Commit Graph
15 Commits
Author SHA1 Message Date
Nikos Mavrogiannopoulos 2be9af605b tlslib: simplified by requiring gnutls 3.3.5
This removes the (unconditional) ZERO_COPY conditional.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-05-30 22:49:07 +02:00
Dimitri Papadopoulos d91ace7c1d Always use the bundled PCL library
Linux distributions have stopped shipping the Portable Coroutine Library.
There always used the vendored code.

Fixes #663.

Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
2026-05-23 17:43:36 +02:00
Dimitri Papadopoulos c30bd5dca4 Address build warning
[libprotobuf WARNING protoc-gen-c/main.cc:44] `protoc-c` is deprecated. Please use `protoc` instead!

Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
2026-05-09 10:16:00 +02:00
Nikos Mavrogiannopoulos 22bbad4eb5 worker: add per-worker memory limit via RLIMIT_DATA
Introduce a per-worker heap cap as defense-in-depth against
memory-exhaustion DoS attacks. The limit uses RLIMIT_DATA rather
than RLIMIT_AS: since Linux 4.7 RLIMIT_DATA covers brk and private
anonymous mmap regions, i.e, the paths used by malloc and talloc, while
ignoring shared-library file mappings that inflate RLIMIT_AS without
reflecting actual allocation.

This aligns with haproxy's handling. See also:
https://github.com/torvalds/linux/commit/84638335900f1995495838fe1bd4870c43ec1f67
https://sources.debian.org/src/haproxy/3.2.17-1/src/limits.c?hl=486#L486
https://www.kernel.org/doc/html/latest/mm/overcommit-accounting.html

The cap is computed at worker startup by reading the data+stack field
from /proc/self/statm.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-05-06 13:54:40 +02:00
Nikos Mavrogiannopoulos 9c44e09356 ocserv-fw-nftables: replace ipcalc with pure-shell mask_to_prefix
ipcalc was used only to convert dotted-decimal subnet masks to CIDR
prefix lengths (e.g. 255.255.0.0 -> 16), replaced with a POSIX shell
script.

Relates: #709

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-05-02 17:21:38 +02:00
Nikos Mavrogiannopoulos dda2015aa4 meson: nftables is preferred unless iptables is explicitly requested
Relates: #709

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-05-01 22:17:04 +02:00
Nikos Mavrogiannopoulos a65f2c22a2 protobuf source files are generated during release
Protobuf files are removed from the repository and are only
auto-generated during dist.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-04-23 19:21:27 +02:00
Dimitri Papadopoulos 99650ec7cb Add check to disable adaptive rate limiting
Disable when targeting Linux kernels that do not support Unix socket
monitoring (UNIX_DIAG), like the default OpenWrt kernel.

This will avoid flooding the log with this error message:
	NLM query failed

Signed-off-by: Dimitri Papadopoulos <3350651-DimitriPapadopoulos@users.noreply.gitlab.com>
2026-04-17 21:58:37 +02:00
Nikos Mavrogiannopoulos da90b76b07 bumped versions
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-04-17 00:08:27 +02:00
Nikos Mavrogiannopoulos 2e81af318e strsep: removed conditional code for strsep
strsep() was used conditionally in plain authentication with fallback
code, whereas radius code used it unconditionally. Rely on strsep()
unconditionally to simplify the code.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-04-06 21:02:06 +02:00
Nikos Mavrogiannopoulos 598bcf405e Added ocserv-fw for nftables
This also introduces a basic functional test for ocserv-fw.

Resolves: #397

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-03-29 16:55:12 +02:00
Nikos Mavrogiannopoulos efa28e1492 worker: flush coverage data on exit
Add a worker_exit() wrapper that calls __gcov_exit() before _exit()
when built with coverage instrumentation (-Db_coverage=true -> WITH_COVERAGE).
As atexit() handlers from libgcov are not triggered by SIGTERM, it caused
caused all worker-side coverage data to be silently lost.

umask(022) is set before __gcov_exit() so the .gcda files
are written with 0644 permissions and are readable by lcov.

This restores coverage for code paths that run exclusively in the
worker, such as lzs_compress(), lz4_compress().

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-03-22 21:16:57 +01:00
Nikos Mavrogiannopoulos a7df5240f1 http-heads: generate as C file to avoid issue with coverage
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos df6cfdd64e tests: radius: auto-generate the freeradius config directory
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-03-20 20:47:35 +01:00
Nikos Mavrogiannopoulos 18401eb298 Replaced autoconf with meson build files
Resolves: #699

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
2026-03-20 20:47:27 +01:00