HTTP2 Cleartext H2C Client Via GoLang

HTTP/2 Cleartext (H2C) Client Example in Go

Derrick Wippler

• 5 min read

This blog post was written and self-published by one of our developers. You can also find it on Medium.

Since my internet foo failed me, and the only workable example of an H2C client I can find was in the actual go test suite, I’m going to lay out what I discovered about H2C support in golang here.

First, in case you may be wondering what H2C is, It is essentially HTTP/2 but without TLS. H2C is understandably not widely publicized as HTTP/2 with TLS is more secure and not open to some types of attacks. However, H2C isn’t without its use cases; for instance, GRPC uses H2C when you build a client with grpc.WithInsecure().

Second, is that the standard golang code supports HTTP2 but does not directly support H2C. H2C support only exists in the golang.org/x/net/http2/h2c package. You can make your HTTP server H2C capable by wrapping your handler or mux with h2c.NewHandler() like so.


1h2s := &http2.Server{}
2
3handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
4    fmt.Fprintf(w, "Hello, %v, http: %v", r.URL.Path, r.TLS == nil)
5})
6
7server := &http.Server{
8    Addr:    "0.0.0.0:1010",
9    Handler: h2c.NewHandler(handler, h2s),
10}
11
12fmt.Printf("Listening [0.0.0.0:1010]...\n")
13checkErr(server.ListenAndServe(), "while listening")

The above code allows the server to support H2C upgrade and H2C prior knowledge along with standard HTTP/2 and HTTP/1.1 that golang natively supports.

If you don’t care about supporting HTTP/1.1, then you can run this code, which only supports H2C prior knowledge.


1server := http2.Server{}
2
3l, err := net.Listen("tcp", "0.0.0.0:1010")
4checkErr(err, "while listening")
5
6fmt.Printf("Listening [0.0.0.0:1010]...\n")
7for {
8    conn, err := l.Accept()
9    checkErr(err, "during accept")
10
11    server.ServeConn(conn, &http2.ServeConnOpts{
12        Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
13            fmt.Fprintf(w, "Hello, %v, http: %v", r.URL.Path, r.TLS == nil)
14        }),
15    })
16}

Once you have a running server, you can test your server by installing curl-OpenSSL and use curl to test your H2C enabled server.

$ brew install curl-openssl # Add curl-openssl to the front of your path $ export PATH="/usr/local/opt/curl-openssl/bin:$PATH"

Connect via HTTP1.1 then upgrade to HTTP/2 (H2C)

$ curl -v --http2 http://localhost:1010 * Trying ::1:1010... * TCP_NODELAY set * Connected to localhost (::1) port 1010 (#0) > GET / HTTP/1.1 > Host: localhost:1010 > User-Agent: curl/7.65.0 > Accept: */* > Connection: Upgrade, HTTP2-Settings > Upgrade: h2c > HTTP2-Settings: AAMAAABkAARAAAAAAAIAAAAA > * Mark bundle as not supporting multiuse < HTTP/1.1 101 Switching Protocols < Connection: Upgrade < Upgrade: h2c * Received 101 * Using HTTP2, server supports multi-use * Connection state changed (HTTP/2 confirmed) * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 * Connection state changed (MAX_CONCURRENT_STREAMS == 250)! < HTTP/2 200 < content-type: text/plain; charset=utf-8 < content-length: 20 < date: Wed, 05 Jun 2019 19:01:40 GMT < * Connection #0 to host localhost left intact Hello, /, http: true

Connect via HTTP/2 (H2C)

curl -v --http2-prior-knowledge http://localhost:1010 * Trying ::1:1010... * TCP_NODELAY set * Connected to localhost (::1) port 1010 (#0) * Using HTTP2, server supports multi-use * Connection state changed (HTTP/2 confirmed) * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 * Using Stream ID: 1 (easy handle 0x7fdab8007000) > GET / HTTP/2 > Host: localhost:1010 > User-Agent: curl/7.65.0 > Accept: */* > * Connection state changed (MAX_CONCURRENT_STREAMS == 250)! < HTTP/2 200 < content-type: text/plain; charset=utf-8 < content-length: 20 < date: Wed, 05 Jun 2019 19:00:43 GMT < * Connection #0 to host localhost left intact Hello, /, http: true

Now, Remember when I said that the golang standard library does not support H2C? While that is technically correct, there is a workaround to get the golang standard HTTP/2 client to connect to an H2C enabled server.

To do so, you have to override DialTLS and set the super-secret AllowHTTP flag.


1client := http.Client{
2    Transport: &http2.Transport{
3        // So http2.Transport doesn't complain the URL scheme isn't 'https'
4        AllowHTTP: true,
5        // Pretend we are dialing a TLS endpoint.
6        // Note, we ignore the passed tls.Config
7        DialTLS: func(network, addr string, cfg *tls.Config) (net.Conn, error) {
8            return net.Dial(network, addr)
9        },
10    },
11}
12
13resp, _ := client.Get(url)
14fmt.Printf("Client Proto: %d\n", resp.ProtoMajor)