Changeset c6dda6d in mod_gnutls for src/gnutls_config.c


Ignore:
Timestamp:
Oct 21, 2016, 6:40:02 PM (3 years ago)
Author:
Thomas Klute <thomas2.klute@…>
Branches:
debian/master, debian/stretch-backports, master, upstream
Children:
333bbc7
Parents:
d26fa55
Message:

Rate limit OCSP requests

Retries after failed OCSP requests must be rate limited. If the
responder is overloaded or buggy we don't want to add too much more
load, and if a MITM is messing with requests a repetition loop might
end up being a self-inflicted denial of service.

The minimum time to wait between retries can be configured using the
GnuTLSOCSPFailureTimeout directive.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • src/gnutls_config.c

    rd26fa55 rc6dda6d  
    2626/* Default OCSP response grace time in seconds */
    2727#define MGS_GRACE_TIME 60
     28/* Default OCSP failure timeout in seconds */
     29#define MGS_FAILURE_TIMEOUT 300
    2830
    2931#ifdef APLOG_USE_MODULE
     
    870872                                "GnuTLSOCSPGraceTime"))
    871873        sc->ocsp_grace_time = apr_time_from_sec(argint);
     874    else if (!apr_strnatcasecmp(parms->directive->directive,
     875                                "GnuTLSOCSPFailureTimeout"))
     876        sc->ocsp_failure_timeout = apr_time_from_sec(argint);
    872877    else
    873878        /* Can't happen unless there's a serious bug in mod_gnutls or Apache */
     
    11231128    sc->ocsp_mutex = NULL;
    11241129    sc->ocsp_grace_time = apr_time_from_sec(MGS_GRACE_TIME);
     1130    sc->ocsp_failure_timeout = apr_time_from_sec(MGS_FAILURE_TIMEOUT);
    11251131
    11261132/* this relies on GnuTLS never changing the gnutls_certificate_request_t enum to define -1 */
     
    11831189    gnutls_srvconf_assign(ocsp_response_file);
    11841190    gnutls_srvconf_merge(ocsp_grace_time, apr_time_from_sec(MGS_GRACE_TIME));
     1191    gnutls_srvconf_merge(ocsp_failure_timeout,
     1192                         apr_time_from_sec(MGS_FAILURE_TIMEOUT));
    11851193
    11861194    gnutls_srvconf_assign(ca_list);
Note: See TracChangeset for help on using the changeset viewer.