-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
BUG - ParseHttp exception. Recovering, but please report this: runtime error: slice bounds out of range #6409
Comments
Based on the stack trace it looks like a slice indexing bug while attempting to parse the HTTP header. @anergiti Would you be able to capture a short trace and attach it here so we can replay the data through Packetbeat?
And this looks similar to #2150. https://github.com/elastic/beats/blob/v6.2.1/packetbeat/protos/http/http_parser.go#L179 |
This is indeed look similar to #2150, I know I played with that code a few
month ago, a pcap dump would be very helpful.
On Tue, Feb 20, 2018 at 4:31 PM Andrew Kroh ***@***.***> wrote:
Based on the stack trace it looks like a slice indexing bug while
attempting to parse the HTTP header. @anergiti
<https://github.com/anergiti> Would you be able to capture a short trace
<https://www.elastic.co/guide/en/beats/packetbeat/current/recording-trace.html>
and attach it here so we can replay the data through Packetbeat?
runtime.panicslice
/usr/local/go/src/runtime/panic.go:35github.com/elastic/beats/packetbeat/protos/http.(*parser).parseHTTPLine
/go/src/github.com/elastic/beats/packetbeat/protos/http/http_parser.go:179github.com/elastic/beats/packetbeat/protos/http.(*parser).parse
/go/src/github.com/elastic/beats/packetbeat/protos/http/http_parser.go:107github.com/elastic/beats/packetbeat/protos/http.(*httpPlugin).doParse
/go/src/github.com/elastic/beats/packetbeat/protos/http/http.go:293github.com/elastic/beats/packetbeat/protos/http.(*httpPlugin).Parse
/go/src/github.com/elastic/beats/packetbeat/protos/http/http.go:224github.com/elastic/beats/packetbeat/protos/tcp.(*TCPStream).addPacket
/go/src/github.com/elastic/beats/packetbeat/protos/tcp/tcp.go:115github.com/elastic/beats/packetbeat/protos/tcp.(*TCP).Process
/go/src/github.com/elastic/beats/packetbeat/protos/tcp/tcp.go:208github.com/elastic/beats/packetbeat/decoder.(*Decoder).onTCP
/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:317github.com/elastic/beats/packetbeat/decoder.(*Decoder).process
/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:258github.com/elastic/beats/packetbeat/decoder.(*Decoder).OnPacket
/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:164github.com/elastic/beats/packetbeat/sniffer.(*Sniffer).Run
/go/src/github.com/elastic/beats/packetbeat/sniffer/sniffer.go:193github.com/elastic/beats/packetbeat/beater.(*packetbeat).Run.func2
/go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:202"
And this looks similar to #2150
<#2150>.
https://github.com/elastic/beats/blob/v6.2.1/packetbeat/protos/http/http_parser.go#L179
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#6409 (comment)>, or mute
the thread
<https://github.com/notifications/unsubscribe-auth/AAACgFO-vc21zDjWQK5fxlnSB38qTW4Vks5tWznKgaJpZM4SKhhK>
.
--
ph
|
Hey @andrewkroh |
I wasn't able to open the attached pcap file (after unzipping) with Packetbeat or Wireshark. I think it got corrupted somehow. Not sure if it was during the upload or something Packetbeat did while writing it. Sorry to ask, but can you try again? |
Hey, |
pcap files are not plain text so it is expected that tail doesn't work properly.
The files produced by |
mytrace.pcap.zip |
Hi @anergiti , can you confirm that you get the runtime error when running this pcap through packetbeat? Because I don't seem to get it. Try with:
|
Yup you right. is there a difference between pcap and standalone? |
@anergiti can you try capturing more traffic with the |
Sure, can try |
Hey. i have uploaded the pcap file. can download it from dropbox link bellow. |
There was a bounds check error in parsing HTTP responses. A malformed response line in the form "HTTP/1.1\r\n" would cause a panic when parsed.
There was a bounds check error in parsing HTTP responses. A malformed response line in the form "HTTP/1.1\r\n" would cause a panic when parsed. Related to #6409
There was a bounds check error in parsing HTTP responses. A malformed response line in the form "HTTP/1.1\r\n" would cause a panic when parsed. Related to elastic#6409
There was a bounds check error in parsing HTTP responses. A malformed response line in the form "HTTP/1.1\r\n" would cause a panic when parsed. Related to elastic#6409
There was a bounds check error in parsing HTTP responses. A malformed response line in the form "HTTP/1.1\r\n" would cause a panic when parsed. Related to elastic#6409
There was a bounds check error in parsing HTTP responses. A malformed response line in the form "HTTP/1.1\r\n" would cause a panic when parsed. Related to #6409
There was a bounds check error in parsing HTTP responses. A malformed response line in the form "HTTP/1.1\r\n" would cause a panic when parsed. Related to #6409
hey guys, |
@andrewkroh how are you? |
@adriansr I just updated to 6.2.4, but still see this issue in production. I'm trying to figure out how to provide a pcap without sensitive data. |
Can you provide the stacktrace reported by packetbeat? |
|
A broken HTTP request caused the parser to report a panic. Fixes elastic#6409
A broken HTTP request caused the parser to report a panic. Fixes elastic#6409
A broken HTTP request caused the parser to report a panic. Fixes elastic#6409 (cherry picked from commit a634802)
…elastic#7339) A broken HTTP request caused the parser to report a panic. Fixes elastic#6409 (cherry picked from commit 73a009f)
There was a bounds check error in parsing HTTP responses. A malformed response line in the form "HTTP/1.1\r\n" would cause a panic when parsed. Related to elastic#6409
Hello,
Opening a bug issue per elasticteam request:
Hello.
im running packetbeat; Version: 6.2.1 on ubuntu machine,
Connected to Elasticsearch version 5.1.2.
capturing mirrored traffic.
this is my yml file:
`packetbeat.interfaces.device: eth5
packetbeat.interfaces.type: af_packet
packetbeat.interfaces.snaplen: 1500
packetbeat.interfaces.buffer_size_mb: 500
packetbeat.flows:
ports: [53]
include_authorities controls whether or not the dns.authorities field
(authority resource records) is added to messages.
include_authorities: true
include_additionals controls whether or not the dns.additionals field
(additional resource records) is added to messages.
include_additionals: true
type: http
Configure the ports where to listen for HTTP traffic. You can disable
the HTTP protocol by commenting out the list of ports.
enabled: true
ports: [80, 8080]
send_headers: false
send_all_headers: false
include_body_for: ["application/json"]
send_request: true
send_response: true
transaction_timeout: 20s
output.elasticsearch:
Array of hosts to connect to.
hosts: ["1.1.1.1:9200"]`
most of packets are not parsed due to ParseHttp exception - slice bounds out of range.
This is a snip of debug logs of Packetbeat:
The text was updated successfully, but these errors were encountered: