Rust抓包http/https

相干库的安装

使用vcpkg安装openssl库

1. vcpkg install openssl:x64-windows

复制代码

并设置openssl库位置的环境变量

1. $Env:OPENSSL_DIR="D:/vcpkg/packages/openssl_x64-windows/"

复制代码

安装openssl软件，由于必要使用openssl天生自署名证书
Cargo依赖

1. [dependencies]
2. anyhow = "1.0.81"
3. bytes = "1.6.0"
4. futures = "0.3.30"
5. http-body-util = "0.1.1"
6. hyper = { version = "1.2.0", features = ["full"] }
7. hyper-util = { version = "0.1.3", features = ["full"] }
8. openssl = "0.10.64"
9. tokio = { version = "1.37.0", features = ["full"] }
10. tokio-openssl = "0.6.4"
11. futures-util = "0.3.30"
12. tokio-util = "0.7.10"

复制代码

使用OpenSSL天生自署名证书

1. 1、生成RSA私钥文件
2. openssl genrsa -out proxylea_private.key 2048
3. 2、创建证书签名请求文件
4. openssl req -new -key proxylea_private.key -out server.csr
5. 3、使用私钥为证书签名（自签名）
6. openssl x509 -req -days 3650 -in server.csr -signkey  proxylea_private.key -out proxylea_cert.crt
7. 4、将proxylea_cert.crt证书导入电脑受信任根证书目录下

复制代码

动态为相干网站颁发证书

1. ///创建一个证书颁发模块 crt.mod
3. use std::{fs::File, io::Read};
5. use openssl::asn1::Asn1Integer;
6. use openssl::bn::BigNum;
7. use openssl::rand;
9. use openssl::pkey::{Private};
10. use openssl::rsa::Rsa;
12. use openssl::{
13.     pkey::PKey, x509::extension::SubjectAlternativeName, x509::X509,
14. };
16. // 以下函数用于加载根证书和私钥
17. fn load_root_cert_and_key(
18.     root_cert_path: &str,
19.     root_key_path: &str,
20. ) -> (X509, PKey<Private>) {
21.     let ca_file = File::open(root_cert_path).unwrap();
22.     let bytes = ca_file.bytes().map(|b| b.unwrap()).collect::<Vec<u8>>();
23.     let ca = X509::from_pem(&bytes).unwrap();
25.     let pkey_file = File::open(root_key_path).unwrap();
26.     let bytes = pkey_file.bytes().map(|b| b.unwrap()).collect::<Vec<u8>>();
27.     let pkey = PKey::private_key_from_pem(&bytes).unwrap();
29.     // 实现加载根证书和私钥的逻辑
30.     (ca, pkey)
31. }
34. // 客户端动态颁发证书
35. fn client_cert_signing(
36.     _root_cert_path: &str,
37.     _root_key_path: &str,
38.     host:&str
39. ) -> Result<(X509, PKey<Private>), openssl::error::Error> {
40.     // 加载根证书和私钥
41.     let (root_cert, root_key) = load_root_cert_and_key(root_cert_path, root_key_path);
42.    
43.     // 生成密钥对
44.     let rsa = Rsa::generate(2048).unwrap();
45.     let private_key = PKey::from_rsa(rsa).unwrap();
47.     let public_key_pem = private_key.public_key_to_pem().unwrap();
48.     let public_key = PKey::public_key_from_pem(&public_key_pem).unwrap();
50.     // 设置证书有效期
51.     // let not_before = openssl::asn1::Asn1Time::days_from_now(0).unwrap();
52.     //let not_after = openssl::asn1::Asn1Time::days_from_now(365).unwrap();
54.     // 颁发证书
55.     let mut cert = X509::builder().unwrap();
56.     cert.set_version(2).unwrap();
58.     let mut x509_name = openssl::x509::X509NameBuilder::new().unwrap();
59.     x509_name.append_entry_by_text("C", "ZH").unwrap();
60.     x509_name.append_entry_by_text("ST", "SC").unwrap();
61.     x509_name.append_entry_by_text("L", "YC").unwrap();
62.     x509_name.append_entry_by_text("O", "YC").unwrap();
63.     x509_name.append_entry_by_text("OU", "YC").unwrap();
64.     x509_name
65.         .append_entry_by_text("CN", host)
66.         .unwrap();
67.     let x509_name = x509_name.build();
69.     cert.set_subject_name(&x509_name).unwrap();
70.     cert.set_issuer_name(&root_cert.subject_name()).unwrap();
71.     let mut serial_number = [0; 16];
72.     rand::rand_bytes(&mut serial_number).unwrap();
74.     let serial_number = BigNum::from_slice(&serial_number).unwrap();
75.     let serial_number = Asn1Integer::from_bn(&serial_number).unwrap();
76.     cert.set_serial_number(&serial_number).unwrap();
78.     cert.set_not_before(root_cert.not_before()).unwrap();
79.     cert.set_not_after(root_cert.not_after()).unwrap();
80.     cert.set_pubkey(&public_key).unwrap();
83.     let alternative_name = SubjectAlternativeName::new()
84.             .dns(host)
85.             .build(&cert.x509v3_context(Some(&root_cert),None)).unwrap();
86.         cert.append_extension(alternative_name).unwrap();
88.     cert.sign(&root_key, openssl::hash::MessageDigest::sha256())
89.         .unwrap();
90.    
91.     Ok((cert.build(), private_key))
92. }
95. pub fn get_crt_key(host:&str) ->(X509, PKey<Private>){
96.         //导入自签名CA证书，并将crt格式的CA证书导入浏览器
97.         //导入CA证书的私钥
98.     client_cert_signing("./crt/proxylea_cert.crt",
99.                         "./crt/proxylea_private.key", host).unwrap()
100. }

