Skip to content

Add an extra timeout waiting for RVAs #8434

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Oct 21, 2025
Merged

Add an extra timeout waiting for RVAs #8434

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c5a0b8a
Add an extra timeout waiting for RVAs
mcpherrinm Oct 7, 2025
08afa19
Use time.AfterFunc and make it configurable
aarongable Oct 15, 2025
541c029
Set it in config-next
aarongable Oct 15, 2025
93cdf6d
Review comments
aarongable Oct 16, 2025
163af35
Simplify conditional
aarongable Oct 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions cmd/boulder-va/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import (

"github.com/letsencrypt/boulder/bdns"
"github.com/letsencrypt/boulder/cmd"
"github.com/letsencrypt/boulder/config"
"github.com/letsencrypt/boulder/features"
bgrpc "github.com/letsencrypt/boulder/grpc"
"github.com/letsencrypt/boulder/iana"
Expand Down Expand Up @@ -50,10 +51,9 @@ type RemoteVAGRPCClientConfig struct {
type Config struct {
VA struct {
vaConfig.Common
RemoteVAs []RemoteVAGRPCClientConfig `validate:"omitempty,dive"`
// Deprecated and ignored
MaxRemoteValidationFailures int `validate:"omitempty,min=0,required_with=RemoteVAs"`
Features features.Config
RemoteVAs []RemoteVAGRPCClientConfig `validate:"omitempty,dive"`
SlowRemoteTimeout config.Duration
Features features.Config
}

Syslog cmd.SyslogConfig
Expand Down Expand Up @@ -149,7 +149,9 @@ func main() {
c.VA.AccountURIPrefixes,
va.PrimaryPerspective,
"",
iana.IsReservedAddr)
iana.IsReservedAddr,
c.VA.SlowRemoteTimeout.Duration,
)
cmd.FailOnError(err, "Unable to create VA server")

start, err := bgrpc.NewServer(c.VA.GRPC, logger).Add(
Expand Down
4 changes: 3 additions & 1 deletion cmd/remoteva/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,7 +140,9 @@ func main() {
c.RVA.AccountURIPrefixes,
c.RVA.Perspective,
c.RVA.RIR,
iana.IsReservedAddr)
iana.IsReservedAddr,
0,
)
cmd.FailOnError(err, "Unable to create Remote-VA server")

start, err := bgrpc.NewServer(c.RVA.GRPC, logger).Add(
Expand Down
1 change: 1 addition & 0 deletions test/config-next/va.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@
"http://boulder.service.consul:4001/acme/acct/",
"http://boulder.service.consul:4000/acme/reg/"
],
"slowRemoteTimeout": "2s",
"features": {
"DNSAccount01Enabled": true
}
Expand Down
9 changes: 9 additions & 0 deletions va/va.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -216,6 +216,7 @@ type ValidationAuthorityImpl struct {
maxRemoteFailures int
accountURIPrefixes []string
singleDialTimeout time.Duration
slowRemoteTimeout time.Duration
perspective string
rir string
isReservedIPFunc func(netip.Addr) error
Expand All @@ -239,6 +240,7 @@ func NewValidationAuthorityImpl(
perspective string,
rir string,
reservedIPChecker func(netip.Addr) error,
slowRemoteTimeout time.Duration,
) (*ValidationAuthorityImpl, error) {

if len(accountURIPrefixes) == 0 {
Expand Down Expand Up @@ -620,6 +622,13 @@ func (va *ValidationAuthorityImpl) doRemoteOperation(ctx context.Context, op rem
firstProb = currProb
}

// If enough perspectives have passed, set a tighter deadline for the
// remaining perspectives.
if len(passed) >= required && len(passedRIRs) >= requiredRIRs && va.slowRemoteTimeout != 0 {
timer := time.AfterFunc(va.slowRemoteTimeout, cancel)
defer timer.Stop()
}

// Once all the VAs have returned a result, break the loop.
if len(passed)+len(failed) >= remoteVACount {
break
Expand Down
2 changes: 2 additions & 0 deletions va/va_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,7 @@ func setup(srv *httptest.Server, userAgent string, remoteVAs []RemoteVA, mockDNS
perspective,
"",
isNonLoopbackReservedIP,
time.Second,
)
if err != nil {
panic(fmt.Sprintf("Failed to create validation authority: %v", err))
Expand Down Expand Up @@ -323,6 +324,7 @@ func TestNewValidationAuthorityImplWithDuplicateRemotes(t *testing.T) {
"example perspective",
"",
isNonLoopbackReservedIP,
time.Second,
)
test.AssertError(t, err, "NewValidationAuthorityImpl allowed duplicate remote perspectives")
test.AssertContains(t, err.Error(), "duplicate remote VA perspective \"dadaist\"")
Expand Down