Commit Graph

339 Commits

Author SHA1 Message Date
Adam Ierymenko
d56f740dc6 Now with less bugs. 2017-03-03 13:49:21 -08:00
Adam Ierymenko
d79585d44d Circuit tests now report link quality. Also fixed a little thing in revocation propagation. 2017-03-01 15:12:17 -08:00
Adam Ierymenko
2bf9145ae6 Outgoing side of packet counter for link quality reporting. Also some cleanup and a cluster mode build fix. 2017-03-01 10:22:57 -08:00
Adam Ierymenko
10185e92fa Certificate of ownership -- used to secure against IP address spoofing, especially for IPv4 and regular IPv6. 2017-02-23 11:47:36 -08:00
Adam Ierymenko
af4e79735c Fix "orbit" semantics. Federation works. 2017-02-13 16:38:21 -08:00
Adam Ierymenko
969e09210d Fix loading of existing moons. 2017-02-13 16:14:48 -08:00
Adam Ierymenko
e4b6611201 Only accept world updates from upstreams. 2017-02-13 09:46:34 -08:00
Adam Ierymenko
42f28bce52 Cleanup and make moons (federated roots) a little easier to deal with. 2017-02-13 09:03:48 -08:00
Adam Ierymenko
cdc289fa9c Tags work. 2017-02-07 14:06:40 -08:00
Adam Ierymenko
435e4c4695 Fix HELLO parse bug. 2017-02-06 12:06:10 -08:00
Adam Ierymenko
f85a630a64 Docs and a small build fix in debug mode. 2017-02-06 07:17:45 -08:00
Adam Ierymenko
43182f8f57 Docs, code cleanup, and protect the extra new fields of HELLO with encryption as a precaution. 2017-02-05 16:19:03 -08:00
Adam Ierymenko
3587aa1ea7 Add and send certificates of representation to tell people what our valid upstreams are. These are not used yet but will be needed for future privacy modes, etc. Also some cleanup. 2017-02-04 13:17:00 -08:00
Adam Ierymenko
beb642faa5 Stub out CAN_REACH. 2017-02-04 10:21:31 -08:00
Adam Ierymenko
ed31cb76d6 Fix to cluster network configs. 2017-01-30 16:04:05 -08:00
Adam Ierymenko
eebd271bb1 Implement cross cluster sharing of network configs to make clusters able to actually join networks. 2017-01-30 15:40:22 -08:00
Adam Ierymenko
1d775af34a Fix moon persistence. 2017-01-27 15:35:21 -08:00
Adam Ierymenko
9f7919f71f Add comments to join ("orbit") moons. 2017-01-27 15:27:26 -08:00
Adam Ierymenko
bc218f9414 little fix 2017-01-27 13:52:29 -08:00
Adam Ierymenko
f102fd7f92 Extend in-band world updates to handle moons too. 2017-01-27 13:50:56 -08:00
Adam Ierymenko
64774d0d4f Replace piecemeal designation of upstreams with the concept of moons, which is simpler and easier to use and inherits all the cool live update stuff of worlds (now called planets) and global roots. 2017-01-27 13:27:52 -08:00
Adam Ierymenko
d5528e4e9a Wire up VERB_USER_MESSAGE in core. 2017-01-09 15:55:07 -08:00
Adam Ierymenko
42ba70e79e Replace long callback arg list with struct, and implement path whitelisting, path blacklisting, and local.conf support for roles. 2016-11-22 10:54:58 -08:00
Adam Ierymenko
2ea9f516e1 Rate gate expensive validation of new identities in HELLO. 2016-11-18 12:59:04 -08:00
Adam Ierymenko
ab4021dd0e Do packet MAC check before locallyValidate(), and add timing measurement in selftest. 2016-11-18 11:09:19 -08:00
Adam Ierymenko
bf8d71e82c Add notion of upstream that is separate from root in Topology, etc. 2016-11-17 16:20:41 -08:00
