Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chunked multi-part web posts #285

Closed
MarkScherfling opened this issue Jan 27, 2021 · 10 comments · Fixed by #287
Closed

chunked multi-part web posts #285

MarkScherfling opened this issue Jan 27, 2021 · 10 comments · Fixed by #287

Comments

@MarkScherfling
Copy link

Does circuits supported chunked data decoding a web POST? Below are the headers and the stack trace when data is received with the header: Transfer-Encoding: chunked

Environment and Platform

  • OS: Mac OS
  • Python: 3.6.9
  • circuits: 3.2.1

<_read[web] (<socket.socket fd=22, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('0.0.0.0', 9001)> )>
<connect[web] (<socket.socket fd=26, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 49964)>, '192.168.1.215', 49964 )>
<_read[web] (<socket.socket fd=26, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 49964)> )>
<read[web] (<socket.socket fd=26, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 49964)>, b'POST /cts/yeti_threat_service HTTP/1.1\r\nTransfer-Encoding: chunked\r\nContent-Type: multipart/form-data; boundary=HbS4UskuFNL07YlRgmuNmyXtg2-VTAVWiQFR8of\r\nHost: 192.168.1.215:9001\r\nConnection: Keep-Alive\r\nUser-Agent: Apache-HttpClient/4.5.6 (Java/1.8.0_181)\r\nAccept-Encoding: gzip,deflate\r\n\r\nf3\r\n--HbS4UskuFNL07YlRgmuNmyXtg2-VTAVWiQFR8of\r\nContent-Disposition: form-data; name="artifact"\r\nContent-Type: application/json; charset=UTF-8\r\nContent-Transfer-Encoding: 8bit\r\n\r\n{"type":"file.content","value":"wweigle_2020_12_21_attch_1_of_1.eml"}\r\n' )>
<_read[web] (<socket.socket fd=26, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 49964)> )>
<request[web] (<Request POST /cts/yeti_threat_service HTTP/1.1>, <Response 200 OK None (0)> )>
<read[web] (<socket.socket fd=26, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 49964)>, b'b61\r\n\r\n--HbS4UskuFNL07YlRgmuNmyXtg2-VTAVWiQFR8of\r\nContent-Disposition: form-data; name="file"; filename="wweigle_2020_12_21_attch_1_of_1.eml"\r\nContent-Type: application/octet-stream\r\nContent-Transfer-Encoding: binary\r\n\r\n<content>

ERROR <handler[*][request][0.10] (Dispatcher._on_request)> (<request[web] (<Request POST /cts/yeti_threat_service HTTP/1.1>, <Response 200 OK None (0)> )>) (<class 'circuits.web.parsers.multipart.MultipartError'>): MultipartError('Unexpected end of multipart stream.',)
Traceback (most recent call last):
  File "/Users/xxxxx/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/core/manager.py", line 659, in _dispatcher
    value = event_handler(event, *eargs, **ekwargs)
  File "/Users/xxxxx/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/dispatchers/dispatcher.py", line 114, in _on_request
    process(req, event.kwargs)
  File "/Users/xxxxx/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/processors.py", line 54, in process
    process_multipart(request, params)
  File "/Users/xxxxx/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/processors.py", line 30, in process_multipart
    for part in parser:
  File "/Users/xxxxx/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/parsers/multipart.py", line 209, in __iter__
    for part in self._part_iter:
  File "/Users/xxxxx/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/parsers/multipart.py", line 310, in _iterparse
    raise MultipartError("Unexpected end of multipart stream.")
circuits.web.parsers.multipart.MultipartError: Unexpected end of multipart stream.
@spaceone
Copy link
Contributor

Yes, it is supported.
How are you doing the request? Via a web browser or via a library?
Can you attach the whole request?
In the log lines it's broken.

