 71 |uage: ja,en-US;q| 000000e0 3d 30 2e 37 2c 65 6e 3b 71 3d 30 2e 33 0d 0a 41 |=0.7,en;q=0.3..A| 000000f0 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 |ccept-Encoding: | 00000100 67 7a 69 70 2c 20 64 65 66 6c 61 74 65 0d 0a 43 |gzip, deflate..C| 00000110 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d |onnection: keep-| 00000120 61 6c 69 76 65 0d 0a 0d 0a 48 54 54 50 2f 31 2e |alive....HTTP/1.| 00000130 31 20 32 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 |1 200 OK..Date: | 00000140 54 75 65 2c 20 31 34 20 4a 75 6c 20 32 30 31 35 |Tue, 14 Jul 2015| 00000150 20 30 32 3a 32 36 3a 33 34 20 47 4d 54 0d 0a 53 | 02:26:34 GMT..S| 00000160 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e |erver: Apache/2.| 00000170 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 |4.6 (CentOS) Ope| 00000180 6e 53 53 4c 2f 31 2e 30 2e 31 65 2d 66 69 70 73 |nSSL/1.0.1e-fips| 00000190 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a |..Last-Modified:| 000001a0 20 4d 6f 6e 2c 20 32 35 20 4d 61 79 20 32 30 31 | Mon, 25 May 201| 000001b0 35 20 30 30 3a 33 31 3a 35 38 20 47 4d 54 0d 0a |5 00:31:58 GMT..| 000001c0 45 54 61 67 3a 20 22 36 30 2d 35 31 36 64 64 32 |ETag: "60-516dd2| 000001d0 33 34 31 65 64 35 62 22 0d 0a 41 63 63 65 70 74 |341ed5b"..Accept| 000001e0 2d 52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a |-Ranges: bytes..| 000001f0 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 |Content-Length: | 00000200 39 36 0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 20 |96..Keep-Alive: | 00000210 74 69 6d 65 6f 75 74 3d 35 2c 20 6d 61 78 3d 31 |timeout=5, max=1| 00000220 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 |00..Connection: | 00000230 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e 74 |Keep-Alive..Cont| 00000240 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 |ent-Type: text/h| 00000250 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 |tml; charset=UTF| 00000260 2d 38 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 |-8....<html>.<he| 00000270 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 68 65 6c |ad>. <title>hel| 00000280 6c 6f 2c 20 68 74 74 70 32 3c 2f 74 69 74 6c 65 |lo, http2</title| 00000290 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e |>.</head>.<body>| 000002a0 0a 20 20 54 68 69 73 20 69 73 20 74 65 73 74 20 |. This is test | 000002b0 70 61 67 65 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f |page..</body>.</| 000002c0 68 74 6d 6c 3e |html>| 000002c5 00000000 00 00 06 04 00 00 00 00 00 00 03 00 00 00 64 50 |..............dP| 00000010 52 49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a 0d |RI * HTTP/2.0...| 00000020 0a 53 4d 0d 0a 0d 0a 00 00 0c 04 00 00 00 00 00 |.SM.............| 00000030 00 03 00 00 00 64 00 04 00 00 ff ff 00 00 05 02 |.....d..........| 00000040 00 00 00 00 03 00 00 00 00 c8 00 00 05 02 00 00 |................| 00000050 00 00 05 00 00 00 00 64 00 00 05 02 00 00 00 00 |.......d........| 00000060 07 00 00 00 00 00 00 00 05 02 00 00 00 00 09 00 |................| 00000070 00 00 07 00 00 00 05 02 00 00 00 00 0b 00 00 00 |................| 00000080 03 00 00 00 25 01 25 00 00 00 0d 00 00 00 0b 0f |....%.%.........| 00000090 82 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 53 |...A...¥.<[email protected]| 000000a0 03 2a 2f 2a 90 7a 89 aa 69 d2 9a c4 c0 57 02 e0 |.*/*.z..i....W..| 000000b0 00 00 00 04 01 00 00 00 00 00 00 52 01 04 00 00 |...........R....| 000000c0 00 0d 88 76 8f aa 69 d2 9a e4 52 a9 a7 4a 6b 13 |...v..i...R..Jk.| 000000d0 01 5c 0b 83 0f 0d 02 39 36 58 89 a4 7e 56 1c c5 |.¥.....96X..~V..| 000000e0 81 97 00 0f 61 96 df 69 7e 94 0b 4a 65 b6 85 04 |....a..i~..Je...| 000000f0 00 b6 a0 05 70 2d 5c 13 ca 62 d1 bf 6c 96 d0 7a |....p-¥..b..l..z| 00000100 be 94 13 6a 68 1f a5 04 00 b6 a0 01 71 90 dc 6d |...jh.......q..m| 00000110 e5 31 68 df 00 00 60 00 01 00 00 00 0d 3c 68 74 |.1h...`......<ht| 00000120 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 |ml>.<head>. <ti| 00000130 74 6c 65 3e 68 65 6c 6c 6f 2c 20 68 74 74 70 32 |tle>hello, http2| 00000140 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e |</title>.</head>| 00000150 0a 3c 62 6f 64 79 3e 0a 20 20 54 68 69 73 20 69 |.<body>. This i| 00000160 73 20 74 65 73 74 20 70 61 67 65 2e 0a 3c 2f 62 |s test page..</b| 00000170 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 00 00 00 |ody>.</html>....| 00000180 04 01 00 00 00 00 00 00 08 07 00 00 00 00 00 00 |................| 00000190 00 00 00 00 00 00 00 |.......| 00000197 709バイト 407バイト
  3. 多重化 • HTTP/1.1  1リクエストずつ  html, css, js, png

