GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-08-09 09:51:49 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,277 Commits 33 Branches 91 Tags
tmp-fix-745
Commit Graph
167 Commits
Author SHA1 Message Date
Nikos Mavrogiannopoulos cdc9a5b5f4 Merge branch 'mr588-worker-seccomp-musl' into 'master' 
worker-privs: allow munmap/mremap/madvise for isolated workers

Closes #749

See merge request openconnect/ocserv!588
 2026-07-28 05:52:58 +00:00
Alex Protsko b931112cb2 worker-privs: allow munmap/mremap/madvise for isolated workers 
Fix worker crashes on musl-based systems when isolate-workers = true by allowing munmap, mremap, and madvise in the worker seccomp filter.

Move seccomp coverage to Alpine CI and use oc_syslog for seccomp trap diagnostics instead of direct write()-based output.

Keep glibc backtrace diagnostics as the default and allow musl builds to select the syscall-only fallback with the assume-glibc Meson option.

Resolves: #749
Signed-off-by: Alex Protsko <fidget2015@yahoo.com>
 2026-07-20 16:43:23 +03:00
Dimitri Papadopoulos 915f819009 ci: wget → curl 
Standardise on `curl` instead of using both `wget` and `curl`.

Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
 2026-06-25 13:15:06 +02:00
Nikos Mavrogiannopoulos a53e6d4e25 .gitlab-ci.yml: do not store .tmp files as artifacts 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-06-17 06:16:37 +02:00
Nikos Mavrogiannopoulos 3f4a1f0e68 tests: reduce parallelization in asan 
Often certain tests when run under asan will fail with out of memory.
Reduce parallelization for these tests when run under asan to reduce
memory pressure.

Example:
https://gitlab.com/openconnect/ocserv/-/jobs/14724892759

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-06-11 15:40:37 +02:00
Nikos Mavrogiannopoulos 86fe12e989 .gitlab-ci.yml: removed unnecessary jobs from schedules [ci skip] 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-05-31 00:14:34 +02:00
Nikos Mavrogiannopoulos f0406217eb .gitlab-ci.yml: run and print debugging information [ci skip] 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-05-31 00:08:02 +02:00
Nikos Mavrogiannopoulos 7bf968617b .gitlab-ci.yml: do not depend our schedules on the coverity job 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-05-30 23:42:19 +02:00
Dimitri Papadopoulos 174561dd66 CI: upgrade Fedora and Ubuntu 
* Fedora 43 → 44
* Ubuntu 24.04 → 26.02 (we also test Ubuntu 22.04)

Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
 2026-05-08 14:41:19 +02:00
Nikos Mavrogiannopoulos 22bbad4eb5 worker: add per-worker memory limit via RLIMIT_DATA 
Introduce a per-worker heap cap as defense-in-depth against
memory-exhaustion DoS attacks. The limit uses RLIMIT_DATA rather
than RLIMIT_AS: since Linux 4.7 RLIMIT_DATA covers brk and private
anonymous mmap regions, i.e, the paths used by malloc and talloc, while
ignoring shared-library file mappings that inflate RLIMIT_AS without
reflecting actual allocation.

This aligns with haproxy's handling. See also:
https://github.com/torvalds/linux/commit/84638335900f1995495838fe1bd4870c43ec1f67
https://sources.debian.org/src/haproxy/3.2.17-1/src/limits.c?hl=486#L486
https://www.kernel.org/doc/html/latest/mm/overcommit-accounting.html

The cap is computed at worker startup by reading the data+stack field
from /proc/self/statm.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-05-06 13:54:40 +02:00
Nikos Mavrogiannopoulos 139ff827d9 config: restructure per-vhost configuration for clarity and maintainability 
Introduce a protobuf-generated ReloadableConfig (cfg.proto) to hold all
fields that reload on SIGHUP, and separate them from static_cfg_st, which
holds fields that require a server restart.  Named vhosts inherit from the
default vhost via a pack/unpack round-trip. Adding a new config field
only requires editing cfg.proto.  Struct and accessor names (ReloadableConfig,
static_cfg_st, GETRCONFIG, GETSCONFIG) now reflect each field's lifetime.
A new unit test covers the full inheritance path.

Resolves: #705

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-04-22 20:29:15 +02:00
Nikos Mavrogiannopoulos 611eb00527 config: add scope annotations and validation script 
Add machine-readable [scope: X] annotations to doc/sample.config and
src/vpn.h struct fields to document which config options are permanent,
global-only, per-vhost, or per-user/group overridable.

Scope vocabulary:
  global (non-reloadable)  -- in perm_cfg_st; requires restart; cannot differ per vhost
  vhost (non-reloadable)   -- in perm_cfg_st; requires restart; can differ per vhost
  global            -- in cfg_st; reloadable; cannot be set in [vhost:] sections
  vhost             -- in cfg_st; reloadable; can differ per vhost
  vhost user        -- in cfg_st; reloadable; also overridable per user/group

Add tests/check-config-scope.py: a script that cross-checks the annotations
against the actual code:
  (a) every option in sample.config has a [scope:] annotation
  (b-c) [global] options match error_on_vhost() calls in config.c
  (d-e) [vhost user] options match handlers in src/sup-config/file.c
  (f) every field in cfg_st and perm_cfg_st has a [scope:] comment

Also fix a pre-existing bug in src/sup-config/file.c: the tunnel-all-dns
option was compared using an underscore ("tunnel_all_dns") instead of
the correct dash ("tunnel-all-dns"), silently ignoring the per-user
setting.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-04-14 18:57:45 +02:00
Nikos Mavrogiannopoulos 9840050511 .gitlab-ci.yml: increased jobs 
Several tests run longer without taking any resources, allow
more parallelization to finish faster.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-04-02 23:15:56 +02:00
Nikos Mavrogiannopoulos fd3235784f tests: gssapi tests were moved to a specific testsuite 
They are skipped in Ubuntu 22.04.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-29 17:32:23 +02:00
Nikos Mavrogiannopoulos 233aa02236 tests: do not run the firewall tests in i386/Debian 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-29 17:32:23 +02:00
Nikos Mavrogiannopoulos 979ccc711d .gitlab-ci.yml: updated to Ubuntu 24.04 and Fedora 43 
This deprecates Ubuntu 20.04 builds and Fedora 42 builds
and tests the latest version.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-29 17:00:33 +02:00
Nikos Mavrogiannopoulos b5e631f6f4 .gitlab-ci.yml: added distcheck job 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos a7df5240f1 http-heads: generate as C file to avoid issue with coverage 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos 18401eb298 Replaced autoconf with meson build files 
Resolves: #699

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-03-20 20:47:27 +01:00
Nikos Mavrogiannopoulos 8cdce81e6e .gitlab-ci.yml: increased job parallelization 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-01-11 09:04:18 +01:00
Nikos Mavrogiannopoulos ebea140c5f Added centos10 build in CI 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-01-11 09:04:18 +01:00
Nikos Mavrogiannopoulos 8ddc9b6abd Updated CI to fedora42 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-01-02 16:45:56 +01:00
Nikos Mavrogiannopoulos 5d75e3fd74 Removed centos7 builds (EOL) 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2026-01-02 16:45:46 +01:00
Dimitri PapadopoulosandNikos Mavrogiannopoulos 300f986a70 .gitlab-ci.yml: forget the Ubuntu 16 image 
We don't use UBUNTU_BUILD in CI any more.

Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
 2026-01-01 17:32:08 +01:00
Nikos Mavrogiannopoulos 826aa0503f Signoff rules: ignore the misformed commit 6a65e3acdd 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2025-12-21 10:31:48 +01:00
Dimitri Papadopoulos e21f08fb97 Do not apply clang-format to vendored files 
Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
 2025-04-02 09:05:42 +02:00
Nikos Mavrogiannopoulos c2ddad4280 .gitlab-ci.yml: use fedora 41 images 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2024-12-01 17:40:05 +01:00
Nikos Mavrogiannopoulos 528ae633f3 Added check for coding style using clang-format 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2024-12-01 17:03:04 +01:00
Nikos Mavrogiannopoulos db053d084d .gitlab-ci.yml: use saas-linux-small-amd64 tag 
The linux and shared tags were deprecated:
https://docs.gitlab.com/ee/update/deprecations.html?removal_milestone=17.0#removal-of-tags-from-small-saas-runners-on-linux

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2024-05-10 20:32:23 +02:00
Nikos Mavrogiannopoulos cf56c9754b Switch from http-parser to llhttp 
http-parser is an unmaintained library that has been replaced by llhttp.

