]> git.ipfire.org Git - thirdparty/systemd.git/commit
projects / thirdparty / systemd.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 67d0ce8) | patch
resolved: reduce the maximum nsec3 iterations to 100 31480/head
authorRonan Pigott <ronan@rjp.ie>
Sun, 25 Feb 2024 07:23:32 +0000 (00:23 -0700)
committerRonan Pigott <ronan@rjp.ie>
Mon, 26 Feb 2024 08:55:57 +0000 (01:55 -0700)
commiteba291124bc11f03732d1fc468db3bfac069f9cb
treee1665049fe6729b1782addc5a361a1789d540db2tree | snapshot
parent67d0ce8843d612a2245d0966197d4f528b911b66commit | diff
resolved: reduce the maximum nsec3 iterations to 100

According to RFC9267, the 2500 value is not helpful, and in fact it can
be harmful to permit a large number of iterations. Combined with limits
on the number of signature validations, I expect this will mitigate the
impact of maliciously crafted domains designed to cause excessive
cryptographic work.
src/resolve/resolved-dns-dnssec.c diff | blob | blame | history
Unnamed repository; edit this file 'description' to name the repository.