mainGnuTLS - Support: sr #108551, libdane: Remove or significantly...

 
 

sr #108551: libdane: Remove or significantly increase MAX_DATA_ENTRIES limit in dane_raw_tlsa()

Submitter:  None
Submitted:  Sat 19 Apr 2014 04:02:55 PM UTC
   
 
Category:  Extra library Priority:  5 - Normal
Severity:  4 - Important Status:  Done
Privacy:  Public Assigned to:  nmav
Originator Email:  -email is unavailable- Open/Closed:  Closed
Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 28 Apr 2014 09:29:58 AM UTC, comment #1: 

I've increased to 100.
Thank you.

Nikos Mavrogiannopoulos <nmav>
Group administrator
Sat 19 Apr 2014 04:02:55 PM UTC, original submission:  

There is a MAX_DATA_ENTRIES limit in dane_raw_tlsa that restricts the number of TLSA recors that will be processed to 4. RFC6698 does not specify a minimum or maximum number of records to support.

The call to libunbound has already retrieved and allocated memory for all the TLSA records, so there is no reason to limit the maximum number of records that will be processed to an abitrarily small number.

This makes it impossible to support more than 2 EE certificates where there are multiple servers for a hostname in different administrative domains (e.g. IRC servers in a network) because they will need at least 2 TLSA records each (to handle certificate rollover).

If the limit is not removed it should be raised to a more practical number like 100. With caching of the SHA256/SHA512 hash the CPU usage required to perform 100 checks should be minimal.

An estimate of the maximum number of TLSA records likely to fit in a 65536 byte DNS response buffer is around 940 (SHA256) or 1770 (SHA512). This maximum will be further reduced by the need to include an RRSIG record in the response.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-04-28 nmav StatusNone Done
        Assigned toNone nmav
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code