Resolves: #598

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2024-04-28 13:37:19 +02:00
Nikos Mavrogiannopoulos dd6778bf60 .gitlab-ci.yml: use CI_PROJECT_ID for triage 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2024-01-16 06:06:05 +01:00
Nikos Mavrogiannopoulos 5756c06d81 .gitlab-ci.yml: removed the cppcheck checks 
They were causing more troubles than they were detecting actual
issues.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2024-01-05 22:09:11 +01:00
Nikos Mavrogiannopoulos 20310ec202 .gitlab-ci.yml: corrected latest fedora release 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-11-22 21:06:42 +01:00
Nikos Mavrogiannopoulos 09779ea55b .gitlab-ci.yml: use latest fedora 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-11-21 15:31:22 +01:00
Nikos Mavrogiannopoulos 02442aabbc Replaced nuttcp tests with iperf3 
iperf3 is consistently included in all distributions we
are testing at, in contrast with nuttcp.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-07-27 15:50:33 +02:00
Nikos Mavrogiannopoulos 78e25f4ff6 .gitlab-ci.yml: introduced a signoff check 
This also moves any static analyzers checks early in the testing
phases ti catch basic errors faster.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-07-13 02:05:55 +02:00
Nikos Mavrogiannopoulos 9bd97bde91 .gitlab-ci.yml: added ubuntu22.04 
There is an issue with gssapi on this version of Ubuntu. While
the package exists, it doesn't work as openssl doesn't support
md4. See https://bugs.launchpad.net/ubuntu/+source/gss-ntlmssp/+bug/1995915

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-07-11 14:47:32 +02:00
Nikos Mavrogiannopoulos 5841da06b6 .gitlab-ci.yml: static-analyzer: enable optional code 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-07-07 12:05:58 +02:00
Nikos Mavrogiannopoulos b0c45ffc50 .gitlab-ci.yml: use the new centos images 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-06-26 13:31:19 +02:00
Nikos Mavrogiannopoulos 0fac0efc14 .gitlab-ci.yml: added almalinux9 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-06-13 16:51:38 +02:00
Nikos Mavrogiannopoulos 39e6eb7d2c .gitlab-ci.yml: added almalinux8 build 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-06-13 16:51:38 +02:00
Nikos Mavrogiannopoulos cb48bc8f7f .gitlab-ci.yml: use fedora38 image 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-06-13 16:51:38 +02:00
Nikos Mavrogiannopoulos a7c3c4f1bc Regenerated expired certificates and updated scripts for new ones 
Also added rules and templates to regenerate certificates when
needed.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-06-02 06:15:45 +02:00
Nikos Mavrogiannopoulos d98a06e143 Fixed operation of make distcheck 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-05-08 09:43:16 +02:00
Nikos Mavrogiannopoulos 3610b9f4f8 .gitlab-ci.yml: moved distcheck to noprocfs 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-05-07 14:40:50 +02:00
Nikos Mavrogiannopoulos fb31fb4740 .gitlab-ci.yml: test distcheck not just dist 
This will detect issues that show up on release time.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2023-05-07 14:25:48 +02:00
Nikos Mavrogiannopoulos e7a9529051 improved code coverage identification 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2022-12-02 19:59:52 +01:00
Dimitri Papadopoulos c009134915 Add codespell CI runner 
Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
 2021-12-23 10:04:30 +01:00
Nikos Mavrogiannopoulos cffd7d23b3 fedora: updated to 35 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2021-12-22 19:38:16 +01:00
Nikos Mavrogiannopoulos ceebc11cc4 tests: check functionality of an IPv6 net with prefix 127 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
 2021-10-31 22:26:16 +01:00