Merge pull request #109 from epi052/106-notify-users-of-bad-certs

logging initialized early enough to display all intended log messages

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "feroxbuster"
-version = "1.4.0"
+version = "1.4.1"
 authors = ["Ben 'epi' Risher <epibar052@gmail.com>"]
 license = "MIT"
 edition = "2018"
@@ -19,7 +19,7 @@ futures = { version = "0.3"}
 tokio = { version = "0.2", features = ["full"] }
 tokio-util = {version = "0.3", features = ["codec"]}
 log = "0.4"
-env_logger = "0.7"
+env_logger = "0.8"
 reqwest = { version = "0.10", features = ["socks"] }
 clap = "2"
 lazy_static = "1.4"

src/heuristics.rs

@@ -10,7 +10,6 @@ use crate::{
 };
 use console::style;
 use indicatif::ProgressBar;
-use std::process;
 use tokio::sync::mpsc::UnboundedSender;
 use uuid::Uuid;
 
@@ -287,14 +286,6 @@ pub async fn connectivity_test(target_urls: &[String]) -> Vec<String> {
 
     if good_urls.is_empty() {
         log::error!("Could not connect to any target provided, exiting.");
-        log::trace!("exit: connectivity_test");
-        eprintln!(
-            "{} {} Could not connect to any target provided",
-            status_colorizer("ERROR"),
-            module_colorizer("heuristics::connectivity_test"),
-        );
-
-        process::exit(1);
     }
 
     log::trace!("exit: connectivity_test -> {:?}", good_urls);
@@ -316,8 +307,7 @@ fn try_send_message_to_file(msg: &str, tx_file: UnboundedSender<String>, save_ou
             }
             Err(e) => {
                 log::error!(
-                    "{} {} {}",
-                    status_colorizer("ERROR"),
+                    "{} {}",
                     module_colorizer("heuristics::try_send_message_to_file"),
                     e
                 );

src/lib.rs

@@ -15,11 +15,26 @@ use reqwest::{
     header::HeaderMap,
     {Response, StatusCode, Url},
 };
+use std::{error, fmt};
 use tokio::sync::mpsc::{UnboundedReceiver, UnboundedSender};
 
 /// Generic Result type to ease error handling in async contexts
-pub type FeroxResult<T> =
-    std::result::Result<T, Box<dyn std::error::Error + Send + Sync + 'static>>;
+pub type FeroxResult<T> = std::result::Result<T, Box<dyn error::Error + Send + Sync + 'static>>;
+
+/// Simple Error implementation to allow for custom error returns
+#[derive(Debug, Default)]
+pub struct FeroxError {
+    /// fancy string that can be printed via Display
+    pub message: String,
+}
+
+impl error::Error for FeroxError {}
+
+impl fmt::Display for FeroxError {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(f, "{}", &self.message)
+    }
+}
 
 /// Generic mpsc::unbounded_channel type to tidy up some code
 pub type FeroxChannel<T> = (UnboundedSender<T>, UnboundedReceiver<T>);

src/main.rs

@@ -1,11 +1,11 @@
 use crossterm::event::{self, Event, KeyCode};
 use feroxbuster::{
     banner,
-    config::{CONFIGURATION, PROGRESS_PRINTER},
+    config::{CONFIGURATION, PROGRESS_BAR, PROGRESS_PRINTER},
     heuristics, logger, reporter,
     scanner::{scan_url, PAUSE_SCAN},
     utils::{ferox_print, get_current_depth, module_colorizer, status_colorizer},
-    FeroxResponse, FeroxResult, SLEEP_DURATION, VERSION,
+    FeroxError, FeroxResponse, FeroxResult, SLEEP_DURATION, VERSION,
 };
 use futures::StreamExt;
 use std::{
@@ -19,7 +19,7 @@ use std::{
     },
     time::Duration,
 };
-use tokio::{io, sync::mpsc::UnboundedSender};
+use tokio::{io, sync::mpsc::UnboundedSender, task::JoinHandle};
 use tokio_util::codec::{FramedRead, LinesCodec};
 