Adam Ierymenko
226123ca08 Refactor controller to permit sending of pushes as well as just replies to config requests. 2016-11-10 11:54:47 -08:00
Adam Ierymenko
93b4ac5cb2 Remove unused POW code, will revisit later. 2016-10-13 13:17:30 -07:00
Adam Ierymenko
7e90ab3534 TRACE verbosity increase on exceptions in NETWORK_CREDENTIALS. 2016-09-28 11:06:44 -07:00
Adam Ierymenko
5ee1ccd659 Send need credential error on more cases. 2016-09-27 16:41:08 -07:00
Adam Ierymenko
0b44919ba2 Clusters can send multiple OKs so we must allow this. 2016-09-27 16:33:37 -07:00
Adam Ierymenko
9f550292fe Simply network auth logic and always sent error on auth failure even for unknown networks to prevent forensics. 2016-09-27 13:49:43 -07:00
Adam Ierymenko
cc4bacc199 Cleanup, and implement compression disable flag for networks. 2016-09-27 12:22:25 -07:00
Adam Ierymenko
15c07c58b6 Refactored network config chunking to sign every chunk to prevent stupid DOS attack potential, and implement network config fast propagate (though we probably will not use this for a bit). 2016-09-27 11:33:48 -07:00
Adam Ierymenko
7e4b6b594b It now builds. 2016-09-26 17:05:39 -07:00
Adam Ierymenko
eac3667ec1 Bunch more refactoring and work on revocations, etc. 2016-09-26 16:17:02 -07:00
Adam Ierymenko
1f74dd4589 Revocation work in progress, add WATCH which is TEE with implicit rate sync (thanks JG@DCVC!), and clean up some cruft in Network. 2016-09-23 16:08:38 -07:00
Adam Ierymenko
d3524f3609 Refactor COM stuff a bit, and respond to COM requests a bit more readily for rapid setup. Will need to revisit later. 2016-09-20 21:21:34 -07:00
Adam Ierymenko
5b6d27e659 Implement relay policy, and setting multicast limit to 0 now disables multicast on the network as would be expected. 2016-09-13 14:27:18 -07:00
Adam Ierymenko
8ef0e4bbaf Get rid of HELLO rate gate on path since its basically worthless. There are 65535 ports per IP. 2016-09-13 10:46:36 -07:00
Adam Ierymenko
0da9a9a3e0 Set trustEstablished in a few more places. 2016-09-13 10:33:03 -07:00
Adam Ierymenko
cba37c6107 Add a few more rate limit gates for anti-DOS hardening. 2016-09-13 10:13:23 -07:00
Adam Ierymenko
ea1da3321a Rate gate requests for COM. 2016-09-12 15:19:21 -07:00
Adam Ierymenko
debc4c45ee Set trust established flag in MULTICAST_GATHER. 2016-09-09 11:45:34 -07:00
Adam Ierymenko
ab9afbc749 (1) Public networks now get COMs even though they do not gate with them since they will need them to push auth for multicast stuff, (2) added a bunch of rate limit circuit breakers for anti-DOS, (3) cleanup. 2016-09-09 11:36:10 -07:00
Adam Ierymenko
ef87069957 Fix gating of multicast GATHER replies since these can come from upstream, etc., and fix an issue with sending ECHO to recheck marginal paths. 2016-09-09 09:32:00 -07:00
Adam Ierymenko
0d4109a9f1 More refactoring to clean up code, and add a gate function to make sure we do not handle OK packets we did not expect. This hardens up a few potential edge cases around security, since such messages might be used to e.g. pollute a cache and DOS under certain conditions. 2016-09-09 08:43:58 -07:00
