[GH-ISSUE #6596] [Bug] Pcap URI inventory silently omits cleartext HTTP/2 requests #3982

New issue

Closed

opened 2026-10-31 00:45:47 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:45:47 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6596

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

inspect-pcap-capture returned http_request_uris: [], http_request_uri_count: 0 and coverage: "complete" for a small cleartext HTTP/2 capture containing GET http://example.test/h2. Its protocol distribution correctly identified http2. TShark extracted the URI from the same file without a decode-as override.

Reproduction

Use a pcap containing a cleartext HTTP/2 request on TCP port 80. The reduced self-created fixture used a TCP handshake, HTTP/2 client preface, an empty SETTINGS frame and one HEADERS frame. Its HPACK block was hexadecimal 8286010c6578616d706c652e7465737404032f6832 (GET, http, example.test, /h2), with stream 1 and flags END_STREAM|END_HEADERS.

From the REA repository root, run with TShark and capinfos on PATH:

tshark -n -r http2.pcap -T fields -e frame.number -e frame.protocols -e http2.request.full_uri -e http.request.full_uri
node scripts/rea.mjs inspect-pcap-capture ./http2.pcap --json

Compare the HTTP/2 URI in TShark's output with REA's empty URI inventory. Observed once through the public CLI.

For an exact fixture without a packet generator dependency, decode this complete 367-byte pcap with Python:

python - <<'PY'
import base64
from pathlib import Path
Path('http2.pcap').write_bytes(base64.b64decode('1MOyoQIABAAAAAAAAAAAAP//AAABAAAAAPFTZQAAAAA2AAAANgAAAAIAAAAAAgIAAAAAAQgARQAAKAABAABABvbLwAACAcAAAgLDUABQAAAAAAAAAABQAv//aD4AAAHxU2UAAAAANgAAADYAAAACAAAAAAICAAAAAAEIAEUAACgAAQAAQAb2y8AAAgLAAAIBAFDDUAAAAAAAAAABUBL//2gtAAAC8VNlAAAAADYAAAA2AAAAAgAAAAACAgAAAAABCABFAAAoAAEAAEAG9svAAAIBwAACAsNQAFAAAAABAAAAAVAQ//9oLgAAA/FTZQAAAAB1AAAAdQAAAAIAAAAAAgIAAAAAAQgARQAAZwABAABABvaMwAACAcAAAgLDUABQAAAAAQAAAAFQGP//tGAAAFBSSSAqIEhUVFAvMi4wDQoNClNNDQoNCgAAAAQAAAAAAAAAFQEFAAAAAYKGAQxleGFtcGxlLnRlc3QEAy9oMg=='))
PY

Expected behavior

The HTTP request URI inventory should include the URI that the selected dissector recovered. If HTTP/2 URIs are outside the supported inventory, the result should make that omission explicit instead of reporting a complete empty inventory. The CLI describes pcap inspection generally, and its result exposes an unqualified http_request_uris field.

Impact and scope

The observed HTTP/2 request is missing from the URI inventory and its retained http-uris view. This can hide an endpoint during recorded-network analysis even when the saved bytes are cleartext and TShark successfully dissects them. Verified with one reduced fixture; other HTTP/2 captures and HTTP/3 were not tested. Direct TShark field extraction is an available workaround.

REA version

6.7.0; source revision 642f6571ea9d333ea50114c25e648dbb5b8a3c46.

Runtime and platform

Node v24.22.1; Omarchy, Linux 7.2.8-9-omarchy, x86_64; TShark and capinfos 4.7.4.

Target and artifact context

Self-created 367-byte Ethernet/IPv4/TCP pcap; one cleartext HTTP/2 GET to http://example.test/h2. No live capture or browser provider was used.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

TShark, frame 4:

eth:ethertype:ip:tcp:http:http2  http://example.test/h2

REA's actual normalized result, exit 0 and empty stderr:

{"packet_count":4,"protocol_distribution":[{"protocol":"eth:ethertype:ip:tcp","packet_count":3},{"protocol":"eth:ethertype:ip:tcp:http:http2","packet_count":1}],"http_request_uris":[],"http_request_uri_count":0,"coverage":"complete"}

Typed outcome or recovery expected

Retain the decoded URI, or report the applicable HTTP/2 inventory limitation and partial coverage.

Analysis or suspected cause

Source-derived: the selected fields include http.request.full_uri but omit http2.request.full_uri. The aggregate parser reads only the HTTP/1 field. The retained URI facet directly projects that inventory.

