Bugfix in HTTP_Server: HTTP_Server without authentication (HTTP_AUTH_…

…MECHS.NONE) was broken. (#4433)
secdev · Jun 20, 2024 · 8d35918 · 8d35918
1 parent de36337
commit 8d35918
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 2 deletions.
diff --git a/scapy/layers/http.py b/scapy/layers/http.py
@@ -1022,7 +1022,7 @@ def BEGIN(self):
 
     @ATMT.condition(BEGIN, prio=0)
     def should_authenticate(self):
-        if self.authmethod == HTTP_AUTH_MECHS.NONE:
+        if self.authmethod == HTTP_AUTH_MECHS.NONE.value:
             raise self.SERVE()
         else:
             raise self.AUTH()
@@ -1147,7 +1147,9 @@ def CLOSED(self):
     # Serving
 
     @ATMT.state()
-    def SERVE(self, pkt):
+    def SERVE(self, pkt=None):
+        if pkt is None:
+            return
         answer = self.answer(pkt)
         if answer:
             self.send(answer)

diff --git a/test/scapy/layers/http.uts b/test/scapy/layers/http.uts
@@ -353,3 +353,15 @@ with run_httpserver(mech=HTTP_AUTH_MECHS.BASIC, BASIC_IDENTITIES={"user": "passw
         html = f.read().decode('utf-8')
 
 assert html == "<!doctype html><html><body><h1>OK</h1></body></html>"
+
+
+= HTTP_Server with native python client without auth
+~ http-client
+
+import urllib.request
+
+with run_httpserver(mech=HTTP_AUTH_MECHS.NONE):
+    with urllib.request.urlopen('http://127.0.0.1:8080/') as f:
+        html = f.read().decode('utf-8')
+
+assert html == "<!doctype html><html><body><h1>OK</h1></body></html>"