v0.34.16

src/config/compile.rs

@@ -208,9 +208,10 @@ pub fn compile_with_active(
             <= MAX_ROUTES,
         "too many rules across all redirect hosts (max 256)"
     );
+    let config_bytes = serde_json::to_vec(&config)?.len();
     ensure!(
-        serde_json::to_vec(&config)?.len() <= MAX_CONFIG_BYTES,
-        "configuration too large"
+        config_bytes <= MAX_CONFIG_BYTES,
+        "configuration too large ({config_bytes} bytes, maximum {MAX_CONFIG_BYTES} bytes)"
     );
     let listeners = crate::vhost::listener_plan(&config, &desired_policy)?;
     crate::stream::validate(

src/config/model.rs

@@ -13,7 +13,7 @@ use std::{
 };
 use url::{Host, Url};
 
-pub const MAX_CONFIG_BYTES: usize = 262_144;
+pub const MAX_CONFIG_BYTES: usize = 2_097_152;
 pub const MAX_BACKENDS: usize = 128;
 pub const MAX_ROUTES: usize = 256;
 

src/config/tests.rs

@@ -9,6 +9,42 @@ mod tests {
             admin_addr: "127.0.0.1:9090".parse().unwrap(),
         }
     }
+    fn config_with_large_responses(count: usize) -> Config {
+        let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
+        config.vhosts[0].routes = (0..count)
+            .map(|index| crate::vhost::PathRoute {
+                id: format!("large-{index}"),
+                path_prefix: format!("/large-{index}"),
+                response: Some(crate::vhost::LocationResponse {
+                    body: "x".repeat(60_000),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            })
+            .collect();
+        config
+    }
+
+    #[test]
+    fn configuration_above_legacy_limit_compiles() {
+        let config = config_with_large_responses(5);
+        let bytes = serde_json::to_vec(&config).unwrap().len();
+        assert!(bytes > 262_144);
+        assert!(bytes <= MAX_CONFIG_BYTES);
+        assert!(compile(config, 1, &policy()).is_ok());
+    }
+
+    #[test]
+    fn configuration_above_new_limit_is_rejected() {
+        let config = config_with_large_responses(36);
+        assert!(serde_json::to_vec(&config).unwrap().len() > MAX_CONFIG_BYTES);
+        let error = match compile(config, 1, &policy()) {
+            Ok(_) => panic!("oversized configuration should be rejected"),
+            Err(error) => error,
+        };
+        assert!(error.to_string().contains("configuration too large"));
+    }
+
     #[test]
     fn route_handles_reuse_snapshot_ownership_without_cloning_compiled_routes() {
         let snapshot =
@@ -80,17 +116,14 @@ mod tests {
             method: crate::auth_provider::IntegrationMethod::Oidc,
         });
         host.oidc.enabled = true;
-        host.oidc.issuer_url = "https://auth.test.com".into();
+        host.oidc.issuer_url = "https://auth.gruszczynski.cc".into();
         host.oidc.client_id = "app".into();
         host.oidc.client_secret = "client-secret".into();
         host.oidc.session_secret = "a-unique-testing-session-secret-32-bytes".into();
         host.oidc.redirect_url = "https://localhost/_rustproxy/oidc/callback".into();
         assert!(host.validate().is_ok());
         let encoded = serde_json::to_value(&host).unwrap();
-        assert_eq!(
-            encoded["authentication"],
-            serde_json::json!({"provider":"authelia","method":"oidc"})
-        );
+        assert_eq!(encoded["authentication"], serde_json::json!({"provider":"authelia","method":"oidc"}));
         let restored: crate::vhost::Vhost = serde_json::from_value(encoded.clone()).unwrap();
         assert_eq!(restored.authentication, host.authentication);
         assert!(restored.validate().is_ok());