revocation: Enforce a (configurable) timeout when fetching OCSP/CRL
Malicious servers could otherwise block the fetching thread indefinitely after the initial TCP handshake (which has a default timeout of 10s in the curl and winhttp plugins, the soup plugin actually has a default overall timeout of 10s).
This commit is contained in:
@@ -134,6 +134,11 @@ METHOD(fetcher_t, set_option, bool,
|
||||
this->request_type = strdup(va_arg(args, char*));
|
||||
break;
|
||||
}
|
||||
case FETCH_TIMEOUT:
|
||||
{
|
||||
/* we already enforce a 10s timeout */
|
||||
break;
|
||||
}
|
||||
default:
|
||||
supported = FALSE;
|
||||
break;
|
||||
|
||||
Reference in New Issue
Block a user