Adam Ierymenko
|
83abc00aae
|
docs
|
10 years ago |
|
Adam Ierymenko
|
5b6d27e659
|
Implement relay policy, and setting multicast limit to 0 now disables multicast on the network as would be expected.
|
10 years ago |
|
Adam Ierymenko
|
8ef0e4bbaf
|
Get rid of HELLO rate gate on path since its basically worthless. There are 65535 ports per IP.
|
10 years ago |
|
Adam Ierymenko
|
0da9a9a3e0
|
Set trustEstablished in a few more places.
|
10 years ago |
|
Adam Ierymenko
|
cba37c6107
|
Add a few more rate limit gates for anti-DOS hardening.
|
10 years ago |
|
Adam Ierymenko
|
ea1da3321a
|
Rate gate requests for COM.
|
10 years ago |
|
Adam Ierymenko
|
debc4c45ee
|
Set trust established flag in MULTICAST_GATHER.
|
10 years ago |
|
Adam Ierymenko
|
ab9afbc749
|
(1) Public networks now get COMs even though they do not gate with them since they will need them to push auth for multicast stuff, (2) added a bunch of rate limit circuit breakers for anti-DOS, (3) cleanup.
|
10 years ago |
|
Adam Ierymenko
|
ef87069957
|
Fix gating of multicast GATHER replies since these can come from upstream, etc., and fix an issue with sending ECHO to recheck marginal paths.
|
10 years ago |
|
Adam Ierymenko
|
0d4109a9f1
|
More refactoring to clean up code, and add a gate function to make sure we do not handle OK packets we did not expect. This hardens up a few potential edge cases around security, since such messages might be used to e.g. pollute a cache and DOS under certain conditions.
|
10 years ago |
|
Adam Ierymenko
|
16df2c3363
|
Clean up handling of COMs, network access control, and fix a backward compatiblity issue.
|
10 years ago |
|
Adam Ierymenko
|
1f6b13b7fd
|
Fix bug causing null addresses to get in memberships[] hash.
|
10 years ago |
|
Adam Ierymenko
|
daf8a66ced
|
More correct and efficient to initialize member relationship push stuff lazily when member is learned.
|
10 years ago |
|
Adam Ierymenko
|
20278bb9e4
|
Also send MULTICAST_LIKEs to controllers.
|
10 years ago |
|
Adam Ierymenko
|
c7a4da3dd3
|
Turns out we do not need to pass network to receive().
|
10 years ago |
|
Adam Ierymenko
|
1908aa55f5
|
Refactor MULTICAST_LIKE pushing to eliminate redundant and unnecessary pushes and simplify code.
|
10 years ago |
|
Adam Ierymenko
|
1c08f5e857
|
Tweak some expire times.
|
10 years ago |
|
Adam Ierymenko
|
c9ee8612e4
|
Credential TTL (tags/capabilities) should be credential time max delta, since we could get pushed one that is newer.
|
10 years ago |
|
Adam Ierymenko
|
a7d988745b
|
Use ECHO instead of HELLO where possible.
|
10 years ago |
|
Adam Ierymenko
|
ff9f8b1c2b
|
Typo fix.
|
10 years ago |
|
Adam Ierymenko
|
b5c86b6ba4
|
Bunch more path refactoring. Peers no longer forget paths, but do not normally use expired paths. Expired paths might still be tried if nothing else is reachable.
|
10 years ago |
|
Adam Ierymenko
|
f2d2df2b11
|
Cluster build fix.
|
10 years ago |
|
Adam Ierymenko
|
48a374c82c
|
(1) fix crazy bug introduced in doRENDEZVOUS(), (2) reclaim Paths after paths[] condense, (3) fix an edge case around symmetric NAT and external IP change detection.
|
10 years ago |
|
Adam Ierymenko
|
8a2e8bd585
|
Rework how paths are set as remote cluster preferred. The code is now clearer and cluster preference indications are now very sticky as they should be.
|
10 years ago |
|
Adam Ierymenko
|
43780742b0
|
comments, docs
|
10 years ago |
|
Adam Ierymenko
|
d7f2287ce9
|
More tweaks to path behavior.
|
10 years ago |
|
Adam Ierymenko
|
eebcf08084
|
Tweaks to new Path code for dual-stack operation, and other fixes.
|
10 years ago |
|
Adam Ierymenko
|
01aa469591
|
Remove debug line.
|
10 years ago |
|
Adam Ierymenko
|
4992ac2d9f
|
Cluster sub-optimal is in fact necessary...
|
10 years ago |
|
Adam Ierymenko
|
412979ba8f
|
Attempt to reactivate dead paths.
|
10 years ago |
|
Adam Ierymenko
|
4f8253dcdb
|
Tweaks to path handling...
|
10 years ago |
|
Adam Ierymenko
|
4931e44998
|
Implement "weak pointer" behavior on Topology Path canonicalization hash table.
|
10 years ago |
|
Adam Ierymenko
|
d1101441b3
|
Tweak some timings.
|
10 years ago |
|
Adam Ierymenko
|
e8f6b4b5d3
|
Rest of big Path canonicalization refactor.
|
10 years ago |
|
Adam Ierymenko
|
a3bdae9735
|
Work in progress: Path canonicalization refactor.
|
10 years ago |
|
Adam Ierymenko
|
d5e6f59004
|
.
|
10 years ago |
|
Adam Ierymenko
|
22271f2a49
|
Cleanup.
|
10 years ago |
|
Adam Ierymenko
|
8b6d23b9f6
|
Optimize filter code a bit, and add a network-level setting for what should happen if an unsupported or unknown MATCH is encountered in a rules table.
|
10 years ago |
|
Adam Ierymenko
|
25056de5d3
|
Also need to send credentials when TEEing and REDIRECTing.
|
10 years ago |
|
Adam Ierymenko
|
994b25af4e
|
Simplify some logic.
|
10 years ago |
|
Adam Ierymenko
|
74afef8eb1
|
Think through and refine a few things in rules, especially edge case TEE and REDIRECT behavior and semantics.
|
10 years ago |
|
Adam Ierymenko
|
54489a7f61
|
rename SAMENESS to DIFFERENCE which is less confusing
|
10 years ago |
|
Adam Ierymenko
|
8e3004591b
|
Add overlooked MATCH_ICMP to rule set.
|
10 years ago |
|
Adam Ierymenko
|
2ff2a8fd9a
|
Cluster build fixes and warning elimination.
|
10 years ago |
|
Adam Ierymenko
|
cb63babac4
|
Debug output fixes.
|
10 years ago |
|
Adam Ierymenko
|
ac1c127b68
|
Debug output fixes.
|
10 years ago |
|
Adam Ierymenko
|
cb82193333
|
Debug output fixes.
|
10 years ago |
|
Adam Ierymenko
|
f0636ffd4a
|
EXT_FRAME messages should always be accepted if we are the destination for a matching TEE or REDIRECT rule.
|
10 years ago |
|
Adam Ierymenko
|
51a420671f
|
Make rules engine debug a bit more verbose.
|
10 years ago |
|
Adam Ierymenko
|
7223685b96
|
.
|
10 years ago |
