HTTP Framing Diff Toolkit

Offline tools for HTTP/1.1 framing research:

1. Variant generator (http_smuggle_fuzzer.py) — builds CL/TE and related byte patterns for local harnesses.
2. Differential harness (framing_diff.py) — feeds the same byte stream to a reference observer (and optional external parser CLIs) and prints a structured comparison.

This repository does not send network traffic and does not assign a smuggling or vulnerability verdict from a single parser's internal state.

Classification labels

Label	Meaning
valid	Well-formed message under a normal reading
invalid-syntax	Violates RFC syntax (e.g. 3x chunk size, space instead of ;)
ambiguous-framing	Conflicting CL/TE or dual CL — seed for multi-component tests
incomplete-stream	Declared length exceeds bytes supplied — streaming wait
known-cve-seed	Payload tied to a public CVE for regression only

Hard rule: incomplete streams are never labeled smuggling.

Usage

# list built-in cases and classes
python framing_diff.py --list-cases
python framing_diff.py --list-classes

# run the invalidated false-positive pattern (must print OBSERVATION_ONLY)
python framing_diff.py --variant incomplete-declared-chunk

# offline variant generation (no sockets)
python http_smuggle_fuzzer.py --host local.example --list

# tests
python test_variants.py
python test_framing_diff.py

Pure-Python policy backends (no gcc required)

python pure_backends.py tinyproxy-1.11.3 < sample.http
python pure_backends.py tinyproxy-fixed < sample.http
python test_pure_backends.py

Models Tinyproxy 1.11.3 (CL-wins + forward both) vs fixed (prefer chunked / strip dual CL+TE). These are policy models, not the real binary.

External C backends (when toolchain available)

# stubs under backends/ (point -I at your local http-parser sources)
gcc -O2 -I/path/to/http-parser backends/parse_http_parser_cli.c \
    /path/to/http-parser/http_parser.c -o parse_http_parser_cli.exe

python framing_diff.py --variant cl-te-conflict \
  --backend hp=./parse_http_parser_cli.exe

Validation standard for future claims

A framing issue becomes a security finding only when all of the following hold:

1. Spec or documented invariant is identified.
2. Complete, fragmented, and EOF cases are tested where relevant.
3. Negative controls pass.
4. At least two real components disagree on message boundaries.
5. An impact oracle shows a security consequence (auth bypass, cache poison, wrong vhost, memory corruption, etc.).

Parser field values or “one message counted” on incomplete input are observations, not findings.

Invalidated http-parser candidate

A previous claim treated an incomplete 0xFFFFF chunk as request smuggling. That was wrong: the parser was waiting for more chunk data; text that looked like GET /admin was still body; FFFFF F is not a valid chunk extension; no second component was tested. See examples/http-parser/smuggle.c (EXPECTED_INCOMPLETE_STREAM) and the retrospective in the disclosures repo.

Related

• Corpus of labeled HTTP byte samples: http11-parser-corpus (sibling repo)
• Disclosures / reproductions: proto-cve-disclosures
• Pcap heuristics: traffic-analyzer

Only use these tools on systems you own or are explicitly authorized to test.