Skip to content

Commit ae2fc05

Browse files
MaineK00nMaineK00n
committed
feat!(detector): timeout can be set, default is no timeout
1 parent 28d1021 commit ae2fc05

File tree

10 files changed

+106
-35
lines changed

10 files changed

+106
-35
lines changed

‎config/vulnDictConf.go

+6
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,12 @@ type VulnDict struct {
3939
SQLite3Path string
4040

4141
DebugSQL bool
42+
43+
// Timeout for entire request (type: http only)
44+
TimeoutSec uint
45+
46+
// Timeout for each request (type: http only)
47+
TimeoutSecPerRequest uint
4248
}
4349

4450
// GetType returns type

‎detector/cti.go

+9-4
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,7 @@ func getCTIsViaHTTP(cveIDs []string, urlPrefix string) (responses []ctiResponse,
146146
}
147147
}
148148

149-
timeout := time.After(2 * 60 * time.Second)
149+
timeout := time.After(time.Duration(config.Conf.Cti.TimeoutSec) * time.Second)
150150
var errs []error
151151
for i := 0; i < nReq; i++ {
152152
select {
@@ -155,7 +155,9 @@ func getCTIsViaHTTP(cveIDs []string, urlPrefix string) (responses []ctiResponse,
155155
case err := <-errChan:
156156
errs = append(errs, err)
157157
case <-timeout:
158-
return nil, xerrors.New("Timeout Fetching CTI")
158+
if config.Conf.Cti.TimeoutSec > 0 {
159+
return nil, xerrors.New("Timeout Fetching CTI")
160+
}
159161
}
160162
}
161163
if len(errs) != 0 {
@@ -174,8 +176,11 @@ func httpGetCTI(url string, req ctiRequest, resChan chan<- ctiResponse, errChan
174176
var resp *http.Response
175177
count, retryMax := 0, 3
176178
f := func() (err error) {
177-
// resp, body, errs = gorequest.New().SetDebug(config.Conf.Debug).Get(url).End()
178-
resp, body, errs = gorequest.New().Timeout(10 * time.Second).Get(url).End()
179+
req := gorequest.New().Get(url)
180+
if config.Conf.Cti.TimeoutSecPerRequest > 0 {
181+
req = req.Timeout(time.Duration(config.Conf.Cti.TimeoutSecPerRequest) * time.Second)
182+
}
183+
resp, body, errs = req.End()
179184
if 0 < len(errs) || resp == nil || resp.StatusCode != 200 {
180185
count++
181186
if count == retryMax {

‎detector/cve_client.go

+13-4
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ func (client goCveDictClient) fetchCveDetails(cveIDs []string) (cveDetails []cve
8080
}
8181
}
8282

83-
timeout := time.After(2 * 60 * time.Second)
83+
timeout := time.After(time.Duration(config.Conf.CveDict.TimeoutSec) * time.Second)
8484
var errs []error
8585
for range cveIDs {
8686
select {
@@ -89,7 +89,9 @@ func (client goCveDictClient) fetchCveDetails(cveIDs []string) (cveDetails []cve
8989
case err := <-errChan:
9090
errs = append(errs, err)
9191
case <-timeout:
92-
return nil, xerrors.New("Timeout Fetching CVE")
92+
if config.Conf.CveDict.TimeoutSec > 0 {
93+
return nil, xerrors.New("Timeout Fetching CVE")
94+
}
9395
}
9496
}
9597
if len(errs) != 0 {
@@ -113,7 +115,11 @@ func httpGet(key, url string, resChan chan<- response, errChan chan<- error) {
113115
var errs []error
114116
var resp *http.Response
115117
f := func() (err error) {
116-
resp, body, errs = gorequest.New().Timeout(10 * time.Second).Get(url).End()
118+
req := gorequest.New().Get(url)
119+
if config.Conf.OvalDict.TimeoutSecPerRequest > 0 {
120+
req = req.Timeout(time.Duration(config.Conf.CveDict.TimeoutSecPerRequest) * time.Second)
121+
}
122+
resp, body, errs = req.End()
117123
if 0 < len(errs) || resp == nil || resp.StatusCode != 200 {
118124
return xerrors.Errorf("HTTP GET Error, url: %s, resp: %v, err: %+v",
119125
url, resp, errs)
@@ -177,7 +183,10 @@ func httpPost(url string, query map[string]string) ([]cvemodels.CveDetail, error
177183
var errs []error
178184
var resp *http.Response
179185
f := func() (err error) {
180-
req := gorequest.New().Timeout(10 * time.Second).Post(url)
186+
req := gorequest.New().Post(url)
187+
if config.Conf.CveDict.TimeoutSecPerRequest > 0 {
188+
req = req.Timeout(time.Duration(config.Conf.CveDict.TimeoutSecPerRequest) * time.Second)
189+
}
181190
for key := range query {
182191
req = req.Send(fmt.Sprintf("%s=%s", key, query[key])).Type("json")
183192
}

‎detector/exploitdb.go

+9-4
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@ func getExploitsViaHTTP(cveIDs []string, urlPrefix string) (
181181
}
182182
}
183183

184-
timeout := time.After(2 * 60 * time.Second)
184+
timeout := time.After(time.Duration(config.Conf.Exploit.TimeoutSec) * time.Second)
185185
var errs []error
186186
for i := 0; i < nReq; i++ {
187187
select {
@@ -190,7 +190,9 @@ func getExploitsViaHTTP(cveIDs []string, urlPrefix string) (
190190
case err := <-errChan:
191191
errs = append(errs, err)
192192
case <-timeout:
193-
return nil, xerrors.New("Timeout Fetching Exploit")
193+
if config.Conf.Exploit.TimeoutSec > 0 {
194+
return nil, xerrors.New("Timeout Fetching Exploit")
195+
}
194196
}
195197
}
196198
if len(errs) != 0 {
@@ -209,8 +211,11 @@ func httpGetExploit(url string, req exploitRequest, resChan chan<- exploitRespon
209211
var resp *http.Response
210212
count, retryMax := 0, 3
211213
f := func() (err error) {
212-
// resp, body, errs = gorequest.New().SetDebug(config.Conf.Debug).Get(url).End()
213-
resp, body, errs = gorequest.New().Timeout(10 * time.Second).Get(url).End()
214+
req := gorequest.New().Get(url)
215+
if config.Conf.Exploit.TimeoutSecPerRequest > 0 {
216+
req = req.Timeout(time.Duration(config.Conf.Exploit.TimeoutSecPerRequest) * time.Second)
217+
}
218+
resp, body, errs = req.End()
214219
if 0 < len(errs) || resp == nil || resp.StatusCode != 200 {
215220
count++
216221
if count == retryMax {

‎detector/kevuln.go

+9-4
Original file line numberDiff line numberDiff line change
@@ -276,7 +276,7 @@ func getKEVulnsViaHTTP(cveIDs []string, urlPrefix string) (
276276
}
277277
}
278278

279-
timeout := time.After(2 * 60 * time.Second)
279+
timeout := time.After(time.Duration(config.Conf.KEVuln.TimeoutSec) * time.Second)
280280
var errs []error
281281
for i := 0; i < nReq; i++ {
282282
select {
@@ -285,7 +285,9 @@ func getKEVulnsViaHTTP(cveIDs []string, urlPrefix string) (
285285
case err := <-errChan:
286286
errs = append(errs, err)
287287
case <-timeout:
288-
return nil, xerrors.New("Timeout Fetching KEVuln")
288+
if config.Conf.KEVuln.TimeoutSec > 0 {
289+
return nil, xerrors.New("Timeout Fetching KEVuln")
290+
}
289291
}
290292
}
291293
if len(errs) != 0 {
@@ -304,8 +306,11 @@ func httpGetKEVuln(url string, req kevulnRequest, resChan chan<- kevulnResponse,
304306
var resp *http.Response
305307
count, retryMax := 0, 3
306308
f := func() (err error) {
307-
// resp, body, errs = gorequest.New().SetDebug(config.Conf.Debug).Get(url).End()
308-
resp, body, errs = gorequest.New().Timeout(10 * time.Second).Get(url).End()
309+
req := gorequest.New().Get(url)
310+
if config.Conf.KEVuln.TimeoutSecPerRequest > 0 {
311+
req = req.Timeout(time.Duration(config.Conf.KEVuln.TimeoutSecPerRequest) * time.Second)
312+
}
313+
resp, body, errs = req.End()
309314
if 0 < len(errs) || resp == nil || resp.StatusCode != 200 {
310315
count++
311316
if count == retryMax {

‎detector/msf.go

+9-4
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ func getMetasploitsViaHTTP(cveIDs []string, urlPrefix string) (
147147
}
148148
}
149149

150-
timeout := time.After(2 * 60 * time.Second)
150+
timeout := time.After(time.Duration(config.Conf.Metasploit.TimeoutSec) * time.Second)
151151
var errs []error
152152
for i := 0; i < nReq; i++ {
153153
select {
@@ -156,7 +156,9 @@ func getMetasploitsViaHTTP(cveIDs []string, urlPrefix string) (
156156
case err := <-errChan:
157157
errs = append(errs, err)
158158
case <-timeout:
159-
return nil, xerrors.New("Timeout Fetching Metasploit")
159+
if config.Conf.Metasploit.TimeoutSec > 0 {
160+
return nil, xerrors.New("Timeout Fetching Metasploit")
161+
}
160162
}
161163
}
162164
if len(errs) != 0 {
@@ -175,8 +177,11 @@ func httpGetMetasploit(url string, req metasploitRequest, resChan chan<- metaspl
175177
var resp *http.Response
176178
count, retryMax := 0, 3
177179
f := func() (err error) {
178-
// resp, body, errs = gorequest.New().SetDebug(config.Conf.Debug).Get(url).End()
179-
resp, body, errs = gorequest.New().Timeout(10 * time.Second).Get(url).End()
180+
req := gorequest.New().Get(url)
181+
if config.Conf.Metasploit.TimeoutSecPerRequest > 0 {
182+
req = req.Timeout(time.Duration(config.Conf.Metasploit.TimeoutSecPerRequest) * time.Second)
183+
}
184+
resp, body, errs = req.End()
180185
if 0 < len(errs) || resp == nil || resp.StatusCode != 200 {
181186
count++
182187
if count == retryMax {

‎gost/microsoft.go

+16-3
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818
"github.com/parnurzeal/gorequest"
1919
"golang.org/x/xerrors"
2020

21+
"github.com/future-architect/vuls/config"
2122
"github.com/future-architect/vuls/logging"
2223
"github.com/future-architect/vuls/models"
2324
"github.com/future-architect/vuls/util"
@@ -47,7 +48,11 @@ func (ms Microsoft) DetectCVEs(r *models.ScanResult, _ bool) (nCVEs int, err err
4748
var errs []error
4849
var resp *http.Response
4950
f := func() error {
50-
resp, body, errs = gorequest.New().Timeout(10 * time.Second).Post(u).SendStruct(content).Type("json").EndBytes()
51+
req := gorequest.New().Post(u).SendStruct(content).Type("json")
52+
if config.Conf.Gost.TimeoutSecPerRequest > 0 {
53+
req = req.Timeout(time.Duration(config.Conf.Gost.TimeoutSecPerRequest) * time.Second)
54+
}
55+
resp, body, errs = req.EndBytes()
5156
if 0 < len(errs) || resp == nil || resp.StatusCode != 200 {
5257
return xerrors.Errorf("HTTP POST error. url: %s, resp: %v, err: %+v", u, resp, errs)
5358
}
@@ -88,7 +93,11 @@ func (ms Microsoft) DetectCVEs(r *models.ScanResult, _ bool) (nCVEs int, err err
8893
var errs []error
8994
var resp *http.Response
9095
f := func() error {
91-
resp, body, errs = gorequest.New().Timeout(10 * time.Second).Post(u).SendStruct(content).Type("json").EndBytes()
96+
req := gorequest.New().Post(u).SendStruct(content).Type("json")
97+
if config.Conf.Gost.TimeoutSecPerRequest > 0 {
98+
req = req.Timeout(time.Duration(config.Conf.Gost.TimeoutSecPerRequest) * time.Second)
99+
}
100+
resp, body, errs = req.EndBytes()
92101
if 0 < len(errs) || resp == nil || resp.StatusCode != 200 {
93102
return xerrors.Errorf("HTTP POST error. url: %s, resp: %v, err: %+v", u, resp, errs)
94103
}
@@ -151,7 +160,11 @@ func (ms Microsoft) DetectCVEs(r *models.ScanResult, _ bool) (nCVEs int, err err
151160
var errs []error
152161
var resp *http.Response
153162
f := func() error {
154-
resp, body, errs = gorequest.New().Timeout(10 * time.Second).Post(u).SendStruct(content).Type("json").EndBytes()
163+
req := gorequest.New().Post(u).SendStruct(content).Type("json")
164+
if config.Conf.Gost.TimeoutSecPerRequest > 0 {
165+
req = req.Timeout(time.Duration(config.Conf.Gost.TimeoutSecPerRequest) * time.Second)
166+
}
167+
resp, body, errs = req.EndBytes()
155168
if 0 < len(errs) || resp == nil || resp.StatusCode != 200 {
156169
return xerrors.Errorf("HTTP POST error. url: %s, resp: %v, err: %+v", u, resp, errs)
157170
}

‎gost/util.go

+15-7
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"github.com/parnurzeal/gorequest"
1414
"golang.org/x/xerrors"
1515

16+
"github.com/future-architect/vuls/config"
1617
"github.com/future-architect/vuls/logging"
1718
"github.com/future-architect/vuls/models"
1819
"github.com/future-architect/vuls/util"
@@ -59,7 +60,7 @@ func getCvesViaHTTP(cveIDs []string, urlPrefix string) (
5960
}
6061
}
6162

62-
timeout := time.After(2 * 60 * time.Second)
63+
timeout := time.After(time.Duration(config.Conf.Gost.TimeoutSec) * time.Second)
6364
var errs []error
6465
for i := 0; i < nReq; i++ {
6566
select {
@@ -68,11 +69,13 @@ func getCvesViaHTTP(cveIDs []string, urlPrefix string) (
6869
case err := <-errChan:
6970
errs = append(errs, err)
7071
case <-timeout:
71-
return nil, xerrors.New("Timeout Fetching OVAL")
72+
if config.Conf.Gost.TimeoutSec > 0 {
73+
return nil, xerrors.New("Timeout Fetching Gost")
74+
}
7275
}
7376
}
7477
if len(errs) != 0 {
75-
return nil, xerrors.Errorf("Failed to fetch OVAL. err: %w", errs)
78+
return nil, xerrors.Errorf("Failed to fetch Gost. err: %w", errs)
7679
}
7780
return
7881
}
@@ -124,7 +127,7 @@ func getCvesWithFixStateViaHTTP(r *models.ScanResult, urlPrefix, fixState string
124127
}
125128
}
126129

127-
timeout := time.After(2 * 60 * time.Second)
130+
timeout := time.After(time.Duration(config.Conf.Gost.TimeoutSec) * time.Second)
128131
var errs []error
129132
for i := 0; i < nReq; i++ {
130133
select {
@@ -133,7 +136,9 @@ func getCvesWithFixStateViaHTTP(r *models.ScanResult, urlPrefix, fixState string
133136
case err := <-errChan:
134137
errs = append(errs, err)
135138
case <-timeout:
136-
return nil, xerrors.New("Timeout Fetching Gost")
139+
if config.Conf.Gost.TimeoutSec > 0 {
140+
return nil, xerrors.New("Timeout Fetching Gost")
141+
}
137142
}
138143
}
139144
if len(errs) != 0 {
@@ -148,8 +153,11 @@ func httpGet(url string, req request, resChan chan<- response, errChan chan<- er
148153
var resp *http.Response
149154
count, retryMax := 0, 3
150155
f := func() (err error) {
151-
// resp, body, errs = gorequest.New().SetDebug(config.Conf.Debug).Get(url).End()
152-
resp, body, errs = gorequest.New().Timeout(10 * time.Second).Get(url).End()
156+
req := gorequest.New().Get(url)
157+
if config.Conf.Gost.TimeoutSecPerRequest > 0 {
158+
req = req.Timeout(time.Duration(config.Conf.Gost.TimeoutSecPerRequest) * time.Second)
159+
}
160+
resp, body, errs = req.End()
153161
if 0 < len(errs) || resp == nil || resp.StatusCode != 200 {
154162
count++
155163
if count == retryMax {

‎oval/oval.go

+11-2
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,12 @@ func (b Base) CheckIfOvalFetched(osFamily, release string) (bool, error) {
8484
if err != nil {
8585
return false, xerrors.Errorf("Failed to join URLPath. err: %w", err)
8686
}
87-
resp, body, errs := gorequest.New().Timeout(10 * time.Second).Get(url).End()
87+
88+
req := gorequest.New().Get(url)
89+
if config.Conf.OvalDict.TimeoutSecPerRequest > 0 {
90+
req = req.Timeout(time.Duration(config.Conf.OvalDict.TimeoutSecPerRequest) * time.Second)
91+
}
92+
resp, body, errs := req.End()
8893
if 0 < len(errs) || resp == nil || resp.StatusCode != 200 {
8994
return false, xerrors.Errorf("HTTP GET error, url: %s, resp: %v, err: %+v", url, resp, errs)
9095
}
@@ -143,7 +148,11 @@ func (b Base) CheckIfOvalFresh(osFamily, release string) (ok bool, err error) {
143148
if err != nil {
144149
return false, xerrors.Errorf("Failed to join URLPath. err: %w", err)
145150
}
146-
resp, body, errs := gorequest.New().Timeout(10 * time.Second).Get(url).End()
151+
req := gorequest.New().Get(url)
152+
if config.Conf.OvalDict.TimeoutSecPerRequest > 0 {
153+
req = req.Timeout(time.Duration(config.Conf.OvalDict.TimeoutSecPerRequest) * time.Second)
154+
}
155+
resp, body, errs := req.End()
147156
if 0 < len(errs) || resp == nil || resp.StatusCode != 200 {
148157
return false, xerrors.Errorf("HTTP GET error, url: %s, resp: %v, err: %+v", url, resp, errs)
149158
}

‎oval/util.go

+9-3
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ func getDefsByPackNameViaHTTP(r *models.ScanResult, url string) (relatedDefs ova
206206
}
207207
}
208208

209-
timeout := time.After(2 * 60 * time.Second)
209+
timeout := time.After(time.Duration(config.Conf.OvalDict.TimeoutSec) * time.Second)
210210
var errs []error
211211
for i := 0; i < nReq; i++ {
212212
select {
@@ -244,7 +244,9 @@ func getDefsByPackNameViaHTTP(r *models.ScanResult, url string) (relatedDefs ova
244244
case err := <-errChan:
245245
errs = append(errs, err)
246246
case <-timeout:
247-
return relatedDefs, xerrors.New("Timeout Fetching OVAL")
247+
if config.Conf.OvalDict.TimeoutSec > 0 {
248+
return relatedDefs, xerrors.New("Timeout Fetching OVAL")
249+
}
248250
}
249251
}
250252
if len(errs) != 0 {
@@ -259,7 +261,11 @@ func httpGet(url string, req request, resChan chan<- response, errChan chan<- er
259261
var resp *http.Response
260262
count, retryMax := 0, 3
261263
f := func() (err error) {
262-
resp, body, errs = gorequest.New().Timeout(10 * time.Second).Get(url).End()
264+
req := gorequest.New().Get(url)
265+
if config.Conf.OvalDict.TimeoutSecPerRequest > 0 {
266+
req = req.Timeout(time.Duration(config.Conf.OvalDict.TimeoutSecPerRequest) * time.Second)
267+
}
268+
resp, body, errs = req.End()
263269
if 0 < len(errs) || resp == nil || resp.StatusCode != 200 {
264270
count++
265271
if count == retryMax {

0 commit comments

Comments
 (0)