244 Commits

Author	SHA1	Message	Date
Adam Ierymenko	0b3b994241	Relay policy can now be computed.	2017-01-27 14:05:09 -08:00
Adam Ierymenko	c8554504f3	.	2016-12-22 18:37:46 -08:00
Adam Ierymenko	6b12d86209	Add a workaround for an edge case in TEE/REDIRECT if we are the inbound destination and teeing is only being done on the outbound side.	2016-12-22 18:06:35 -08:00
Adam Ierymenko	fe530548bb	Fix MATCH_RANDOM in controller.	2016-12-22 16:57:45 -08:00
Adam Ierymenko	2eaff6d484	Fix to characteristcs in rules engine.	2016-12-22 16:36:38 -08:00
Adam Ierymenko	226123ca08	Refactor controller to permit sending of pushes as well as just replies to config requests.	2016-11-10 11:54:47 -08:00
Adam Ierymenko	27d997a2e5	.	2016-10-13 15:17:17 -07:00
Adam Ierymenko	6469aa9df9	typo	2016-10-13 14:28:39 -07:00
Adam Ierymenko	ce6b5bc6f5	.	2016-10-13 14:21:24 -07:00
Adam Ierymenko	4f3775bb86	Fix ICMP match.	2016-10-13 14:21:00 -07:00
Adam Ierymenko	8850a8610a	Fix filter trace.	2016-10-13 13:59:17 -07:00
Adam Ierymenko	e53f63ca87	Broke down and added an OR to the rules engine. It is now possible to have a series of MATCHes that are ORed.	2016-10-11 12:00:16 -07:00
Adam Ierymenko	45c4ccb153	Add a tags both equal match.	2016-10-05 16:38:42 -07:00
Adam Ierymenko	adeb7e7da0	Make capability flags match more user-friendly and appropriate since "match any flag" is generally what we want.	2016-10-05 12:54:46 -07:00
Adam Ierymenko	988049f39b	Add new rule to rules engine: random match.	2016-09-30 14:07:00 -07:00
Adam Ierymenko	9eaa3756f8	Fix deadlock-causing regression in Network.	2016-09-30 12:22:54 -07:00
Adam Ierymenko	4fe9a4fe83	Fix memory leak.	2016-09-28 16:13:59 -07:00
Adam Ierymenko	9f550292fe	Simply network auth logic and always sent error on auth failure even for unknown networks to prevent forensics.	2016-09-27 13:49:43 -07:00
Adam Ierymenko	cc4bacc199	Cleanup, and implement compression disable flag for networks.	2016-09-27 12:22:25 -07:00
Adam Ierymenko	15c07c58b6	Refactored network config chunking to sign every chunk to prevent stupid DOS attack potential, and implement network config fast propagate (though we probably will not use this for a bit).	2016-09-27 11:33:48 -07:00
Adam Ierymenko	eac3667ec1	Bunch more refactoring and work on revocations, etc.	2016-09-26 16:17:02 -07:00
Adam Ierymenko	1f74dd4589	Revocation work in progress, add WATCH which is TEE with implicit rate sync (thanks JG@DCVC!), and clean up some cruft in Network.	2016-09-23 16:08:38 -07:00
Adam Ierymenko	d3524f3609	Refactor COM stuff a bit, and respond to COM requests a bit more readily for rapid setup. Will need to revisit later.	2016-09-20 21:21:34 -07:00
Adam Ierymenko	68e549233d	Revise bearer token code in controller, and add relay policy as a meta-data item presented to controller by nodes (to facilitate future meshiness).	2016-09-15 13:17:37 -07:00
Adam Ierymenko	15402933bc	Add physical MTU recommendation hint to network config via API.	2016-09-14 16:55:25 -07:00
Adam Ierymenko	83abc00aae	docs	2016-09-13 14:58:59 -07:00
Adam Ierymenko	ab9afbc749	(1) Public networks now get COMs even though they do not gate with them since they will need them to push auth for multicast stuff, (2) added a bunch of rate limit circuit breakers for anti-DOS, (3) cleanup.	2016-09-09 11:36:10 -07:00
Adam Ierymenko	ef87069957	Fix gating of multicast GATHER replies since these can come from upstream, etc., and fix an issue with sending ECHO to recheck marginal paths.	2016-09-09 09:32:00 -07:00
Adam Ierymenko	0d4109a9f1	More refactoring to clean up code, and add a gate function to make sure we do not handle OK packets we did not expect. This hardens up a few potential edge cases around security, since such messages might be used to e.g. pollute a cache and DOS under certain conditions.	2016-09-09 08:43:58 -07:00
Adam Ierymenko	16df2c3363	Clean up handling of COMs, network access control, and fix a backward compatiblity issue.	2016-09-08 19:48:05 -07:00
Adam Ierymenko	1f6b13b7fd	Fix bug causing null addresses to get in memberships[] hash.	2016-09-08 16:09:56 -07:00
Adam Ierymenko	daf8a66ced	More correct and efficient to initialize member relationship push stuff lazily when member is learned.	2016-09-07 15:47:20 -07:00
Adam Ierymenko	20278bb9e4	Also send MULTICAST_LIKEs to controllers.	2016-09-07 15:34:34 -07:00
Adam Ierymenko	1908aa55f5	Refactor MULTICAST_LIKE pushing to eliminate redundant and unnecessary pushes and simplify code.	2016-09-07 15:15:52 -07:00
Adam Ierymenko	eebcf08084	Tweaks to new Path code for dual-stack operation, and other fixes.	2016-09-03 15:39:05 -07:00
Adam Ierymenko	22271f2a49	Cleanup.	2016-09-01 13:36:41 -07:00
Adam Ierymenko	8b6d23b9f6	Optimize filter code a bit, and add a network-level setting for what should happen if an unsupported or unknown MATCH is encountered in a rules table.	2016-09-01 12:07:17 -07:00
Adam Ierymenko	25056de5d3	Also need to send credentials when TEEing and REDIRECTing.	2016-08-31 17:56:59 -07:00
Adam Ierymenko	994b25af4e	Simplify some logic.	2016-08-31 17:45:55 -07:00
Adam Ierymenko	74afef8eb1	Think through and refine a few things in rules, especially edge case TEE and REDIRECT behavior and semantics.	2016-08-31 16:50:22 -07:00
Adam Ierymenko	54489a7f61	rename SAMENESS to DIFFERENCE which is less confusing	2016-08-31 14:14:58 -07:00
Adam Ierymenko	8e3004591b	Add overlooked MATCH_ICMP to rule set.	2016-08-31 14:01:15 -07:00
Adam Ierymenko	cb63babac4	Debug output fixes.	2016-08-29 16:38:10 -07:00
Adam Ierymenko	ac1c127b68	Debug output fixes.	2016-08-29 16:24:08 -07:00
Adam Ierymenko	cb82193333	Debug output fixes.	2016-08-29 16:19:26 -07:00
Adam Ierymenko	f0636ffd4a	EXT_FRAME messages should always be accepted if we are the destination for a matching TEE or REDIRECT rule.	2016-08-29 15:54:06 -07:00
Adam Ierymenko	51a420671f	Make rules engine debug a bit more verbose.	2016-08-29 15:17:34 -07:00
Adam Ierymenko	7223685b96	.	2016-08-26 15:30:20 -07:00
Adam Ierymenko	e7dff1c785	Change logic a little for self-as-destination in TEE and REDIRECT.	2016-08-26 15:28:31 -07:00
Adam Ierymenko	a5383d83d8	Do not TEE or REDIRECT to self.	2016-08-26 15:25:00 -07:00