mirror of
https://gitlab.com/openconnect/ocserv.git
synced 2026-08-08 09:21:48 +08:00
Nikos Mavrogiannopoulos
22bbad4eb5
Introduce a per-worker heap cap as defense-in-depth against memory-exhaustion DoS attacks. The limit uses RLIMIT_DATA rather than RLIMIT_AS: since Linux 4.7 RLIMIT_DATA covers brk and private anonymous mmap regions, i.e, the paths used by malloc and talloc, while ignoring shared-library file mappings that inflate RLIMIT_AS without reflecting actual allocation. This aligns with haproxy's handling. See also: https://github.com/torvalds/linux/commit/84638335900f1995495838fe1bd4870c43ec1f67 https://sources.debian.org/src/haproxy/3.2.17-1/src/limits.c?hl=486#L486 https://www.kernel.org/doc/html/latest/mm/overcommit-accounting.html The cap is computed at worker startup by reading the data+stack field from /proc/self/statm. Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
31 lines
3.5 KiB
Meson
31 lines
3.5 KiB
Meson
option('pam', type: 'feature', value: 'auto', description: 'PAM authentication support')
|
|
option('radius', type: 'feature', value: 'auto', description: 'RADIUS authentication/accounting support')
|
|
option('gssapi', type: 'feature', value: 'auto', description: 'GSSAPI/Kerberos authentication support')
|
|
option('liboath', type: 'feature', value: 'auto', description: 'OTP support via liboath')
|
|
option('libnl', type: 'feature', value: 'auto', description: 'libnl3 support in occtl')
|
|
option('maxmind', type: 'feature', value: 'auto', description: 'GeoIP support via libmaxminddb')
|
|
option('geoip', type: 'feature', value: 'auto', description: 'GeoIP support via libgeoip (fallback when maxmind absent)')
|
|
option('lz4', type: 'feature', value: 'auto', description: 'LZ4 compression support')
|
|
option('compression', type: 'feature', value: 'enabled', description: 'Compression support (LZS + optional LZ4)')
|
|
option('seccomp', type: 'feature', value: 'auto', description: 'seccomp worker isolation')
|
|
option('systemd', type: 'feature', value: 'auto', description: 'systemd socket-activation support')
|
|
option('oidc-auth', type: 'feature', value: 'disabled', description: 'OpenID Connect authentication support')
|
|
option('latency-stats', type: 'feature', value: 'disabled', description: 'Capture latency statistics')
|
|
option('anyconnect-compat', type: 'feature', value: 'enabled', description: 'Cisco AnyConnect client compatibility')
|
|
option('namespaces', type: 'feature', value: 'enabled', description: 'Linux network namespace support')
|
|
option('utmp', type: 'feature', value: 'auto', description: 'utmp support via libutil')
|
|
option('libwrap', type: 'feature', value: 'auto', description: 'TCP wrappers support via libwrap')
|
|
option('sock-diag', type: 'feature', value: 'auto', description: 'Use the sock_diag netlink subsystem for adaptive rate limiting')
|
|
option('local-talloc', type: 'boolean', value: false, description: 'Force use of bundled talloc')
|
|
option('local-llhttp', type: 'boolean', value: true, description: 'Use bundled llhttp (default); false to require system llhttp')
|
|
option('local-protobuf', type: 'boolean', value: false, description: 'Force use of bundled protobuf-c')
|
|
option('local-pcl', type: 'boolean', value: true, description: 'Use bundled PCL (default); false to require system pcl')
|
|
option('seccomp-trap', type: 'boolean', value: false, description: 'Filtered syscalls fail with a signal (for CI/testing)')
|
|
option('worker-memory-limit-test', type: 'boolean', value: false, description: 'RLIMIT_DATA failures in worker are fatal (for CI/testing)')
|
|
option('root-tests', type: 'boolean', value: true, description: 'Enable tests requiring root/namespaces')
|
|
option('tun-tests', type: 'boolean', value: true, description: 'Enable tests requiring /dev/net/tun')
|
|
option('kerberos-tests', type: 'boolean', value: false, description: 'Enable tests requiring a Kerberos setup')
|
|
option('with-werror', type: 'boolean', value: false, description: 'Treat compiler warnings as errors')
|
|
option('pager', type: 'string', value: 'less', description: 'Default pager for occtl (empty string for none)')
|
|
option('firewall-script', type: 'combo', choices: ['auto', 'nftables', 'iptables'], value: 'nftables', description: 'Firewall script backend (nftables by default; auto is an alias for nftables)')
|