 /// Atomic boolean flag, used to determine whether or not the terminal input handler should exit
@@ -61,12 +61,6 @@ fn get_unique_words_from_wordlist(path: &str) -> FeroxResult<Arc<HashSet<String>
     let file = match File::open(&path) {
         Ok(f) => f,
         Err(e) => {
-            eprintln!(
-                "{} {} {}",
-                status_colorizer("ERROR"),
-                module_colorizer("main::get_unique_words_from_wordlist"),
-                e
-            );
             log::error!("Could not open wordlist: {}", e);
             log::trace!("exit: get_unique_words_from_wordlist -> {}", e);
 
@@ -111,13 +105,9 @@ async fn scan(
             .await??;
 
     if words.len() == 0 {
-        eprintln!(
-            "{} {} Did not find any words in {}",
-            status_colorizer("ERROR"),
-            module_colorizer("main::scan"),
-            CONFIGURATION.wordlist
-        );
-        process::exit(1);
+        let mut err = FeroxError::default();
+        err.message = format!("Did not find any words in {}", CONFIGURATION.wordlist);
+        return Err(Box::new(err));
     }
 
     let mut tasks = vec![];
@@ -142,6 +132,7 @@ async fn scan(
     Ok(())
 }
 
+/// Get targets from either commandline or stdin, pass them back to the caller as a Result<Vec>
 async fn get_targets() -> FeroxResult<Vec<String>> {
     log::trace!("enter: get_targets");
 
@@ -165,12 +156,23 @@ async fn get_targets() -> FeroxResult<Vec<String>> {
     Ok(targets)
 }
 
-#[tokio::main]
-async fn main() {
-    // setup logging based on the number of -v's used
-    logger::initialize(CONFIGURATION.verbosity);
+/// async main called from real main, broken out in this way to allow for some synchronous code
+/// to be executed before bringing the tokio runtime online
+async fn wrapped_main() {
+    // join can only be called once, otherwise it causes the thread to panic
+    tokio::task::spawn_blocking(move || {
+        // ok, lazy_static! uses (unsurprisingly in retrospect) a lazy loading model where the
+        // thing obtained through deref isn't actually created until it's used. This created a
+        // problem when initializing the logger as it relied on PROGRESS_PRINTER which may or may
+        // not have been created by the time it was needed for logging (really only occurred in
+        // heuristics / banner / main). In order to initialize logging properly, we need to ensure
+        // PROGRESS_PRINTER and PROGRESS_BAR have been used at least once.  This call satisfies
+        // that constraint
+        PROGRESS_PRINTER.println("");
+        PROGRESS_BAR.join().unwrap();
+    });
 
-    // can't trace main until after logger is initialized
+    // can't trace main until after logger is initialized and the above task is started
     log::trace!("enter: main");
     log::debug!("{:#?}", *CONFIGURATION);
 
@@ -189,17 +191,9 @@ async fn main() {
         Ok(t) => t,
         Err(e) => {
             // should only happen in the event that there was an error reading from stdin
-            log::error!("{}", e);
-            ferox_print(
-                &format!(
-                    "{} {} {}",
-                    status_colorizer("ERROR"),
-                    module_colorizer("main::get_targets"),
-                    e
-                ),
-                &PROGRESS_PRINTER,
-            );
-            process::exit(1);
+            log::error!("{} {}", module_colorizer("main::get_targets"), e);
+            clean_up(tx_term, term_handle, tx_file, file_handle, save_output).await;
+            return;
         }
     };
 
@@ -212,15 +206,49 @@ async fn main() {
     // discard non-responsive targets
     let live_targets = heuristics::connectivity_test(&targets).await;
 
