`find_observables()` method returns 'Connection broken: IncompleteRead(0 bytes read)'

[orzechowska]

Request Type

Bug

Work Environment

Question	Answer
TheHive4py version / git hash	1.8.1

Problem Description

When calling find_observables method I get the following error:

Error: ('Connection broken: IncompleteRead(0 bytes read)', IncompleteRead(0 bytes read))
Traceback (most recent call last):
  File "/opt/conda/lib/python3.7/site-packages/thehive4py/api.py", line 598, in find_observables
    return self.__find_rows("/api/case/artifact/_search", **attributes)
  File "/opt/conda/lib/python3.7/site-packages/thehive4py/api.py", line 122, in __find_rows
    raise TheHiveException("Error: {}".format(e))
thehive4py.exceptions.TheHiveException: Error: ('Connection broken: IncompleteRead(0 bytes read)', IncompleteRead(0 bytes read))

find_cases() and find_alerts() both work without issue.

Steps to Reproduce

>>> from thehive4py.api import TheHiveApi
>>> api_key = XXX
>>> hive_url = YYY
>>> 
>>> api = TheHiveApi(hive_url, api_key, version=4,  organisation='ZZZ', cert=False)
>>> query = {'_field': 'tlp', '_value': 2}
>>> range = '0-2'
>>> sort = []
>>> response = api.find_observables(query=query, range=range, sort=sort)
Error: ('Connection broken: IncompleteRead(0 bytes read)', IncompleteRead(0 bytes read))
Traceback (most recent call last):
  File "/opt/conda/lib/python3.7/site-packages/thehive4py/api.py", line 598, in find_observables
    return self.__find_rows("/api/case/artifact/_search", **attributes)
  File "/opt/conda/lib/python3.7/site-packages/thehive4py/api.py", line 122, in __find_rows
    raise TheHiveException("Error: {}".format(e))
thehive4py.exceptions.TheHiveException: Error: ('Connection broken: IncompleteRead(0 bytes read)', IncompleteRead(0 bytes read))
>>> response = api.find_cases(query=query, range=range, sort=sort)
>>> print(response.status_code)
200

I tired different query parameters, nothing seems to work. I would appreciate any help with solving this issue.

[mieczkowski]

@orzechowska you could try my way, found in chromium requests. Maybe authors will finally adapt thehive4py to new hive version...

# observables = self.hive_api.get_case_observables(hive_case_id, query=In('dataType', ['mail']))
observables = requests.post(self.hive_api.url+'/api/v1/query?name=observables', json={"query":[{"_name":"getCase","idOrName":hive_case_id},{"_name":"observables"},{"_name":"filter","_like":{"_field":"dataType","_value":"mail"}}]}, proxies=self.hive_api.proxies, auth=self.hive_api.auth)

[pandvan]

I've just hit the same error executing the find_alerts() method.

Here below the full stack trace

  warnings.warn(
2021-10-12 11:12:34,174 - TheHive - ERROR:Failed to execute Error: ('Connection broken: IncompleteRead(34 bytes read)', IncompleteRead(34 bytes read))-963e5141-120a-451d-a081-067230bb0a88
Traceback (most recent call last):
  File "/usr/local/lib/python3.9/site-packages/urllib3/response.py", line 697, in _update_chunk_length
    self.chunk_left = int(line, 16)
ValueError: invalid literal for int() with base 16: b'HTTP/1.1 503 Service Unavailable\r\n'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.9/site-packages/urllib3/response.py", line 437, in _error_catcher
    yield
  File "/usr/local/lib/python3.9/site-packages/urllib3/response.py", line 764, in read_chunked
    self._update_chunk_length()
  File "/usr/local/lib/python3.9/site-packages/urllib3/response.py", line 701, in _update_chunk_length
    raise httplib.IncompleteRead(line)
http.client.IncompleteRead: IncompleteRead(34 bytes read)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.9/site-packages/requests/models.py", line 753, in generate
    for chunk in self.raw.stream(chunk_size, decode_content=True):
  File "/usr/local/lib/python3.9/site-packages/urllib3/response.py", line 572, in stream
    for line in self.read_chunked(amt, decode_content=decode_content):
  File "/usr/local/lib/python3.9/site-packages/urllib3/response.py", line 793, in read_chunked
    self._original_response.close()
  File "/usr/local/lib/python3.9/contextlib.py", line 135, in __exit__
    self.gen.throw(type, value, traceback)
  File "/usr/local/lib/python3.9/site-packages/urllib3/response.py", line 455, in _error_catcher
    raise ProtocolError("Connection broken: %r" % e, e)
urllib3.exceptions.ProtocolError: ('Connection broken: IncompleteRead(34 bytes read)', IncompleteRead(34 bytes read))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.9/site-packages/thehive4py/api.py", line 120, in __find_rows
    return requests.post(req, params=params, json=data, proxies=self.proxies, auth=self.auth, verify=self.cert)
  File "/usr/local/lib/python3.9/site-packages/requests/api.py", line 119, in post
    return request('post', url, data=data, json=json, **kwargs)
  File "/usr/local/lib/python3.9/site-packages/requests/api.py", line 61, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python3.9/site-packages/requests/sessions.py", line 542, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python3.9/site-packages/requests/sessions.py", line 697, in send
    r.content
  File "/usr/local/lib/python3.9/site-packages/requests/models.py", line 831, in content
    self._content = b''.join(self.iter_content(CONTENT_CHUNK_SIZE)) or b''
  File "/usr/local/lib/python3.9/site-packages/requests/models.py", line 756, in generate
    raise ChunkedEncodingError(e)
requests.exceptions.ChunkedEncodingError: ('Connection broken: IncompleteRead(34 bytes read)', IncompleteRead(34 bytes read))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/app/walkoff_app_sdk/app_base.py", line 2556, in execute_action
    newres = await func(**params)
  File "/app/app.py", line 67, in find_best_case_to_merge
    response = self.thehive.find_alerts(query=query)
  File "/usr/local/lib/python3.9/site-packages/thehive4py/api.py", line 1053, in find_alerts
    return self.__find_rows("/api/alert/_search", **attributes)
  File "/usr/local/lib/python3.9/site-packages/thehive4py/api.py", line 122, in __find_rows
    raise TheHiveException("Error: {}".format(e))
thehive4py.exceptions.TheHiveException: Error: ('Connection broken: IncompleteRead(34 bytes read)', IncompleteRead(34 bytes read))

Could be something related to this one https://github.com/psf/requests/issues/4248?

[KRUXLEX]

The same issue hear. Need to immediately fix.