Adam Ierymenko
16df2c3363 Clean up handling of COMs, network access control, and fix a backward compatiblity issue. 2016-09-08 19:48:05 -07:00
Adam Ierymenko
c7a4da3dd3 Turns out we do not need to pass network to receive(). 2016-09-07 15:24:53 -07:00
Adam Ierymenko
1908aa55f5 Refactor MULTICAST_LIKE pushing to eliminate redundant and unnecessary pushes and simplify code. 2016-09-07 15:15:52 -07:00
Adam Ierymenko
a7d988745b Use ECHO instead of HELLO where possible. 2016-09-07 12:01:03 -07:00
Adam Ierymenko
b5c86b6ba4 Bunch more path refactoring. Peers no longer forget paths, but do not normally use expired paths. Expired paths might still be tried if nothing else is reachable. 2016-09-07 11:13:17 -07:00
Adam Ierymenko
48a374c82c (1) fix crazy bug introduced in doRENDEZVOUS(), (2) reclaim Paths after paths[] condense, (3) fix an edge case around symmetric NAT and external IP change detection. 2016-09-06 14:05:58 -07:00
Adam Ierymenko
4992ac2d9f Cluster sub-optimal is in fact necessary... 2016-09-02 14:20:55 -07:00
Adam Ierymenko
4f8253dcdb Tweaks to path handling... 2016-09-02 13:33:56 -07:00
Adam Ierymenko
e8f6b4b5d3 Rest of big Path canonicalization refactor. 2016-09-02 11:51:33 -07:00
Adam Ierymenko
74afef8eb1 Think through and refine a few things in rules, especially edge case TEE and REDIRECT behavior and semantics. 2016-08-31 16:50:22 -07:00
Adam Ierymenko
f0636ffd4a EXT_FRAME messages should always be accepted if we are the destination for a matching TEE or REDIRECT rule. 2016-08-29 15:54:06 -07:00
Adam Ierymenko
cd3683f2ba Fix a missing receive(). 2016-08-24 17:50:51 -07:00
Adam Ierymenko
347ebcd899 Set trust flag in network controllers if remote query is accepted to allow NATed network controllers to better traverse. 2016-08-24 17:48:13 -07:00
Adam Ierymenko
c476285bd6 Harden PUSH_DIRECT_PATHS and simplify things by only doing it on receive when hops>0 and trust has been established. 2016-08-24 16:16:39 -07:00
Adam Ierymenko
0ee4d3554a Stub out USER_MESSAGE. 2016-08-23 14:38:20 -07:00
Adam Ierymenko
0a7a33ef8f Instantaneous blacklisting and credential revocation. 2016-08-23 13:46:36 -07:00
Adam Ierymenko
7036831203 Sign Dictionary in doNETWORK_CONFIG_REQUEST. 2016-08-23 11:57:56 -07:00
Adam Ierymenko
0dfc08b317 Tidy up a few minor protocol things, improve documentation in Packet.hpp. 2016-08-23 11:29:02 -07:00
Adam Ierymenko
faa9a06bf5 Controller fixes... 2016-08-17 17:37:37 -07:00
Adam Ierymenko
d166b494ee Rule parse fix. 2016-08-10 13:41:22 -07:00
Adam Ierymenko
c9d7845fea Minor bug fix and some instrumentation stuff for testing. 2016-08-09 17:00:01 -07:00
Adam Ierymenko
e1310a764a More cleanup and removal of cruft due to obsolete network-specific relays (will be replaced with federation stuff). 2016-08-09 15:45:26 -07:00
Adam Ierymenko
dee7f75f7e Minor cleanup. 2016-08-09 14:46:11 -07:00
Adam Ierymenko
774c7e0ea5 Put CONFIG_REFRESH back. 2016-08-09 13:52:08 -07:00
Adam Ierymenko
4d498b3765 Handling of multi-part chunked network configs on the inbound side. 2016-08-09 13:14:38 -07:00
Adam Ierymenko
