v0.101.4 prep #153
v0.101.4 prep #153
Conversation
Pathbuilding complexity can be quadratic, particularly when the set of intermediates all have subjects matching a trust anchor. In these cases we need to bound the number of expensive signature validation operations that are performed to avoid a DoS on CPU usage. This commit implements a simple maximum signature check limit inspired by the approach taken in the Golang x509 package. No more than 100 signatures will be evaluated while pathbuilding. This limit works in practice for Go when processing real world certificate chains and so should be appropriate for our use case as well.
Codecov Report
@@ Coverage Diff @@
## rel-0.101 #153 +/- ##
=============================================
+ Coverage 94.75% 94.89% +0.13%
=============================================
Files 15 15
Lines 3432 3504 +72
=============================================
+ Hits 3252 3325 +73
+ Misses 180 179 -1
📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
|
can give some suggestion whether should i update in my C-S system:
|
|
You should just update both. Updating them should be trivial, since this change in semver-compatible. |
our client is an large online application, we want to evaluate the influence on client, I check rustsec https://rustsec.org/advisories/RUSTSEC-2023-0052.html describe that only has influence when tls client/server that accept client certificate, but in our scenes, client does not supply certificate to server. |
|
If your server doesn't accept client certificates it should not be affected. |
is the same for client ? should client be affected ? |
|
Clients always accept server certificates, so they are definitely affected. |
0.101.4 release prep
This branch targets a base of
rel-0.101to prepare a point release in the v0.101.x series.Proposed release notes
verify_cert: enforce maximum number of signatures.
Pathbuilding complexity can be quadratic, particularly when the set of intermediates all have subjects matching a trust anchor. In these cases we need to bound the number of expensive signature validation operations that are performed to avoid a DoS on CPU usage.
This commit implements a simple maximum signature check limit inspired by the approach taken in the Golang x509 package. No more than 100 signatures will be evaluated while pathbuilding. This limit works in practice for Go when processing real world certificate chains and so should be appropriate for our use case as well.
Cargo: version 0.101.3 -> 0.101.4
Bumps the Cargo version.