net: acquireThread might block for a long time #63978
This was previously reported to the go security team.
When the cgo resolver is being used, we call the acquireThread function to limit the amount of concurrent cgo calls running and also to limit the amount of threads that will be ever created (by the net package) by the runtime for cgo calls. The limit is currently capped to 500.
This might be problematic for services that connect to a user-provided hostnames.
1-3 (Resolvers Count) * 2 (default attempts count) * 5s (default timeout).
Obviously with MITM it is simpler to trip timeouts.
We don't use the cgo resolver much these days on unix systems (except desktop linux, because of systemd nsswitch modules we don't support in the go resolver). On windows and darwin the cgo resolver is the default.
I will send CLs for this.
The text was updated successfully, but these errors were encountered:
Huh — I don't remember. 😅
I think I misinterpreted