复制代码

效果如下，可以望见www.baidu.com网站的证书由自署名证书颁发。

使用hyper构建HTTP署理服务器

构建本地署理服务器

1. #[tokio::main]
2. pub async fn main() -> Result<()> {
3.     // This address is localhost
4.     let addr: SocketAddr = "127.0.0.1:7890".parse().unwrap();
6.     // Bind to the port and listen for incoming TCP connections
7.     let listener = TcpListener::bind(addr).await?;
8.     println!("Listening on http://{}", addr);
9.     loop {
10.         let (tcp_stream, addr) = listener.accept().await?;
11.         let msg = format!("{addr} connected");
12.         dbg!(msg);
13.         tokio::task::spawn(async move {
14.             let io = TokioIo::new(tcp_stream);
16.             let conn = http1::Builder::new()
17.                 .serve_connection(io, service_fn(server_upgrade));
19.             // Don't forget to enable upgrades on the connection.
20.             let mut conn = conn.with_upgrades();
22.             let conn = Pin::new(&mut conn);
23.             if let Err(err) = conn.await {
24.                 println!("Error serving connection: {:?}", err);
25.             }
26.         });
27.     }
28. }

复制代码

将http协议升级到https

1、欣赏器在举行https握手时，必要先发送一个CONNECT的http哀求给署理服务器，署理服务器返回状态码200的http相应，代表欣赏器与署理服务毗连创建乐成。
2、欣赏器与署理服务器开始TLS握手，署理服务器开始毗连远程网站服务器。
3、二者都毗连乐成时就可以传输数据了。
4、对于http哀求，署理服务器与远程服务器毗连乐成后直接转发哀求和相应。

1. /// Intercept local requests
2. fn intercept_request(mut request: Request<Incoming>) -> (Request<HttpBody>, Option<Response<HttpBody>>) {
3.     dbg!(request.uri().to_string());
4.     request.headers_mut().remove("Accept-Encoding");
5.     let req = request.map(|b| b.boxed());
7.     if let Some(Ok(host)) = req.headers().get(header::HOST).map(|h| h.to_str()) {
8.         if host.contains("127.0.0.1:7890")
9.             || host.contains("localhost:7890")
10.             || host.contains("baidu") {
11.             let resp = Response::builder()
12.                 .header(header::CONTENT_TYPE, "text/plain")
13.                 .body(full("Proxylea Server Power By Rust & Hyper\n"));
14.             return (req, Some(resp.unwrap()));
15.         }
16.     }
17.     (req, None)
18. }
20. /// Intercept remote responses
21. fn intercept_response(mut response: Response<Incoming>) -> Response<HttpBody> {
22.     dbg!({ format!("{:?}", response.headers()) });
23.     response.headers_mut().insert("proxy-server", "Proxylea".parse().unwrap());
24.     //let (parts,incoming)=resp.into_parts();
25.     let resp = response.map(|b| b.map_frame(|frame| {
26.         //You can modify and record the response body
27.         if let Some(bytes) = frame.data_ref() {
28.             //todo
29.         }
30.         frame
31.     }).boxed());
32.     resp
33. }

复制代码

拦截本地欣赏器哀求和远程服务器相应

1、拦截欣赏器对baidu网站的哀求，并返回一些信息
2、拦截全部http相应，而且打印相应头和添加一些相应头

1. /// Intercept local requests
2. fn intercept_request(mut request: Request<Incoming>) -> (Request<HttpBody>, Option<Response<HttpBody>>) {
3.     dbg!(request.uri().to_string());
4.     request.headers_mut().remove("Accept-Encoding");
5.     let req = request.map(|b| b.boxed());
7.     if let Some(Ok(host)) = req.headers().get(header::HOST).map(|h| h.to_str()) {
8.         if host.contains("127.0.0.1:7890")
9.             || host.contains("localhost:7890")
10.             || host.contains("baidu") {
11.             let resp = Response::builder()
12.                 .header(header::CONTENT_TYPE, "text/plain")
13.                 .body(full("Proxylea Server Power By Rust & Hyper\n"));
14.             return (req, Some(resp.unwrap()));
15.         }
16.     }
17.     (req, None)
18. }
20. /// Intercept remote responses
21. fn intercept_response(mut response: Response<Incoming>) -> Response<HttpBody> {
22.     dbg!({ format!("{:?}", response.headers()) });
23.     response.headers_mut().insert("proxy-server", "Proxylea".parse().unwrap());
24.     //let (parts,incoming)=resp.into_parts();
25.     let resp = response.map(|b| b.map_frame(|frame| {
26.         //You can modify and record the response body
27.         if let Some(bytes) = frame.data_ref() {
28.             //todo
29.         }
30.         frame
31.     }).boxed());
32.     resp
33. }

复制代码

效果展示

全部代码

团体代码写下来标题不大，重要是前面的openssl库的编译有些标题。Rust的hyper库类似于Java的Netty库，都属于底层库，但是hyper功能远不如Netty，hyper只是一个http相干的底层库。另有就是相干文档与资源着实是TM太少了，只能去看官方的example。从开辟服从上来讲还是Netty更快（不如说是Java开辟服从更快），但是学习hyper库有助于学习Rust的异步、特性、泛型，假如望见hyper库内里的pin_xx、poll_xx、各种特性与泛型非常天然的话，那么离纯熟使用Rust也就不远了。

