Bug report: TypeError in HTTP/2 Parsing: String Indices Must Be Integers

[techware01]

I encountered a TypeError while running the pcapng_to_har function in the pcapng-utils package. The error traceback is as follows:

Code

Traceback (most recent call last):
  File "$USER/pcapng-utils/venv/lib/python3.12/site-packages/pcapng_utils/pcapng_to_har.py", line 65, in cli
    pcapng_to_har(
  File "$USER/pcapng-utils/venv/lib/python3.12/site-packages/pcapng_utils/pcapng_to_har.py", line 126, in pcapng_to_har
    traffic.parse_traffic()
  File "$USER/pcapng-utils/venv/lib/python3.12/site-packages/pcapng_utils/tshark/traffic.py", line 35, in parse_traffic
    self.parsed_traffic[protocol_class] = protocol_class(self.traffic)
                                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "$USER/pcapng-utils/venv/lib/python3.12/site-packages/pcapng_utils/tshark/protocols/http2.py", line 559, in __init__
    self.parse_traffic()
  File "$USER/pcapng-utils/venv/lib/python3.12/site-packages/pcapng_utils/tshark/protocols/http2.py", line 617, in parse_traffic
    http2_stream.process()
  File "$USER/pcapng-utils/venv/lib/python3.12/site-packages/pcapng_utils/tshark/protocols/http2.py", line 380, in process
    self.response = Http2Response(resp_substreams)  # may be empty
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "$USER/pcapng-utils/venv/lib/python3.12/site-packages/pcapng_utils/tshark/protocols/http2.py", line 92, in __init__
    self.headers, self.data, self.headers_streams, self.data_streams = Http2Helper.get_headers_and_data(substreams)
                                                                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "$USER/pcapng-utils/venv/lib/python3.12/site-packages/pcapng_utils/tshark/protocols/http2.py", line 508, in get_headers_and_data
    headers += Http2Helper.get_headers(substream)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "$USER/pcapng-utils/tshark/protocols/http2.py", line 416, in get_headers
    h_name = get_tshark_bytes_from_raw(header['http2.header.name_raw']).decode()
                                       ~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: string indices must be integers, not 'str'

The error occurs when trying to access a dictionary key in the get_headers function, but the variable header is sometimes not structured as expected. When tested the header was sometimes a string instead of a dict (e.g. http2.header.name.length). When I added code to catch these cases an output har file was created, that probably misses some header information.

Steps to Reproduce:

• Run the pcapng_to_har function with a specific pcapng file that contains HTTP/2 traffic
  • I recorded the traffic of the android App deepl using PCAPdroid and FriTap (for the keys) and used editcap as explained to combine both pcap and keylog file.
• Observe the error traceback.

Expected Behavior:

The function should parse the HTTP/2 traffic without raising a TypeError.

Environment:

pcapng-utils version: 1.0.5
Python version: 3.12.7
tshark 4.4.1

Please let me know if you need any further information to assist in resolving this issue.

[U039b]

What version of tshark do you use?

[techware01]

I have TShark (Wireshark) 4.4.1. installed on my system. That should be used by pcapng-utils if not specified otherwise right?

[CyrilBrulebois]

Running Debian unstable I suppose? Our current target is Debian 12 which ships 4.0.17-0+deb12u1.

[U039b]

As mentioned in the readme, we only support tshark version >4 so, all good here.

[techware01]

Running Debian unstable I suppose? Our current target is Debian 12 which ships 4.0.17-0+deb12u1.

Thanks for the clarification. I'm running Arch Linux and I'm using the pcapng_to_harutility independently from the PTS.

I apologize for not spotting that earlier. I was not aware that >= 4.0 does not include 4.4. Will try to install an older version and test it again.

[U039b]

@techware01 the version of tshark you have should work just fine as it's >=4.x