    複数のTCP接続 によって並列化 8 TCP 接続 HTTPリクエスト HTTPレスポンス HTTPリクエスト HTTPレスポンス % nc 127.0.0.1 80 HEAD / HTTP/1.1 Host: 127.0.0.1 HTTP/1.1 200 OK Date: Sat, 18 Jul 2015 08:07:26 GMT Server: Apache Last-Modified: Mon, 20 Oct 2014 10:10:09 GMT ETag: "4a0ddc-181-505d7eb663776" Accept-Ranges: bytes Content-Length: 385 Vary: Accept-Encoding Content-Type: text/html HEAD / HTTP/1.1 Host: 127.0.0.1 HTTP/1.1 200 OK Date: Sat, 18 Jul 2015 08:07:28 GMT Server: Apache Last-Modified: Mon, 20 Oct 2014 10:10:09 GMT ETag: "4a0ddc-181-505d7eb663776" Accept-Ranges: bytes Content-Length: 385 Vary: Accept-Encoding Content-Type: text/html
  4. 多重化 • HTTP/1.1  HTTPパイプライン リクエスト1が遅い場合 後ろが待たされる 9 TCP 接続

    HTTPリクエスト1 HTTPレスポンス1 HTTPリクエスト2 HTTPレスポンス2 % cat req.txt HEAD / HTTP/1.1 Host: 127.0.0.1 HEAD / HTTP/1.1 Host: 127.0.0.1 % cat req.txt | nc 127.0.0.1 80 HTTP/1.1 200 OK Date: Sat, 18 Jul 2015 08:15:58 GMT Server: Apache Last-Modified: Mon, 20 Oct 2014 10:10:09 GMT ETag: "4a0ddc-181-505d7eb663776" Accept-Ranges: bytes Content-Length: 385 Vary: Accept-Encoding Content-Type: text/html HTTP/1.1 200 OK Date: Sat, 18 Jul 2015 08:15:58 GMT Server: Apache Last-Modified: Mon, 20 Oct 2014 10:10:09 GMT ETag: "4a0ddc-181-505d7eb663776" Accept-Ranges: bytes Content-Length: 385 Vary: Accept-Encoding Content-Type: text/html
  5. 多重化 • HTTP/2 ストリームID:ストリームの識別番号 12 TCP接続 ストリームID:1 ストリームID:3 ストリームID:5 ストリームID