bcd05fbdfa Chunking of network config replies. 2016-08-09 09:34:13 -07:00
Adam Ierymenko
2ba9343607 Encode and decode of tags and capabilities in NetworkConfig. 2016-08-09 08:32:42 -07:00
Adam Ierymenko
00fd9c3a15 It builds... almost ready to test some rules engine stuff. 2016-08-08 17:33:26 -07:00
Adam Ierymenko
4d9b74b171 . 2016-08-04 15:27:20 -07:00
Adam Ierymenko
331382cf2f More cleanup and a tiny federation prep item. 2016-08-04 12:14:13 -07:00
Adam Ierymenko
98152d974a More cleanup and removal of DeferredPackets, will do the latter in a more elegant way. 2016-08-04 11:40:38 -07:00
Adam Ierymenko
5cf410490e . 2016-08-04 10:18:33 -07:00
Adam Ierymenko
404a0bbddd ... 2016-08-04 09:51:15 -07:00
Adam Ierymenko
f057bb63cd More work on tags and capabilities. 2016-08-04 09:02:35 -07:00
Adam Ierymenko
7e6e56e2bc Bunch of work on pushing and replication of tags and capabilities, and protocol cleanup. 2016-08-03 18:04:08 -07:00
Adam Ierymenko
4929be08f7 Cleanup and stub out new object transfer messages. 2016-07-26 12:33:51 -07:00
Adam Ierymenko
7404eb46c4 Integration of Filter into inbound and outbound packet path. 2016-07-25 16:51:10 -07:00
Moritz Warning
b3073f44a2 move sourceAddress out of scope
sourceAddress is used in the catch block
2016-07-21 23:03:04 +02:00
Adam Ierymenko
9785fde32a Trusted paths work! 2016-07-12 11:40:45 -07:00
Adam Ierymenko
9657675755 Plumbing through trusted path stuff to OneService. 2016-07-12 11:30:22 -07:00
Adam Ierymenko
765082fdb6 Trusted path support, and version bump to 1.1.9 2016-07-12 08:29:50 -07:00
Adam Ierymenko
19735e7050 Revert backgrounding of controller requests hack. Controller code is not really parallel anyway and we fixed the perf problem. 2016-06-29 11:43:22 -07:00
Adam Ierymenko
45f315e603 Defer NETWORK_CONFIG_REQUEST packets and allow multithreaded processing. 2016-06-27 17:09:04 -07:00
Adam Ierymenko
674b84d908 Plumbing for network setting control, and GitHub issue #330 2016-06-21 14:58:30 -07:00
Adam Ierymenko
b2d048aa0e Make Dictionary templatable so it can be used where we want a higher capacity. 2016-06-21 07:32:58 -07:00
Adam Ierymenko
e09c1a1c11 Big refactor mostly builds. We now have a uniform backward compatible netconf. 2016-06-16 12:28:43 -07:00
Grant Limberg
de1b745988 comment out a few TRACE messages that don't compile 2016-05-14 13:29:31 -07:00
Adam Ierymenko
548730660b Ready to test whole new netconf refactor. 2016-05-11 10:19:14 -07:00
Adam Ierymenko
8b9519f0af Simplify a bunch of NetworkConfig stuff by eliminating accessors, also makes network controller easier to refactor. 2016-05-06 16:13:11 -07:00
Adam Ierymenko
90e1262a8b More refactoring to remove old Dictionary dependencies. 2016-04-26 08:20:03 -07:00
Adam Ierymenko
368efaa2ba Kill some old debug code. 2016-04-19 12:55:48 -07:00
Adam Ierymenko
2f18a92e20 Cleanup in numerous places, reduce network chattiness around MULTICAST_LIKE, and fix a "how was that working" latent bug causing some control traffic to take the scenic route. 2016-04-19 12:09:35 -07:00
Adam Ierymenko
4c455876f9 Revise peer path weighting to always prioritize cluster-optimal paths. 2016-04-19 09:22:51 -07:00
