|
|
10185e92fa
|
Certificate of ownership -- used to secure against IP address spoofing, especially for IPv4 and regular IPv6.
|
2017-02-23 11:47:36 -08:00 |
|
|
|
af4e79735c
|
Fix "orbit" semantics. Federation works.
|
2017-02-13 16:38:21 -08:00 |
|
|
|
969e09210d
|
Fix loading of existing moons.
|
2017-02-13 16:14:48 -08:00 |
|
|
|
e4b6611201
|
Only accept world updates from upstreams.
|
2017-02-13 09:46:34 -08:00 |
|
|
|
42f28bce52
|
Cleanup and make moons (federated roots) a little easier to deal with.
|
2017-02-13 09:03:48 -08:00 |
|
|
|
cdc289fa9c
|
Tags work.
|
2017-02-07 14:06:40 -08:00 |
|
|
|
435e4c4695
|
Fix HELLO parse bug.
|
2017-02-06 12:06:10 -08:00 |
|
|
|
f85a630a64
|
Docs and a small build fix in debug mode.
|
2017-02-06 07:17:45 -08:00 |
|
|
|
43182f8f57
|
Docs, code cleanup, and protect the extra new fields of HELLO with encryption as a precaution.
|
2017-02-05 16:19:03 -08:00 |
|
|
|
3587aa1ea7
|
Add and send certificates of representation to tell people what our valid upstreams are. These are not used yet but will be needed for future privacy modes, etc. Also some cleanup.
|
2017-02-04 13:17:00 -08:00 |
|
|
|
beb642faa5
|
Stub out CAN_REACH.
|
2017-02-04 10:21:31 -08:00 |
|
|
|
ed31cb76d6
|
Fix to cluster network configs.
|
2017-01-30 16:04:05 -08:00 |
|
|
|
eebd271bb1
|
Implement cross cluster sharing of network configs to make clusters able to actually join networks.
|
2017-01-30 15:40:22 -08:00 |
|
|
|
1d775af34a
|
Fix moon persistence.
|
2017-01-27 15:35:21 -08:00 |
|
|
|
9f7919f71f
|
Add comments to join ("orbit") moons.
|
2017-01-27 15:27:26 -08:00 |
|
|
|
bc218f9414
|
little fix
|
2017-01-27 13:52:29 -08:00 |
|
|
|
f102fd7f92
|
Extend in-band world updates to handle moons too.
|
2017-01-27 13:50:56 -08:00 |
|
|
|
64774d0d4f
|
Replace piecemeal designation of upstreams with the concept of moons, which is simpler and easier to use and inherits all the cool live update stuff of worlds (now called planets) and global roots.
|
2017-01-27 13:27:52 -08:00 |
|
|
|
d5528e4e9a
|
Wire up VERB_USER_MESSAGE in core.
|
2017-01-09 15:55:07 -08:00 |
|
|
|
42ba70e79e
|
Replace long callback arg list with struct, and implement path whitelisting, path blacklisting, and local.conf support for roles.
|
2016-11-22 10:54:58 -08:00 |
|
|
|
2ea9f516e1
|
Rate gate expensive validation of new identities in HELLO.
|
2016-11-18 12:59:04 -08:00 |
|
|
|
ab4021dd0e
|
Do packet MAC check before locallyValidate(), and add timing measurement in selftest.
|
2016-11-18 11:09:19 -08:00 |
|
|
|
bf8d71e82c
|
Add notion of upstream that is separate from root in Topology, etc.
|
2016-11-17 16:20:41 -08:00 |
|
|
|
226123ca08
|
Refactor controller to permit sending of pushes as well as just replies to config requests.
|
2016-11-10 11:54:47 -08:00 |
|
|
|
93b4ac5cb2
|
Remove unused POW code, will revisit later.
|
2016-10-13 13:17:30 -07:00 |
|
|
|
7e90ab3534
|
TRACE verbosity increase on exceptions in NETWORK_CREDENTIALS.
|
2016-09-28 11:06:44 -07:00 |
|
|
|
5ee1ccd659
|
Send need credential error on more cases.
|
2016-09-27 16:41:08 -07:00 |
|
|
|
0b44919ba2
|
Clusters can send multiple OKs so we must allow this.