    0:コネクション制御用 奇数:クライアントが開始した 偶数:サーバが開始した
  6. 0 1 2 3 4 5 6 7 8 9

    10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Length(24) = 0x04 Type(8) = 0x8 Flags(8) R Stream Identifier(31) Stream Identifier(31) R Window Size Increment(31) Window Size Increment(31) 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Length(24) = 0x04 Type(8) = 0x8 Flags(8) R Stream Identifier(31) Stream Identifier(31) R Window Size Increment(31) Window Size Increment(31) 多重化 • フロー制御 使用するフレーム:SETTINGS, WINDOW_UPDATEフレーム TCPのウィンドウサイズと同じようなイメージ 例)WINDOW_UPDATEフレーム 15
  7. 多重化 HTTP/1.1(Apache + mod_ssl) • 複数のTCPセッション HTTP/2(nghttpd) • 一つのTCPセッション 18

    0 1 2 3 4 5 6 1回目 2回目 3回目 平均 http/1.1 http/2 HTTP/1.1 HTTP/2 1回目 4.86 2.23 2回目 4.91 2.31 3回目 4.86 2.27 平均 4.88 [sec] 2.27 [sec]
  8. バイナリ化 • ストリーム内を流れるフレームの種類 20 0 1 2 3 4 5

    6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Length(24) Type(8) Flags(8) R Stream Identifier(31) Stream Identifier(31) フレームヘッダ
  9. Type フレーム名 Type フレーム名 0x0 DATA 0x5 PUSH_PROMISE 0x1 HEADERS

    0x6 PING 0x2 PRIORITY 0x7 GOAWAY 0x3 RST_STREAM 0x8 WINDOW_UPDATE 0x4 SETTINGS 0x9 CONTINUATION Type フレーム名 Type フレーム名 0x0 DATA 0x5 PUSH_PROMISE 0x1 HEADERS 0x6 PING 0x2 PRIORITY 0x7 GOAWAY 0x3 RST_STREAM 0x8 WINDOW_UPDATE 0x4 SETTINGS 0x9 CONTINUATION バイナリ化 フレームの種類 21 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Length(24) Type(8) Flags(8) R Stream Identifier(31) Stream Identifier(31)
  10. バイナリ化 HTTP/1.1 HTTP/2 22 POST /upload.cgi HTTP/1.1 Host: 127.0.0.1 Content-Type:

    binary Content-Length: 256 .................... .................... .................... .................... :method: POST :scheme: http :authority: 127.0.0.1 content-type: binary content-length: 256 HEADERSフレーム .................... .................... .................... .................... DATAフレーム 対応イメージ ヘッダ
  11. バイナリ化 リクエストの自作 23 % hexdump -C req.bin 00000000 50 52

    49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a |PRI * HTTP/2.0..| 00000010 0d 0a 53 4d 0d 0a 0d 0a 00 00 00 04 00 00 00 00 |..SM............| 00000020 00 00 00 14 01 25 00 00 00 01 00 00 00 00 0f 82 |.....%..........| 00000030 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 |..A...¥.<.B.@.| 0000003e nghttpdを--no-tlsで動かしたものにリクエストを投げる
  12. バイナリ化 リクエストの自作 24 % hexdump -C req.bin 00000000 50 52

    49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a |PRI * HTTP/2.0..| 00000010 0d 0a 53 4d 0d 0a 0d 0a 00 00 00 04 00 00 00 00 |..SM............| 00000020 00 00 00 14 01 25 00 00 00 01 00 00 00 00 0f 82 |.....%..........| 00000030 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 |..A...¥.<.B.@.| 0000003e % cat req.bin | nc -nvv 192.168.11.104 80 | tee res.bin | strings (UNKNOWN) [192.168.11.104] 80 (http) open mA3pN <html> <head> <title>hello, http2</title> </head> <body> This is test page. </body> </html>
  13. PRISM バイナリ化 リクエストの自作 25 % hexdump -C req.bin 00000000 50

    52 49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a |PRI * HTTP/2.0..| 00000010 0d 0a 53 4d 0d 0a 0d 0a 00 00 00 04 00 00 00 00 |..SM............| 00000020 00 00 00 14 01 25 00 00 00 01 00 00 00 00 0f 82 |.....%..........| 00000030 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 |..A...¥.<.B.@.| 0000003e PRI * HTTP/2.0¥r¥n¥r¥nSM¥r¥n¥r¥n • コネクションプリフェイス HTTP/2使用の確認 HTTP/2接続の初期設定を確立
  14. バイナリ化 リクエストの自作 26 % hexdump -C req.bin 00000000 50 52

