Adam Ierymenko
|
10185e92fa
|
Certificate of ownership -- used to secure against IP address spoofing, especially for IPv4 and regular IPv6.
|
9 years ago |
|
Adam Ierymenko
|
af4e79735c
|
Fix "orbit" semantics. Federation works.
|
9 years ago |
|
Adam Ierymenko
|
969e09210d
|
Fix loading of existing moons.
|
9 years ago |
|
Adam Ierymenko
|
e4b6611201
|
Only accept world updates from upstreams.
|
9 years ago |
|
Adam Ierymenko
|
42f28bce52
|
Cleanup and make moons (federated roots) a little easier to deal with.
|
9 years ago |
|
Adam Ierymenko
|
cdc289fa9c
|
Tags work.
|
9 years ago |
|
Adam Ierymenko
|
435e4c4695
|
Fix HELLO parse bug.
|
9 years ago |
|
Adam Ierymenko
|
f85a630a64
|
Docs and a small build fix in debug mode.
|
9 years ago |
|
Adam Ierymenko
|
43182f8f57
|
Docs, code cleanup, and protect the extra new fields of HELLO with encryption as a precaution.
|
9 years ago |
|
Adam Ierymenko
|
3587aa1ea7
|
Add and send certificates of representation to tell people what our valid upstreams are. These are not used yet but will be needed for future privacy modes, etc. Also some cleanup.
|
9 years ago |
|
Adam Ierymenko
|
beb642faa5
|
Stub out CAN_REACH.
|
9 years ago |
|
Adam Ierymenko
|
ed31cb76d6
|
Fix to cluster network configs.
|
9 years ago |
|
Adam Ierymenko
|
eebd271bb1
|
Implement cross cluster sharing of network configs to make clusters able to actually join networks.
|
9 years ago |
|
Adam Ierymenko
|
1d775af34a
|
Fix moon persistence.
|
9 years ago |
|
Adam Ierymenko
|
9f7919f71f
|
Add comments to join ("orbit") moons.
|
9 years ago |
|
Adam Ierymenko
|
bc218f9414
|
little fix
|
9 years ago |
|
Adam Ierymenko
|
f102fd7f92
|
Extend in-band world updates to handle moons too.
|
9 years ago |
|
Adam Ierymenko
|
64774d0d4f
|
Replace piecemeal designation of upstreams with the concept of moons, which is simpler and easier to use and inherits all the cool live update stuff of worlds (now called planets) and global roots.
|
9 years ago |
|
Adam Ierymenko
|
d5528e4e9a
|
Wire up VERB_USER_MESSAGE in core.
|
9 years ago |
|
Adam Ierymenko
|
42ba70e79e
|
Replace long callback arg list with struct, and implement path whitelisting, path blacklisting, and local.conf support for roles.
|
9 years ago |
|
Adam Ierymenko
|
2ea9f516e1
|
Rate gate expensive validation of new identities in HELLO.
|
9 years ago |
|
Adam Ierymenko
|
ab4021dd0e
|
Do packet MAC check before locallyValidate(), and add timing measurement in selftest.
|
9 years ago |
|
Adam Ierymenko
|
bf8d71e82c
|
Add notion of upstream that is separate from root in Topology, etc.
|
9 years ago |
|
Adam Ierymenko
|
226123ca08
|
Refactor controller to permit sending of pushes as well as just replies to config requests.
|
9 years ago |
|
Adam Ierymenko
|
93b4ac5cb2
|
Remove unused POW code, will revisit later.
|
10 years ago |
|
Adam Ierymenko
|
7e90ab3534
|
TRACE verbosity increase on exceptions in NETWORK_CREDENTIALS.
|
10 years ago |
|
Adam Ierymenko
|
5ee1ccd659
|
Send need credential error on more cases.
|
10 years ago |
|
Adam Ierymenko
|
0b44919ba2
|
Clusters can send multiple OKs so we must allow this.
