http/2 parsing API

[mnot]

Hey,

I've only skimmed the docs, so I may have missed something; apologies if this is the case (and a ref appreciated).

I'd like to parse http/2 from a PCAP (file or live) to generate events, in order to feed them into things like mnot/htracr.

This is possible using the node HTTP parser for h1 (as in seen https://github.com/mranney/http_trace/blob/master/http_session.js), but AFAICT (again, after a brief look), not with http2.

[molnarg]

Hi Mark,

it's somewhat more complicated with node-http2 than http1 but it's doable.

We have a protocol "submodule" that exposes the lower level building blocks of node-http2. Two such building blocks you would need are the deserializer and the decompressor. Both of them are node Transform Streams and work like this: raw data -> deserializer -> packet objects -> decompressor -> packet objects with header packets assembled and decompressed. Do you think that would be enough for your needs? I can write a short example code for doing that.

Connection and stream state management would harder to reconstruct from a pcap file using the other building blocks from node-http2, but it would maybe be doable.