    49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a |PRI * HTTP/2.0..| 00000010 0d 0a 53 4d 0d 0a 0d 0a 00 00 00 04 00 00 00 00 |..SM............| 00000020 00 00 00 14 01 25 00 00 00 01 00 00 00 00 0f 82 |.....%..........| 00000030 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 |..A...¥.<.B.@.| 0000003e 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Length(24) Type(8) Flags(8) R Stream Identifier(31) Stream Identifier(31) Identifier(16) Value(32) SETTINGSフレーム
  15. % hexdump -C req.bin 00000000 50 52 49 20 2a

    20 48 54 54 50 2f 32 2e 30 0d 0a |PRI * HTTP/2.0..| 00000010 0d 0a 53 4d 0d 0a 0d 0a 00 00 00 04 00 00 00 00 |..SM............| 00000020 00 00 00 14 01 25 00 00 00 01 00 00 00 00 0f 82 |.....%..........| 00000030 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 |..A...¥.<.B.@.| 0000003e バイナリ化 リクエストの自作 27 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 00 00 00 04 00 0 00 00 00 00 SETTINGSフレーム
  16. バイナリ化 リクエストの自作 28 % hexdump -C req.bin 00000000 50 52

    49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a |PRI * HTTP/2.0..| 00000010 0d 0a 53 4d 0d 0a 0d 0a 00 00 00 04 00 00 00 00 |..SM............| 00000020 00 00 00 14 01 25 00 00 00 01 00 00 00 00 0f 82 |.....%..........| 00000030 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 |..A...¥.<.B.@.| 0000003e 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Length(24) Type(8) Flags(8) R Stream Identifier(31) Stream Identifier(31) E Stream Dependency(31) Stream Dependency(31) Weight(8) Header Block Fragment (*) HEADERSフレーム
  17. バイナリ化 リクエストの自作 29 % hexdump -C req.bin 00000000 50 52

    49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a |PRI * HTTP/2.0..| 00000010 0d 0a 53 4d 0d 0a 0d 0a 00 00 00 04 00 00 00 00 |..SM............| 00000020 00 00 00 14 01 25 00 00 00 01 00 00 00 00 0f 82 |.....%..........| 00000030 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 |..A...¥.<.B.@.| 0000003e 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 00 00 14 = 20バイト 01 25 0 00 00 00 01 0 00 00 00 00 0f 82 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 HEADERSフレーム
  18. バイナリ化 • HPACK 30 82 84 86 41 8a 0b

    e2 5c 2e 3c b8 42 b8 40 d7 82 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7
  19. バイナリ化 • HPACK 31 82 84 86 41 8a 0b

    e2 5c 2e 3c b8 42 b8 40 d7 0 1 2 3 4 5 6 7 1 Index(7+) インデックスヘッダフィールド表現 静的テーブル:よく使うもの 82 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7
  20. バイナリ化 • HPACK 32 82 :method : GET 84 :path

    : / 86 :scheme : http 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 0 1 2 3 4 5 6 7 0 1 Index(6+) H Value Length(7+) Value String リテラルヘッダフィールド表現 82 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 静的テーブル:よく使うもの
  21. バイナリ化 • HPACK 33 82 :method : GET 84 :path

    : / 86 :scheme : http 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 0 1 2 3 4 5 6 7 0 1 Index(6+) H Value Length(7+) Value String リテラルヘッダフィールド表現 0b e2 5c 2e 3c b8 42 b8 40 d7 を2進数に変換すると ハフマン符号(対応表) 00001011111000100101110000101110001111… 192.16…. 82 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7
  22. バイナリ化 • HPACK 82 :method : GET 84 :path :

    / 86 :scheme : http 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 :authority : 192.168.11.104 • 静的テーブル:よく使うもの • 動的テーブル:過去に使ったもの(キャッシュ) 82 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7
  23. バイナリ化 リクエストの自作 35 % hexdump -C req.bin 00000000 50 52

