RTR_DeleteSession does not accept session_id keyword (v.1.4.6). #1256

bleriotx · 2024-11-30T22:02:05Z

bleriotx
Nov 30, 2024

Describe the bug
Uber call APIHarnessV2.RTR_DeleteSession() returns an error:
{'body': {'errors': [{'code': 500, 'message': 'Expecting value: line 1 column 1 (char 0)'}], 'resources': []}, 'headers': {}, 'status_code': 500}

To Reproduce
Steps to reproduce the behavior.

BODY = {'device_id': '337537c709e24e9d97e8c857e254ec53', 'origin': 'falconpy_api', 'queue_offline': False, 'timeout': 90}
-- Perform a successful call to: APIHarnessV2.RTR_InitSession(body=BODY)
-- Save the session_id value from the resp["body"]["resources"][0]["session_id"] (e.g variable s_id)
-- Perform a call to: APIHarnessV2.RTR_DeleteSession(session_id=s_id)
-- Resp returns error:
{'body': {'errors': [{'code': 500, 'message': 'Expecting value: line 1 column 1 (char 0)'}], 'resources': []}, 'headers': {}, 'status_code': 500}

Expected behavior
RTR_DeleteSession() should be able to parse session_id parameter and delete the session.

Environment (please complete the following information):

OS: Ubuntu Linux 20.04
Python: 3.8
FalconPy: 1.4.6

Additional context
Since I am fairly new to to FalconPy - I assume I am doing something wrong in my code. The bug also occurs in your sampleI your sample code - bulk_execute.py.

NOTE: This error also occurs if you run the sample program: https://github.com/CrowdStrike/falconpy/tree/main/samples/rtr
/bulk_execute.py
Line # 148
NOTE: This error also occurs if you call the service class API equivalents.

Answered by bleriotx

Dec 2, 2024

I created a new venv to run updated versions of urllib3 and requests. Python 3.8.10 (default, Nov 7 2024, 13:10:47) [GCC 9.4.0] on linux Type "help", "copyright", "credits" or "license" for more information.

>> import urllib3, requests >> print(urllib3.__version__)

2.2.3

>> print(requests.__version__)

2.32.3 This "fixed" the 500 error issue: 1.4.6 {'status_code': 201, 'headers': ... []}} 3705aba6-028e-4db3-a0f6-893c40411ce0 {'status_code': 204, 'headers': {}, 'body': {'errors': [{'message': 'No content was received for this request.'}], 'resources': []}} {'status_code': 400, 'headers': {'Server': 'nginx',... 'errors': [{'code': 400, 'message': 'Could not find existing session'}]}} reque…

View full answer

crowdstrikedcs · 2024-12-02T15:20:56Z

crowdstrikedcs
Dec 2, 2024
Maintainer

Hi @bleriotx thanks for letting us know about this. Seems the issue is that the response from the API is not including expected data. In this case we get a 204 response back with no content from the Delete Request.

Out of curiosity, if you call the DeleteSession operation twice in a row, my expectation is that the first will "fail" with the above error and the second will return an error related to the session_id not being found. If this is the case I think the operation is working in that the session is being deleted, however FalconPy is returning a seperate error in parsing the empty response.

curl --request DELETE \
  --url 'https://api.crowdstrike.com/real-time-response/entities/sessions/v1?session_id=86ee734f-ab15-4499-9913-721ae73dcde4' \
  --header 'accept: application/json' \
  --header 'authorization: Bearer XXX' -v
*   Trying 13.56.9.61:443...
* TCP_NODELAY set
* Connected to api.crowdstrike.com (13.56.9.61) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=US; ST=California; L=Sunnyvale; O=CrowdStrike, Inc.; CN=api.crowdstrike.com
*  start date: Mar 22 00:00:00 2024 GMT
*  expire date: Mar 21 23:59:59 2025 GMT
*  subjectAltName: host "api.crowdstrike.com" matched cert's "api.crowdstrike.com"
*  issuer: C=US; O=CrowdStrike, Inc.; CN=CrowdStrike Global EV CA G2
*  SSL certificate verify ok.
> DELETE /real-time-response/entities/sessions/v1?session_id=86ee734f-ab15-4499-9913-721ae73dcde4 HTTP/1.1
> Host: api.crowdstrike.com
> User-Agent: curl/7.68.0
> accept: application/json
> authorization: Bearer XXX
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Mark bundle as not supporting multiuse
< HTTP/1.1 204 No Content
< Server: nginx
< Date: Mon, 02 Dec 2024 15:15:20 GMT
< Content-Type: application/json
< Connection: keep-alive
< X-Cs-Region: us-1
< X-Cs-Traceid: 3b42a3c4-f029-496f-bc70-ae8c38e80868
< X-Ratelimit-Limit: 6000
< X-Ratelimit-Remaining: 5870
< Strict-Transport-Security: max-age=31536000; includeSubDomains
<
* Connection #0 to host api.crowdstrike.com left intact

