2019年11月

HTTP 2 的特性

从 HTTP 2 in action 这本书看的, 发现这个网站总结的不错: https://tools.keycdn.com/http2-test, 就摘抄过来了. 顺便测试了一下 (20191104), taobao, ebay 支持 Http2, jd 和 baidu 主页都不支持 HTTP2

  1. HTTP/2 is binary, instead of textual.
  2. It is fully multiplexed, sending multiple requests in parallel over a single TCP connection.
  3. It uses header compression HPACK to reduce overhead.
  4. It allows servers to “push” responses proactively into client caches instead of waiting for a new request for each resource
  5. It uses the new ALPN extension which allows for faster-encrypted connections since the application protocol is determined during the initial connection.
  6. It reduces additional round trip times (RTT), making your website load faster without any optimization.
  7. Domain sharding and asset concatenation is no longer needed with HTTP/2.
  8. Flow control
  9. Stream prioritization

如何判断一个网站是不是支持 HTTP2? 使用最新的 curl 命令:

LM-SHC-16507776:tmp xiatian$ curl -vvv -s  --http2 https://www.jd.com:443/ 2>&1 | grep ALPN
* ALPN, offering h2
* ALPN, offering http/1.1
* ALPN, server accepted to use http/1.1
LM-SHC-16507776:tmp xiatian$ curl -vvv -s  --http2 https://www.ebay.com:443/ 2>&1 | grep ALPN
* ALPN, offering h2
* ALPN, offering http/1.1
* ALPN, server accepted to use h2

上面的输出中 baidu 首页不支持, ebay 首页支持.


从下面这个问答看:
在 Chrome 里面, 对于 HTTP 2 同一个 origin 不同的 tab 之间共享一个 tcp 连接.
对于 HTTP 1.1:

  1. HTTP/1.1 sockets are stored in a pool when they are not active. A request from any tab may end up using any socket in the pool;
  2. Incognito tabs use their own independent socket pool (All incognito tabs for a profile share just one socket pool, though);
  3. Isolated apps use their own socket pools.
  4. Different profiles and guest mode use their own socket pools.
  5. Global requests not tied to a profile use their own socket pool;

https://stackoverflow.com/questions/51535819/in-http-1-1-are-connections-shared-across-multiple-chrome-tabs-to-the-same-origi
https://groups.google.com/a/chromium.org/forum/#!topic/chromium-dev/S3TEvmRWcNE

netcat(nc) 的各种操作

  1. 扫描端口
    nc -vzu 192.168.0.1 80-90
    nc -v -z www.tianxiaohui.com 90-100
    nc -v -n -z -w 1 192.168.1.2 1-1000

  2. 从客户单传文件到服务端
    服务端先起来
    nc -l 8080 > file.txt
    nc -v remote_server 8080 > localfile.txt

  3. 从服务端传文件到客户端
    nc -4 -v -l 7070 < myfile.txt
    客户端可用浏览器或者 nc 命令
    nc -v www.tianxiaohui.com 7070

  4. 作为代理

    单向代理: nc -l 12345 | nc www.google.com 80
    双向:
    mkfifo backpipe
    nc -l 12345 0<backpipe | nc www.google.com 80 1>backpipe

  5. 让任何命令作为网络服务器 (网络后门)

    服务端: nc -4 -l -p 1234 -e /bin/sh
    客户端: nc remote_server 1234
    ls -lah

如果遇到:
close: Bad file descriptor
加上 -4 参数.

使用 telnet, nc, openssl 浏览网站

LM-SHC-16507776:~ xiatian$ telnet www.tianxiaohui.com 80
Trying 156.236.115.130...
Connected to www.tianxiaohui.com.
Escape character is '^]'.

GET /about.html HTTP/1.1
Host: www.tianxiaohui.com

HTTP/1.1 400 Bad Request
Date: Sat, 02 Nov 2019 03:18:30 GMT
Server: Apache
Accept-Ranges: bytes
Connection: close
Content-Type: text/html


printf "GET /index.html HTTP/1.0\r\nHost: www.tianxiaohui.com\r\n\r\n" | nc www.tianxiaohui.com 80

使用 openssl 浏览 https 的
LM-SHC-16507776:~ xiatian$ openssl

OpenSSL> s_client -crlf -connect www.bing.com:443 -quiet

depth=2 C = IE, O = Baltimore, OU = CyberTrust, CN = Baltimore CyberTrust Root
verify return:1
depth=1 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, OU = Microsoft IT, CN = Microsoft IT TLS CA 2
verify return:1
depth=0 CN = www.bing.com
verify return:1

GET / HTTP/1.1
Host:www.bing.com

HTTP/1.1 302
Cache-Control: private
Content-Length: 137
Content-Type: text/html; charset=utf-8
Location: https://cn.bing.com/
Date: Sat, 02 Nov 2019 03:11:59 GMT

Object moved
Object moved to https://cn.bing.com.

GET / HTTP/1.1
Host:cn.bing.com

HTTP/1.1 200 OK
Cache-Control: private, max-age=0
Content-Length: 114805