[govc] Introduce TLSHandshakeTimeout parameter

govc/README.md

@@ -82,6 +82,8 @@ to set defaults:
   > govc about.cert -u host -k -thumbprint | tee -a $GOVC_TLS_KNOWN_HOSTS
   > govc about -u user:pass@host
 
+* `GOVC_TLS_HANDSHAKE_TIMEOUT`: Limits the time spent performing the TLS handshake.
+
 * `GOVC_INSECURE`: Disable certificate verification.
 
   > This option sets Go's tls.Config.InsecureSkipVerify flag and is false by default.

govc/flags/client.go

@@ -25,10 +25,12 @@ import (
 	"flag"
 	"fmt"
 	"io/ioutil"
+	"net/http"
 	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/vmware/govmomi/session"
 	"github.com/vmware/govmomi/vim25"
@@ -37,18 +39,19 @@ import (
 )
 
 const (
-	envURL           = "GOVC_URL"
-	envUsername      = "GOVC_USERNAME"
-	envPassword      = "GOVC_PASSWORD"
-	envCertificate   = "GOVC_CERTIFICATE"
-	envPrivateKey    = "GOVC_PRIVATE_KEY"
-	envInsecure      = "GOVC_INSECURE"
-	envPersist       = "GOVC_PERSIST_SESSION"
-	envMinAPIVersion = "GOVC_MIN_API_VERSION"
-	envVimNamespace  = "GOVC_VIM_NAMESPACE"
-	envVimVersion    = "GOVC_VIM_VERSION"
-	envTLSCaCerts    = "GOVC_TLS_CA_CERTS"
-	envTLSKnownHosts = "GOVC_TLS_KNOWN_HOSTS"
+	envURL                 = "GOVC_URL"
+	envUsername            = "GOVC_USERNAME"
+	envPassword            = "GOVC_PASSWORD"
+	envCertificate         = "GOVC_CERTIFICATE"
+	envPrivateKey          = "GOVC_PRIVATE_KEY"
+	envInsecure            = "GOVC_INSECURE"
+	envPersist             = "GOVC_PERSIST_SESSION"
+	envMinAPIVersion       = "GOVC_MIN_API_VERSION"
+	envVimNamespace        = "GOVC_VIM_NAMESPACE"
+	envVimVersion          = "GOVC_VIM_VERSION"
+	envTLSCaCerts          = "GOVC_TLS_CA_CERTS"
+	envTLSKnownHosts       = "GOVC_TLS_KNOWN_HOSTS"
+	envTLSHandshakeTimeout = "GOVC_TLS_HANDSHAKE_TIMEOUT"
 )
 
 const cDescr = "ESX or vCenter URL"
@@ -58,21 +61,21 @@ type ClientFlag struct {
 
 	*DebugFlag
 
-	url           *url.URL
-	username      string
-	password      string
-	cert          string
-	key           string
-	insecure      bool
-	persist       bool
-	minAPIVersion string
-	vimNamespace  string
-	vimVersion    string
-	tlsCaCerts    string
-	tlsKnownHosts string
-	tlsHostHash   string
-
-	client *vim25.Client
+	url                 *url.URL
+	username            string
+	password            string
+	cert                string
+	key                 string
+	insecure            bool
+	persist             bool
+	minAPIVersion       string
+	vimNamespace        string
+	vimVersion          string
+	tlsCaCerts          string
+	tlsKnownHosts       string
+	tlsHostHash         string
+	tlsHandshakeTimeout time.Duration
+	client              *vim25.Client
 }
 
 var (
@@ -215,6 +218,16 @@ func (flag *ClientFlag) Register(ctx context.Context, f *flag.FlagSet) {
 			usage := fmt.Sprintf("TLS known hosts file [%s]", envTLSKnownHosts)
 			f.StringVar(&flag.tlsKnownHosts, "tls-known-hosts", value, usage)
 		}
+
+		{
+			value, err := time.ParseDuration(os.Getenv(envTLSHandshakeTimeout))
+			if err != nil {
+				value = 10 * time.Second
+			}
+			usage := fmt.Sprintf("TLS handshake timeout [%s]", envTLSHandshakeTimeout)
+			f.DurationVar(&flag.tlsHandshakeTimeout, "tls-handshake-timeout", value, usage)
+		}
+
 	})
 }
 
@@ -275,6 +288,10 @@ func (flag *ClientFlag) configure(sc *soap.Client) (soap.RoundTripper, error) {
 		return nil, err
 	}
 
+	if t, ok := sc.Transport.(*http.Transport); ok {
+		t.TLSHandshakeTimeout = flag.tlsHandshakeTimeout
+	}
+
 	// Retry twice when a temporary I/O error occurs.
 	// This means a maximum of 3 attempts.
 	return vim25.Retry(sc, vim25.TemporaryNetworkError(3)), nil

govc/test/cli.bats

@@ -9,6 +9,24 @@ load test_helper
   assert_success
   assert_line "Vendor: VMware, Inc."
 
+  run govc about --tls-handshake-timeout=10s
+  assert_success
+  assert_line "Vendor: VMware, Inc."
+
+  run env GOVC_TLS_HANDSHAKE_TIMEOUT=10s govc about
+  assert_success
+  assert_line "Vendor: VMware, Inc."
+
+  run env GOVC_TLS_HANDSHAKE_TIMEOUT=NOT_A_DURATION govc about
+  assert_success
+  assert_line "Vendor: VMware, Inc."
+
+  run govc about --tls-handshake-timeout=1ns
+  assert_failure
+
+  run env GOVC_TLS_HANDSHAKE_TIMEOUT=1ns govc about
+  assert_failure
+
   run govc about -json
   assert_success
 

govc/test/test_helper.bash

@@ -7,6 +7,7 @@ export GOVC_PERSIST_SESSION=false
 unset GOVC_URL
 unset GOVC_DEBUG
 unset GOVC_TLS_KNOWN_HOSTS
+unset GOVC_TLS_HANDSHAKE_TIMEOUT
 unset GOVC_DATACENTER
 unset GOVC_HOST
 unset GOVC_USERNAME