Nikos Mavrogiannopoulos 4303a12f60 worker: harden HTTP request header size limits ...

Bound memory growth in the worker for unauthenticated connections by
enforcing HTTP headers limit in addition to HTTP body limit.

Resolves: #712

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

2026-05-06 13:54:21 +02:00

..

certs

tests: added test-pass-cert-rfc822name

2026-02-28 11:46:56 +01:00

data

radius-auth: fix Framed-IPv6-Prefix routes being silently dropped

2026-05-01 16:31:38 +02:00

scripts

Typos found by codespell

2021-10-09 17:57:11 +02:00

user-config

Respect tunnel-all-dns in per-user/group config

2026-04-26 21:05:06 -04:00

user-config-explicit

test-explicit-ip: corrected the illegal IP address

2021-10-31 22:26:25 +01:00

user-config-opt

Remove spaces

2022-11-28 11:22:33 +01:00

ac-aes128-gcm-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

ac-aes256-gcm-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

aes128-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

aes256-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

apple-ios

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

asan.supp

tests: skip leaks in occtl

2021-11-01 10:23:01 +01:00

ban-ips.c

Fix new Coverity Scan defect

2026-05-01 19:26:45 +00:00

bandwidth

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

banner

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

check-config-scope.py

config: extend vhost_inherit_static_config to cover vhost-scoped fields

2026-04-23 10:51:26 +02:00

cipher-common.sh

cipher-tests: skip if legacy DTLS is disabled

2026-03-29 17:32:23 +02:00

common.sh

tests: fix flaky radius tests by waiting for server readiness

2026-04-25 17:20:38 +02:00

config-auth.xml

Remove spaces

2022-11-28 11:22:33 +01:00

config-inherit.c

config: extend vhost_inherit_static_config to cover vhost-scoped fields

2026-04-23 10:51:26 +02:00

connect-ios-script

Replaced autoconf with meson build files

2026-03-20 20:47:27 +01:00

connect-script

Replaced autoconf with meson build files

2026-03-20 20:47:27 +01:00

cstp-recv.c

tests: initialize worker_st using = {0}

2026-03-29 17:32:16 +02:00

defvhost-traffic

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

disconnect-user

tests: fixed flaky condition in disconnect-user

2026-03-29 21:13:28 +02:00

disconnect-user2

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

drain-server

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

drain-server-fail

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

flowcontrol

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

fw-ocserv

tests: added tests for ocserv setting fw rules

2026-03-29 16:55:12 +02:00

fw-ocserv-ports-routes

tests: added tests for ocserv setting fw rules

2026-03-29 16:55:12 +02:00

generate_oidc_test_data.c

Main() signature compliant with C standard

2024-12-06 12:08:52 +01:00

haproxy-auth

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

haproxy-connect

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

haproxy-proxyproto

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

haproxy-proxyproto-v1

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

html-escape.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

human_addr.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

idle-timeout

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

invalid-configs

tests: replaced explicit ports with random assignment

2020-08-09 13:14:22 +02:00

ipv4-prefix.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

ipv6-iface

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

ipv6-prefix.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

ipv6-small-net

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

json

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

json-escape.c

Updated code to follow with kernel coding style

2024-12-01 17:01:05 +01:00

kerberos

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

kkdcp-parsing.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

lz4-compression

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

lzs-compression

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

meson.build

worker: harden HTTP request header size limits

2026-05-06 13:54:21 +02:00

multiple-routes

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

no-dtls-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

no-ipv6-ocv3

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

no-route-default

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

no-route-group

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

ns.sh

terminate-commands: kill stray processes and reset routes

2026-03-15 21:05:36 +01:00

oc-aes128-gcm-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

oc-aes256-gcm-cipher

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

ocpasswd-test

tests: added tests for multiple ocpasswd options

2026-04-13 22:43:52 +02:00

ping-leases

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

port-parsing.c

config: restructure per-vhost configuration for clarity and maintainability

2026-04-22 20:29:15 +02:00

proxyproto-v1.c

tests: initialize worker_st using = {0}

2026-03-29 17:32:16 +02:00

proxyproto-v2.c

worker: fix PP2_SUBTYPE_SSL_CN parsed as top-level TLV instead of sub-TLV

2026-04-16 22:46:41 +02:00

psk-negotiate

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

psk-negotiate-match

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

radius

tests: fix flaky radius tests by waiting for server readiness

2026-04-25 17:20:38 +02:00

radius-config

tests: fix flaky radius tests by waiting for server readiness

2026-04-25 17:20:38 +02:00

radius-group

tests: fix flaky radius tests by waiting for server readiness

2026-04-25 17:20:38 +02:00

radius-ipv6-prefix

radius-auth: fix Framed-IPv6-Prefix routes being silently dropped

2026-05-01 16:31:38 +02:00

radius-multi-group

tests: fix flaky radius tests by waiting for server readiness

2026-04-25 17:20:38 +02:00

radius-multi-group-comma

tests: fix flaky radius tests by waiting for server readiness

2026-04-25 17:20:38 +02:00

radius-otp

tests: fix flaky radius tests by waiting for server readiness

2026-04-25 17:20:38 +02:00

random-net2.sh

tests: auto-generate random addresses instead of hard-coding them

2023-12-29 21:18:28 +01:00

random-net.sh