@MarkScherfling
Copy link
Author

MarkScherfling commented Jan 28, 2021

here's more. It continues but will the same pattern

<registered[web] (<HTTP/web 78606:MainThread (queued=0) [S]>, <Server/web 78606:MainThread (queued=9) [R]> )>
<registered[web] (<Dispatcher/web 78606:MainThread (queued=0) [S]>, <HTTP/web 78606:MainThread (queued=0) [S]> )>
<registered[/] (<Root// 78606:MainThread (queued=0) [S]>, <Server/web 78606:MainThread (queued=7) [R]> )>
<registered[web] (<Logger/web 78606:MainThread (queued=0) [S]>, <Server/web 78606:MainThread (queued=6) [R]> )>
<registered[*] (<Debugger/* 78606:MainThread (queued=0) [S]>, <Server/web 78606:MainThread (queued=5) [R]> )>
<registered[/cts/yeti_threat_service] (<Test//cts/yeti_threat_service 78606:MainThread (queued=0) [S]>, <Server/web 78606:MainThread (queued=4) [R]> )>
<started[web] (<Server/web 78606:MainThread (queued=3) [R]> )>
<registered[select] (<Select/select 78606:MainThread (queued=0) [S]>, <TCPServer/web 78606:MainThread (queued=0) [S]> )>
<ready[web] (<TCPServer/web 78606:MainThread (queued=0) [S]>, ('192.168.1.215', 9001) )>
circuits.web/3.2.1 ready! Listening on: http://192.168.1.215:9001
<_read[web] (<socket.socket fd=3, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001)> )>
<_read[web] (<socket.socket fd=3, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001)> )>
<connect[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)>, '192.168.1.215', 52401 )>
<_read[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)> )>
<read[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)>, b'POST /cts/yeti_threat_service HTTP/1.1\r\nTransfer-Encoding: chunked\r\nContent-Type: multipart/form-data; boundary=ygdpVhgNZvCeNoHQdIOr2RvW7y3XIn6kYeIdXC\r\nHost: 192.168.1.215:9001\r\nConnection: Keep-Alive\r\nUser-Agent: Apache-HttpClient/4.5.6 (Java/1.8.0_181)\r\nAccept-Encoding: gzip,deflate\r\n\r\nf3\r\n--ygdpVhgNZvCeNoHQdIOr2RvW7y3XIn6kYeIdXC\r\nContent-Disposition: form-data; name="artifact"\r\nContent-Type: application/json; charset=UTF-8\r\nContent-Transfer-Encoding: 8bit\r\n\r\n{"type":"file.content","value":"cjohnsen_2020_12_21_attch_1_of_1.eml"}\r\n' )>
<request[web] (<Request POST /cts/yeti_threat_service HTTP/1.1>, <Response 200 OK None (0)> )>
<_read[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)> )>
<request_failure[web] (<request[web] (<Request POST /cts/yeti_threat_service HTTP/1.1>, <Response 200 OK None (0)> )>, (<class 'circuits.web.parsers.multipart.MultipartError'>, MultipartError('Unexpected end of multipart stream.',), <traceback object at 0x105420748>) )>
<exception[web] (<class 'circuits.web.parsers.multipart.MultipartError'>, MultipartError('Unexpected end of multipart stream.',), ['  File "/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/core/manager.py", line 677, in _dispatcher\n    value = event_handler(event, *eargs, **ekwargs)\n', '  File "/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/dispatchers/dispatcher.py", line 111, in _on_request\n    process(req, event.kwargs)\n', '  File "/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/processors.py", line 69, in process\n    process_multipart(request, params)\n', '  File "/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/processors.py", line 31, in process_multipart\n    for part in parser:\n', '  File "/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/parsers/multipart.py", line 206, in __iter__\n    for part in self._part_iter:\n', '  File "/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/parsers/multipart.py", line 307, in _iterparse\n    raise MultipartError("Unexpected end of multipart stream.")\n'] handler=<bound method Dispatcher._on_request of <Dispatcher/web 78606:MainThread (queued=0) [S]>>, fevent=<request[web] (<Request POST /cts/yeti_threat_service HTTP/1.1>, <Response 500 Internal Server Error None (0)> )>)>
ERROR <handler[*][request][0.10] (Dispatcher._on_request)> (<request[web] (<Request POST /cts/yeti_threat_service HTTP/1.1>, <Response 500 Internal Server Error None (0)> )>) (<class 'circuits.web.parsers.multipart.MultipartError'>): MultipartError('Unexpected end of multipart stream.',)
Traceback (most recent call last):
  File "/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/core/manager.py", line 677, in _dispatcher
    value = event_handler(event, *eargs, **ekwargs)
  File "/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/dispatchers/dispatcher.py", line 111, in _on_request
    process(req, event.kwargs)
  File "/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/processors.py", line 69, in process
    process_multipart(request, params)
  File "/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/processors.py", line 31, in process_multipart
    for part in parser:
  File "/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/parsers/multipart.py", line 206, in __iter__
    for part in self._part_iter:
  File "/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/parsers/multipart.py", line 307, in _iterparse
    raise MultipartError("Unexpected end of multipart stream.")
circuits.web.parsers.multipart.MultipartError: Unexpected end of multipart stream.

