astelm/telemt
1
0
Fork 0
mirror of https://github.com/telemt/telemt.git synced 2026-09-09 03:54:07 +03:00
Code Issues Packages Projects Releases Wiki Activity
1,800 Commits 1 Branch 111 Tags
25e76a3afbb27d34078d9fb8ae9641bd772cbec7
Commit Graph

100 Commits

Author SHA1 Message Date
Alexey 25e76a3afb Merge pull request #884 from vgrebenschikov/feature/synlimit-pf-support 
Add PF synlimit backend
 2026-08-12 21:17:40 +03:00
Alexey 064cd0da61 Merge branch 'flow/3.5.0' into flow-bulk-mss 2026-08-12 21:05:14 +03:00
Alexey 7289621458 Update listeners.rs 2026-08-12 21:03:51 +03:00
Vladimir Grebenshchikov e2eec67a33 Add PF synlimit backend 
Implement synlimit = "pf" for PF-based firewalls using per-listener source tracking rules in a Telemt-owned anchor.

PF evaluates max-src-conn-rate through source tracking when creating
tates for completed TCP connections. Telemt installs a rate-limited pass
rule followed by a reject fallback rule in the listener anchor:

  - under-limit new connections create PF state and pass;
  - over-limit new connections fall through to block return-rst;
  - access resumes automatically when the source rate drops below the configured window.