+    if live_targets.is_empty() {
+        clean_up(tx_term, term_handle, tx_file, file_handle, save_output).await;
+        return;
+    }
+
     // kick off a scan against any targets determined to be responsive
     match scan(live_targets, tx_term.clone(), tx_file.clone()).await {
         Ok(_) => {
             log::info!("All scans complete!");
         }
-        Err(e) => log::error!("An error occurred: {}", e),
+        Err(e) => {
+            ferox_print(
+                &format!("{} while scanning: {}", status_colorizer("Error"), e),
+                &PROGRESS_PRINTER,
+            );
+            clean_up(tx_term, term_handle, tx_file, file_handle, save_output).await;
+            process::exit(1);
+        }
     };
 
-    // manually drop tx in order for the rx task's while loops to eval to false
+    clean_up(tx_term, term_handle, tx_file, file_handle, save_output).await;
+
+    log::trace!("exit: main");
+}
+
+/// Single cleanup function that handles all the necessary drops/finishes etc required to gracefully
+/// shutdown the program
+async fn clean_up(
+    tx_term: UnboundedSender<FeroxResponse>,
+    term_handle: JoinHandle<()>,
+    tx_file: UnboundedSender<String>,
+    file_handle: Option<JoinHandle<()>>,
+    save_output: bool,
+) {
+    log::trace!(
+        "enter: clean_up({:?}, {:?}, {:?}, {:?}, {}",
+        tx_term,
+        term_handle,
+        tx_file,
+        file_handle,
+        save_output
+    );
+
     drop(tx_term);
     log::trace!("dropped terminal output handler's transmitter");
 
@@ -255,9 +283,19 @@ async fn main() {
     // mark all scans complete so the terminal input handler will exit cleanly
     SCAN_COMPLETE.store(true, Ordering::Relaxed);
 
-    log::trace!("exit: main");
-
     // clean-up function for the MultiProgress bar; must be called last in order to still see
-    // the final trace message above
+    // the final trace messages above
     PROGRESS_PRINTER.finish();
+
+    log::trace!("exit: clean_up");
+}
+
+fn main() {
+    // setup logging based on the number of -v's used
+    logger::initialize(CONFIGURATION.verbosity);
+
+    if let Ok(mut runtime) = tokio::runtime::Runtime::new() {
+        let future = wrapped_main();
+        runtime.block_on(future);
+    }
 }

src/reporter.rs

@@ -92,7 +92,7 @@ async fn spawn_terminal_reporter(
     );
 
     while let Some(resp) = resp_chan.recv().await {
-        log::debug!("received {} on reporting channel", resp.url());
+        log::trace!("received {} on reporting channel", resp.url());
 
         if CONFIGURATION.status_codes.contains(&resp.status().as_u16()) {
             let report = if CONFIGURATION.quiet {
@@ -126,7 +126,7 @@ async fn spawn_terminal_reporter(
                 }
             }
         }
-        log::debug!("report complete: {}", resp.url());
+        log::trace!("report complete: {}", resp.url());
     }
     log::trace!("exit: spawn_terminal_reporter");
 }

src/scanner.rs

@@ -1,5 +1,5 @@
 use crate::{
-    config::{CONFIGURATION, PROGRESS_BAR},
+    config::CONFIGURATION,
     extractor::get_links,
     filters::{FeroxFilter, StatusCodeFilter, WildcardFilter},
     heuristics, progress,
@@ -619,11 +619,9 @@ pub async fn scan_url(
     progress_bar.reset_elapsed();
 
     if CALL_COUNT.load(Ordering::Relaxed) == 0 {
-        // join can only be called once, otherwise it causes the thread to panic
-        tokio::task::spawn_blocking(move || PROGRESS_BAR.join().unwrap());
         CALL_COUNT.fetch_add(1, Ordering::Relaxed);
 
