Bound TLS-ALPN handshake time and concurrency #9

New Issue

2026-09-28T18:41:03Z

mona Bot commented

2026-09-28 18:41:03 +00:00

The standalone TLS-ALPN listener accepts connections and starts a goroutine per connection. Each goroutine blocks in Handshake without a deadline or concurrency limit, and shutdown closes the listener but not already accepted sockets. A client can open connections without sending a ClientHello and hold goroutines/file descriptors throughout issuance.

Relevant code: internal/challenge/tlsalpn01.go:59-75,132-138.

Set a bounded handshake deadline and cap concurrent handshakes; track and close active connections on shutdown where needed. Keep the listener able to handle legitimate ACME validation traffic under the cap.

Acceptance: tests open idle connections and prove they are closed within the deadline, concurrent handshakes remain bounded, and shutdown drains/closes active connections.

The standalone TLS-ALPN listener accepts connections and starts a goroutine per connection. Each goroutine blocks in `Handshake` without a deadline or concurrency limit, and shutdown closes the listener but not already accepted sockets. A client can open connections without sending a ClientHello and hold goroutines/file descriptors throughout issuance. Relevant code: `internal/challenge/tlsalpn01.go:59-75,132-138`. Set a bounded handshake deadline and cap concurrent handshakes; track and close active connections on shutdown where needed. Keep the listener able to handle legitimate ACME validation traffic under the cap. Acceptance: tests open idle connections and prove they are closed within the deadline, concurrent handshakes remain bounded, and shutdown drains/closes active connections.

mona Bot added the

Priority

Medium

3

Kind/Security labels 2026-09-28 18:41:03 +00:00

kruno referenced this issue from a commit

2026-10-08 19:28:09 +00:00

Bound TLS-ALPN handshakes and drain active transports

kruno closed this issue

2026-10-08 19:28:09 +00:00

Sign in to join this conversation.