schannel: lower the maximum allowed time to block to 7 seconds #19205
Conversation
During TLS renegotiation, the schannel_recv_renegotiate() function is allowed to block for a short while. Reduce the maximum allowed time to block from 10 minutes down to 7 seconds.
|
Renegotiation may take longer than that, but to be fair I chose a number (5 minutes) that just seemed reasonable. I don't have any metrics on what is or is not appropriate in these cases. |
lib/vtls/schannel.c
Outdated
| SCH_RENEG_CALLER_IS_SEND | ||
| }; | ||
|
|
||
| #define MAX_REGEG_BLOCK_TIME (7 * 1000) /* 7 seconds in milliseconds */ |
There was a problem hiding this comment.
REGEG/RENEG but IMO this is really a one line change where you could have set max_renegotiate_ms to 7 * 1000
Sure, but that would be a very broken setup on extremely long latency and then I think it is better to fail.
Sure, but why not "clean up" while there. |
|
I want to merge this and if it really turns into a problem I'm sure people will tell us and then we can adjust it up a little again. |
|
https://en.wikipedia.org/wiki/7_Seconds_(song) I'm fine with merging this. |
During TLS renegotiation, the schannel_recv_renegotiate() function is allowed to block for a short while. Reduce the maximum allowed time to block from 10 minutes down to 7 seconds.