fix(traffic): 抓包时重建 net/http 抹掉的 Host 头 - #114
Open
wuchulonly wants to merge 1 commit into
Open
Conversation
net/http parses the request-line authority into Request.Host and deletes "Host" from Request.Header, so a header sequence built from that map alone never carries a Host line. A request reconstructed from a captured flow was therefore incomplete and could not be replayed (e.g. pasted into a repeater). Add PairsFromHTTPWithHost, which prepends the Host header when the map lacks one, and use it on both capture paths: ExchangeFromHTTP (direct HTTP tools) via req.Host, and the MITM newCaptureState via the client-sent Host (falling back to the URL authority), keeping any non-default port. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
任务重放/展示时从抓包 flow 重建的 HTTP 请求缺少
Host:头,导致报文不完整、无法直接粘进 Burp Repeater 等工具重放。根因
Go
net/http解析请求时把Host从Request.Header删掉,挪到Request.Host。抓包处用PairsFromHTTP(req.Header)构造报文头,只遍历这个已不含 Host 的 map,于是 Host 在生成 flow 时就丢了(权威信息只留在URL里)。改动
aop/traffic/exchange.go:新增PairsFromHTTPWithHost(headers, host)—— 当 header map 无 Host 且 host 非空时,在最前补一条Host(幂等,已有则不重复);ExchangeFromHTTP用req.Host接入。tools/proxy/mitm.go:newCaptureState改用PairsFromHTTPWithHost,Host 取客户端原样发的Request.Raw().Host(保留非默认端口),回退 URL 授权部分。不改变任何既有函数签名(纯新增),响应侧不动。
测试
aop/traffic:TestPairsFromHTTPWithHost(补/幂等/空 host)、TestExchangeFromHTTPAddsHost。tools/proxy:TestCaptureIncludesHostHeader—— 经 hub 抓包后断言请求头含正确 Host。go test ./aop/traffic/ ./tools/proxy/通过;gofmt/vet 干净。影响范围
仅对新抓的流量生效;头部原始顺序不变(本 PR 不涉及)。
🤖 Generated with Claude Code