Packetbeat cannot parse Tomcat's response status line because of reason phrase

cero-t · March 16, 2018, 7:10am

I tried to use Packetbeat 6.2.2 to capture packets of Tomcat request / response but failed to capture with this error.

http/http_parser.go(156) Failed to understand HTTP response status: 200

Tomcat (> 8.5) returns only the response status code without reason phrase by default, but packetbeat's parser expects the reason phrase and it cause above error. I think the spec of HTTP 1.1 (RFC 2616) is ambiguous regarding whether the reason phrase is optional or required. I think a "space" is required, but the "phrase" is not required.

github.com

elastic/beats/blob/master/packetbeat/protos/http/http_parser.go#L210


	}


	// ok so far
	s.parseOffset = i + 2
	m.headerOffset = s.parseOffset
	s.parseState = stateHeaders


	return true, true, true
}


func parseResponseStatus(s []byte) (uint16, []byte, error) {
	if isDebug {
		debugf("parseResponseStatus: %s", s)
	}


	p := bytes.IndexByte(s, ' ')
	if p == -1 {
		return 0, nil, errors.New("Not able to identify status code")
	}
	statusCode, err := parseInt(s[0:p])
	if err != nil {

RFC 2616
https://tools.ietf.org/html/rfc2616#section-6.1

Then, is it reasonable to modify Packetbeat to be enabled to parse the response status line without any reason phrase?

steffens · March 16, 2018, 8:56am

Hmmm.... this sounds somewhat familiar to me. If servers do give this kind of response-code-only-response, packetbeat should support this. Do you plan to create a pull request? Otherwise, just open an issue.

adrisr · March 16, 2018, 9:31am

A fix for this was already merged (#6208) but we have failed to backport it to 6.2.

adrisr · March 16, 2018, 10:14am

The fix won't make it to 6.2.3, but it will be available in the next version, most likely 6.3.0

cero-t · March 17, 2018, 9:14am

Thanks, I'm grad to here that. I'll wait for 6.3!

system · April 14, 2018, 9:14am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Wrong phrase in the http.response.phrase field Beats packetbeat	4	867	August 29, 2017
Packetbeat - Bug parsing http method Beats beats-development , packetbeat	1	533	October 25, 2020
Failed to understand HTTP response Beats packetbeat	2	844	February 22, 2018
Fail to parse HTTP parameters: parse "response\"}}\nPOST /_bulk": net/url: invalid control character in Beats docker , packetbeat	1	968	January 23, 2021
Tomcat HTTP requests are not showing by PACKETBEAT Beats packetbeat	2	533	June 11, 2018

Packetbeat cannot parse Tomcat's response status line because of reason phrase

Related topics