denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

revocation: Enforce a (configurable) timeout when fetching OCSP/CRL

Browse Source 
Malicious servers could otherwise block the fetching thread indefinitely
after the initial TCP handshake (which has a default timeout of 10s
in the curl and winhttp plugins, the soup plugin actually has a default
overall timeout of 10s).
This commit is contained in:
Tobias Brunner
2022-10-03 10:48:46 +02:00
parent b1e926148a
commit 1968615590
4 changed files with 56 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/plugins/revocation.opt
+2 -1
View File
@@ -4,4 +4,5 @@ charon.plugins.revocation.enable_ocsp = yes
charon.plugins.revocation.enable_crl = yes
Whether CRL validation should be enabled.
charon.plugins.revocation.timeout = 10s
Timeout used when fetching OCSP/CRL.