Adam Ierymenko
|
10185e92fa
|
Certificate of ownership -- used to secure against IP address spoofing, especially for IPv4 and regular IPv6.
|
9 years ago |
|
Adam Ierymenko
|
b679ebde3b
|
Ad-hoc networks, a cool and easy to implement little feature that allows controllerless networks. These only allow IPv6 6plane, no multicast, and the network ID encodes the allowed port range.
|
9 years ago |
|
Adam Ierymenko
|
4b11566505
|
Integrate moon concept into http config bus, and clean up that code quite a bit.
|
9 years ago |
|
Adam Ierymenko
|
42f28bce52
|
Cleanup and make moons (federated roots) a little easier to deal with.
|
9 years ago |
|
Adam Ierymenko
|
672f17c6e9
|
Add a mask and value range to the IP tos rule field. This allows TOS to be matched more usefully. This will break anyone using tos in the beta, but nobody seems to be and its pre-release so now is the time.
|
9 years ago |
|
Adam Ierymenko
|
9ddc2a4331
|
Add a break action to rules engine to make capabilities easier to use.
|
9 years ago |
|
Adam Ierymenko
|
9f7919f71f
|
Add comments to join ("orbit") moons.
|
9 years ago |
|
Adam Ierymenko
|
0b3b994241
|
Relay policy can now be computed.
|
9 years ago |
|
Adam Ierymenko
|
64774d0d4f
|
Replace piecemeal designation of upstreams with the concept of moons, which is simpler and easier to use and inherits all the cool live update stuff of worlds (now called planets) and global roots.
|
9 years ago |
|
Adam Ierymenko
|
d5528e4e9a
|
Wire up VERB_USER_MESSAGE in core.
|
9 years ago |
Grant Limberg
|
c6c578ce1d
|
Fixes to allow usage of ZeroTierOne.h with a C compiler
|
9 years ago |
|
Adam Ierymenko
|
42ba70e79e
|
Replace long callback arg list with struct, and implement path whitelisting, path blacklisting, and local.conf support for roles.
|
9 years ago |
|
Adam Ierymenko
|
97d915b06c
|
Expose relay policy in node settings.
|
9 years ago |
|
Adam Ierymenko
|
673c0c811e
|
Wire through upstream stuff and add setRole().
|
9 years ago |
|
Adam Ierymenko
|
c61ca1dea2
|
Keep connections up for netconf stuff as well as frames.
|
9 years ago |
|
Adam Ierymenko
|
e53f63ca87
|
Broke down and added an OR to the rules engine. It is now possible to have a series of MATCHes that are ORed.
|
10 years ago |
|
Adam Ierymenko
|
45c4ccb153
|
Add a tags both equal match.
|
10 years ago |
|
Adam Ierymenko
|
adeb7e7da0
|
Make capability flags match more user-friendly and appropriate since "match any flag" is generally what we want.
|
10 years ago |
|
Adam Ierymenko
|
988049f39b
|
Add new rule to rules engine: random match.
|
10 years ago |
|
Adam Ierymenko
|
7e4b6b594b
|
It now builds.
|
10 years ago |
|
Adam Ierymenko
|
eac3667ec1
|
Bunch more refactoring and work on revocations, etc.
|
10 years ago |
|
Adam Ierymenko
|
1f74dd4589
|
Revocation work in progress, add WATCH which is TEE with implicit rate sync (thanks JG@DCVC!), and clean up some cruft in Network.
|
10 years ago |
|
Adam Ierymenko
|
15402933bc
|
Add physical MTU recommendation hint to network config via API.
|
10 years ago |
|
Adam Ierymenko
|
5b6d27e659
|
Implement relay policy, and setting multicast limit to 0 now disables multicast on the network as would be expected.
|
10 years ago |
|
Adam Ierymenko
|
0d4109a9f1
|
More refactoring to clean up code, and add a gate function to make sure we do not handle OK packets we did not expect. This hardens up a few potential edge cases around security, since such messages might be used to e.g. pollute a cache and DOS under certain conditions.