<read[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)>, b'b41\r\n\r\n--ygdpVhgNZvCeNoHQdIOr2RvW7y3XIn6kYeIdXC\r\nContent-Disposition: form-data; name="file"; filename="cjohnsen_2020_12_21_attch_1_of_1.eml"\r\nContent-Type: application/octet-stream\r\nContent-Transfer-Encoding: binary\r\n\r\nReceived: from BN6PR02MB2193.namprd02.prod.outlook.com (2603:10b6:404:2e::17)\r\n by MWHPR02MB3263.namprd02.prod.outlook.com with HTTPS; Mon, 21 Dec 2020\r\n 13:14:11 +0000\r\nReceived: from DM5PR19CA0054.namprd19.prod.outlook.com (2603:10b6:3:116::16)\r\n by BN6PR02MB2193.namprd02.prod.outlook.com (2603:10b6:404:2e::17) with\r\n Microsoft SMTP Server (version=TLS1_2,\r\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3676.33; Mon, 21 Dec\r\n 2020 13:14:10 +0000\r\nReceived: from DM6NAM10FT046.eop-nam10.prod.protection.outlook.com\r\n (2603:10b6:3:116:cafe::cb) by DM5PR19CA0054.outlook.office365.com\r\n (2603:10b6:3:116::16) with Microsoft SMTP Server (version=TLS1_2,\r\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3676.30 via Frontend\r\n Transport; Mon, 21 Dec 2020 13:14:10 +0000\r\nAuthentication-Results: spf=softfail (sender IP is 216.251.112.172)\r\n smtp.mailfrom=lalandia.dk; expediacorp.mail.onmicrosoft.com; dkim=fail (body\r\n hash did not verify) header.d=lalandia.dk;expediacorp.mail.onmicrosoft.com;\r\n dmarc=fail action=none header.from=lalandia.dk;\r\nReceived-SPF: SoftFail (protection.outlook.com: domain of transitioning\r\n lalandia.dk discourages use of 216.251.112.172 as permitted sender)\r\nReceived: from edge.expedia.com (216.251.112.172) by\r\n DM6NAM10FT046.mail.protection.outlook.com (10.13.153.44) with Microsoft SMTP\r\n Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id\r\n 15.20.3676.22 via Frontend Transport; Mon, 21 Dec 2020 13:14:08 +0000\r\nReceived: from CHCXEXCHMBX013.SEA.CORP.EXPECN.COM (10.184.69.26) by\r\n edge.expedia.com (10.184.170.23) with Microsoft SMTP Server (version=TLS1_2,\r\n cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2106.2; Mon, 21 Dec\r\n 2020 05:14:03 -0800\r\nReceived: from CHCXEXCHMBX013.SEA.CORP.EXPECN.COM (10.184.69.26) by\r\n CHCXEXCHMBX013.SEA.CORP.EXPECN.com (10.184.69.26) with Microsoft SMTP Server\r\n (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id\r\n 15.1.2106.2; Mon, 21 Dec 2020 05:14:01 -0800\r\nReceived: from mx1a.expedia.com (10.184.170.30) by\r\n CHCXEXCHMBX013.SEA.CORP.EXPECN.COM (10.184.69.26) with Microsoft SMTP Server\r\n (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2106.2\r\n via Frontend Transport; Mon, 21 Dec 2020 05:14:01 -0800\r\nReceived-SPF: Pass (mx1a_ext.expedia.com: domain of\r\n  sl@lalandia.dk designates 89.104.206.42 as permitted sender)\r\n  identity=mailfrom; client-ip=89.104.206.42;\r\n  receiver=mx1a_ext.expedia.com;\r\n  envelope-from="sl@lalandia.dk"; x-sender="sl@lalandia.dk";\r\n  x-conformance=spf_only; x-record-type="v=spf1";\r\n  x-record-text="v=spf1 ip4:72.35.23.0/24 ip4:72.35.12.0/24\r\n  ip4:192.162.216.0/22 ip4:2\r\na24\r\n08.70.128.0/21 ip4:185.38.180.0/22\r\n  ip4:89.104.206.0/23 ip4:68.71.200.64/27\r\n  ip6:2a01:77c0:1180::/46 ip6:2a01:77c0:6::/47\r\n  ip6:2001:978:2a01::/48 ip6:2001:978:2a02::/48 ~all"\r\nAuthentication-Results-Original: mx1a_ext.expedia.com; spf=Pass\r\n