facebookincubator / TTPForge / 25017792694

Pull #617

github

Allow per-step execution timeout override (basic and file steps) (#617)

Summary:

TTPForge currently caps every basic/file step at a hardcoded 100-minute execution timeout. This blocks any TTP whose single step legitimately runs longer than 100 minutes
   - This blocks creating a TTP which simulates DNS beaconing behavior over a 5 hour period.
   - TTPs with very long running behavior should be run in the background, so they aren't hogging a host for hours.

This adds two new fields to basic/file steps:
  - step_timeout: Go duration string (e.g. "7h", "30m"). Optional.
  - long_running: bool. Required true to set step_timeout > 100m.

Including the `long_running` bool makes it more obvious that the default timeout has been changed. It also prevents YAML authors from changing the default timeout to something very long without acknowledging the long duration.

Hard cap of MaxExecutionTimeout = 24h applies even with long_running: true. I don't think there are any TTPs that would require a timeout longer than that. This protects against typos.

Differential Revision: D102381432

40 of 48 new or added lines in 5 files covered. (83.33%)

3196 of 5711 relevant lines covered (55.96%)

14.85 hits per line