lukechilds/node - node - Gitea: Git with a cup of tea

6793 Commits

131 Branches

446 Tags

325 MiB

Tree: edd3de8fea

Commit Graph

Author	SHA1	Message	Date
Ben Noordhuis	ff552ddbaa	tls: fix off-by-one error in renegotiation check Make CLIENT_RENEG_LIMIT inclusive instead of exclusive, i.e. a limit of 2 means the peer can renegotiate twice, not just once. Update pummel/test-tls-ci-reneg-attack accordingly and make it less timing sensitive (and run faster) while we're at it.	13 years ago
isaacs	0cdf85e28d	Lint all the JavaScripts.	13 years ago
Ben Noordhuis	3415427dbf	tls: mitigate session renegotiation attacks The TLS protocol allows (and sometimes requires) clients to renegotiate the session. However, renegotiation requires a disproportional amount of server-side resources, particularly CPU time, which makes it a potential vector for denial-of-service attacks. To mitigate this issue, we keep track of and limit the number of renegotiation requests over time, emitting an error if the threshold is exceeded.	13 years ago

Author

SHA1

Message

Date

Ben Noordhuis

ff552ddbaa

tls: fix off-by-one error in renegotiation check

Make CLIENT_RENEG_LIMIT inclusive instead of exclusive, i.e. a limit of 2
means the peer can renegotiate twice, not just once.

Update pummel/test-tls-ci-reneg-attack accordingly and make it less timing
sensitive (and run faster) while we're at it.

13 years ago

isaacs

0cdf85e28d

Lint all the JavaScripts.

13 years ago

Ben Noordhuis

3415427dbf

tls: mitigate session renegotiation attacks

The TLS protocol allows (and sometimes requires) clients to renegotiate the
session. However, renegotiation requires a disproportional amount of server-side
resources, particularly CPU time, which makes it a potential vector for
denial-of-service attacks.

To mitigate this issue, we keep track of and limit the number of renegotiation
requests over time, emitting an error if the threshold is exceeded.

13 years ago

3 Commits (edd3de8feaed468be7be2dfcbeb60aa3c94d65f7)