|
2016-09-27 16:33:37 -07:00 |
|
|
|
9f550292fe
|
Simply network auth logic and always sent error on auth failure even for unknown networks to prevent forensics.
|
2016-09-27 13:49:43 -07:00 |
|
|
|
cc4bacc199
|
Cleanup, and implement compression disable flag for networks.
|
2016-09-27 12:22:25 -07:00 |
|
|
|
15c07c58b6
|
Refactored network config chunking to sign every chunk to prevent stupid DOS attack potential, and implement network config fast propagate (though we probably will not use this for a bit).
|
2016-09-27 11:33:48 -07:00 |
|
|
|
7e4b6b594b
|
It now builds.
|
2016-09-26 17:05:39 -07:00 |
|
|
|
eac3667ec1
|
Bunch more refactoring and work on revocations, etc.
|
2016-09-26 16:17:02 -07:00 |
|
|
|
1f74dd4589
|
Revocation work in progress, add WATCH which is TEE with implicit rate sync (thanks JG@DCVC!), and clean up some cruft in Network.
|
2016-09-23 16:08:38 -07:00 |
|
|
|
d3524f3609
|
Refactor COM stuff a bit, and respond to COM requests a bit more readily for rapid setup. Will need to revisit later.
|
2016-09-20 21:21:34 -07:00 |
|
|
|
5b6d27e659
|
Implement relay policy, and setting multicast limit to 0 now disables multicast on the network as would be expected.
|
2016-09-13 14:27:18 -07:00 |
|
|
|
8ef0e4bbaf
|
Get rid of HELLO rate gate on path since its basically worthless. There are 65535 ports per IP.
|
2016-09-13 10:46:36 -07:00 |
|
|
|
0da9a9a3e0
|
Set trustEstablished in a few more places.
|
2016-09-13 10:33:03 -07:00 |
|
|
|
cba37c6107
|
Add a few more rate limit gates for anti-DOS hardening.
|
2016-09-13 10:13:23 -07:00 |
|
|
|
ea1da3321a
|
Rate gate requests for COM.
|
2016-09-12 15:19:21 -07:00 |
|
|
|
debc4c45ee
|
Set trust established flag in MULTICAST_GATHER.
|
2016-09-09 11:45:34 -07:00 |
|
|
|
ab9afbc749
|
(1) Public networks now get COMs even though they do not gate with them since they will need them to push auth for multicast stuff, (2) added a bunch of rate limit circuit breakers for anti-DOS, (3) cleanup.
|
2016-09-09 11:36:10 -07:00 |
|
|
|
ef87069957
|
Fix gating of multicast GATHER replies since these can come from upstream, etc., and fix an issue with sending ECHO to recheck marginal paths.
|
2016-09-09 09:32:00 -07:00 |
|
|
|
0d4109a9f1
|
More refactoring to clean up code, and add a gate function to make sure we do not handle OK packets we did not expect. This hardens up a few potential edge cases around security, since such messages might be used to e.g. pollute a cache and DOS under certain conditions.
|
2016-09-09 08:43:58 -07:00 |
|
|
|
16df2c3363
|
Clean up handling of COMs, network access control, and fix a backward compatiblity issue.
|
2016-09-08 19:48:05 -07:00 |
|
|
|
c7a4da3dd3
|
Turns out we do not need to pass network to receive().
|
2016-09-07 15:24:53 -07:00 |
|
|
|
1908aa55f5
|
Refactor MULTICAST_LIKE pushing to eliminate redundant and unnecessary pushes and simplify code.
|
2016-09-07 15:15:52 -07:00 |
|
|
|
a7d988745b
|
Use ECHO instead of HELLO where possible.
|
2016-09-07 12:01:03 -07:00 |
|
|
|
b5c86b6ba4
|
Bunch more path refactoring. Peers no longer forget paths, but do not normally use expired paths. Expired paths might still be tried if nothing else is reachable.
|
2016-09-07 11:13:17 -07:00 |
|
|
|
48a374c82c
|
(1) fix crazy bug introduced in doRENDEZVOUS(), (2) reclaim Paths after paths[] condense, (3) fix an edge case around symmetric NAT and external IP change detection.
|
2016-09-06 14:05:58 -07:00 |
|