-        // this protection around join also allows us to add the first scanned url to SCANNED_URLS
+        // this protection allows us to add the first scanned url to SCANNED_URLS
         // from within the scan_url function instead of the recursion handler
         add_url_to_list_of_scanned_urls(&target_url, &SCANNED_URLS);
 

tests/test_banner.rs

@@ -23,7 +23,7 @@ fn banner_prints_proxy() -> Result<(), Box<dyn std::error::Error>> {
         .pipe_stdin(file)
         .unwrap()
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -56,7 +56,7 @@ fn banner_prints_headers() -> Result<(), Box<dyn std::error::Error>> {
         .arg("-H")
         .arg("mostuff:mothings")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -87,7 +87,7 @@ fn banner_prints_filter_sizes() -> Result<(), Box<dyn std::error::Error>> {
         .arg("--filter-size")
         .arg("44444444")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -118,7 +118,7 @@ fn banner_prints_queries() -> Result<(), Box<dyn std::error::Error>> {
         .arg("--query")
         .arg("stuff=things")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -147,7 +147,7 @@ fn banner_prints_status_codes() -> Result<(), Box<dyn std::error::Error>> {
         .arg("-s")
         .arg("201,301,401")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -174,7 +174,7 @@ fn banner_prints_output_file() -> Result<(), Box<dyn std::error::Error>> {
         .arg("--output")
         .arg("/super/cool/path")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -201,7 +201,7 @@ fn banner_prints_insecure() -> Result<(), Box<dyn std::error::Error>> {
         .arg("http://localhost")
         .arg("-k")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -228,7 +228,7 @@ fn banner_prints_redirects() -> Result<(), Box<dyn std::error::Error>> {
         .arg("http://localhost")
         .arg("-r")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -258,7 +258,7 @@ fn banner_prints_extensions() -> Result<(), Box<dyn std::error::Error>> {
         .arg("--extensions")
         .arg("pdf")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -285,7 +285,7 @@ fn banner_prints_dont_filter() -> Result<(), Box<dyn std::error::Error>> {
         .arg("http://localhost")
         .arg("--dont-filter")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -312,7 +312,7 @@ fn banner_prints_verbosity_one() -> Result<(), Box<dyn std::error::Error>> {
         .arg("http://localhost")
         .arg("-v")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -339,7 +339,7 @@ fn banner_prints_verbosity_two() -> Result<(), Box<dyn std::error::Error>> {
         .arg("http://localhost")
         .arg("-vv")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -366,7 +366,7 @@ fn banner_prints_verbosity_three() -> Result<(), Box<dyn std::error::Error>> {
         .arg("http://localhost")
         .arg("-vvv")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -393,7 +393,7 @@ fn banner_prints_verbosity_four() -> Result<(), Box<dyn std::error::Error>> {
         .arg("http://localhost")
         .arg("-vvvv")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -420,7 +420,7 @@ fn banner_prints_add_slash() -> Result<(), Box<dyn std::error::Error>> {
         .arg("http://localhost")
         .arg("-f")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -448,7 +448,7 @@ fn banner_prints_infinite_depth() -> Result<(), Box<dyn std::error::Error>> {
         .arg("--depth")
         .arg("0")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -476,7 +476,7 @@ fn banner_prints_recursion_depth() -> Result<(), Box<dyn std::error::Error>> {
         .arg("--depth")
         .arg("343214")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -503,7 +503,7 @@ fn banner_prints_no_recursion() -> Result<(), Box<dyn std::error::Error>> {
         .arg("http://localhost")
         .arg("-n")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -522,7 +522,7 @@ fn banner_prints_no_recursion() -> Result<(), Box<dyn std::error::Error>> {
 
 #[test]
 /// test allows non-existent wordlist to trigger the banner printing to stderr
-/// expect to see only the error of could not connect
+/// expect to see nothing
 fn banner_doesnt_print() -> Result<(), Box<dyn std::error::Error>> {
     Command::cargo_bin("feroxbuster")
         .unwrap()
@@ -530,10 +530,8 @@ fn banner_doesnt_print() -> Result<(), Box<dyn std::error::Error>> {
         .arg("http://localhost")
         .arg("-q")
         .assert()
-        .failure()
-        .stderr(predicate::str::contains(
-            "ERROR heuristics::connectivity_test Could not connect to any target provided",
-        ));
+        .success()
+        .stderr(predicate::str::is_empty());
     Ok(())
 }
 
