add http3 fingerprint tests

tests/README.md

@@ -2,7 +2,8 @@ The tests verify that `curl-impersonate` has the same network signature as that
 
 ## Running the tests
 
-The tests assume that you've built `curl-impersonate` docker image before (see [Building from source](https://github.com/lwthiker/curl-impersonate#building-from-source)).
+The tests assume that you've built the `curl-impersonate` docker image before.
+See [Building from source](../docs/02_install.md#building-from-source).
 
 To run the tests, build with:
 ```
@@ -14,14 +15,20 @@ docker run --rm curl-impersonate-tests
 ```
 This simply runs `pytest` in the container. You can pass additional flags to `pytest` such as `--log-cli-level DEBUG`.
 
+For example, to run only the HTTP/3 tests:
+
+```
+docker run --rm curl-impersonate-tests -k http3 --log-cli-level DEBUG
+```
+
 ## How the tests work
 For each supported browser, the following tests are performed:
 * A packet capture is started while `curl-impersonate` is run with the relevant wrapper script. The Client Hello message is extracted from the capture and compared against the known signature of the browser.
 * `curl-impersonate` is run, connecting to a local `nghttpd` server (a simple HTTP/2 server). The HTTP/2 pseudo-headers and headers are extracted from the output log of `nghttpd` and compared to the known headers of the browser.
+* HTTP/3-enabled targets are run against a local `aioquic` server. The server records the HTTP/3 pseudo-headers, request headers, HTTP/3 SETTINGS, and raw QUIC transport parameters and compares them to the expected target fingerprint.
 
 ## What's missing
 The following tests are still missing:
 
 - [x] Test that `curl-impersonate` sends the same HTTP/2 SETTINGS as the browser.
 - [x] Update safari versions, double `rsa_pss_rsae_sha384`
-

tests/http3_targets.yaml

@@ -0,0 +1,204 @@
+# HTTP/3-enabled wrapper scripts and their expected H3 / QUIC fingerprints.
+#
+# The values come from the built-in impersonation profiles in patches/curl.patch.
+# Chrome QUIC transport parameters are intentionally permuted by the
+# impersonation profile, so those targets allow order-insensitive matching.
+- curl_binary: curl_chrome145
+  expected:
+    http3:
+      pseudo_headers:
+        - :method
+        - :authority
+        - :scheme
+        - :path
+      headers:
+        - 'sec-ch-ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145"'
+        - 'sec-ch-ua-mobile: ?0'
+        - 'sec-ch-ua-platform: "macOS"'
+        - 'upgrade-insecure-requests: 1'
+        - 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36'
+        - 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7'
+        - 'sec-fetch-site: none'
+        - 'sec-fetch-mode: navigate'
+        - 'sec-fetch-user: ?1'
+        - 'sec-fetch-dest: document'
+        - 'accept-encoding: gzip, deflate, br, zstd'
+        - 'accept-language: en-US,en;q=0.9'
+        - 'priority: u=0, i'
+      settings:
+        - key: 1
+          value: 65536
+        - key: 6
+          value: 262144
+        - key: 7
+          value: 100
+        - key: 51
+          value: 1
+        - grease: true
+    quic:
+      allow_permutation: true
+      transport_parameters:
+        - key: 1
+          value: 30000
+        - key: 3
+          value: 1472
+        - key: 4
+          value: 15728640
+        - key: 5
+          value: 6291456
+        - key: 6
+          value: 6291456
+        - key: 7
+          value: 6291456
+        - key: 8
+          value: 100
+        - key: 9
+          value: 103
+        - key: 15
+          hex: ''
+        - key: 17
+          version_information:
+            chosen: 1
+            available:
+              - value: 1
+              - grease: true
+        - key: 32
+          value: 65536
+        - key: 12583
+          value: any
+        - key: 18258
+          value: 1
+        - grease: true
+
+- curl_binary: curl_chrome146
+  expected:
+    http3:
+      pseudo_headers:
+        - :method
+        - :authority
+        - :scheme
+        - :path
+      headers:
+        - 'sec-ch-ua: "Chromium";v="146", "Not-A.Brand";v="24", "Google Chrome";v="146"'
+        - 'sec-ch-ua-mobile: ?0'
+        - 'sec-ch-ua-platform: "macOS"'
+        - 'upgrade-insecure-requests: 1'
+        - 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36'
+        - 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7'
+        - 'sec-fetch-site: none'
+        - 'sec-fetch-mode: navigate'
+        - 'sec-fetch-user: ?1'
+        - 'sec-fetch-dest: document'
+        - 'accept-encoding: gzip, deflate, br, zstd'
+        - 'accept-language: en-US,en;q=0.9'
+        - 'priority: u=0, i'
+      settings:
+        - key: 1
+          value: 65536
+        - key: 6
+          value: 262144
+        - key: 7
+          value: 100
+        - key: 51
+          value: 1
+        - grease: true
+    quic:
+      allow_permutation: true
+      transport_parameters:
+        - key: 1
+          value: 30000
+        - key: 3
+          value: 1472
+        - key: 4
+          value: 15728640
+        - key: 5
+          value: 6291456
+        - key: 6
+          value: 6291456
+        - key: 7
+          value: 6291456
+        - key: 8
+          value: 100
+        - key: 9
+          value: 103
+        - key: 15
+          hex: ''
+        - key: 17
+          version_information:
+            chosen: 1
+            available:
+              - value: 1
+              - grease: true
+        - key: 32
+          value: 65536
+        - key: 12583
+          value: any
+        - key: 12584
+          hex: '4f524947'
+        - grease: true
+
+- curl_binary: curl_firefox147
+  expected:
+    http3:
+      pseudo_headers:
+        - :method
+        - :scheme
+        - :authority
+        - :path
+      headers:
+        - 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0'
+        - 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
+        - 'accept-language: en-US,en;q=0.9'
+        - 'accept-encoding: gzip, deflate, br, zstd'
+        - 'upgrade-insecure-requests: 1'
+        - 'sec-fetch-dest: document'
+        - 'sec-fetch-mode: navigate'
+        - 'sec-fetch-site: none'
+        - 'sec-fetch-user: ?1'
+        - 'priority: u=0, i'
+        - 'te: trailers'
+      settings:
+        - key: 1
+          value: 65536
+        - key: 7
+          value: 20
+        - key: 727725890
+          value: 0
+        - key: 16765559
+          value: 1
+        - key: 51
+          value: 1
+        - key: 8
+          value: 1
+    quic:
+      allow_permutation: false
+      transport_parameters:
+        - key: 1
+          value: 30000
+        - key: 4
+          value: 25165824
+        - key: 5
+          value: 12582912
+        - key: 6
+          value: 1048576
+        - key: 7
+          value: 1048576
+        - key: 8
+          value: 100
+        - key: 9
+          value: 100
+        - key: 11
+          value: 20
+        - key: 14
+          value: 8
+        - key: 15
+          hex: any
+        - key: 17
+          version_information:
+            chosen: 1
+            available:
+              - grease: true
+              - value: 1
+        - grease: true
+        - key: 32
+          value: 65535

tests/requirements.txt

@@ -1,4 +1,5 @@
 pyyaml
 pytest
 pytest-asyncio
+aioquic
 th1 @ git+https://github.com/lexiforest/th1.git@main