mirror of
https://github.com/BishopFox/cloudfox.git
synced 2026-11-07 09:56:01 -10:00
jbarciabf
494443d7ce
The NetworkPortsModule cached EC2 NACLs and Security Groups in two per-region maps. The cache lookup read the maps without holding a lock while the cache population path took a write lock, producing a "concurrent map read and map write" runtime panic when multiple region goroutines hit the cache check concurrently. The panic reproduced reliably in low-density AWS accounts where every region goroutine raced through the cache check at the same instant. Take the read lock on the cache fast-path in both getEC2NACLsPerRegion and getEC2SecurityGroupsPerRegion. Move naclsMutex and securityGroupsMutex from package-level vars onto the module struct so concurrent module instances stop serializing on each other's locks. Convert CommandCounter from plain int fields with naked ++/-- to int64 fields with Incr/Decr/Load methods that use atomic.AddInt64 and atomic.LoadInt64 internally. Worker goroutines and the spinner goroutine were updating and reading the same counters without synchronization, producing torn integer writes that could show as off-by-one progress in the spinner. Plain int64 storage keeps the struct copyable so existing constructors and helpers that take modules by value continue to vet-clean. Add TestNetworkPortsCacheConcurrentAccess as a regression test. With the read lock removed, "go test -race" reports the mapaccess2_faststr read racing the locked write; with the fix in place the test passes.