Skip to content

Accept --sleep <ms> in addition to --sleep=<ms>#359

Open
ChrisJr404 wants to merge 1 commit into
rbsec:masterfrom
ChrisJr404:fix-sleep-space-arg-357
Open

Accept --sleep <ms> in addition to --sleep=<ms>#359
ChrisJr404 wants to merge 1 commit into
rbsec:masterfrom
ChrisJr404:fix-sleep-space-arg-357

Conversation

@ChrisJr404
Copy link
Copy Markdown

Closes #357.

--sleep is the only common rate-limiting flag in sslscan and the manual arg parser only matched the strncmp("--sleep=", ...) form. The space-separated form --sleep <ms> silently fell through to the next else-if (and was eventually treated as an unrecognized argument or as a hostname), so users who tried --sleep 100 saw it appear to have no effect — that's exactly the confusion the issue describes.

Fix

Add a parallel else if (strcmp("--sleep", argv[argLoop]) == 0) branch that advances argLoop to consume the value, atoi-parses it, and sets options->sleep using the same >=0 guard as the existing branch. If the user passes --sleep with no following argument, print a friendly error pointing at both working forms:

$ ./sslscan --sleep
--sleep requires a value in milliseconds (e.g. --sleep 100 or --sleep=100)

Verification

End-to-end timing against example.com confirms both forms now sleep identically:

$ python3 -c "..." # measure wall-clock for each
--- baseline (no --sleep) ---  0.26s
--- --sleep=200 (existing) ---  2.49s
--- --sleep 200 (was broken)--- 2.51s

The build is clean against system OpenSSL on Linux:

$ make
Building against system OpenSSL...
$ ls -la sslscan
-rwxrwxr-x ... sslscan

I scoped this fix to --sleep only (the issue) rather than reworking the whole arg parser to handle both --option value and --option=value for every flag — happy to extend the pattern if you'd prefer it consistent across all options.

Issue rbsec#357: --sleep is the only common rate-limiting flag in sslscan
and the manual arg parser only matched the strncmp("--sleep=", ...)
form. The space-separated form --sleep <ms> silently fell through to
the next else-if (and was eventually treated as an unrecognized
argument or as a hostname), so users who tried --sleep 100 saw it
appear to have no effect.

Add a parallel branch that handles --sleep <ms>: it advances argLoop
to consume the value, atoi-parses it, and sets options->sleep using
the same >=0 guard as the existing branch. If the user passes --sleep
with no following argument, print a friendly error pointing at both
working forms and exit.

End-to-end timing against example.com confirms both forms now sleep
identically:

  --no-sleep:        0.26s
  --sleep=200:       2.49s   (existing)
  --sleep 200:       2.51s   (was broken; now fixed)

Closes rbsec#357
@rbsec
Copy link
Copy Markdown
Owner

rbsec commented May 17, 2026

I'm not against the idea of accepting both --sleep=200 (as per the help text and manpage) and --sleep 200 as equivalent - but making that change for just --sleep would make it inconsistent with the other arguments that require parameters, which is likely to cause far more problems than not accepting --sleep 200.

The error condition in this PR also don't work properly, because it only checks for --sleep as the final argument. If you try that then you get an error:

$ ./sslscan example.org --sleep   
--sleep requires a value in milliseconds (e.g. --sleep 100 or --sleep=100)

But that command would never have been valid the first place, because options need to come before the hostname. So if you try and follow the recommendation and run ./sslscan example.org --sleep 100 then it still doesn't work. And if you have an empty sleep in the middle of the command like $ ./sslscan --sleep --no-heartbleed example.org then it still doesn't error (which is the current behaviour).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

--sleep <ms> doesn't work

2 participants