Why am I getting the error "TAXII polling: 'StatusMessage object has no attribute 'content_blocks'" from SPLICE app?

[wusgabatgmaildo]

Hello Everyone,

I am getting the following error messages from my SPLICE apps

11-11-2014 13:59:33.449 -0800 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splice/bin/taxii.py" something went wrong with TAXII polling: 'StatusMessage' object has no attribute 'content_blocks'
11-11-2014 13:59:18.141 -0800 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splice/bin/taxii.py" something went wrong with TAXII polling: 'StatusMessage' object has no attribute 'content_blocks'
11-11-2014 13:59:03.202 -0800 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splice/bin/taxii.py" something went wrong with TAXII polling: 'StatusMessage' object has no attribute 'content_blocks'

Any idea?

Thanks,
G.

[wusgabatgmaildo]

Hello,

Thanks for your reply.
Could you please let me know which file to look for exactly.
I was looking at the ../taxii_services/middleware.py file and the original developer proposed the following , but it did not make any difference:
Regards,
G.

#xta = request.META.get('HTTP_X_TAXII_ACCEPT', None)^M
**xta = request.META.get('HTTP_X_TAXII_ACCEPT', 'X-TAXII-Content-Type')^M****
if xta is None: # Can respond with whatever we want. try to use the X-TAXII-Content-Type header to pick^**M
xtct = request.META.get('HTTP_X_TAXII_CONTENT_TYPE', None)^M
if xtct == VID_TAXII_XML_10:^M
sm = exception.to_status_message_10()^M
version = VID_TAXII_SERVICES_10^M
else: # Well, we tried - use TAXII XML 1.1 as a default^M
sm = exception.to_status_message_11()^M
version = VID_TAXII_SERVICES_11^M
elif xta == VID_TAXII_XML_10:^M
sm = exception.to_status_message_10()^M
version = VID_TAXII_SERVICES_10^M
elif xta == VID_TAXII_XML_11:^M
sm = exception.to_status_message_11()^M
version = VID_TAXII_SERVICES_11^M
else:^M
# For now, just pretend X-TAXII-Accept was TAXII 1.1^M
# Not 100% sure what the right response is... HTTP Unacceptable?^M
# Squash the exception argument and create a new one for unknown HTTP Accept?^M
sm = exception.to_status_message_11()^M
version = VID_TAXII_SERVICES_11^

[apptester12345]

Hi,

we were getting the same error message when implementing our TAXII server. We found out that it was because we were not sending the X-TAXII-Content-Type HTTP header in response to a Splice TAXII Poll Request.

Splice is using this header to determine the message type and if it's missing it assumes that it's a Status message and later fails when processing the message with the error you describe.

Check that your server returns the correct TAXII headers.

Hope this helps.