1. use std::error::Error;
2. use std::net::SocketAddr;
3. use std::pin::Pin;
4. use std::sync::Mutex;
6. use anyhow::{anyhow, Result};
7. use bytes::Bytes;
8. use futures::FutureExt;
9. use http_body_util::{BodyExt, Empty, Full};
10. use http_body_util::combinators::BoxBody;
11. use hyper::{header, Request, Response, StatusCode};
12. use hyper::body::{Body, Incoming};
13. use hyper::client::conn::http1::{Builder, Connection, SendRequest};
14. use hyper::rt::{Read, Write};
15. use hyper::server::conn::http1;
16. use hyper::service::service_fn;
17. use hyper::upgrade::Upgraded;
18. use hyper_util::rt::TokioIo;
19. use openssl::ssl::{Ssl, SslAcceptor, SslConnector, SslMethod, SslVerifyMode};
20. use tokio::net::{TcpListener, TcpStream};
21. use tokio_openssl::SslStream;
23. pub mod crt;
25. type HttpBody = BoxBody<Bytes, hyper::Error>;
27. #[tokio::main]
28. pub async fn main() -> Result<()> {
29.     // This address is localhost
30.     let addr: SocketAddr = "127.0.0.1:7890".parse().unwrap();
32.     // Bind to the port and listen for incoming TCP connections
33.     let listener = TcpListener::bind(addr).await?;
34.     println!("Listening on http://{}", addr);
35.     loop {
36.         let (tcp_stream, addr) = listener.accept().await?;
37.         let _msg = format!("{addr} connected");
38.         //dbg!(msg);
39.         tokio::task::spawn(async move {
40.             let io = TokioIo::new(tcp_stream);
42.             let conn = http1::Builder::new()
43.                 .serve_connection(io, service_fn(handle));
45.             // Don't forget to enable upgrades on the connection.
46.             let mut conn = conn.with_upgrades();
48.             let conn = Pin::new(&mut conn);
49.             if let Err(err) = conn.await {
50.                 println!("Error serving connection: {:?}", err);
51.             }
52.         });
53.     }
54. }
56. fn get_host_port(host_name: &str) -> (&str, u16) {
57.     match host_name.find(":") {
58.         None => {
59.             (host_name, 80)
60.         }
61.         Some(i) => {
62.             (&host_name[0..i], *&host_name[i + 1..].parse().unwrap_or(80))
63.         }
64.     }
65. }
67. fn not_found_host() -> Response<HttpBody> {
68.     Response::builder().status(404).body(full("not found host")).unwrap()
69. }
71. /// Our server HTTP handler to initiate HTTP upgrades.
72. async fn handle(mut req: Request<Incoming>) -> Result<Response<HttpBody>> {
73.     if req.method() != hyper::Method::CONNECT {
74.         let (host, port) = match req.headers().get(header::HOST) {
75.             None => {
76.                 return Ok(not_found_host());
77.             }
78.             Some(h) => { get_host_port(h.to_str()?) }
79.         };
81.         let stream = TcpStream::connect((host, port)).await?;
82.         let io = TokioIo::new(stream);
84.         let (mut sender, conn) = Builder::new()
85.             .preserve_header_case(true)
86.             .title_case_headers(true)
87.             .handshake(io)
88.             .await?;
89.         tokio::task::spawn(async move {
90.             if let Err(err) = conn.await {
91.                 println!("Connection failed: {:?}", err);
92.             }
93.         });
94.         let (req, resp) = intercept_request(req);
95.         return match resp {
96.             None => {
97.                 let resp = sender.send_request(req).await?;
98.                 Ok(resp.map(|b| b.boxed()))
99.             }
100.             Some(resp) => {
101.                 Ok(resp)
102.             }
103.         };
104.     }
106.     let res = Response::new(empty());
107.     // handle https
108.     tokio::task::spawn(async move {
109.         match hyper::upgrade::on(&mut req).await {
110.             Ok(upgraded) => {
111.                 if let Some(host) = req.uri().host() {
112.                     if let Err(e) = server_upgraded_https(host, upgraded).await {
113.                         let error_msg = format!("server io error: {}", e);
114.                         dbg!(error_msg);
115.                     };
116.                 }
117.             }
118.             Err(e) => eprintln!("upgrade error: {}", e),
119.         }
120.     });
122.     Ok(res)
123. }
126. /// https upgraded
127. async fn server_upgraded_https(host: &str, upgraded: Upgraded) -> Result<()> {
128.     let upgraded = TokioIo::new(upgraded);
129.     // we have an upgraded connection that we can read and
130.     // write on directly.
131.     //
132.     let tls_acceptor = get_tls_acceptor(host);
133.     let ssl = Ssl::new(tls_acceptor.context())?;
134.     let mut tls_stream = SslStream::new(ssl, upgraded)?;
135.     if let Err(err) = SslStream::accept(Pin::new(&mut tls_stream)).await {
136.         return Err(anyhow!("error during tls handshake connection from : {}", err));
137.     }
138.     let stream = TokioIo::new(tls_stream);
