From cdc787d92d4db70b7627cceb702e90c74d6869d8 Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Fri, 3 Jul 2026 14:36:22 +0200 Subject: [PATCH] pv: download_first_crl_from_x509: Increase the timeout to 10s MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 3-second timeout might be too short for slow networks therefore increase it to 10s. In addition move this constant to a more prominent position and add documentation. Assisted-by: IBM Bob:1.0.5 Signed-off-by: Marc Hartmayer Reviewed-by: Steffen Eiden Signed-off-by: Jan Höppner --- rust/pv/src/verify/helper.rs | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/rust/pv/src/verify/helper.rs b/rust/pv/src/verify/helper.rs index 52640e5a..d19a29db 100644 --- a/rust/pv/src/verify/helper.rs +++ b/rust/pv/src/verify/helper.rs @@ -56,6 +56,19 @@ const SECURITY_CHAIN_MAX_LEN: c_int = 2; /// while preventing abuse. const CRL_MAX_REDIRECTIONS: usize = 10; +/// Maximum timeout duration for CRL (Certificate Revocation List) downloads. +/// +/// This timeout applies to individual CRL download operations to prevent +/// indefinite blocking when fetching revocation information from remote servers. +/// +/// # Value +/// +/// Set to 10 seconds, which provides a reasonable balance between: +/// - Allowing sufficient time for legitimate CRL downloads over slow networks +/// - Preventing excessive delays in certificate verification workflows +/// - Protecting against unresponsive or malicious CRL distribution points +const CRL_TIMEOUT_MAX: Duration = Duration::from_secs(10); + /// Verifies that the HKD /// * has enough security bits /// * is inside its validity period @@ -471,10 +484,7 @@ fn download_first_crl_from_x509_impl( cert: &X509Ref, mut client: H, ) -> Result>> { - use std::time::Duration; - use crate::utils::read_crls; - const CRL_TIMEOUT_MAX: Duration = Duration::from_secs(3); 'outer: for dist_point_url in x509_dist_points(cert) { // Validate protocol BEFORE attempting download