MISP / MISP/misp-modules

Connecting to internet services (passivetotal, virustotal, ...) through a proxy

Open
#57 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
377
Forks
280
Avg merge
2d 2h
Merged PRs (30d)
10

Description

Our MISP is placed in an internal environment, internet services are only reachable by going through a squid proxy (without any auth, as our MISP IP is whitelisted).
While syncing with other MISP instances in the internet works after configuring the proxy in the "Settings-->Proxy" tab, misp-modules like virustotal, countrycode etc. fail.
Is this not implemented yet, or did I just miss the required step while working through the readme?

www-data@misp:/usr/local/src/misp-modules$ /usr/local/bin/misp-modules
HTTPConnectionPool(host='www.geognos.com', port=80): Max retries exceeded with url: /api/en/countries/info/all.json (Caused by NewConnectionError('<requests.packages.urllib3.connection.HTTPConnection object at 0x7f35addd2438>: Failed to establish a new connection: [Errno -2] Name or service not known',))
2016-10-05 14:47:25,682 - misp-modules - INFO - Launch MISP modules server from current directory.
2016-10-05 14:47:25,682 - misp-modules - INFO - Helpers loaded cache.py
2016-10-05 14:47:25,686 - misp-modules - INFO - MISP modules ocr imported
2016-10-05 14:47:25,686 - misp-modules - INFO - MISP modules testimport imported
2016-10-05 14:47:25,793 - misp-modules - INFO - MISP modules stiximport imported
2016-10-05 14:47:25,795 - misp-modules - WARNING - MISP modules countrycode failed due to HTTPConnectionPool(host='www.geognos.com', port=80): Max retries exceeded with url: /api/en/countries/info/all.json (Caused by NewConnectionError('<requests.packages.urllib3.connection.HTTPConnection object at 0x7f35aaf8eb38>: Failed to establish a new connection: [Errno -2] Name or service not known',))

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the misp-modules README and the /usr/local/bin/misp-modules entry point, then inspect how the countrycode and other external-service modules make HTTP requests. Reproduce the failure through the squid proxy and verify that the affected modules can reach services such as www.geognos.com when the proxy is configured.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.