1 reply

crowdstrikedcs Dec 2, 2024
Maintainer

@bleriotx could you provide some sample code that you are using in full so we can take a closer look? I did confirm on version 1.4.6 that this sort of response is handled gracefully. Attaching my sample and response

from falconpy import RealTimeResponse

BODY = {'device_id': '4a2860eace2e4868b2975f141a1f80aa', 'origin': 'falconpy_api', 'queue_offline': False, 'timeout': 90}

falcon = RealTimeResponse()

resp = falcon.RTR_InitSession(body=BODY)

session_id = resp["body"]["resources"][0]["session_id"]

print(session_id)

del_session = falcon.RTR_DeleteSession(session_id=session_id)

print(del_session)


14fb3aca-7395-4692-ae4f-8a50144c2cc8
{'status_code': 204, 'headers': {}, 'body': {'errors': [{'message': 'No content was received for this request.'}], 'resources': []}}

bleriotx · 2024-12-02T17:06:42Z

bleriotx
Dec 2, 2024
Author

Using your code:

BODY={'device_id': '337537c709e24e9d97e8c857e254ec53', 'origin': 'falconpy_api', 'queue_offline': False, 'timeout': 90}
resp = falcon.RTR_InitSession(body=BODY)
print(resp)
session_id = resp["body"]["resources"][0]["session_id"]
print(session_id)
del_session = falcon.RTR_DeleteSession(session_id=session_id)
print(del_session)
del_session = falcon.RTR_DeleteSession(session_id=session_id)
print(del_session)

Here is the output:
{'status_code': 201, 'headers': {'Server': 'nginx',...
04d15be0-8dd0-48cb-8365-04b15d4caf85

{'status_code': 500, 'headers': {}, 'body': {'errors': [{'message': 'Expecting value: line 1 column 1 (char 0)', 'code': 500}], 'resources': []}}

{'status_code': 400, 'headers': {'Server': 'nginx', ... 'errors': [{'code': 400, 'message': 'Could not find existing session'}]}}

If I call delete session twice as suggested, the session_id is gone.
It appears the session_id is being deleted, but the response is not being parsed right somewhere...

Python version:
Python 3.8.10 (default, Nov 7 2024, 13:10:47)
[GCC 9.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.

MGS

0 replies

bleriotx · 2024-12-02T17:36:27Z

bleriotx
Dec 2, 2024
Author

I confirmed in the requests response, the API server is not returning any data content for the RTR_DeleteSession() call.
This was pointed out to me by your first response above.

Notice empty 'data' field.

MGS

0 replies

crowdstrikedcs · 2024-12-02T17:43:48Z

crowdstrikedcs
Dec 2, 2024
Maintainer

Can you confirm your current falconpy Version?

❯ python
Python 3.12.0 (main, Mar  4 2024, 17:33:22) [GCC 9.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import falconpy
>>> falconpy.__version__
'1.4.6'
>>> ```

0 replies

bleriotx · 2024-12-02T18:02:03Z

bleriotx
Dec 2, 2024
Author

$ python3 Python 3.8.10 (default, Nov 7 2024, 13:10:47) [GCC 9.4.0] on linux Type "help", "copyright", "credits" or "license" for more information.

>> import falconpy >> falconpy.__version__

'1.4.6'

>>

Dec 2, 2024, 09:44 by ***@***.***:

…

Can you confirm your current falconpy Version? ❯ pythonPython 3.12.0 (main, Mar 4 2024, 17:33:22) [GCC 9.4.0] on linuxType "help", "copyright", "credits" or "license" for more information.>>> import falconpy>>> falconpy.__version__'1.4.6'>>> ``` — Reply to this email directly, > view it on GitHub <#1256 (comment)>> , or > unsubscribe <https://github.com/notifications/unsubscribe-auth/APRYHD2RUGB2FQVPSR7ZX5T2DSL6TAVCNFSM6AAAAABS34LRTWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCNBTHE2TGNY>> . You are receiving this because you were mentioned.> Message ID: > <CrowdStrike/falconpy/repo-discussions/1256/comments/11439537> @> github> .> com>

1 reply

crowdstrikedcs Dec 2, 2024
Maintainer

Thanks, and just to confirm can you try adding this to the code with errors and executing?

print(falconpy.__version__)

bleriotx · 2024-12-02T18:41:37Z

bleriotx
Dec 2, 2024
Author

print(falconpy.__version__) falcon, err = fa_get_rtr_service_class(cfg) BODY = {'device_id': '337537c709e24e9d97e8c857e254ec53', 'origin': 'falconpy_api', 'queue_offline': False, 'timeout': 90} resp = falcon.RTR_InitSession(body=BODY) print(resp) session_id = resp["body"]["resources"][0]["session_id"] print(session_id) del_session = falcon.RTR_DeleteSession(session_id=session_id) print(del_session) del_session = falcon.RTR_DeleteSession(session_id=session_id) print(del_session) 1.4.6 {'status_code': 201, 'headers': {'Server': 'nginx', ... 7888f5aa-f794-4268-987b-10f2726efdc2 {'status_code': 500, 'headers': {}, 'body': {'errors': [{'message': 'Expecting value: line 1 column 1 (char 0)', 'code': 500}], 'resources': []}} {'status_code': 400, 'headers': {'Server': 'nginx'... 'errors': [{'code': 400, 'message': 'Could not find existing session'}]}} MGS Dec 2, 2024, 10:25 by ***@***.***:

…

Thanks, and just to confirm can you try adding this to the code with errors and executing? print(falconpy.__version__) — Reply to this email directly, > view it on GitHub <#1256 (reply in thread)>> , or > unsubscribe <https://github.com/notifications/unsubscribe-auth/APRYHD33GENGPURCWZ43X232DSQZBAVCNFSM6AAAAABS34LRTWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCNBTHE4TEMI>> . You are receiving this because you were mentioned.> Message ID: > <CrowdStrike/falconpy/repo-discussions/1256/comments/11439921> @> github> .> com>

0 replies

bleriotx · 2024-12-02T18:46:32Z

bleriotx
Dec 2, 2024
Author

How about this being the issue: Python 3.8.10 (default, Nov 7 2024, 13:10:47) [GCC 9.4.0] on linux Type "help", "copyright", "credits" or "license" for more information.

>> import requests >> print(requests.__version__)

2.25.1

>>

MGS Dec 2, 2024, 10:25 by ***@***.***:

…

Thanks, and just to confirm can you try adding this to the code with errors and executing? print(falconpy.__version__) — Reply to this email directly, > view it on GitHub <#1256 (reply in thread)>> , or > unsubscribe <https://github.com/notifications/unsubscribe-auth/APRYHD33GENGPURCWZ43X232DSQZBAVCNFSM6AAAAABS34LRTWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCNBTHE4TEMI>> . You are receiving this because you were mentioned.> Message ID: > <CrowdStrike/falconpy/repo-discussions/1256/comments/11439921> @> github> .> com>

1 reply

crowdstrikedcs Dec 2, 2024
Maintainer

We do require requests and urllib3 per https://github.com/CrowdStrike/falconpy/blob/main/requirements.txt though not at a specifc version. Here are the versions I have.

>>> import requests
>>> requests.__version__
'2.32.3'
>>> import urllib3
>>> urllib3.__version__
'1.26.19'

crowdstrikedcs · 2024-12-02T19:10:20Z

crowdstrikedcs
Dec 2, 2024
Maintainer

Let's also enable debugging logs if the issue persists

import logging
from falconpy import RealTimeResponse
log = logging.basicConfig(level=logging.DEBUG)
falcon = RealTimeResponse(debug=True)

0 replies

bleriotx · 2024-12-02T19:39:57Z

bleriotx
Dec 2, 2024
Author

I created a new venv to run updated versions of urllib3 and requests. Python 3.8.10 (default, Nov 7 2024, 13:10:47) [GCC 9.4.0] on linux Type "help", "copyright", "credits" or "license" for more information.

>> import urllib3, requests >> print(urllib3.__version__)

2.2.3

>> print(requests.__version__)

2.32.3 This "fixed" the 500 error issue: 1.4.6 {'status_code': 201, 'headers': ... []}} 3705aba6-028e-4db3-a0f6-893c40411ce0 {'status_code': 204, 'headers': {}, 'body': {'errors': [{'message': 'No content was received for this request.'}], 'resources': []}} {'status_code': 400, 'headers': {'Server': 'nginx',... 'errors': [{'code': 400, 'message': 'Could not find existing session'}]}} requests version 2.25.1 and/or urllib3 version 1.25.8 do not handle an empty response data field well. IMHO: It is probably not a good idea for the API server to be so lazy and not give some form of a response. You can close this issue. Thank you all very much for the fast response on this. FalconPy rox! MGS Dec 2, 2024, 11:10 by ***@***.***:

…

Let's also enable debugging logs if the issue persists import loggingfrom falconpy import RealTimeResponselog = logging.basicConfig(level=logging.DEBUG)falcon = RealTimeResponse(debug=True) — Reply to this email directly, > view it on GitHub <#1256 (comment)>> , or > unsubscribe <https://github.com/notifications/unsubscribe-auth/APRYHDYZFSL2WDVNCCO65I32DSWDDAVCNFSM6AAAAABS34LRTWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCNBUGAZDSMY>> . You are receiving this because you were mentioned.> Message ID: > <CrowdStrike/falconpy/repo-discussions/1256/comments/11440293> @> github> .> com>

1 reply

crowdstrikedcs Dec 2, 2024
Maintainer

Thanks for letting us know, we've avoided pinning specific version for these modules but will have to take a look for the minimum supported versions.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RTR_DeleteSession does not accept session_id keyword (v.1.4.6). #1256

{{title}}

Replies: 9 comments 4 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

RTR_DeleteSession does not accept session_id keyword (v.1.4.6). #1256

bleriotx Nov 30, 2024

Replies: 9 comments · 4 replies

crowdstrikedcs Dec 2, 2024 Maintainer

crowdstrikedcs Dec 2, 2024 Maintainer

bleriotx Dec 2, 2024 Author

bleriotx Dec 2, 2024 Author

crowdstrikedcs Dec 2, 2024 Maintainer

bleriotx Dec 2, 2024 Author

crowdstrikedcs Dec 2, 2024 Maintainer

bleriotx Dec 2, 2024 Author

bleriotx Dec 2, 2024 Author

crowdstrikedcs Dec 2, 2024 Maintainer

crowdstrikedcs Dec 2, 2024 Maintainer

bleriotx Dec 2, 2024 Author

crowdstrikedcs Dec 2, 2024 Maintainer

bleriotx
Nov 30, 2024

Replies: 9 comments 4 replies

crowdstrikedcs
Dec 2, 2024
Maintainer

crowdstrikedcs Dec 2, 2024
Maintainer

bleriotx
Dec 2, 2024
Author

bleriotx
Dec 2, 2024
Author

crowdstrikedcs
Dec 2, 2024
Maintainer

bleriotx
Dec 2, 2024
Author

crowdstrikedcs Dec 2, 2024
Maintainer

bleriotx
Dec 2, 2024
Author

bleriotx
Dec 2, 2024
Author

crowdstrikedcs Dec 2, 2024
Maintainer

crowdstrikedcs
Dec 2, 2024
Maintainer

bleriotx
Dec 2, 2024
Author

crowdstrikedcs Dec 2, 2024
Maintainer