astelm/telemt
1
0
Fork 0
mirror of https://github.com/telemt/telemt.git synced 2026-10-11 11:55:59 +03:00
Code Issues Packages Projects Releases Wiki Activity
1,924 Commits 1 Branch 118 Tags
326c0ecdb9b74d22e4159615ae0670037ea98a4d
Commit Graph

127 Commits

Author SHA1 Message Date
Alexey 326c0ecdb9 Rustfmt 2026-09-25 19:49:36 +03:00
Alexey c12c5c73c1 Conntrack: Firewall reconciliation process-owned&transactional 2026-09-25 19:35:31 +03:00
Alexey f1107c21d9 Process-wide concurrency + Cancellation ownership fixes 2026-09-23 22:30:51 +03:00
Alexey d706b3f3ba Hardswap Invariants in tests + Quota fixes 2026-09-20 00:28:52 +03:00
Alexey 89dacbd17e TOCTOU and lifecycle races across runtime boundaries fixes 2026-09-19 22:37:22 +03:00
Alexey acad414cc7 Runtime paths symlink preserved + User Admission Registration 2026-09-18 23:11:09 +03:00
Alexey 02f66c542e Descriptor-anchored Secured Filesystem Operations 2026-09-17 22:45:48 +03:00
Alexey 55f3d19ee0 Direct-since-epoch 2026-09-15 20:37:41 +03:00
Alexey 0ac236955a Proxy Shared User Drafts 2026-09-14 20:19:48 +03:00
Alexey 844e41ea34 Races in admission + accounting + publication,+ PID fixed 2026-09-09 22:45:02 +03:00
Alexey 20a4d50524 Restart-gated Decoy Fast-Track 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-09-06 18:51:13 +03:00
Alexey 106b26a5b7 Decoy Fasttrack Drafts 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-09-05 21:18:48 +03:00
Alexey 9f023ff9c7 WEB Bounded Bridge Recovery added 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-09-04 19:01:56 +03:00
Alexey 718ce0847e WEB Carrier Counters + Status 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-31 21:39:09 +03:00
Alexey 66f2b8889f Split oversized runtime modules + Async tests hardened 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-30 09:39:33 +03:00
Alexey 281f63f940 Runtime Ownership hardened 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-30 08:38:03 +03:00
Alexey 084834f5ec API for WEB: bounded lifecycle and overload observability added 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-29 16:19:21 +03:00
Alexey cf0cd08387 WEB Knobs in API 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-27 21:42:14 +03:00
Alexey f73f52a033 WEB: Lifecycle + Lane ownership + Diag fixes 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-27 09:02:19 +03:00
Alexey d2edd90479 WEB: websocket + websocket-lanes as Carrier 2026-08-26 09:16:06 +03:00
Alexey e774bc8c9a WEB Debug + Trace 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-25 12:59:41 +03:00
Alexey 1a18f2452f Fixed routing across endpoint refresh 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-23 20:43:22 +03:00
Alexey 840b6f563a Rustfmt 2026-08-23 10:56:00 +03:00
Alexey 1029703c2c WEB 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
Co-Authored-By: John Preston <17900494+john-preston@users.noreply.github.com>
 2026-08-23 03:12:53 +03:00
Alexey fb47ad149c Rustfmt 2026-08-22 16:31:49 +03:00
Alexey 7f4b87bea4 Redesign runtime w/ include-aware config + Module Split + Listener Lifecycle + Atomic Reload 2026-08-22 16:13:25 +03:00
Alexey 189e10800a Hardened listener reload + config persistence + SYN Limit startup safety 2026-08-22 13:45:57 +03:00
Alexey 25e76a3afb Merge pull request #884 from vgrebenschikov/feature/synlimit-pf-support 
Add PF synlimit backend
 2026-08-12 21:17:40 +03:00
Alexey 064cd0da61 Merge branch 'flow/3.5.0' into flow-bulk-mss 2026-08-12 21:05:14 +03:00
Alexey 7289621458 Update listeners.rs 2026-08-12 21:03:51 +03:00
Vladimir Grebenshchikov e2eec67a33 Add PF synlimit backend 
Implement synlimit = "pf" for PF-based firewalls using per-listener source tracking rules in a Telemt-owned anchor.

PF evaluates max-src-conn-rate through source tracking when creating
tates for completed TCP connections. Telemt installs a rate-limited pass
rule followed by a reject fallback rule in the listener anchor:

  - under-limit new connections create PF state and pass;
  - over-limit new connections fall through to block return-rst;
  - access resumes automatically when the source rate drops below the configured window.

Keep Linux iptables/nftables behavior unchanged.
PF maps synlimit_hitcount / synlimit_seconds to max-src-conn-rate and intentionally has
no direct equivalent for Linux-only burst/hashlimit knobs.
 2026-07-20 09:43:46 +02:00
Alexey a5216d77fb Rustfmt 2026-07-19 18:41:23 +03:00
Alexey 4679bdcfd5 Atomic Maestro Sessions + Shutdown gate 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-19 16:10:42 +03:00
Alexey c6f40e3717 Harden Maestro reload lifecycle and readiness barriers 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-18 14:27:24 +03:00
Alexey 61ec46c2db Merge pull request #871 from xaer981/fix/client-mss-bulk 
fix(server): client_mss_bulk — fragment only ServerHello, keep bulk MSS from start
 2026-07-18 14:02:03 +03:00
Alexey 991d5b2c38 Maestro: add in-process runtime generation reload 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-17 23:56:00 +03:00
Alexey 73afeccae1 Rustfmt 2026-07-13 12:20:24 +03:00
Yaroslav Petrovskikh 5e9d99bb4d fix(server): fragment only the initial FakeTLS response 2026-07-13 11:26:48 +03:00
Alexey ea296bbdc8 Replace per-session pool trimming with pressure hysteresis 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 21:36:01 +03:00
Alexey 96425f15c8 Bound Direct relay buffers with an adaptive global memory envelope 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 20:56:54 +03:00
Alexey d4c4980e5a Bound ME writer queues by resident payload bytes 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 18:43:42 +03:00
Alexey 87c82c2a63 Add bounded file logging rotation and retention #832 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-24 00:16:02 +03:00
Alexey e994ddea00 Accept advertised logging flags in CLI by #848 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-23 23:20:12 +03:00
Alexey d414c73c9b Hardened KDF-Tuple + NAT Probing + Paddings 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-14 16:15:41 +03:00
Alexey 2675779915 Fix SYN limiter lifecycle and default burst 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-12 14:40:26 +03:00
Alexey 1cbde70a14 Add per-listener SYN limiter for Netfilter control 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-11 23:58:48 +03:00
Alexey 27a5f5a4ec MSS Tuning with config 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-06 12:11:05 +03:00
Alexey 462215b53c Dual-stack fixes for Upstreams by #798 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-01 19:50:26 +03:00
Alexey 2264980926 User Disabler in API by #814 + Consistent Listeners in API by #800 2026-05-31 11:17:18 +03:00
Aleksei K a77aedfd7a Atomically claim pressure eviction budget in MR 2026-05-29 13:17:47 +03:00