tests: auto-generate random addresses instead of hard-coding them

2023-12-29 21:18:28 +01:00

resumption

tests: resumption: enhanced and avoid the use of gnutls-cli insecure option

2026-01-11 09:04:18 +01:00

server-cert-ed25519

tests: replaced explicit ports with random assignment

2020-08-09 13:14:22 +02:00

server-cert-rsa-pss

tests: replaced explicit ports with random assignment

2020-08-09 13:14:22 +02:00

session-timeout

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

sleep-connect-script

test-script-multi-user: Fix timeout: move sleep 600 inside connect branch

2026-03-20 20:47:35 +01:00

str-test2.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

str-test.c

Updated code to follow with kernel coding style

2024-12-01 17:01:05 +01:00

terminate-commands

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-append-routes

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-ban

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-ban-local

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-camouflage

test-camouflage: improve termination of client connection

2026-03-20 20:47:35 +01:00

test-camouflage-norealm

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-cert

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-cert-opt-pass

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-cert-svc

Add support for Cisco IP-Phone Enterprise firmware VPN client.

2023-07-11 22:48:22 +12:00

test-client-bypass-protocol

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-config-per-group

tests: auto-generate random addresses instead of hard-coding them

2023-12-29 21:18:28 +01:00

test-config-per-group-url-cert

Allow selecting group by URL or profile

2024-04-23 21:35:00 +02:00

test-config-per-group-url-pass

Allow selecting group by URL or profile

2024-04-23 21:35:00 +02:00

test-cookie-invalidation

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-cookie-timeout

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-cookie-timeout-2

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-enc-key

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-explicit-ip

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-fork

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-fw-normalize-route

ocserv-fw-nftables: replace ipcalc with pure-shell mask_to_prefix

2026-05-02 17:21:38 +02:00

test-fw-script

tests: added tests for ocserv setting fw rules

2026-03-29 16:55:12 +02:00

test-get-cert

tests: replaced explicit ports with random assignment

2020-08-09 13:14:22 +02:00

test-group-cert

tests: removed legacy tests and added missing ones

2023-06-22 12:29:02 +02:00

test-group-name

tests: replaced explicit ports with random assignment

2020-08-09 13:14:22 +02:00

test-group-pass

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-gssapi

tests: replaced explicit ports with random assignment

2020-08-09 13:14:22 +02:00

test-gssapi-opt-cert

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-gssapi-opt-pass

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-http-limits

worker: harden HTTP request header size limits

2026-05-06 13:54:21 +02:00

test-ignore-querystring-of-post

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-iroute

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-maintenance

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-max-same-1

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-multi-cookie

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-multiple-client-ip

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-namespace-listen

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-no-udp

Allow using no-udp option in vhosts

2026-04-14 13:26:32 -04:00

test-occtl

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-occtl-commands

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-oidc

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-otp

tests: check that empty password with correct OTP fails when password is set

2026-04-03 13:58:18 +02:00

test-otp-cert

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-owasp-headers

Remove spaces

2022-11-28 11:22:33 +01:00

test-pam

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-pam-noauth

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-pass

tests: check for the case where a password is incorrectly entered

2026-04-03 12:29:01 +02:00

test-pass-cert

tests: check for the case where a password is incorrectly entered

2026-04-03 12:29:01 +02:00

test-pass-cert-rfc822name

tests: added test-pass-cert-rfc822name

2026-02-28 11:46:56 +01:00

test-pass-group-cert

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-pass-group-cert-no-pass

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-pass-opt-cert

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-pass-pam-acct

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-pass-script

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-pass-svc

Add support for Cisco IP-Phone Enterprise firmware VPN client.

2023-07-11 22:48:22 +12:00

test-replay

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

test-san-cert

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-script-multi-user

test-script-multi-user: simplified

2026-03-22 22:54:48 +01:00

test-sighup

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-sighup-key-change

tests: replaced explicit ports with random assignment

2020-08-09 13:14:22 +02:00

test-stress

ignore querystring while dispatching

2023-06-10 16:21:34 +08:00

test-udp-listen-host

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-user-config

Respect tunnel-all-dns in per-user/group config

2026-04-26 21:05:06 -04:00

test-vhost

tests: explicitly specify the path (srcdir vs builddir) of config files

2026-03-20 20:47:35 +01:00

test-vhost-udp-port-inheritance

Fix global option inheritance for virtual hosts

2026-04-09 20:20:45 -04:00

test-year-2038

protobuf: use 64-bit signed integers for timestamp fields

2026-04-14 13:59:05 -04:00

traffic

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00

url-escape.c

tests: replace strcpy() with strlcpy()

2026-01-07 15:46:16 -05:00

valid-hostname.c

valid_hostname: enhance to cover RFC 1123 requirements

2026-04-18 15:51:20 +02:00

vhost-traffic

tests: introduced helper to have uniform termination of client and server

2026-03-22 12:29:59 +01:00