|
10 years ago |
|
Adam Ierymenko
|
9f550292fe
|
Simply network auth logic and always sent error on auth failure even for unknown networks to prevent forensics.
|
10 years ago |
|
Adam Ierymenko
|
cc4bacc199
|
Cleanup, and implement compression disable flag for networks.
|
10 years ago |
|
Adam Ierymenko
|
15c07c58b6
|
Refactored network config chunking to sign every chunk to prevent stupid DOS attack potential, and implement network config fast propagate (though we probably will not use this for a bit).
|
10 years ago |
|
Adam Ierymenko
|
7e4b6b594b
|
It now builds.
|
10 years ago |
|
Adam Ierymenko
|
eac3667ec1
|
Bunch more refactoring and work on revocations, etc.
|
10 years ago |
|
Adam Ierymenko
|
1f74dd4589
|
Revocation work in progress, add WATCH which is TEE with implicit rate sync (thanks JG@DCVC!), and clean up some cruft in Network.
|
10 years ago |
|
Adam Ierymenko
|
d3524f3609
|
Refactor COM stuff a bit, and respond to COM requests a bit more readily for rapid setup. Will need to revisit later.
|
10 years ago |
|
Adam Ierymenko
|
5b6d27e659
|
Implement relay policy, and setting multicast limit to 0 now disables multicast on the network as would be expected.
|
10 years ago |
|
Adam Ierymenko
|
8ef0e4bbaf
|
Get rid of HELLO rate gate on path since its basically worthless. There are 65535 ports per IP.
|
10 years ago |
|
Adam Ierymenko
|
0da9a9a3e0
|
Set trustEstablished in a few more places.
|
10 years ago |
|
Adam Ierymenko
|
cba37c6107
|
Add a few more rate limit gates for anti-DOS hardening.
|
10 years ago |
|
Adam Ierymenko
|
ea1da3321a
|
Rate gate requests for COM.
|
10 years ago |
|
Adam Ierymenko
|
debc4c45ee
|
Set trust established flag in MULTICAST_GATHER.
|
10 years ago |
|
Adam Ierymenko
|
ab9afbc749
|
(1) Public networks now get COMs even though they do not gate with them since they will need them to push auth for multicast stuff, (2) added a bunch of rate limit circuit breakers for anti-DOS, (3) cleanup.
|
10 years ago |
|
Adam Ierymenko
|
ef87069957
|
Fix gating of multicast GATHER replies since these can come from upstream, etc., and fix an issue with sending ECHO to recheck marginal paths.
|
10 years ago |
|
Adam Ierymenko
|
0d4109a9f1
|
More refactoring to clean up code, and add a gate function to make sure we do not handle OK packets we did not expect. This hardens up a few potential edge cases around security, since such messages might be used to e.g. pollute a cache and DOS under certain conditions.
|
10 years ago |
|
Adam Ierymenko
|
16df2c3363
|
Clean up handling of COMs, network access control, and fix a backward compatiblity issue.
|
10 years ago |
|
Adam Ierymenko
|
c7a4da3dd3
|
Turns out we do not need to pass network to receive().
|
10 years ago |
|
Adam Ierymenko
|
1908aa55f5
|
Refactor MULTICAST_LIKE pushing to eliminate redundant and unnecessary pushes and simplify code.
|
10 years ago |
|
Adam Ierymenko
|
a7d988745b
|
Use ECHO instead of HELLO where possible.
|
10 years ago |
|
Adam Ierymenko
|
b5c86b6ba4
|
Bunch more path refactoring. Peers no longer forget paths, but do not normally use expired paths. Expired paths might still be tried if nothing else is reachable.
|
10 years ago |
|
Adam Ierymenko
|
48a374c82c
|
(1) fix crazy bug introduced in doRENDEZVOUS(), (2) reclaim Paths after paths[] condense, (3) fix an edge case around symmetric NAT and external IP change detection.
|
10 years ago |