Adam Ierymenko
cecfa99b7b (1) cluster members send a flag indicating that a PUSH_DIRECT_PATHS is a cluster redirect, (2) 1.1.5 uses this to avoid a bug (this bug does not exist in 1.1.4) 2016-04-18 16:44:23 -07:00
Adam Ierymenko
ad1e83d8b9 Refactor IncomingPacket for new NetworkConfig 2016-04-12 12:32:33 -07:00
Adam Ierymenko
fe3a84a422 Fix problems with previous commit. 2016-03-03 14:15:09 -08:00
Adam Ierymenko
7b5c1696eb Fix a CIRCUIT_TEST bug in forwarding of tests along hop paths on private networks. Unfortunately this means full circuit testing for private nets will need an upgrade. :( 2016-02-23 14:56:51 -08:00
Adam Ierymenko
c7c61b4ac0 Fix checking of path address validity. 2016-02-22 16:01:35 -08:00
Adam Ierymenko
43fff1a87e Deprecate reporting of local clock in circuit tests since a small number of users might have security problems with this. 2016-02-22 12:59:26 -08:00
Adam Ierymenko
2aa7138373 Reduce direct ping delay back to 1m and make SelfAwareness aware of local received-on address to eliminate false symmetric classification. 2016-02-22 09:47:50 -08:00
Adam Ierymenko
4e4fd51117 boring doc stuff 2016-01-12 14:04:55 -08:00
Adam Ierymenko
83ef98a9dc Add a network-associated user ptr in API. 2016-01-12 11:04:35 -08:00
Adam Ierymenko
b3e3d4cacc Instead of using binary packet comparison, add a callback to the API to explicitly check whether paths should be used. Check in with this callback (if present) when learning new paths or sending initial packets. 2016-01-11 10:17:44 -08:00
Adam Ierymenko
1023ef23b7 Remove somewhat ugly and costly anti-recursion hack -- we will switch to more explicit methods. 2016-01-11 09:06:10 -08:00
Adam Ierymenko
a56fbc1929 Close another potential anti-recursion loophole. 2016-01-06 15:35:27 -08:00
Adam Ierymenko
d8143a5e18 Implement first pass on rapid dead path detection, and increment version to 1.1.3 (dev) 2016-01-05 16:41:54 -08:00
Adam Ierymenko
436c1fac1d Selectively move over changes from "edge" to "dev" excluding netcon. 2015-12-21 16:15:39 -08:00
Adam Ierymenko
94f4316a0e Fix for possible high CPU usage on multicast queries. 2015-11-09 14:54:05 -08:00
Adam Ierymenko
57b71bfff0 Cluster simplification and refactor work in progress... 2015-11-08 13:57:02 -08:00
Adam Ierymenko
5f39d5b7ea Further pare down Cluster messaging and rename some stuff. 2015-11-06 14:37:17 -08:00
Adam Ierymenko
8ef4edebbf Deferred decode for HELLO to prevent HELLOcalypse under high load of new peers. 2015-11-05 12:22:58 -08:00
Adam Ierymenko
f1b6427e63 Decided to make this 1.1.0 (semantic versioning increment is warranted), and add a legacy hack for older clients working with clusters. 2015-11-02 09:32:56 -08:00
Adam Ierymenko
938d0a970b TRACE build fixes. 2015-10-28 10:01:32 -07:00
Adam Ierymenko
da93712846 Clean up PUSH_DIRECT_PATH limits a bit more and make them a bit smarter. 2015-10-28 09:11:30 -07:00
Adam Ierymenko
cdc99bfee1 Add a circuit breaker for VERB_PUSH_DIRECT_PATHS. 2015-10-27 18:18:26 -07:00
Adam Ierymenko
88b100e5d0 More cleanup. 2015-10-27 17:59:17 -07:00
Adam Ierymenko
