-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Packetbeat HTTP parsing fails on empty status phrase #6176
Comments
The warning tells status:302 so the status seems to be parsed? See my full log file for more examples: packetbeat.log Packetbeat and tomcat running together in a docker-container. Maybe there is a problem with docker network because of logged messages "Ignore empty non-FIN packet"? |
@mbudnick It is failing because it expects something else after the status code. Your server status response is in the form:
When packetbeat is expecting a non-empty status phrase:
|
Hello @adriansr I was checking and testing this issue and about to commit it to my fork but it seemed to obvious to me where the issue might be that I'd rather leave the question in this issue before actually make a PR. In the function Let me know what you think about this change. |
Hi @jreyeshdez I think it's better to just return the phrase, even if empty, instead of an error. |
Hi @adriansr xkoomy |
User reports some HTTP servers may respond with a broken status line that's missing a space between the status code and the optional status phrase. HTTP clients tested already support this behavior. This patch adjusts the http parser so that this deviation from the standard is accepted. Fixes elastic#6176
User reports some HTTP servers may respond with a broken status line that's missing a space between the status code and the optional status phrase. HTTP clients tested already support this behavior. This patch adjusts the http parser so that this deviation from the standard is accepted. Fixes #6176
User reports some HTTP servers may respond with a broken status line that's missing a space between the status code and the optional status phrase. HTTP clients tested already support this behavior. This patch adjusts the http parser so that this deviation from the standard is accepted. Fixes elastic#6176
User reports some HTTP servers may respond with a broken status line that's missing a space between the status code and the optional status phrase. HTTP clients tested already support this behavior. This patch adjusts the http parser so that this deviation from the standard is accepted. Fixes #6176
User reports some HTTP servers may respond with a broken status line that's missing a space between the status code and the optional status phrase. HTTP clients tested already support this behavior. This patch adjusts the http parser so that this deviation from the standard is accepted. Fixes elastic#6176
User reports some HTTP servers may respond with a broken status line that's missing a space between the status code and the optional status phrase. HTTP clients tested already support this behavior. This patch adjusts the http parser so that this deviation from the standard is accepted. Fixes #6176
User reports some HTTP servers may respond with a broken status line that's missing a space between the status code and the optional status phrase. HTTP clients tested already support this behavior. This patch adjusts the http parser so that this deviation from the standard is accepted. Fixes elastic#6176
An HTTP response whose status phrase is empty causes the following error:
For example :
The response parser in https://github.com/elastic/beats/blob/master/packetbeat/protos/http/http_parser.go#L224 is expecting the status-phrase to be non-empty.
From this question on discuss.
The text was updated successfully, but these errors were encountered: