trailofbits/algo

`install.sh` - `publicIpFromMetadata` doesn't use any timeout for `curl`

Opened this issue · 0 comments

Describe the bug

Currently, the curl commands at:

algo/install.sh

Lines 48 to 57 in 4bed66f

publicIpFromMetadata() {
if curl -s http://169.254.169.254/metadata/v1/vendor-data | grep DigitalOcean >/dev/null; then
ENDPOINT="$(curl -s http://169.254.169.254/metadata/v1/interfaces/public/0/ipv4/address)"
elif test "$(curl -s http://169.254.169.254/latest/meta-data/services/domain)" = "amazonaws.com"; then
ENDPOINT="$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4)"
elif host -t A -W 10 metadata.google.internal 127.0.0.53 >/dev/null; then
ENDPOINT="$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip")"
elif test "$(curl -s -H Metadata:true 'http://169.254.169.254/metadata/instance/compute/publisher/?api-version=2017-04-02&format=text')" = "Canonical"; then
ENDPOINT="$(curl -H Metadata:true 'http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-04-02&format=text')"
fi

don’t use a custom timeout and they might block indefinitely (in case connection is successful, but a reply is never sent back from the server). We should probably add --connect-timeout and/or --max-time.

To Reproduce
Steps to reproduce the behavior:

  1. block access to the endpoint
  2. run install.sh

Expected behavior
install.sh returns an error after few seconds and retries the command.