|
10 years ago |
|
Adam Ierymenko
|
b5c86b6ba4
|
Bunch more path refactoring. Peers no longer forget paths, but do not normally use expired paths. Expired paths might still be tried if nothing else is reachable.
|
10 years ago |
|
Adam Ierymenko
|
eebcf08084
|
Tweaks to new Path code for dual-stack operation, and other fixes.
|
10 years ago |
|
Adam Ierymenko
|
8b6d23b9f6
|
Optimize filter code a bit, and add a network-level setting for what should happen if an unsupported or unknown MATCH is encountered in a rules table.
|
10 years ago |
|
Adam Ierymenko
|
54489a7f61
|
rename SAMENESS to DIFFERENCE which is less confusing
|
10 years ago |
|
Adam Ierymenko
|
8e3004591b
|
Add overlooked MATCH_ICMP to rule set.
|
10 years ago |
|
Adam Ierymenko
|
ded5a53a6c
|
Documentation updates, add rules engine revision to network config request meta-data.
|
10 years ago |
|
Adam Ierymenko
|
d637988ccf
|
Fix chicken or egg problem in tags, and better filter debug instrumentation.
|
10 years ago |
|
Adam Ierymenko
|
5eaf397a94
|
Add a debug log feature in the filter, which only works if enabled in Network.cpp.
|
10 years ago |
|
Adam Ierymenko
|
95ff057e04
|
Increase rule limits a little since chunking in netconf can accomodate this.
|
10 years ago |
|
Adam Ierymenko
|
2cdda38dc4
|
It basically works... at least on current controllers.
|
10 years ago |
|
Adam Ierymenko
|
ccea3d04d6
|
Push NETWORK_CONFIG_REFRESH on POSTs to /member/... in controller.
|
10 years ago |
|
Adam Ierymenko
|
8e3463d47a
|
Add length limit to TEE and REDIRECT, and completely factor out old C json-parser to eliminate a dependency.
|
10 years ago |
|
Adam Ierymenko
|
e2f783ebbd
|
.
|
10 years ago |
|
Adam Ierymenko
|
4d9b74b171
|
.
|
10 years ago |
|
Adam Ierymenko
|
98152d974a
|
More cleanup and removal of DeferredPackets, will do the latter in a more elegant way.
|
10 years ago |
|
Adam Ierymenko
|
7e6e56e2bc
|
Bunch of work on pushing and replication of tags and capabilities, and protocol cleanup.
|
10 years ago |
|
Adam Ierymenko
|
67cb03742e
|
Add tag rules and split out rule serialize/deserialize so the code can be reused.
|
10 years ago |
|
Adam Ierymenko
|
ecc1324bb0
|
Rules engine work: capability based security model with tags and capabilities, and some cleanup across other places.
|
10 years ago |
|
Adam Ierymenko
|
d3b0081447
|
Cleanup...
|
10 years ago |
|
Adam Ierymenko
|
22e44c762b
|
More rules engine work: key/value pair matching for microsegmentation.
|
10 years ago |
|
Adam Ierymenko
|
eaf6d6c938
|
Basic L2/L3 filter for rules engine (not integrated yet) and some cleanup.
|
10 years ago |
|
Adam Ierymenko
|
9657675755
|
Plumbing through trusted path stuff to OneService.
|
10 years ago |
|
Adam Ierymenko
|
765082fdb6
|
Trusted path support, and version bump to 1.1.9
|
10 years ago |
|
Adam Ierymenko
|
330c80f3f5
|
Add rule type to match a COM field of the peer by ID and value because this will be powerful.
|
10 years ago |
|
Adam Ierymenko
|
e09c1a1c11
|
Big refactor mostly builds. We now have a uniform backward compatible netconf.
|
10 years ago |
