Nikos Mavrogiannopoulos
b23c939d29
contrib: added protocols for requirements management
...
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com >
2026-06-06 12:16:11 +02:00
Nikos Mavrogiannopoulos
22bbad4eb5
worker: add per-worker memory limit via RLIMIT_DATA
...
Introduce a per-worker heap cap as defense-in-depth against
memory-exhaustion DoS attacks. The limit uses RLIMIT_DATA rather
than RLIMIT_AS: since Linux 4.7 RLIMIT_DATA covers brk and private
anonymous mmap regions, i.e, the paths used by malloc and talloc, while
ignoring shared-library file mappings that inflate RLIMIT_AS without
reflecting actual allocation.
This aligns with haproxy's handling. See also:
https://github.com/torvalds/linux/commit/84638335900f1995495838fe1bd4870c43ec1f67
https://sources.debian.org/src/haproxy/3.2.17-1/src/limits.c?hl=486#L486
https://www.kernel.org/doc/html/latest/mm/overcommit-accounting.html
The cap is computed at worker startup by reading the data+stack field
from /proc/self/statm.
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com >
2026-05-06 13:54:40 +02:00
Nikos Mavrogiannopoulos
dda2015aa4
meson: nftables is preferred unless iptables is explicitly requested
...
Relates: #709
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com >
2026-05-01 22:17:04 +02:00
Dimitri Papadopoulos
99650ec7cb
Add check to disable adaptive rate limiting
...
Disable when targeting Linux kernels that do not support Unix socket
monitoring (UNIX_DIAG), like the default OpenWrt kernel.
This will avoid flooding the log with this error message:
NLM query failed
Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com >
2026-04-17 21:58:37 +02:00
Nikos Mavrogiannopoulos
598bcf405e
Added ocserv-fw for nftables
...
This also introduces a basic functional test for ocserv-fw.
Resolves : #397
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com >
2026-03-29 16:55:12 +02:00
Nikos Mavrogiannopoulos
18401eb298
Replaced autoconf with meson build files
...
Resolves : #699
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com >
2026-03-20 20:47:27 +01:00
Nikos Mavrogiannopoulos