140.     let (sender, conn) = https_remote_connect(host, 443).await?;
141.     tokio::spawn(async move {
142.         if let Err(err) = conn.await {
143.             let err_msg = format!("Connection failed: {:?}", err);
144.             dbg!(err_msg);
145.         }
146.     });
147.     let wrap_sender = Mutex::new(sender);
148.     if let Err(err) = http1::Builder::new()
149.         .serve_connection(stream, service_fn(|req| {
150.             let (req, resp) = intercept_request(req);
151.             async {
152.                 match resp {
153.                     None => {
154.                         let remote_resp = wrap_sender.lock().unwrap().send_request(req);
155.                         match remote_resp.await {
156.                             Ok(resp) => {
157.                                 Ok::<_, hyper::Error>(intercept_response(resp))
158.                             }
159.                             Err(err) => {
160.                                 let resp = Response::builder()
161.                                     .status(StatusCode::INTERNAL_SERVER_ERROR)
162.                                     .header(header::CONTENT_TYPE, "text/plain")
163.                                     .body(full(err.to_string())).unwrap();
164.                                 Ok::<_, hyper::Error>(resp)
165.                             }
166.                         }
167.                     }
168.                     Some(resp) => {
169.                         Ok::<_, hyper::Error>(resp)
170.                     }
171.                 }
172.             }
173.         })).await {
174.         println!("Error serving connection: {:?}", err);
175.     }
177.     Ok(())
178. }
181. fn empty() -> HttpBody {
182.     Empty::<Bytes>::new()
183.         .map_err(|never| match never {})
184.         .boxed()
185. }
187. fn full<T: Into<Bytes>>(chunk: T) -> HttpBody {
188.     Full::new(chunk.into())
189.         .map_err(|never| match never {})
190.         .boxed()
191. }
193. /// Certificate not cached
194. fn get_tls_acceptor(host: &str) -> SslAcceptor {
195.     let mut tls_builder = SslAcceptor::mozilla_modern_v5(SslMethod::tls()).unwrap();
197.     let (crt, pri_key) = crt::get_crt_key(host);
199.     tls_builder.set_certificate(&crt).unwrap();
201.     tls_builder.set_private_key(&pri_key).unwrap();
203.     tls_builder.check_private_key().unwrap();
205.     let tls_acceptor = tls_builder.build();
206.     tls_acceptor
207. }
210. async fn https_remote_connect<B>(host: &str, port: u16) -> Result<(SendRequest<B>, Connection<TokioIo<SslStream<TcpStream>>, B>)>
211.     where
212.         B: Body + 'static,
213.         B::Data: Send,
214.         B::Error: Into<Box<dyn Error + Send + Sync>>, {
215.     let addr = format!("{}:{}", host, port);
216.     let tcp_stream = TcpStream::connect(addr).await?;
217.     let mut builder = SslConnector::builder(SslMethod::tls_client())?;
218.     builder.set_verify(SslVerifyMode::NONE);
219.     let connector = builder.build();
220.     let ssl = Ssl::new(connector.context())?;
221.     let mut tls_stream = SslStream::new(ssl, tcp_stream)?;
222.     if let Err(err) = SslStream::connect(Pin::new(&mut tls_stream)).await {
223.         return Err(anyhow!("error during tls handshake connection from : {}", err));
224.     }
225.     let io = TokioIo::new(tls_stream);
226.     Ok(hyper::client::conn::http1::handshake(io).await?)
227. }
229. /// Intercept local requests
230. fn intercept_request(mut request: Request<Incoming>) -> (Request<HttpBody>, Option<Response<HttpBody>>) {
231.     dbg!(request.uri().to_string());
232.     request.headers_mut().remove("Accept-Encoding");
233.     let req = request.map(|b| b.boxed());
235.     if let Some(Ok(host)) = req.headers().get(header::HOST).map(|h| h.to_str()) {
236.         if host.contains("127.0.0.1:7890")
237.             || host.contains("localhost:7890")
238.             || host.contains("baidu") {
239.             let resp = Response::builder()
240.                 .header(header::CONTENT_TYPE, "text/plain")
241.                 .body(full("Proxylea Server Power By Rust & Hyper\n"));
242.             return (req, Some(resp.unwrap()));
243.         }
244.     }
245.     (req, None)
246. }
248. /// Intercept remote responses
249. fn intercept_response(mut response: Response<Incoming>) -> Response<HttpBody> {
250.     dbg!({ format!("{:?}", response.headers()) });
251.     response.headers_mut().insert("proxy-server", "Proxylea".parse().unwrap());
252.     //let (parts,incoming)=resp.into_parts();
253.     let resp = response.map(|b| b.map_frame(|frame| {
254.         if let Some(bytes) = frame.data_ref() {
255.             //
256.         }
257.         frame
258.     }).boxed());
259.     resp
260. }

复制代码

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！qidao123.com:ToB企服之家，中国第一个企服评测及软件市场,开放入驻,技术点评得现金