tests: reduce parallelization in asan

Often certain tests when run under asan will fail with out of memory.
Reduce parallelization for these tests when run under asan to reduce
memory pressure.

Example:
https://gitlab.com/openconnect/ocserv/-/jobs/14724892759

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

.gitlab-ci.yml

@@ -406,7 +406,7 @@ asan/clang/Fedora:
   script:
   - chmod -R o-w tests/data/raddb
   - git submodule update --init
-  - CC=clang CFLAGS="-fsanitize=address -fno-optimize-sibling-calls -fno-omit-frame-pointer -g -O1" meson setup build -Dpam=disabled -Db_lundef=false
+  - CC=clang CFLAGS="-fsanitize=address -fno-optimize-sibling-calls -fno-omit-frame-pointer -g -O1" meson setup build -Dpam=disabled -Db_lundef=false -Dserial-heavy-tests=true
   - ninja -C build -j$JOBS
   - DISABLE_ASAN_BROKEN_TESTS=1 meson test -C build --num-processes $JOBS --no-rebuild
   tags:

tests/meson.build

@@ -298,14 +298,8 @@ if get_option('root-tests')
     'disconnect-user', 'disconnect-user2', 'terminate-commands',
     'ping-leases', 'test-ban-local', 'test-client-bypass-protocol',
     'ipv6-small-net', 'test-camouflage', 'test-camouflage-norealm',
-    'vhost-traffic', 'defvhost-traffic', 'session-timeout',
+    'vhost-traffic', 'defvhost-traffic',
     'test-occtl', 'test-occtl-commands', 'no-ipv6-ocv3',
-    # cipher / traffic tests
-    'traffic', 'bandwidth', 'lz4-compression', 'lzs-compression',
-    'aes256-cipher', 'aes128-cipher',
-    'oc-aes256-gcm-cipher', 'oc-aes128-gcm-cipher',
-    'ac-aes128-gcm-cipher', 'ac-aes256-gcm-cipher',
-    'no-dtls-cipher', 'psk-negotiate', 'psk-negotiate-match',
     'test-config-per-group', 'test-config-per-group-url-pass',
     'test-config-per-group-url-cert', 'test-multiple-client-ip',
   ]
@@ -318,6 +312,29 @@ if get_option('root-tests')
     )
   endforeach
 
+  # iperf3-heavy tests: each spawns many worker processes under load.
+  # Under ASAN, concurrent execution exhausts per-process shadow memory and
+  # triggers a worker-crash / reconnect storm.  Serialise them when
+  # -Dserial-heavy-tests=true is set (used by the ASAN CI job).
+  heavy_root_scripts = [
+    'session-timeout',
+    'traffic', 'bandwidth', 'lz4-compression', 'lzs-compression',
+    'aes256-cipher', 'aes128-cipher',
+    'oc-aes256-gcm-cipher', 'oc-aes128-gcm-cipher',
+    'ac-aes128-gcm-cipher', 'ac-aes256-gcm-cipher',
+    'no-dtls-cipher', 'psk-negotiate', 'psk-negotiate-match',
+  ]
+
+  _heavy_parallel = not get_option('serial-heavy-tests')
+  foreach s : heavy_root_scripts
+    test(s, find_program(s),
+      env:         test_env,
+      timeout:     300,
+      workdir:     test_workdir,
+      is_parallel: _heavy_parallel,
+    )
+  endforeach
+
   # PAM accounting test requires PAM support compiled in and pam_wrapper
   if have_cwrap_pam
     test('test-pass-pam-acct', find_program('test-pass-pam-acct'),