smtp.mailfrom=sl@lalandia.dk; dkim=hardfail (body hash did not verify\r\n [final]) header.i=@lalandia.dk; dmarc=pass (p=none dis=none) d=lalandia.dk\r\nIronPort-SDR: ux6aqMBJWQWomSmLsS95jNIxY83UZldSj0Y2GM9fFDGZsi+p8GfLmmWkE3WUoIuLSJV8Nq0Ll9\r\n ZTL+J04SkNZ3Ty7/eOT1x3MZWXrvFOuEZjlUYtTuwGV4rFvjIQCg5M4Go1BMAMQsn3pXaQJjh9\r\n uuPAr2WN58Pd4YSs4lmJQRVi6qAVf+ixNTlv07Ecrk1uFugCkOX3KVV+aTAQasQHSDuzfDSXLU\r\n oGVDj3aSjssT1OLs169iMEDQ8HvwPujwmZsBUmag7zhK9rRv0Q3Y+JVWy+9NklA6j8xMJWRCb8\r\n pIrr/14iFx8O5CalixBCel+s\r\nX-SRBS: 3.5\r\nX-HAT: Sender Group UNKNOWNLIST, Policy $ACCEPTED applied.\r\nX-IPAS-Result: =?us-ascii?q?A0EYCgDGneBfhyrOaFliHAEBAQEBAQcBARIBAQQEAQGCD?=\r\n =?us-ascii?q?4EjgQB9ewcILoRBiQSIHZQdhjSBEQMYFiYEBwQBAQEGAQQiCQQEAQEBAYQSA?=\r\n =?us-ascii?q?S8BAQIBAQKBdgIkATgTAgECAQEBAwIDAQEBAQEEAQEBAgEBAgMCAgEBAhABA?=\r\n =?us-ascii?q?QEBgQRgYASBQwRegQ4MMwyCOCJ7UDYBAQEBAQEBAQEBAQEBAQEBAQEBAQEBA?=\r\n =?us-ascii?q?QEBAQEPAghBBwxCBwUBAR0BCwEJARMLEgEBOBAfAgYBAQEiAgQFCQcBDhoMA?' )>
<_read[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)> )>
<httperror 500 Internal Server Error>
<httperror 500 Internal Server Error>
<httperror 400 Bad Request>
<read[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)>, b'=\r\n =?us-ascii?q?yABBoMgAYMKAQqsaQEBdYEiEIMEAQEGgTMBgQaDf4EbBwkNAoEpgysZAYRlc?=\r\n =?us-ascii?q?YFrgiMHHxs+AYECP4FHgyGCOiMBAgEGEYERARIBOBYggkqCYIJwVTlPR4ENP?=\r\n =?us-ascii?q?Y9LjCCQWIs/BwOCdIdFAoFdimqHPhkJgyaBLoh7hTGEGoRNhl+GG4Z1GpFuj?=\r\n =?us-ascii?q?V2IZwSBODUhanCBBYMkCQo6AQIBAg0BAgIDAQICCAEBAgIBAgKOFxqDV02ED?=\r\n =?us-ascii?q?IV/QQEBATALLAIGAQkBAQMJAYsgAQE?=\r\nIronPort-PHdr: =?us-ascii?q?9a23=3ANZd0JBb5FnRgX3xmxYrQVjX/LSx+4OfEezUN45?=\r\n =?us-ascii?q?9isYplN5qZr8u5bnLW6fgltlLVR4KTs6sC17OJ9fq4AydcuN6oizMrSNR0TR?=\r\n =?us-ascii?q?gLiMEbzUQLIfWuLgnFFsPsdDEwB89YVVVorDmROElRH9viNRWJ+iXhpTEdFQ?=\r\n =?us-ascii?q?/iOgVrO+/7BpDdj9it1+C15pbffxhEiCCybL9vLhi6txvdutUIjYdtJas91w?=\r\n =?us-ascii?q?bCr2dVdehR2W5mP0+YkQzm5se38p5j8iBQtOwk+sVdT6j0fLk2QKJBAjg+PG?=\r\n =?us-ascii?q?87+MPktR/YTQuS/XQcSXkZkgBJAwfe8h73WIr6vzbguep83CmaOtD2TawxVD?=\r\n =?us-ascii?q?+/4apnVAPkhSEaPDM/7WrZiNF/jLhDrR2uqRJx3pXUbp+VOvpkYqzQZskaSX?=\r\n =?us-ascii?q?ZdUstLSyBNHoGxYo0SBOQBJ+ZYqIz9qkMAoRulAQmhH+fvxSVMhnDs2601zu?=\r\n =?us-ascii?q?UhHhvc0AM9HNICvmnfodLuNKcWSu21yLPHzTHZYPNQxDj96ZLHfgo8rvGPRL?=\r\n =?us-ascii?q?99d9faxkYzGQ3flFqQtZDlMC2P1uQLq2WW8eRtWOavhmMorwx8ojyiy9ouh4?=\r\n =?us-ascii?q?TLmI4YxU3I+Ct5zYg6O9C1VUp2b9GnHZdNqiyWKpZ6TMM+T2xruCs3yqELtJ?=\r\n =?us-ascii?q?imdyYEz5QnwgTQa/2Bc4WQ5xLsTueRITNii3JjeLO/gBCy/la6xu36SMa0zF?=\r\n =?us-ascii?q?BHpTdGnNnUrn0A1Bje5tKaRvdh8UqtwyiD2xzS5+1eLk04i6zWIIM7zLEqjJ?=\r\n =?us-ascii?q?ocq\r\n98a\r\n0HDEzf2mEroiK+WcV0p+vOt6+T7erXqv5icN5Joig3jLKgigNKwAeAmPQ?=\r\n =?us-ascii?q?cSQ2ib4+W826H58U3/XrpKkuU6kqjfsJ/EOcQWvq20DgtP3oo+9xqyAC2q3M?=\r\n =?us-ascii?q?oEkXQGNl5IdwyLg5DsO17UIfD4Cfm/g06rkDdu3/3GJbnhD47JLnfZlLfuZ7?=\r\n =?us-ascii?q?B95FNdyAUp19xQ+pFUBqkbIP3vQk/xqMDYDhghPgOowebnD9V91oUFWW2RBK?=\r\n =?us-ascii?q?+UK73dsFCQ5u0xPuaMZZUauDnnK/gi+v7ulWU1lkMafamsjtMrbyWzHPNmJV?=\r\n =?us-ascii?q?6UZ1Lhks8MHWYDsRA5UfSsg1qHAgRef3KjY6VprCo/IIavCY7FSoGkxrCClm?=\r\n =?us-ascii?q?/vBZl+YmlCA1aAEH6ue4bSCNkWbyfHaNRlujgNUbGnR44okx2t/keu0L5PKu?=\r\n =?us-ascii?q?PQ8ysUtJul2NsjtL6brg076TEhV5fV6GqKVWwhxjpVFRMV/YU6jFJ0zkqKza?