1307 Commits

Author	SHA1	Message	Date
Adam Ierymenko	cba37c6107	Add a few more rate limit gates for anti-DOS hardening.	2016-09-13 10:13:23 -07:00
Adam Ierymenko	ea1da3321a	Rate gate requests for COM.	2016-09-12 15:19:21 -07:00
Adam Ierymenko	debc4c45ee	Set trust established flag in MULTICAST_GATHER.	2016-09-09 11:45:34 -07:00
Adam Ierymenko	ab9afbc749	(1) Public networks now get COMs even though they do not gate with them since they will need them to push auth for multicast stuff, (2) added a bunch of rate limit circuit breakers for anti-DOS, (3) cleanup.	2016-09-09 11:36:10 -07:00
Adam Ierymenko	ef87069957	Fix gating of multicast GATHER replies since these can come from upstream, etc., and fix an issue with sending ECHO to recheck marginal paths.	2016-09-09 09:32:00 -07:00
Adam Ierymenko	0d4109a9f1	More refactoring to clean up code, and add a gate function to make sure we do not handle OK packets we did not expect. This hardens up a few potential edge cases around security, since such messages might be used to e.g. pollute a cache and DOS under certain conditions.	2016-09-09 08:43:58 -07:00
Adam Ierymenko	16df2c3363	Clean up handling of COMs, network access control, and fix a backward compatiblity issue.	2016-09-08 19:48:05 -07:00
Adam Ierymenko	1f6b13b7fd	Fix bug causing null addresses to get in memberships[] hash.	2016-09-08 16:09:56 -07:00
Adam Ierymenko	daf8a66ced	More correct and efficient to initialize member relationship push stuff lazily when member is learned.	2016-09-07 15:47:20 -07:00
Adam Ierymenko	20278bb9e4	Also send MULTICAST_LIKEs to controllers.	2016-09-07 15:34:34 -07:00
Adam Ierymenko	c7a4da3dd3	Turns out we do not need to pass network to receive().	2016-09-07 15:24:53 -07:00
Adam Ierymenko	1908aa55f5	Refactor MULTICAST_LIKE pushing to eliminate redundant and unnecessary pushes and simplify code.	2016-09-07 15:15:52 -07:00
Adam Ierymenko	1c08f5e857	Tweak some expire times.	2016-09-07 12:25:19 -07:00
Adam Ierymenko	c9ee8612e4	Credential TTL (tags/capabilities) should be credential time max delta, since we could get pushed one that is newer.	2016-09-07 12:12:52 -07:00
Adam Ierymenko	a7d988745b	Use ECHO instead of HELLO where possible.	2016-09-07 12:01:03 -07:00
Adam Ierymenko	ff9f8b1c2b	Typo fix.	2016-09-07 11:15:36 -07:00
Adam Ierymenko	b5c86b6ba4	Bunch more path refactoring. Peers no longer forget paths, but do not normally use expired paths. Expired paths might still be tried if nothing else is reachable.	2016-09-07 11:13:17 -07:00
Adam Ierymenko	f2d2df2b11	Cluster build fix.	2016-09-06 15:06:07 -07:00
Adam Ierymenko	48a374c82c	(1) fix crazy bug introduced in doRENDEZVOUS(), (2) reclaim Paths after paths[] condense, (3) fix an edge case around symmetric NAT and external IP change detection.	2016-09-06 14:05:58 -07:00
Adam Ierymenko	8a2e8bd585	Rework how paths are set as remote cluster preferred. The code is now clearer and cluster preference indications are now very sticky as they should be.	2016-09-06 12:45:28 -07:00
Adam Ierymenko	43780742b0	comments, docs	2016-09-06 11:10:04 -07:00
Adam Ierymenko	d7f2287ce9	More tweaks to path behavior.	2016-09-05 15:47:22 -07:00
Adam Ierymenko	eebcf08084	Tweaks to new Path code for dual-stack operation, and other fixes.	2016-09-03 15:39:05 -07:00
Adam Ierymenko	01aa469591	Remove debug line.	2016-09-02 14:26:04 -07:00
Adam Ierymenko	4992ac2d9f	Cluster sub-optimal is in fact necessary...	2016-09-02 14:20:55 -07:00
Adam Ierymenko	412979ba8f	Attempt to reactivate dead paths.	2016-09-02 13:55:33 -07:00
Adam Ierymenko	4f8253dcdb	Tweaks to path handling...	2016-09-02 13:33:56 -07:00
Adam Ierymenko	4931e44998	Implement "weak pointer" behavior on Topology Path canonicalization hash table.	2016-09-02 12:34:02 -07:00
Adam Ierymenko	d1101441b3	Tweak some timings.	2016-09-02 11:54:59 -07:00
Adam Ierymenko	e8f6b4b5d3	Rest of big Path canonicalization refactor.	2016-09-02 11:51:33 -07:00
Adam Ierymenko	a3bdae9735	Work in progress: Path canonicalization refactor.	2016-09-01 15:43:07 -07:00
Adam Ierymenko	d5e6f59004	.	2016-09-01 13:45:32 -07:00
Adam Ierymenko	22271f2a49	Cleanup.	2016-09-01 13:36:41 -07:00
Adam Ierymenko	8b6d23b9f6	Optimize filter code a bit, and add a network-level setting for what should happen if an unsupported or unknown MATCH is encountered in a rules table.	2016-09-01 12:07:17 -07:00
Adam Ierymenko	25056de5d3	Also need to send credentials when TEEing and REDIRECTing.	2016-08-31 17:56:59 -07:00
Adam Ierymenko	994b25af4e	Simplify some logic.	2016-08-31 17:45:55 -07:00
Adam Ierymenko	74afef8eb1	Think through and refine a few things in rules, especially edge case TEE and REDIRECT behavior and semantics.	2016-08-31 16:50:22 -07:00
Adam Ierymenko	54489a7f61	rename SAMENESS to DIFFERENCE which is less confusing	2016-08-31 14:14:58 -07:00
Adam Ierymenko	8e3004591b	Add overlooked MATCH_ICMP to rule set.	2016-08-31 14:01:15 -07:00
Adam Ierymenko	2ff2a8fd9a	Cluster build fixes and warning elimination.	2016-08-31 09:38:21 -07:00
Adam Ierymenko	cb63babac4	Debug output fixes.	2016-08-29 16:38:10 -07:00
Adam Ierymenko	ac1c127b68	Debug output fixes.	2016-08-29 16:24:08 -07:00
Adam Ierymenko	cb82193333	Debug output fixes.	2016-08-29 16:19:26 -07:00
Adam Ierymenko	f0636ffd4a	EXT_FRAME messages should always be accepted if we are the destination for a matching TEE or REDIRECT rule.	2016-08-29 15:54:06 -07:00
Adam Ierymenko	51a420671f	Make rules engine debug a bit more verbose.	2016-08-29 15:17:34 -07:00
Adam Ierymenko	7223685b96	.	2016-08-26 15:30:20 -07:00
Adam Ierymenko	e7dff1c785	Change logic a little for self-as-destination in TEE and REDIRECT.	2016-08-26 15:28:31 -07:00
Adam Ierymenko	a5383d83d8	Do not TEE or REDIRECT to self.	2016-08-26 15:25:00 -07:00
Adam Ierymenko	a3c7627acf	Push more than one packet for credentials if we happen to have a whole lot. Should not happen often but might if a member has tons of tags.	2016-08-26 14:43:16 -07:00
Adam Ierymenko	6bd5aba4fa	fix frame size range bug	2016-08-26 13:26:26 -07:00