diff --git a/api_app/analyzers_manager/observable_analyzers/dnstwist.py b/api_app/analyzers_manager/observable_analyzers/dnstwist.py index 553d934f83..1ef6af6048 100644 --- a/api_app/analyzers_manager/observable_analyzers/dnstwist.py +++ b/api_app/analyzers_manager/observable_analyzers/dnstwist.py @@ -2,6 +2,7 @@ # See the file 'LICENSE' for copying permission. import logging +import ssl from ipaddress import AddressValueError, IPv4Address from urllib.parse import urlparse @@ -55,6 +56,9 @@ def run(self): if self.user_agent: params["useragent"] = self.user_agent - report = dnstwist.run(**params) + try: + report = dnstwist.run(**params) + except (OSError, ssl.SSLError) as e: + return {"error": f"Network/SSL error: {str(e)}"} return report diff --git a/tests/api_app/analyzers_manager/unit_tests/observable_analyzers/test_dnstwist.py b/tests/api_app/analyzers_manager/unit_tests/observable_analyzers/test_dnstwist.py index c2c3de1fc2..554b983568 100644 --- a/tests/api_app/analyzers_manager/unit_tests/observable_analyzers/test_dnstwist.py +++ b/tests/api_app/analyzers_manager/unit_tests/observable_analyzers/test_dnstwist.py @@ -33,3 +33,31 @@ def get_extra_config(cls) -> dict: "user_agent": "IntelOwl-Test", "nameservers": "8.8.8.8,8.8.4.4", } + + def test_run_with_ssl_error(self): + import ssl + + from api_app.analyzers_manager.models import AnalyzerConfig + from api_app.choices import Classification + + config = AnalyzerConfig.objects.filter(name="DNStwist").first() + analyzer = self._setup_analyzer(config, Classification.DOMAIN, "example.com") + + with patch("dnstwist.run", side_effect=ssl.SSLEOFError("EOF occurred in violation of protocol")): + report = analyzer.run() + self.assertIn("error", report) + self.assertTrue(report["error"].startswith("Network/SSL error")) + + def test_run_with_dns_error(self): + import socket + + from api_app.analyzers_manager.models import AnalyzerConfig + from api_app.choices import Classification + + config = AnalyzerConfig.objects.filter(name="DNStwist").first() + analyzer = self._setup_analyzer(config, Classification.DOMAIN, "example.com") + + with patch("dnstwist.run", side_effect=socket.gaierror(-2, "Name or service not known")): + report = analyzer.run() + self.assertIn("error", report) + self.assertTrue(report["error"].startswith("Network/SSL error"))