=\r\n =?us-ascii?q?l/haEIRY5NsqoaGg5vL4XVivd6AoqvBFGJZ4KFTk3hXsW6Unk6G8g8x9Yebk?=\r\n =?us-ascii?q?o6AdimhwDO03niD+oRnriCApA1++TQ3Cu5PJN4wnfC3a8wiF8rGJMVbTX23/?=\r\n =?us-ascii?q?Es9139HYnMwXmexYqjaalO+S/I+SK9wHCVvUZeA0Z6UfDXU00FYFLdo/Wky1?=\r\n =?us-ascii?q?rTa4O3MeUYGA8b4umgMIcUYd71tRJ8QtXjYs3ZQyGMzjS6UD3ZlomnM5bnRV?=\r\n =?us-ascii?q?U/0XrNJEE9gwpPzVC0JCk7AAWd+kGBPDtMMwL3aBLDq/F471SgX20d8gzbVk?=\r\n =?us-ascii?q?N70Oa73iNOn+OBSckN+Lheuyp7hWUlBm6jjs/uEfau/yVeboF9Tc4Y8n1hjT?=\r\n =?us-ascii?q?qGjzJnFYG5A6VknUE4KzRo+FnMj0tqU9genesInmxp0ghUFIGA2lpvXh3D8q?=\r\n =?us-ascii?q?zqZriJDXup9kqDT6jm6nSB8Iia0YAv4alosE68hzj1LUoQ2nA34vBJyXqEpZ?=\r\n =?us-ascii?q?GJMTEKC5vgDRgZ5Qcrobz9fjJs/Ln5imdnL63r4h/d8vEpDckZ4yyZQuVAIK?=\r\n =?us-ascii?q?O6OyjUNskxF/a3Jr0Rv2GPQSldPcNY/f4eL8DlVsuk5fGBJf5evXGorGV3+q?=\r\n =?us-ascii?q?lH0Uy2qix3R+7y3bcYn8in1RKjBxPj0gv778X1hKNqTwowIWfm1hfHBotsO/?=\r\n =?us-ascii?q?FQbMUHWEuxO82XmthnppvHcisNpxazQlIc38mxfgCOKkbwxhBUyREXqGarly?=\r\n =?us-ascii?q?K5y288g3QotK2ZxCvU36HvbgAAIDtBQ2VzxVflOoj8g9EWFE6vc0A3mQGk61?=\r\n =?us-ascii?q?ey9KZaoq17GjqKHBVkXAnTakx8W6+tv6aDZMgSucJ6r3AOA6y1NEqBQ/vmox?=\r\n =?us-ascii?q?JAjn2wV3ILyDYgMC26psaxlElghWaUPHt/62DUfchgyBuMrNCJQfdV1zwKRS?=\r\n =?us-ascii?q?A+hTqETkPpOtCo+dyShpDFv7rmDTr5BsQMIim+6I6bryK06ChLDU+Rhfe2yO?=\r\n =?us-ascii?q?HgQyQzzSKp8thvWGD2oQznY47thOywMbd1cHRyAkb35esnN5hvtrcpvMAv83?=\r\n =?us-ascii?q?xArbK351ZZmmTvCZJh34D+NmMKZX02lo3ftQjh9mB8d0ysmp34bm2+m/VAOe?=\r\n =?us-ascii?q?OmQ1lG/zoGxMxLJbWL3ONVw2xkjkbljT32P6Mm3WwZy6U+73oTmvNKtgwQzB?=\r\n =?us-ascii?q?WRP+pKLxdDGjawzxSj5cnkqIh5dUG3dL6siXsiovOjKo+JkhwbRFKoYLouQQ?=\r\n =?us-ascii?q?Vx9ednO2jg4UfDqYrdUeD+SOs9ujydyE7fhq9oeKIImcYHiwlkFFDNnzoM4N?=\r\n =?us-ascii?q?ApzkFS0r2xh5a4Lmg31aaVOg9ANw/POpoKyCC3pL14ucGznNulHYo8C2UmV8?=\r\n =?us-ascii?q?HHF+33PCxImsWkOQyjMT8u8HupAuSYRT2Ys31noF6RHZeNKEjIPFko3fkzXE?=\r\n =?us-ascii?q?edIFZvml9TbC48v5QaKhmM+ezFV\r\n998\r\nxpQz2o6pQb+liJxkrtrDkPwe1aAmyT3TR?=\r\n =?us-ascii?q?0yVKWgPhxZ010bzn/lCc+Ov8dhGHpj15KKqg6QJV2VSFsTDWQ4c1KcNWnoFZ?=\r\n =?us-ascii?q?6r4p7/66uxGb/rfLPeJLSUrupGUO2UgIiiyZZi42OMP9+DMHBjC65zyg9CR3?=\r\n =?us-ascii?q?d/A8PDh3ACUTYQjXfHaMKK7Be14S0/osGzuPLsRE' )>
<_read[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)> )>
<response[web] (<Response 500 Internal Server Error None (0)> )>
<response[web] (<Response 500 Internal Server Error text/html; charset=utf-8 (0)> )>
<response[web] (<Response 400 Bad Request None (0)> )>
<httperror 400 Bad Request>
<read[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)>, b'rx6JGOBaoaAttu/RmytP?=\r\n =?us-ascii?q?TeZcK1rRxScGwChMtI6XrB0rMl0VUVkS08PyH4F7MGuGqFVKnMz/YPV1pTcD?=\r\n =?us-ascii?q?smcINB46E921xXfYbSkcv7g6Q8xuQoAgJ2FRPtn8izbvsOKmW0Ml/GDW6AKa?=\r\n =?us-ascii?q?6BOTDAyMXwfK/6TrtVje5OsAa3tyrdGEjmcXDLzmG1B03wb7kNuWWdOxpT4t?=\r\n =?us-ascii?q?vvWwtxCWXlUNPtYwG6N9kytzAt3LkonSqVaDwZIWF1RE5dsvud/TtVjvR2XW?=\r\n =?us-ascii?q?dG6yktNvGKzh6Q9PKQMZMKqb1uCyVwmfhd5SEhz5NR5SVNQvB0kW3erY0mr1?=\r\n =?us-ascii?q?Knl7yPwyBrXhNPrn4LjoWHrA1iML7ZvpVBVT7C+w5F82iKChob7+hrC9vmv5?=\r\n =?us-ascii?q?URgtjCna7+MnFDpvrQ9M8VAcTVIYSLMylpPR/gAjWBFAIeVnbrLTTZgEpQ2P?=\r\n =?us-ascii?q?2T7SiTqZ4369DgzZ4HTrZdWF08UP8ZUx43JtEJLZZpUz9hqoa10ZBWt0K3tw?=\r\n =?us-ascii?q?KZBMBK55nwW+KOR/j/MDuVjLACbBwNk/v0KoEaN4uz3EIHCBEyh4DiH0PUVN?