 Adam Ierymenko
|
e53f63ca87
Broke down and added an OR to the rules engine. It is now possible to have a series of MATCHes that are ORed.
|
9 years ago |
|
Adam Ierymenko
|
45c4ccb153
Add a tags both equal match.
|
9 years ago |
|
Adam Ierymenko
|
adeb7e7da0
Make capability flags match more user-friendly and appropriate since "match any flag" is generally what we want.
|
9 years ago |
|
Adam Ierymenko
|
988049f39b
Add new rule to rules engine: random match.
|
9 years ago |
|
Adam Ierymenko
|
7e4b6b594b
It now builds.
|
9 years ago |
|
Adam Ierymenko
|
eac3667ec1
Bunch more refactoring and work on revocations, etc.
|
9 years ago |
|
Adam Ierymenko
|
1f74dd4589
Revocation work in progress, add WATCH which is TEE with implicit rate sync (thanks JG@DCVC!), and clean up some cruft in Network.
|
9 years ago |
|
Adam Ierymenko
|
15402933bc
Add physical MTU recommendation hint to network config via API.
|
9 years ago |
|
Adam Ierymenko
|
5b6d27e659
Implement relay policy, and setting multicast limit to 0 now disables multicast on the network as would be expected.
|
9 years ago |
|
Adam Ierymenko
|
0d4109a9f1
More refactoring to clean up code, and add a gate function to make sure we do not handle OK packets we did not expect. This hardens up a few potential edge cases around security, since such messages might be used to e.g. pollute a cache and DOS under certain conditions.
|
9 years ago |
|
Adam Ierymenko
|
b5c86b6ba4
Bunch more path refactoring. Peers no longer forget paths, but do not normally use expired paths. Expired paths might still be tried if nothing else is reachable.
|
9 years ago |
|
Adam Ierymenko
|
eebcf08084
Tweaks to new Path code for dual-stack operation, and other fixes.
|
9 years ago |
|
Adam Ierymenko
|
8b6d23b9f6
Optimize filter code a bit, and add a network-level setting for what should happen if an unsupported or unknown MATCH is encountered in a rules table.
|
9 years ago |
|
Adam Ierymenko
|
54489a7f61
rename SAMENESS to DIFFERENCE which is less confusing
|
9 years ago |
|
Adam Ierymenko
|
8e3004591b
Add overlooked MATCH_ICMP to rule set.
|
9 years ago |
|
Adam Ierymenko
|
ded5a53a6c
Documentation updates, add rules engine revision to network config request meta-data.
|
9 years ago |
|
Adam Ierymenko
|
d637988ccf
Fix chicken or egg problem in tags, and better filter debug instrumentation.
|
9 years ago |
|
Adam Ierymenko
|
5eaf397a94
Add a debug log feature in the filter, which only works if enabled in Network.cpp.
|
9 years ago |
|
Adam Ierymenko
|
95ff057e04
Increase rule limits a little since chunking in netconf can accomodate this.
|
9 years ago |
|
Adam Ierymenko
|
2cdda38dc4
It basically works... at least on current controllers.
|
9 years ago |
|
Adam Ierymenko
|
ccea3d04d6
Push NETWORK_CONFIG_REFRESH on POSTs to /member/... in controller.
|
9 years ago |
|
Adam Ierymenko
|
8e3463d47a
Add length limit to TEE and REDIRECT, and completely factor out old C json-parser to eliminate a dependency.
|
9 years ago |
|
Adam Ierymenko
|
e2f783ebbd
.
|
9 years ago |
|
Adam Ierymenko
|
4d9b74b171
.
|
9 years ago |
|
Adam Ierymenko
|
98152d974a
More cleanup and removal of DeferredPackets, will do the latter in a more elegant way.
|
9 years ago |
|
Adam Ierymenko
|
7e6e56e2bc
Bunch of work on pushing and replication of tags and capabilities, and protocol cleanup.
|
9 years ago |
|
Adam Ierymenko
|
67cb03742e
Add tag rules and split out rule serialize/deserialize so the code can be reused.
|
9 years ago |
|
Adam Ierymenko
|
ecc1324bb0
Rules engine work: capability based security model with tags and capabilities, and some cleanup across other places.
|
9 years ago |
|
Adam Ierymenko
|
d3b0081447
Cleanup...
|
9 years ago |
|
Adam Ierymenko
|
22e44c762b
More rules engine work: key/value pair matching for microsegmentation.
|
9 years ago |
