search

google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.62k stars 589 forks source link

🐛 Handle None response from ip2geo #2770

Closed pemontto closed 1 year ago

pemontto commented 1 year ago

We found the GeoIP analyser would never complete with our timelines as we were getting None responses from ip2geo. E.g.

Traceback (most recent call last): File "/usr/local/lib/python3.10/dist-packages/timesketch/lib/analyzers/interface.py", line 1134, in run_wrapper result = self.run() File "/usr/local/lib/python3.10/dist-packages/timesketch/lib/analyzers/geoip.py", line 301, in run continue TypeError: cannot unpack non-iterable NoneType object

This fix continues the loop early if we haven't got a result

Before 😢

image

After 🥳

image
jkppr commented 1 year ago

Thanks @pemontto for the PR.

@sydp I'm assigning you as a reviewer since you're the expert for this analyzer. Can you please take a look at these changes and verify if we want to just continue when the response is None or handle the problem in a different way?

pemontto commented 1 year ago

For context the None comes from this function which already handles missing IPs and DB errors: https://github.com/google/timesketch/blob/445c146c4d661012eb082f37987121fd172dda8c/timesketch/lib/analyzers/geoip.py#L118-L125