=\r\n =?us-ascii?q?ZBoyQnYgx8rEhW8Xd4R3E+wAq1O0X0uCNVT6bq2EJswgJlKfwg7jLt/0s6Kh?=\r\n =?us-ascii?q?LRqS08nVNw/LetyTGdfTjtLbuhCIRfCi76rU80YdvwRwd4axH3nFQxZGaCHu?=\r\n =?us-ascii?q?oNyeE4KyY30ly529MHA/NXQKxabQVFwOHObsIlwUgapzW/yENG7K3ODp4x8W?=\r\n =?us-ascii?q?liOZOqsX9E3BpuKdAvIqmFbrFN5lxZgquIsi6hkOwyilxWNwMW/WWedTRd8l?=\r\n =?us-ascii?q?cMHr0vIyOu8u1lrwCB0WgmGiBER78hpfRk8Vk4MuKLwnf7y7B0LUa1Jr/XP+?=\r\n =?us-ascii?q?aDtmPHj8LNXkIo2xZCiRxe5bYvm5RGEQLcRwU1wbCWDRhMKcfSNVQfcZ9J7H?=\r\n =?us-ascii?q?aKNSeW7beSm9QuYsPnTaawCrXS/KcM3hD7RkByQsJVtIJZWcPwtSOQZcb/cO?=\r\n =?us-ascii?q?xcmE9rvVqxYg/cUrIRP0jR2DYf/5PllM8xgtEbf2tNRz06a3z/566L9FZ63b?=\r\n =?us-ascii?q?zYDJFvMi9cBsxebBdUEIW7g3IL7yUGVWHrlLhBlk7aqGWn7iXIUGuiP5w8Pb?=\r\n =?us-ascii?q?HOPUsqVo3xo2pakeD+iEaJoM/Xfzioaotp4o2WsLNC9cTAV60cTKEj4R3Vw9?=\r\n =?us-ascii?q?AKGCOhCzyRQ4zye8eVCcFkbMSqWCziCgXt2m1lHZ34ZI//fO/U0UnpXdgG6t?=\r\n =?us-ascii?q?HDhWJyap/vTDhGQUUi4L1TrLR1YQlJOstpUVvTrw07cpeHDkKd29SqTXyqLG?=\r\n =?us-ascii?q?INHf1Wyey8a71eiSYvPLa3?=\r\nX-IronPort-Anti-Spam-Filtered: true\r\nX-IronPort-AV: E=Sophos;i="5.78,436,1599548400"; \r\n   d="png\'150?scan\'150,208,217,150";a="51080898"\r\nX-Amp-Result: UNKNOWN\r\nX-Amp-Original-Verdict: FILE UNKNOWN\r\nX-Amp-File-Uploaded: False\r\nX-MailPolicy: Default Incoming Mail Policy\r\nSubject: =?utf-8?q?=5BExternal=5D_=5BSecure_Message=5D_SV=3A_Expedia_-_Lalandia_i_?=\r\n =?utf-8?q?R=C3=B8dby_2021?=\r\nX-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown\r\nReceived: from smtp-out12.electric.net ([89.104.206.42])\r\n  \r\na9b\r\nby mx1a_ext.expedia.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Dec 2020 05:10:57 -0800\r\nReceived: from 1krKxf-0001b5-WC by out12c.electric.net with emc1-ok (Exim 4.94)\r\n\t(envelope-from <sl@lalandia.dk>)\r\n\tid 1krKxg-0001ck-U1\r\n\tfor cjohnsen@expediagroup.com; Mon, 21 Dec 2020 05:10:52 -0800\r\nReceived: by emcmailer; Mon, 21 Dec 2020 05:10:52 -0800\r\nReceived: from [10.95.13.51] (helo=smout12a.electric.net)\r\n\tby out12c.electric.net with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\r\n\t(Exim 4.94)\r\n\t(envelope-from <sl@lalandia.dk>)\r\n\tid 1krKxf-0001b5-WC\r\n\tfor cjohnsen@expediagroup.com; Mon, 21 Dec 2020 05:10:51 -0800\r\nReceived: from localhost ([127.0.0.1])\r\n\tby smout12a.electric.net with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256)\r\n\t(Exim 4.90_1)\r\n\t(envelope-from <sl@lalandia.dk>)\r\n\tid 1krKxf-00052r-U7\r\n\tfor cjohnsen@expediagroup.com; Mon, 21 Dec 2020 13:10:51 +0000\r\nReceived: from smtp-out6.electric.net (out6ci.electric.net [10.89.10.53])\r\n        by smout12a.electric.net\r\n        with SMTP ("Comendo Secure Mail (TLS)") id KIYKUX7X\r\n        for cjohnsen@expediagroup.com;\r\n        Mon, 21 Dec 2020 13:10:49 +0000 (UTC)\r\nReceived: from 1krKxc-0000Yg-TR by out6c.electric.net with hostsite:2476267 (Exim 4.94)\r\n\t(envelope-from <sl@lalandia.dk>)\r\n\tid 1krKxc-0000aR-V2\r\n\tfor cjohnsen@expediagroup.com; Mon, 21 Dec 2020 05:10:48 -0800\r\nReceived: by emcmailer; Mon, 21 Dec 2020 05:10:48 -0800\r\nReceived: from [10.89.2.23] (helo=encryptsmart-engine.mailanyone.net)\r\n\tby out6c.electric.net with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\r\n\t(Exim 4.94)\r\n\t(envelope-from <sl@lalandia.dk>)\r\n\tid 1krKxc-0000Yg-TR\r\n\tfor cjohnsen@expediagroup.com; Mon, 21 Dec 2020 05:10:48 -0800\r\nDate: Mon, 21 Dec 2020 13:10:48 +0000\r\nX-MSYS-API: {"metadata":{"from":"sl@lalandia.dk","mid":"809049"},"options":{"click_tracking":false,"ip_pool":"transactional1' )>
