Client Timeout Error

[ghost]

Hello friends!

Since a few days ago, about a week, when invoking the client it returns an error when trying to establish the connection with cti-taxii.mitre.org.
I leave here the code and the error message received, as well as the configuration used. Thank you very much in advance.

---

Configuration:

Python - 3.11.9
attackcti - 0.4.2
pandas - 2.2.2
stix2 - 3.0.1
taxii2-client - 2.3.0
six - 1.16.0
pydantic - 2.7.1

---

Code:

from attackcti import attack_client
lift = attack_client()

---

Error:

TimeoutError Traceback (most recent call last)
File [...]\anaconda3\envs\py311\Lib\site-packages\urllib3\connection.py:198, in HTTPConnection._new_conn(self)
197 try:
--> 198 sock = connection.create_connection(
199 (self._dns_host, self.port),
200 self.timeout,
201 source_address=self.source_address,
202 socket_options=self.socket_options,
203 )
204 except socket.gaierror as e:

File [...]\anaconda3\envs\py311\Lib\site-packages\urllib3\util\connection.py:85, in create_connection(address, timeout, source_address, socket_options)
84 try:
---> 85 raise err
86 finally:
87 # Break explicitly a reference cycle

File [...]\anaconda3\envs\py311\Lib\site-packages\urllib3\util\connection.py:73, in create_connection(address, timeout, source_address, socket_options)
72 sock.bind(source_address)
---> 73 sock.connect(sa)
74 # Break explicitly a reference cycle

TimeoutError: [WinError 10060] Se produjo un error durante el intento de conexión ya que la parte conectada no respondió adecuadamente tras un periodo de tiempo, o bien se produjo un error en la conexión establecida ya que el host conectado no ha podido responder
...
--> 507 raise ConnectTimeout(e, request=request)
509 if isinstance(e.reason, ResponseError):
510 raise RetryError(e, request=request)

ConnectTimeout: HTTPSConnectionPool(host='cti-taxii.mitre.org', port=443): Max retries exceeded with url: /stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/ (Caused by ConnectTimeoutError(<urllib3.connection.HTTPSConnection object at 0x000002813341C750>, 'Connection to cti-taxii.mitre.org timed out. (connect timeout=None)'))

[ghost]

Add an open issue in the mitre-cti repo that could be related although it does not provide much information coincides in time.
mitre/cti#228 (comment)

[ManuMaquina]

Hello @JuanEnriqueUST,
I have encountered the same error, just adding further context:

Traceback (most recent call last):
File "/usr/local/lib/python3.10/dist-packages/urllib3/connection.py", line 198, in _new_conn
sock = connection.create_connection(
File "/usr/local/lib/python3.10/dist-packages/urllib3/util/connection.py", line 85, in create_connection
raise err
File "/usr/local/lib/python3.10/dist-packages/urllib3/util/connection.py", line 73, in create_connection
sock.connect(sa)
TimeoutError: [Errno 110] Connection timed out

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/usr/local/lib/python3.10/dist-packages/urllib3/connectionpool.py", line 793, in urlopen
response = self._make_request(
File "/usr/local/lib/python3.10/dist-packages/urllib3/connectionpool.py", line 491, in _make_request
raise new_e
File "/usr/local/lib/python3.10/dist-packages/urllib3/connectionpool.py", line 467, in _make_request
self._validate_conn(conn)
File "/usr/local/lib/python3.10/dist-packages/urllib3/connectionpool.py", line 1099, in _validate_conn
conn.connect()
File "/usr/local/lib/python3.10/dist-packages/urllib3/connection.py", line 616, in connect
self.sock = sock = self._new_conn()
File "/usr/local/lib/python3.10/dist-packages/urllib3/connection.py", line 207, in _new_conn
raise ConnectTimeoutError(
urllib3.exceptions.ConnectTimeoutError: (<urllib3.connection.HTTPSConnection object at 0x76ceac84ce80>, 'Connection to cti-taxii.mitre.org timed out. (connect timeout=None)')

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/usr/local/lib/python3.10/dist-packages/requests/adapters.py", line 486, in send
resp = conn.urlopen(
File "/usr/local/lib/python3.10/dist-packages/urllib3/connectionpool.py", line 847, in urlopen
retries = retries.increment(
File "/usr/local/lib/python3.10/dist-packages/urllib3/util/retry.py", line 515, in increment
raise MaxRetryError(_pool, url, reason) from reason # type: ignore[arg-type]
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='cti-taxii.mitre.org', port=443): Max retries exceeded with url: /stix/collections/95ecc380-afe9-11e4-9b6c-751b66dd541e/ (Caused by ConnectTimeoutError(<urllib3.connection.HTTPSConnection object at 0x76ceac84ce80>, 'Connection to cti-taxii.mitre.org timed out. (connect timeout=None)'))

[jondricek]

Sorry folks - the TAXII server had gone down, but is back online now

[ManuMaquina]

Connection seems to be working however still some issues
getting this now when I run the following line
atck_cli.get_techniques()

error:
Traceback (most recent call last):
File "/usr/local/lib/python3.10/dist-packages/urllib3/response.py", line 737, in _error_catcher
yield
File "/usr/local/lib/python3.10/dist-packages/urllib3/response.py", line 883, in _raw_read
raise IncompleteRead(self._fp_bytes_read, self.length_remaining)
urllib3.exceptions.IncompleteRead: IncompleteRead(32414 bytes read, 3095448 more expected)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/usr/local/lib/python3.10/dist-packages/requests/models.py", line 816, in generate
yield from self.raw.stream(chunk_size, decode_content=True)
File "/usr/local/lib/python3.10/dist-packages/urllib3/response.py", line 1043, in stream
data = self.read(amt=amt, decode_content=decode_content)
File "/usr/local/lib/python3.10/dist-packages/urllib3/response.py", line 963, in read
data = self._raw_read(amt)
File "/usr/local/lib/python3.10/dist-packages/urllib3/response.py", line 861, in _raw_read
with self._error_catcher():
File "/usr/lib/python3.10/contextlib.py", line 153, in exit
self.gen.throw(typ, value, traceback)
File "/usr/local/lib/python3.10/dist-packages/urllib3/response.py", line 761, in _error_catcher
raise ProtocolError(arg, e) from e
urllib3.exceptions.ProtocolError: ('Connection broken: IncompleteRead(32414 bytes read, 3095448 more expected)', IncompleteRead(32414 bytes read, 3095448 more expected))

During handling of the above exception, another exception occurred:

[ghost]

Hi @jondricek
I have the same problem as @ManuMaquina

code:

techniques = lift.get_techniques()

error:

IncompleteRead Traceback (most recent call last)
File [...]AppData\Local\anaconda3\envs\py311\Lib\site-packages\urllib3\response.py:737, in HTTPResponse._error_catcher(self)
736 try:
--> 737 yield
739 except SocketTimeout as e:
740 # FIXME: Ideally we'd like to include the url in the ReadTimeoutError but
741 # there is yet no clean way to get at it from this context.

File [...]AppData\Local\anaconda3\envs\py311\Lib\site-packages\urllib3\response.py:883, in HTTPResponse._raw_read(self, amt, read1)
873 if (
874 self.enforce_content_length
875 and self.length_remaining is not None
(...)
881 # raised during streaming, so all calls with incorrect
882 # Content-Length are caught.
--> 883 raise IncompleteRead(self._fp_bytes_read, self.length_remaining)
884 elif read1 and (
885 (amt != 0 and not data) or self.length_remaining == len(data)
886 ):
(...)
889 # http.client.HTTPResponse, so we close it here.
890 # See python/cpython#113199

IncompleteRead: IncompleteRead(65182 bytes read, 3062680 more expected)
...
--> 818 raise ChunkedEncodingError(e)
819 except DecodeError as e:
820 raise ContentDecodingError(e)

ChunkedEncodingError: ('Connection broken: IncompleteRead(65182 bytes read, 3062680 more expected)', IncompleteRead(65182 bytes read, 3062680 more expected))

[seansica]

The issue has been resolved. The host ran out of storage. Sorry about that, folks.

I'd like to put in a plug for the new ATT&CK Workbench TAXII 2.1 server. It is the successor to cti-taxii.mitre.org, and it is much more stable. It will replace the TAXII 2.0 server by the end of the year. We encourage you to plan your migrations accordingly.

The usage guide for the new TAXII 2.1 REST API is available here.

[ghost]

Thank you so much @seansica!

And thanks for the info, i will inform myself about TAXII 2.1 and we will plan the migration of the services.

[ghost]

Hi @seansica @jondricek

It seems that the server is down again. We use the attackcti python library and it seems that, as you said, it uses TAXII 2.0.

We will start working on an alternative that allows to make connections directly to TAXII 2.1 without using the library.

In the meantime we would greatly appreciate if you could get the service up again.

Thank you very much in advance.

[seansica]

@JuanEnriqueUST, we're looking into the issue and will keep you posted.

[seansica]

@JuanEnriqueUST, the issue should be resolved. All REST endpoints are working again.