Additional context

The reduced capture is synthetic; the TShark dissection and REA CLI result are actual runtime observations. This differs from #6537, which concerns HTTP/1.0 absolute-form targets without a Host header. No implementation change is included.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A valid saved HTTP/2 request disappears from the endpoint URI inventory while coverage is complete.
Workaround status: available
Workaround basis: The observed direct TShark command returns the missing URI from the same capture.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6596 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `inspect-pcap-capture` returned `http_request_uris: []`, `http_request_uri_count: 0` and `coverage: "complete"` for a small cleartext HTTP/2 capture containing `GET http://example.test/h2`. Its protocol distribution correctly identified `http2`. TShark extracted the URI from the same file without a decode-as override. ### Reproduction 1. Use a pcap containing a cleartext HTTP/2 request on TCP port 80. The reduced self-created fixture used a TCP handshake, HTTP/2 client preface, an empty SETTINGS frame and one HEADERS frame. Its HPACK block was hexadecimal `8286010c6578616d706c652e7465737404032f6832` (GET, http, example.test, /h2), with stream 1 and flags `END_STREAM|END_HEADERS`. 2. From the REA repository root, run with TShark and capinfos on PATH: ```sh tshark -n -r http2.pcap -T fields -e frame.number -e frame.protocols -e http2.request.full_uri -e http.request.full_uri node scripts/rea.mjs inspect-pcap-capture ./http2.pcap --json ``` 3. Compare the HTTP/2 URI in TShark's output with REA's empty URI inventory. Observed once through the public CLI. For an exact fixture without a packet generator dependency, decode this complete 367-byte pcap with Python: ```sh python - <<'PY' import base64 from pathlib import Path Path('http2.pcap').write_bytes(base64.b64decode('1MOyoQIABAAAAAAAAAAAAP//AAABAAAAAPFTZQAAAAA2AAAANgAAAAIAAAAAAgIAAAAAAQgARQAAKAABAABABvbLwAACAcAAAgLDUABQAAAAAAAAAABQAv//aD4AAAHxU2UAAAAANgAAADYAAAACAAAAAAICAAAAAAEIAEUAACgAAQAAQAb2y8AAAgLAAAIBAFDDUAAAAAAAAAABUBL//2gtAAAC8VNlAAAAADYAAAA2AAAAAgAAAAACAgAAAAABCABFAAAoAAEAAEAG9svAAAIBwAACAsNQAFAAAAABAAAAAVAQ//9oLgAAA/FTZQAAAAB1AAAAdQAAAAIAAAAAAgIAAAAAAQgARQAAZwABAABABvaMwAACAcAAAgLDUABQAAAAAQAAAAFQGP//tGAAAFBSSSAqIEhUVFAvMi4wDQoNClNNDQoNCgAAAAQAAAAAAAAAFQEFAAAAAYKGAQxleGFtcGxlLnRlc3QEAy9oMg==')) PY ``` ### Expected behavior The HTTP request URI inventory should include the URI that the selected dissector recovered. If HTTP/2 URIs are outside the supported inventory, the result should make that omission explicit instead of reporting a complete empty inventory. The CLI describes pcap inspection generally, and its result exposes an unqualified `http_request_uris` field. ### Impact and scope The observed HTTP/2 request is missing from the URI inventory and its retained `http-uris` view. This can hide an endpoint during recorded-network analysis even when the saved bytes are cleartext and TShark successfully dissects them. Verified with one reduced fixture; other HTTP/2 captures and HTTP/3 were not tested. Direct TShark field extraction is an available workaround. ### REA version 6.7.0; source revision `642f6571ea9d333ea50114c25e648dbb5b8a3c46`. ### Runtime and platform Node v24.22.1; Omarchy, Linux 7.2.8-9-omarchy, x86_64; TShark and capinfos 4.7.4. ### Target and artifact context Self-created 367-byte Ethernet/IPv4/TCP pcap; one cleartext HTTP/2 GET to `http://example.test/h2`. No live capture or browser provider was used. ### Interface CLI ### Earliest failure stage Transport or result projection ### Relevant output or evidence TShark, frame 4: ```text eth:ethertype:ip:tcp:http:http2 http://example.test/h2 ``` REA's actual normalized result, exit 0 and empty stderr: ```json {"packet_count":4,"protocol_distribution":[{"protocol":"eth:ethertype:ip:tcp","packet_count":3},{"protocol":"eth:ethertype:ip:tcp:http:http2","packet_count":1}],"http_request_uris":[],"http_request_uri_count":0,"coverage":"complete"} ``` ### Typed outcome or recovery expected Retain the decoded URI, or report the applicable HTTP/2 inventory limitation and partial coverage. ### Analysis or suspected cause Source-derived: [the selected fields](https://github.com/morluto/rea/blob/642f6571ea9d333ea50114c25e648dbb5b8a3c46/src/pcap/PcapProvider.ts#L64) include `http.request.full_uri` but omit `http2.request.full_uri`. [The aggregate parser](https://github.com/morluto/rea/blob/642f6571ea9d333ea50114c25e648dbb5b8a3c46/src/pcap/PcapOutput.ts#L319) reads only the HTTP/1 field. [The retained URI facet](https://github.com/morluto/rea/blob/642f6571ea9d333ea50114c25e648dbb5b8a3c46/src/domain/analysisView/pcapCaptureView.ts#L201) directly projects that inventory. ### Additional context The reduced capture is synthetic; the TShark dissection and REA CLI result are actual runtime observations. This differs from #6537, which concerns HTTP/1.0 absolute-form targets without a Host header. No implementation change is included. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A valid saved HTTP/2 request disappears from the endpoint URI inventory while coverage is complete. - Workaround status: available - Workaround basis: The observed direct TShark command returns the missing URI from the same capture.

bsakaguchi closed this issue

2026-10-31 00:45:47 +00:00

bsakaguchi referenced this issue

2026-10-31 01:11:22 +00:00

[PR #4072] [CLOSED] fix(reference): drop replaced CommonJS loaders from reference-source edges #6036