Keep Linux iptables/nftables behavior unchanged.
PF maps synlimit_hitcount / synlimit_seconds to max-src-conn-rate and intentionally has
no direct equivalent for Linux-only burst/hashlimit knobs.
 2026-07-20 09:43:46 +02:00
Alexey a5216d77fb Rustfmt 2026-07-19 18:41:23 +03:00
Alexey 4679bdcfd5 Atomic Maestro Sessions + Shutdown gate 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-19 16:10:42 +03:00
Alexey c6f40e3717 Harden Maestro reload lifecycle and readiness barriers 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-18 14:27:24 +03:00
Alexey 61ec46c2db Merge pull request #871 from xaer981/fix/client-mss-bulk 
fix(server): client_mss_bulk — fragment only ServerHello, keep bulk MSS from start
 2026-07-18 14:02:03 +03:00
Alexey 991d5b2c38 Maestro: add in-process runtime generation reload 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-17 23:56:00 +03:00
Alexey 73afeccae1 Rustfmt 2026-07-13 12:20:24 +03:00
Yaroslav Petrovskikh 5e9d99bb4d fix(server): fragment only the initial FakeTLS response 2026-07-13 11:26:48 +03:00
Alexey ea296bbdc8 Replace per-session pool trimming with pressure hysteresis 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 21:36:01 +03:00
Alexey 96425f15c8 Bound Direct relay buffers with an adaptive global memory envelope 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 20:56:54 +03:00
Alexey d4c4980e5a Bound ME writer queues by resident payload bytes 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 18:43:42 +03:00
Alexey 87c82c2a63 Add bounded file logging rotation and retention #832 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-24 00:16:02 +03:00
Alexey e994ddea00 Accept advertised logging flags in CLI by #848 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-23 23:20:12 +03:00
Alexey d414c73c9b Hardened KDF-Tuple + NAT Probing + Paddings 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-14 16:15:41 +03:00
Alexey 2675779915 Fix SYN limiter lifecycle and default burst 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-12 14:40:26 +03:00
Alexey 1cbde70a14 Add per-listener SYN limiter for Netfilter control 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-11 23:58:48 +03:00
Alexey 27a5f5a4ec MSS Tuning with config 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-06 12:11:05 +03:00
Alexey 462215b53c Dual-stack fixes for Upstreams by #798 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-01 19:50:26 +03:00
Alexey 2264980926 User Disabler in API by #814 + Consistent Listeners in API by #800 2026-05-31 11:17:18 +03:00
Aleksei K a77aedfd7a Atomically claim pressure eviction budget in MR 2026-05-29 13:17:47 +03:00
Alexey 31da0a1356 Fixes for Disable Colors 2026-05-26 12:20:28 +03:00
Alexey 98c985091c Decomposing hot-path modules into focused submodules 
Signed-off-by: Alexey <247128645+axkurcom@users.noreply.github.com>
 2026-05-21 18:03:55 +03:00
Alexey 70d02910b7 Fixes for SILENT-mode by #792 
Signed-off-by: Alexey <247128645+axkurcom@users.noreply.github.com>
 2026-05-20 10:54:37 +03:00
Alexey 914f141715 Exclusive Mask + Startup Speed-up 
Signed-off-by: Alexey <247128645+axkurcom@users.noreply.github.com>
 2026-05-19 22:17:59 +03:00
Alexey 57b2aa0453 Rustfmt 2026-05-10 14:14:52 +03:00
Alexey eef2a38c75 Type Route Cutovers + Reduce IP Tracker cleanup pressure 2026-05-10 13:55:01 +03:00
Alexey 6cb72b3b6c Explicit Reasons of Session Fallback Cleanup + ME Close 2026-05-10 13:50:36 +03:00
Alexey 090b2ca636 Stats and Cleanup-proccess beyond Hot-path 2026-05-10 13:43:41 +03:00
Alexey f0f2bc0482 Limit&Quota Saving as File + API 2026-05-08 14:38:24 +03:00
Alexey 86573be493 Event-driven Wakeup for ME Admission-gate 2026-05-08 13:34:41 +03:00
astronaut808 9f9ca9f270 Add TLS front profile health metrics 2026-05-03 18:07:24 +05:00
Alexey 8520955a5f Update helpers.rs 
Signed-off-by: Alexey <247128645+axkurcom@users.noreply.github.com>
 2026-04-29 15:53:27 +03:00
Alexey 065786b839 TLS Fetcher on multiple tls_domains by #750 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
Signed-off-by: Alexey <247128645+axkurcom@users.noreply.github.com>
 2026-04-29 11:47:42 +03:00
Alexey 8ef5263fce Fix WorkingDirectory behavior 
Signed-off-by: Alexey <247128645+axkurcom@users.noreply.github.com>
Co-Authored-By: mikhailnov <m@mikhailnov.ru>
Signed-off-by: Alexey <247128645+axkurcom@users.noreply.github.com>
 2026-04-28 12:31:21 +03:00
Alexey 67357310f7 TLS 1.2/1.3 Correctness + Full ServerHello + Rustfmt 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-04-23 21:29:18 +03:00
Alexey 8684378030 Human-readable Peer Close Classification 2026-04-21 15:46:18 +03:00
Alexey db8d333ed6 Noisy-network peer Close Errors Classification 2026-04-21 15:35:11 +03:00
Alexey 926e3aa987 Fairness Regression fixes 2026-04-21 01:11:43 +03:00
Dmitry Zarva 2a168b2600 feat: make URLS to obtain proxy_secret, getProxyConfig, getProxyConfigV6 files optionally configurable 2026-04-17 13:04:46 +00:00
Alexey 17a966b822 Rustfmt 2026-04-17 10:48:01 +03:00
Alexey 21ca1014ae Drafting Traffic Control 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-04-15 13:14:45 +03:00
Alexey 696316f919 Rustfmt 2026-04-15 01:39:47 +03:00
Alexey d7a0319696 Server.Listeners + Upstream V4/V6 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-04-15 01:32:49 +03:00
Vladislav Yaroslavlev abff2fd7fe fix(maestro): restore Windows build (missing run_inner) 
The full runtime entry was gated with #[cfg(unix)] while run() still called
run_inner() on non-Unix targets, causing E0425 on Windows (issue #690).

Extract shared pipeline into run_telemt_core with a post-bind hook for Unix
privilege dropping; provide cfg-split run_inner wrappers.

Fixes https://github.com/telemt/telemt/issues/690

Made-with: Cursor
 2026-04-13 00:21:19 +03:00
sintanial ddeda8d914 feat: add configurable RST-on-close mode for client sockets 
Add `rst_on_close` config option (off/errors/always) to control
SO_LINGER(0) behaviour on accepted TCP connections.

- `off` (default): normal FIN on all closes, no behaviour change.
- `errors`: SO_LINGER(0) set on accept, cleared after successful
  handshake auth. Pre-handshake failures (scanners, DPI probes,
  timeouts) send RST instead of FIN, eliminating FIN-WAIT-1 and
  orphan socket accumulation. Authenticated relay sessions still
  close gracefully with FIN.
- `always`: SO_LINGER(0) on accept, never cleared — all closes
  send RST regardless of handshake outcome.
 2026-04-10 05:01:38 +03:00
Alexey 3b717c75da Memory Hard-bounds + Handshake Budget in Metrics + No mutable in hotpath ConnRegistry 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-04-07 18:18:47 +03:00
Alexey fa4e2000a8 Privileges fix 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-04-06 11:10:41 +03:00