@@ -547,7 +545,7 @@ fn banner_prints_extract_links() -> Result<(), Box<dyn std::error::Error>> {
         .arg("http://localhost")
         .arg("-e")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -575,7 +573,7 @@ fn banner_prints_scan_limit() -> Result<(), Box<dyn std::error::Error>> {
         .arg("-L")
         .arg("4")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))
@@ -603,7 +601,7 @@ fn banner_prints_filter_status() -> Result<(), Box<dyn std::error::Error>> {
         .arg("-C")
         .arg("200")
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("─┬─")
                 .and(predicate::str::contains("Target Url"))

tests/test_config.rs

@@ -18,7 +18,7 @@ fn read_in_config_file_for_settings() -> Result<(), Box<dyn std::error::Error>>
         .arg(file.as_os_str())
         .arg("-vvvv")
         .assert()
-        .failure()
+        .success()
         .stderr(predicate::str::contains("│ 37"));
 
     teardown_tmp_directory(tmp_dir);

tests/test_heuristics.rs

@@ -19,11 +19,9 @@ fn test_single_target_cannot_connect() -> Result<(), Box<dyn std::error::Error>>
         .arg("--wordlist")
         .arg(file.as_os_str())
         .assert()
-        .failure()
-        .stderr(
-            predicate::str::contains("Could not connect to any target provided")
-                .and(predicate::str::contains("ERROR"))
-                .and(predicate::str::contains("heuristics::connectivity_test")),
+        .success()
+        .stdout(
+            predicate::str::contains("Could not connect to http://fjdksafjkdsajfkdsajkfdsajkfsdjkdsfdsafdsafdsajkr3l2ajfdskafdsjk, skipping...", )
         );
 
     teardown_tmp_directory(tmp_dir);
@@ -47,11 +45,9 @@ fn test_two_targets_cannot_connect() -> Result<(), Box<dyn std::error::Error>> {
         .pipe_stdin(file)
         .unwrap()
         .assert()
-        .failure()
-        .stderr(
-            predicate::str::contains("Could not connect to any target provided")
-                .and(predicate::str::contains("ERROR"))
-                .and(predicate::str::contains("heuristics::connectivity_test")),
+        .success()
+        .stdout(
+            predicate::str::contains("Could not connect to http://fjdksafjkdsajfkdsajkfdsajkfsdjkdsfdsafdsafdsajkr3l2ajfdskafdsjk, skipping...", )
         );
 
     teardown_tmp_directory(tmp_dir);

tests/test_main.rs

@@ -25,10 +25,8 @@ fn main_use_root_owned_file_as_wordlist() -> Result<(), Box<dyn std::error::Erro
         .arg("/etc/shadow")
         .arg("-vvvv")
         .assert()
-        .success()
-        .stderr(predicate::str::contains(
-            "ERROR main::get_unique_words_from_wordlist Permission denied (os error 13)",
-        ));
+        .failure()
+        .stdout(predicate::str::contains("Permission denied (os error 13)"));
 
     // connectivity test hits it once
     assert_eq!(mock.times_called(), 1);
@@ -57,9 +55,7 @@ fn main_use_empty_wordlist() -> Result<(), Box<dyn std::error::Error>> {
         .arg("-vvvv")
         .assert()
         .failure()
-        .stderr(predicate::str::contains(
-            "ERROR main::scan Did not find any words in",
-        ));
+        .stdout(predicate::str::contains("Did not find any words in"));
 
     assert_eq!(mock.times_called(), 1);
 
@@ -83,11 +79,9 @@ fn main_use_empty_stdin_targets() -> Result<(), Box<dyn std::error::Error>> {
         .pipe_stdin(file)
         .unwrap()
         .assert()
-        .failure()
+        .success()
         .stderr(
             predicate::str::contains("Could not connect to any target provided")
-                .and(predicate::str::contains("ERROR"))
-                .and(predicate::str::contains("heuristics::connectivity_test"))
                 .and(predicate::str::contains("Target Url"))
                 .not(), // no target url found
         );