From sacadmin Fri Mar 11 10:01:19 2005 Received: from phorcys.East.Sun.COM (phorcys.East.Sun.COM [129.148.174.143]) by sac.sfbay.sun.com (8.12.9+Sun/8.12.9) with ESMTP id j2BI1JSp021328 for ; Fri, 11 Mar 2005 10:01:19 -0800 (PST) Received: from phorcys.East.Sun.COM (localhost [127.0.0.1]) by phorcys.East.Sun.COM (8.13.3+Sun/8.13.3) with ESMTP id j2BHxp0b004571; Fri, 11 Mar 2005 12:59:51 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.East.Sun.COM (8.13.3+Sun/8.13.3/Submit) id j2BHxpV7004568; Fri, 11 Mar 2005 12:59:51 -0500 (EST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16945.56471.408302.184878@gargle.gargle.HOWL> Date: Fri, 11 Mar 2005 12:59:51 -0500 From: James Carlson To: psarc@sac.sfbay.sun.com cc: Dan McDonald Subject: 2005/160 IKE Certificate Allocation X-Mailer: VM 7.01 under Emacs 21.3.1 Status: RO Content-Length: 1751 I'm sponsoring this case for Dan McDonald. As it seems like a pretty trivial temporary work-around with obvious future plans, I'm marking it as "closed approved automatic." If you disagree, please speak up by COB today. The certificate parsing library used by in.iked (provided by SafeNet/ SSH) has a compiled-in limit on the number of certificates that it can handle. This limit (currently 256) has proven restrictive with the punchin deployment; see CR 6238962 for details. The solution consists of three parts. First, the compiled-in default will be increased from 256 to 1024, to make it even less likely that any customer will ever run into this (though none has complained yet). Second, a new keyword will be added to ike.config(4). This keyword is Project Private (will not be documented for customer use unless someone runs into this restriction and needs immediate relief) and has a patch/micro release binding. The new keyword is: max_certs - The maximum number of certificates in.iked(1m) can have in memory. This number includes the number of on-disk and on-token certificates (which are permanently cached in memory), and ones received via IKE, LDAP, or HTTP (for which the memory acts as an least-recently-used cache). Third, this entire issue goes away when the new certificate framework (PSARC 2005/074) is available. Because this new framework is in progress now, there's no real point in rewriting the old SafeNet code to just "do the right thing" for dynamic allocation. -- James Carlson, IP Systems Group? Sun Microsystems / 1 Network Drive 71.234W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.497N Fax +1 781 442 1677