From 3c2aa0572f4e54df38a2fe839d408dec63b90dff Mon Sep 17 00:00:00 2001 From: Kyle Sullivan Date: Thu, 27 Apr 2023 16:55:49 -0300 Subject: [PATCH 1/3] Separate connect and read timeouts for http requests --- .../endpoint_chain_scanner.py | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/scanners/web-scanner/scan/endpoint_chain_scanner/endpoint_chain_scanner.py b/scanners/web-scanner/scan/endpoint_chain_scanner/endpoint_chain_scanner.py index dcec0e6214..f7fd96ad52 100644 --- a/scanners/web-scanner/scan/endpoint_chain_scanner/endpoint_chain_scanner.py +++ b/scanners/web-scanner/scan/endpoint_chain_scanner/endpoint_chain_scanner.py @@ -10,9 +10,12 @@ logger = logging.getLogger(__name__) -TIMEOUT = 10 +# Set the default timeout for requests (connect, read) +TIMEOUT = (0.75, 10) CONNECTION_ERROR = "CONNECTION_ERROR" +CONNECTION_TIMEOUT_ERROR = "CONNECTION_TIMEOUT_ERROR" +READ_TIMEOUT_ERROR = "READ_TIMEOUT_ERROR" TIMEOUT_ERROR = "TIMEOUT_ERROR" UNKNOWN_ERROR = "UNKNOWN_ERROR" @@ -128,6 +131,20 @@ def request_connection(uri: Optional[str] = None, connection = HTTPSConnectionRequest(uri=uri, http_response=response) return {"connection": connection, "response": response} + except requests.exceptions.ConnectTimeout as e: + logger.error(f"Connection timeout error {context}: {str(e)}") + if scheme.lower() == "http": + connection = HTTPConnectionRequest(uri=uri, error=CONNECTION_TIMEOUT_ERROR) + elif scheme.lower() == "https": + connection = HTTPSConnectionRequest(uri=uri, error=CONNECTION_TIMEOUT_ERROR) + return {"connection": connection, "response": response} + except requests.exceptions.ReadTimeout as e: + logger.error(f"Read timeout error {context}: {str(e)}") + if scheme.lower() == "http": + connection = HTTPConnectionRequest(uri=uri, error=READ_TIMEOUT_ERROR) + elif scheme.lower() == "https": + connection = HTTPSConnectionRequest(uri=uri, error=READ_TIMEOUT_ERROR) + return {"connection": connection, "response": response} except requests.exceptions.Timeout as e: logger.error(f"Timeout error {context}: {str(e)}") if scheme.lower() == "http": From 42f017c879bd3f0617e824822d733b9ba6fdc1ec Mon Sep 17 00:00:00 2001 From: Kyle Sullivan Date: Thu, 27 Apr 2023 17:07:40 -0300 Subject: [PATCH 2/3] Change connect timeout to 1 sec --- .../scan/endpoint_chain_scanner/endpoint_chain_scanner.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/web-scanner/scan/endpoint_chain_scanner/endpoint_chain_scanner.py b/scanners/web-scanner/scan/endpoint_chain_scanner/endpoint_chain_scanner.py index f7fd96ad52..9a6b6e8059 100644 --- a/scanners/web-scanner/scan/endpoint_chain_scanner/endpoint_chain_scanner.py +++ b/scanners/web-scanner/scan/endpoint_chain_scanner/endpoint_chain_scanner.py @@ -11,7 +11,7 @@ logger = logging.getLogger(__name__) # Set the default timeout for requests (connect, read) -TIMEOUT = (0.75, 10) +TIMEOUT = (1.0, 10) CONNECTION_ERROR = "CONNECTION_ERROR" CONNECTION_TIMEOUT_ERROR = "CONNECTION_TIMEOUT_ERROR" From 87bc282898a797b0c4ef623cfc3a04fef5b8da86 Mon Sep 17 00:00:00 2001 From: Kyle Sullivan Date: Thu, 27 Apr 2023 17:09:19 -0300 Subject: [PATCH 3/3] Change connect timeout to 1 sec --- .../web-scanner/scan/tls_scanner/tls_scanner.py | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/scanners/web-scanner/scan/tls_scanner/tls_scanner.py b/scanners/web-scanner/scan/tls_scanner/tls_scanner.py index 9e5906a19c..2dc5fa3495 100644 --- a/scanners/web-scanner/scan/tls_scanner/tls_scanner.py +++ b/scanners/web-scanner/scan/tls_scanner/tls_scanner.py @@ -24,8 +24,7 @@ logger = logging.getLogger() -TIMEOUT = int(os.getenv("SCAN_TIMEOUT", "80")) - +CONNECT_TIMEOUT = 1 @dataclass class AcceptedCipherSuites: @@ -184,9 +183,15 @@ def __init__(self, domain: str, ip_address: str = None): try: scan_request = ServerScanRequest( - server_location=ServerNetworkLocation(hostname=domain, - ip_address=ip_address), - scan_commands=designated_scans + server_location=ServerNetworkLocation( + hostname=domain, + ip_address=ip_address + ), + scan_commands=designated_scans, + network_configuration=ServerNetworkConfiguration( + tls_server_name_indication=domain, + network_timeout=CONNECT_TIMEOUT + ) ) except ServerHostnameCouldNotBeResolved as e: logger.info(f"Server hostname could not be resolved for domain '{domain}': {str(e)}")