<_read[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)> )>
<write[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)>, b'HTTP/1.1 500 Internal Server Error\r\n' )>
<write[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)>, b'Date: Thu, 28 Jan 2021 22:37:58 GMT\r\nServer: circuits.web/3.2.1\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 1904\r\nConnection: close\r\n\r\n' )>
<write[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)>, b'<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"\n"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">\n<html>\n <head>\n  <meta http-equiv="Content-Type" content="text/html; charset=utf-8"></meta>\n  <title>500 Internal Server Error</title>\n  <style type="text/css">\n   #powered_by {\n    margin-top: 20px;\n    border-top: 2px solid black;\n    font-style: italic;\n   }\n\n   #traceback {\n    color: red;\n   }\n  </style>\n </head>\n <body>\n  <h1>Internal Server Error</h1>\n  \n  <pre id="traceback">ERROR: (&lt;class &#x27;circuits.web.parsers.multipart.MultipartError&#x27;&gt;) Unexpected end of multipart stream.\n  File &quot;/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/core/manager.py&quot;, line 677, in _dispatcher\n    value = event_handler(event, *eargs, **ekwargs)\n  File &quot;/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/dispatchers/dispatcher.py&quot;, line 111, in _on_request\n    process(req, event.kwargs)\n  File &quot;/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/processors.py&quot;, line 69, in process\n    process_multipart(request, params)\n  File &quot;/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/processors.py&quot;, line 31, in process_multipart\n    for part in parser:\n  File &quot;/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/parsers/multipart.py&quot;, line 206, in __iter__\n    for part in self._part_iter:\n  File &quot;/Users/markscherfling/.pyenv/versions/3.6.9/lib/python3.6/site-packages/circuits/web/parsers/multipart.py&quot;, line 307, in _iterparse\n    raise MultipartError(&quot;Unexpected end of multipart stream.&quot;)\n</pre>\n  \n<div id="powered_by">\n    <span>Powered by <a href="http://circuitsweb.com/">circuits.web/3.2.1</a></span>\n</div>\n\n </body>\n</html>\n' )>
<close[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)> )>
<response_success[web] (<response[web] (<Response 500 Internal Server Error text/html; charset=utf-8 (0)> )>, None )>
'192.168.1.215 '- '- '[28/Jan/2021:17:37:58] "'POST /cts/yeti_threat_service HTTP/1.1" 500 '1904 "'" "'Apache-HttpClient/4.5.6 (Java/1.8.0_181)"
<write[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)>, b'HTTP/1.1 500 Internal Server Error\r\n' )>
<write[web] (<socket.socket fd=4, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('192.168.1.215', 9001), raddr=('192.168.1.215', 52401)>, b'Date: Thu, 28 Jan 2021 22:37:58 GMT\r\nServer: circuits.web/3.2.1\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 1904\r\nConnection: close\r\n\r\n' )>