    49 20 2a 20 48 54 54 50 2f 32 2e 30 0d 0a |PRI * HTTP/2.0..| 00000010 0d 0a 53 4d 0d 0a 0d 0a 00 00 00 04 00 00 00 00 |..SM............| 00000020 00 00 00 14 01 25 00 00 00 01 00 00 00 00 0f 82 |.....%..........| 00000030 84 86 41 8a 0b e2 5c 2e 3c b8 42 b8 40 d7 |..A...¥.<.B.@.| 0000003e % cat req.bin | nc -nvv 192.168.11.104 80 | tee res.bin | strings (UNKNOWN) [192.168.11.104] 80 (http) open mA3pN <html> <head> <title>hello, http2</title> </head> <body> This is test page. </body> </html>
  24. バイナリ化 レスポンス 36 % hexdump -C res.bin 00000000 00 00

    06 04 00 00 00 00 00 00 03 00 00 00 64 00 |..............d.| 00000010 00 00 04 01 00 00 00 00 00 00 52 01 04 00 00 00 |..........R.....| 00000020 01 88 76 8f aa 69 d2 9a e4 52 a9 a7 4a 6b 13 01 |..v..i...R..Jk..| 00000030 5c 0b 83 0f 0d 02 39 36 58 89 a4 7e 56 1c c5 81 |¥.....96X..~V...| 00000040 97 00 0f 61 96 d0 7a be 94 10 14 cb 6d 0a 08 01 |...a..z.....m...| 00000050 6d 41 33 70 4e dc 68 0a 62 d1 bf 6c 96 d0 7a be |mA3pN.h.b..l..z.| 00000060 94 13 6a 68 1f a5 04 00 b6 a0 01 71 90 dc 6d e5 |..jh.......q..m.| 00000070 31 68 df 00 00 60 00 01 00 00 00 01 3c 68 74 6d |1h...`......<htm| 00000080 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 |l>.<head>. <tit| 00000090 6c 65 3e 68 65 6c 6c 6f 2c 20 68 74 74 70 32 3c |le>hello, http2<| 000000a0 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a |/title>.</head>.| 000000b0 3c 62 6f 64 79 3e 0a 20 20 54 68 69 73 20 69 73 |<body>. This is| 000000c0 20 74 65 73 74 20 70 61 67 65 2e 0a 3c 2f 62 6f | test page..</bo| 000000d0 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a |dy>.</html>.| 000000dc
  25. ServerPush • サーバからデータを送る仕組み index.htmlを要求されたら 一緒にcommon.cssも一緒に送るといった用途 40 0 1 2 3

    4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Length(24) Type(8) Flags(8) R Stream Identifier(31) Stream Identifier(31) R Promised Stream ID(31) Promised Stream ID(31) Header Block Fragment(*) PUSH_PROMISEフレーム Header Block Fragmentには予定されるリクエストを入れる
  26. 対応サーバ • nghttp2 https://nghttp2.org/ nghttpx(proxy) mod_h2 • h2o 昨年のsecconで出題されたサーバ •

    その他 https://github.com/http2/http2-spec/wiki/Implementations • 備考 nginx https://www.nginx.com/blog/early-alpha-patch-http2/ • Announcing an Early Alpha Patch for HTTP/2 • we plan to release versions of both NGINX and NGINX Plus by the end of 2015 that will include support for HTTP/2. 44
  27. HTTPヘッダインジェクション https://192.168.11.105/redirect.cgi?url=https://192.168.11.105/top.php レスポンス 49 HTTP/1.1 302 Moved Temporarily Server: nginx/1.9.3

    Date: Wed, 26 Aug 2015 12:15:12 GMT Transfer-Encoding: chunked Connection: keep-alive Location: https://192.168.11.105/top.php
  28. HTTPヘッダインジェクション https://192.168.11.105/redirect.cgi?url=https://192.168.11.105/top.php% 0d%0aSet-Cookie:+sessid=yasulib-test レスポンス 51 HTTP/1.1 302 Moved Temporarily Server:

    nginx/1.9.3 Date: Wed, 26 Aug 2015 12:28:32 GMT Transfer-Encoding: chunked Connection: keep-alive Location: https://192.168.11.105/top.php Set-Cookie: sessid=yasulib-test