edisona / dpkt

Automatically exported from code.google.com/p/dpkt
Other
1 stars 0 forks source link

http.response throws an exception when given an HTTP/0.9 GET request #58

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. Create a packet capture of some HTTP/0.9 GET request
2. Run it through the code fragment below
3.

What is the expected output? What do you see instead?
I expect the GET request to be displayed.  Instead, http.response throws an 
exception

What version of the product are you using? On what operating system?
dpkt 1.7  Ubuntu 10.04 with python 2.6.5 Windows/7 with Cygwin Python 2.6.5

Please provide any additional information below.
Test program is
#!/usr/bin/env python

import dpkt
import sys

f = open(sys.argv[1])
pcap = dpkt.pcap.Reader(f)

packet_ctr = 0
for ts, buf in pcap:
    packet_ctr += 1
    eth = dpkt.ethernet.Ethernet(buf)
    ip = eth.data
    tcp = ip.data

    if tcp.dport == 80 and len(tcp.data) > 0:
        try :
            http = dpkt.http.Request(tcp.data)
        except  dpkt.UnpackError, e:
            print "dpkt raised an unpack error %s in packet %d" % (e, packet_ctr
 )
        else :
            print http.uri

f.close()

Output is:
$ python dpkt_test.py C591450-02-int.cap 
dpkt raised an unpack error invalid request: 'GET /\r\n' in packet 4
dpkt raised an unpack error invalid request: 'GET /\r\n' in packet 14
dpkt raised an unpack error invalid request: 'GET /\r\n' in packet 24
/
/
dpkt raised an unpack error invalid request: 'GET /\r\n' in packet 54
dpkt raised an unpack error invalid request: 'GET /\r\n' in packet 64
dpkt raised an unpack error invalid request: 'GET /\r\n' in packet 74
/
/

Original issue reported on code.google.com by jeffsilv...@gmail.com on 22 Dec 2010 at 10:52

GoogleCodeExporter commented 9 years ago
I found the problem:

     def unpack(self, buf):
        f = cStringIO.StringIO(buf)
        line = f.readline()
        l = line.strip().split()
        if len(l) != 3 or l[0] not in self.__methods or            not l[2].startswith(self.__proto):
            raise dpkt.UnpackError('invalid request: %r' % line)

However, in an HTTP/0.9 request, there is no protocol field.  An HTTP/0.9 GET 
request looks like

GET /

so the unpack method throws dpkt.UnpackErrors because there are only 2 elements 
in list l .  This is a problem for F5 HTTP monitors, which use HTTP/0.9 by 
default.

Original comment by jeffsilv...@gmail.com on 22 Dec 2010 at 11:18

GoogleCodeExporter commented 9 years ago
[deleted comment]
GoogleCodeExporter commented 9 years ago
[deleted comment]
GoogleCodeExporter commented 9 years ago
[deleted comment]
GoogleCodeExporter commented 9 years ago
This issue was closed by revision r80.

Original comment by jon.ober...@gmail.com on 6 Jan 2011 at 4:50

GoogleCodeExporter commented 9 years ago
Thanks for the report Jeff.

Fixed in r80!

Original comment by jon.ober...@gmail.com on 6 Jan 2011 at 4:50