@edgarjohnson1700
Copy link

Is there any update on this issue? I am experiencing the same type of error for my recorded future integration project.

@spaceone
Copy link
Contributor

spaceone commented Jul 10, 2021

So your request data is: b'POST /cts/yeti_threat_service HTTP/1.1\r\nTransfer-Encoding: chunked\r\nContent-Type: multipart/form-data; boundary=ygdpVhgNZvCeNoHQdIOr2RvW7y3XIn6kYeIdXC\r\nHost: 192.168.1.215:9001\r\nConnection: Keep-Alive\r\nUser-Agent: Apache-HttpClient/4.5.6 (Java/1.8.0_181)\r\nAccept-Encoding: gzip,deflate\r\n\r\nf3\r\n--ygdpVhgNZvCeNoHQdIOr2RvW7y3XIn6kYeIdXC\r\nContent-Disposition: form-data; name="artifact"\r\nContent-Type: application/json; charset=UTF-8\r\nContent-Transfer-Encoding: 8bit\r\n\r\n{"type":"file.content","value":"cjohnsen_2020_12_21_attch_1_of_1.eml"}\r\n'

POST /cts/yeti_threat_service HTTP/1.1\r\n
Transfer-Encoding: chunked\r\n
Content-Type: multipart/form-data; boundary=ygdpVhgNZvCeNoHQdIOr2RvW7y3XIn6kYeIdXC\r\n
Host: 192.168.1.215:9001\r\n
Connection: Keep-Alive\r\n
User-Agent: Apache-HttpClient/4.5.6 (Java/1.8.0_181)\r\n
Accept-Encoding: gzip,deflate\r\n\r\n

f3\r\n
--ygdpVhgNZvCeNoHQdIOr2RvW7y3XIn6kYeIdXC\r\n
Content-Disposition: form-data; name="artifact"\r\n
Content-Type: application/json; charset=UTF-8\r\n
Content-Transfer-Encoding: 8bit\r\n\r\n

{"type":"file.content","value":"cjohnsen_2020_12_21_attch_1_of_1.eml"}\r\n

I reconstruced the chunk which is not yet send by your client and parsed the whole request with httoop:

>>> import httoop                                                                                                                                                                                                                             
>>> x = httoop.ServerStateMachine('http', 'localhost', '80')                                                                                                                                                                                  
>>> d = b'POST /cts/yeti_threat_service HTTP/1.1\r\nTransfer-Encoding: chunked\r\nContent-Type: multipart/form-data; boundary=ygdpVhgNZvCeNoHQdIOr2RvW7y3XIn6kYeIdXC\r\nHost: 192.168.1.215:9001\r\nConnection: Keep-Alive\r\nUser-Agent: Apache-HttpClient/4.5.6 (Java/1.8.0_181)\r\nAccept-Encoding: gzip,deflate\r\n\r\nf3\r\n--ygdpVhgNZvCeNoHQdIOr2RvW7y3XIn6kYeIdXC\r\nContent-Disposition: form-data; name="artifact"\r\nContent-Type: application/json; charset=UTF-8\r\nContent-Transfer-Encoding: 8bit\r\n\r\n{"type":"file.content","value":"cjohnsen_2020_12_21_attch_1_of_1.eml"}\r\n'
>>> x.parse(d)
>>> x.state
{'startline': True, 'protocol': True, 'headers': True, 'body': False, 'trailer': False, 'method': True, 'uri': True}
>>> x.buffer
bytearray(b'')
>>> m, _ = x.parse(b'2e\r\n\r\n--ygdpVhgNZvCeNoHQdIOr2RvW7y3XIn6kYeIdXC--\r\n\r\n0\r\n\r\n')[0]
>>> str(m.body)
'--ygdpVhgNZvCeNoHQdIOr2RvW7y3XIn6kYeIdXC\r\nContent-Disposition: form-data; name="artifact"\r\nContent-Type: application/json; charset=UTF-8\r\nContent-Transfer-Encoding: 8bit\r\n\r\n{"type":"file.content","value":"cjohnsen_2020_12_21_attch_1_of_1.eml"}\r\n--ygdpVhgNZvCeNoHQdIOr2RvW7y3XIn6kYeIdXC--\r\n'
>>> z = m.body.decode()
>>> z[0].headers
<HTTP Headers([('Content-Disposition', b'form-data; name="artifact"'), ('Content-Type', b'application/json; charset=UTF-8'), ('Content-Transfer-Encoding', b'8bit')])>
>>> str(z[0])
'{"type":"file.content","value":"cjohnsen_2020_12_21_attch_1_of_1.eml"}'

So your request seems to be valid and something, probably circuits.web has a problem with the mix of chunked transfer encoding and a multipart/form-data if not yet all chunks are available.
So either the parsing of the multipart data is too early or it is not capable of handling data as a state machine and feed it with more data.

Would you share your circuits server code?

I can reproduce something like this in httoop if I just parse the multipart body too early:

>>> x = httoop.ServerStateMachine('http', 'localhost', '80')
>>> x.parse(d)
>>> x.message.body.decode()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "httoop/messages/body.py", line 142, in decode
    self.data = codec.decode(self.__content_bytes(), self.encoding, self.mimetype)
  File "httoop/codecs/multipart/multipart.py", line 31, in decode
    raise DecodeError(_(u'Invalid multipart end: %r'), part.decode('ISO8859-1'))
httoop.exceptions.DecodeError: Invalid multipart end: '\r\nContent-Disposition: form-data; name="artifact"\r\nContent-Type: application/json; charset=UTF-8\r\nContent-Transfer-Encoding: 8bit\r\n\r\n{"type":"file.content","value":"cjohnsen_2020_12_21_attch_1_of_1.eml"}'

@spaceone
Copy link
Contributor

@spaceone
Copy link
Contributor

I suspect this line is the cause: https://github.com/circuits/circuits/blob/master/circuits/web/http.py#L283
Content-Length will always be 0 so the if is_message_complete() is not considered.

@mscherfling
Copy link

This is great news. Is there an expectation of when the change will be made and integrated into a release?

@spaceone
Copy link
Contributor

@mscherfling probably not before in 3 weeks as I am in holiday. If I have too much time I can spend an evening maybe.

@mscherfling
Copy link

@spaceone was a change which we can test in our environment?

@spaceone
Copy link
Contributor

spaceone commented Aug 20, 2021

@mscherfling this is now fixed in the latest git master version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants