HTTP Inspection in R80 - HTTP 0.9 Blocked

[dcatpegs]

I have been kicking this around with support for a few weeks now and hoping to see if anyone else noticed this.

We have been R77.30 for years and started upgrading to R80.20.  After upgrading the Security Gateways in a test site to R80 I started noticing some blocked traffic.

The request is simply "GET /"

The reason info is

Reason: illegal header format detected: Malformed HTTP protocol name in request
Information: illegal header format detected
Name: Block HTTP Non Compliant

It is definitely blocking due to the lack of version on the end of the request "GET / HTTP/1.0".  My argument is that HTTP 0.9 while not widely used is still used by large vendors like F5 on their default health checks.

Has anyone else noticed this behavior when going from R77 to R80?

My issue is I do not want to add an exclusion if I can avoid it because this would disable all HTTP inspection for our load balancers until we could change any health checks and there seems to be no way to still support HTTP 0.9

Did CheckPoint deprecate HTTP 0.9 without any notice?

Has anyone else noticed this?

[FedericoMeiners]

Hello,

There is no much information regarding HTTP 0.9 being deprecated, most of the time you have to solve this by adding exceptions to the inspection settings as you stated.

I managed to find sk117392 were the following kernel parameter is presented to avoid these errors:

To check the current value of this kernel parameter:
[Expert@HostName]# fw ctl get int ws_strict_parsing
To set the desired value for this kernel parameter on-the-fly (does not survive reboot):
[Expert@HostName]# fw ctl set int ws_strict_parsing 0

I would highly suggest you to contact the TAC about this inquiry and the proposed flag.

Hope it helps

__

[dcatpegs]

I found that article as well.  I don't know that I need to set that option on the firewall as the inspection policy has something similar as well that could be unchecked.

I think this was an oversight that HTTP 0.9 did not require a version.  Granted HTTP 1.0 was circa 96 so they likely inadvertently deprecated it.

[dcatpegs · Accepted solution]

CheckPoint responded with sk163481.  The dates are well after my ticket was created so my ticket most likely prompted the creation of this.  Fun find!