16bc3e0398 Factor out RemotePath subclass of Path -- no longer needed, just cruft. 2015-10-27 15:00:16 -07:00
Adam Ierymenko
a1a0ee4edb Fix infinite loop in Cluster, clean up some stuff elsewhere, and back out rate limiting in PUSH_DIRECT_PATHS for now (but we will do something else to mitigate amplification attacks) 2015-10-27 12:01:00 -07:00
Adam Ierymenko
54a99d8e32 Well that was broken. 2015-10-27 11:14:07 -07:00
Adam Ierymenko
700c3166b7 Fix inverted sense bug. 2015-10-27 10:51:11 -07:00
Adam Ierymenko
9617208e40 Some cleanup, and use VERB_PUSH_DIRECT_PATHS to redirect newer peers. 2015-10-27 09:53:43 -07:00
Adam Ierymenko
2258e36a59 Move replication of COMs to avoid race condition. 2015-10-20 16:34:21 -07:00
Adam Ierymenko
59e1444b27 Finish wiring up Cluster, fix some issues with other recent changes. 2015-10-20 16:31:41 -07:00
Adam Ierymenko
eb79d4a2f3 Wire up peer announcement in cluster. 2015-10-20 16:24:21 -07:00
Adam Ierymenko
57e29857cf Cluster work -- integrating with the rest of the code. 2015-10-20 15:27:53 -07:00
Adam Ierymenko
3adb183c5f Fix bad COM attachment bug and eliminate an unnecessary redundant check. 2015-10-19 13:38:27 -07:00
Adam Ierymenko
95953b48f9 Do not allow VERB_RENDEZVOUS from non-upstream peers to block potential DOS vector. 2015-10-19 12:56:29 -07:00
Adam Ierymenko
5ce3aac929 Add rate limit on receive of DIRECT_PATH_PUSH to prevent DOS exploitation. 2015-10-16 10:28:09 -07:00
Adam Ierymenko
2debde3451 GitHub issue #235, and I also see no reason not to communicate with people from other Worlds. 2015-10-15 07:22:17 -07:00
Adam Ierymenko
c312ae221f Fix for world size in OK(HELLO) 2015-10-14 10:45:33 -07:00
Adam Ierymenko
123c466843 Full integration of World and World updates. 2015-10-13 12:17:47 -07:00
Adam Ierymenko
5d2f523e81 World stuff... 2015-10-13 12:10:44 -07:00
Adam Ierymenko
cae58f43f1 More World stuff, and mkworld. 2015-10-13 08:49:36 -07:00
Adam Ierymenko
1b1945c63e Work in progress on refactoring root-topology into World and adding in-band updates. 2015-10-12 18:25:29 -07:00
Adam Ierymenko
eff1fe3c61 Create files for each hop (more convenient) and fix a packet parse bug. 2015-10-09 16:22:34 -07:00
Adam Ierymenko
aec13b50fd Be a bit more verbose in circuit test reports to more clearly track current and upstream hop in graph traversal history. 2015-10-09 15:05:26 -07:00
Adam Ierymenko
0c498556d5 Unroll Salsa20 fully for a little more speed (non-SSE now almost as fast as SSE) 2015-10-09 09:39:27 -07:00
Adam Ierymenko
a3876353ca Abiltiy to post a test via the controller web API, and parsing of CIRCUIT_TEST_REPORT messages. 2015-10-08 13:25:38 -07:00
Adam Ierymenko
0ce0bc00d2 Make sure received() gets called for some new messages, and docs. 2015-10-07 16:20:54 -07:00
Adam Ierymenko
69b44bf9a5 Finally add an ECHO. 2015-10-07 16:11:50 -07:00
Adam Ierymenko
73cafbe0ec Limit proof of work difficulty to something sane. 2015-10-07 13:46:44 -07:00
Adam Ierymenko
e5f168f599 Add proof of work request for future DDOS mitigation use. 2015-10-07 13:35:46 -07:00
Adam Ierymenko
13f14c2f4c Kill debug line. 2015-10-07 10:56:47 -07:00