astelm/telemt
1
0
Fork 0
mirror of https://github.com/telemt/telemt.git synced 2026-07-15 16:30:20 +03:00
Code Issues Packages Projects Releases Wiki Activity
1,773 Commits 2 Branches 101 Tags
8c65cd868cdca89db550f6388f0a82b9a7ef2c94
Commit Graph

682 Commits

Author SHA1 Message Date
Alexey 8c65cd868c Enable expanded AES key schedule zeroization 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 21:43:01 +03:00
Alexey ea296bbdc8 Replace per-session pool trimming with pressure hysteresis 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 21:36:01 +03:00
Alexey fb042f826e Optimize crypto and Fake-TLS buffer residency 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 21:22:17 +03:00
Alexey 96425f15c8 Bound Direct relay buffers with an adaptive global memory envelope 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 20:56:54 +03:00
Alexey d4c4980e5a Bound ME writer queues by resident payload bytes 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 18:43:42 +03:00
Alexey 893ce0cf36 Hold C2ME byte permits through ME writer completion 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-10 16:35:39 +03:00
Alexey b8be805aed Rustfmt 2026-07-06 20:12:36 +03:00
Alexey a1ebd44cee Update load_basic_tests.rs 2026-07-05 19:58:37 +03:00
Alexey 25d02a8e0e Update traffic_limiter.rs 2026-07-04 15:45:51 +03:00
Alexey 3375017460 Add the new key to the hot-reload snapshot type 2026-07-04 13:11:08 +03:00
Alexey 25e0abae8a Validate duplicate normalized auto-templates 2026-07-04 12:35:22 +03:00
Alexey 50538d234e CidrRateLimitKey with IpNetwork parsing and serialization added 2026-07-04 10:54:55 +03:00
Alexey 451227da60 Namespace synlimit netfilter rules per target set 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-01 01:47:14 +03:00
Alexey 81ae483201 Add regression coverage for ME routing, D2C padding, synlimit, and MSS bulk validation 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-30 13:13:11 +03:00
Alexey a0ac108807 Secure + VersionD Outbound Paddings Fix 2026-06-29 13:56:16 +03:00
Alexey b9c5c71dbc Restore ME writer source IP for initial proxy request binding 2026-06-29 12:37:31 +03:00
Alexey 9a9fd3f55d Update d2c.rs 2026-06-29 11:37:30 +03:00
Alexey 82f63d0d8a Split config loader helpers into focused modules 2026-06-28 17:25:03 +03:00
Alexey fce75163b0 Rustfmt 2026-06-28 15:45:53 +03:00
Alexey fe56621a83 Delete synlimit_control.rs 2026-06-28 15:43:26 +03:00
Alexey d67e7c5a6f Update mod.rs 2026-06-28 15:29:54 +03:00
Alexey 558f352a57 Synlimit V2 2026-06-28 12:53:28 +03:00
Alexey f56895feac Bump -> 3.4.19 2026-06-24 00:53:01 +03:00
Alexey 87c82c2a63 Add bounded file logging rotation and retention #832 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-24 00:16:02 +03:00
Alexey 7e5a1841b1 Skip netfilter cleanup without CAP_NET_ADMIN by #845 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-24 00:11:11 +03:00
Alexey e994ddea00 Accept advertised logging flags in CLI by #848 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-23 23:20:12 +03:00
Alexey 840713a359 Merge pull request #847 from AndreyOsipuk/feat/client-mss-relay 
feat(server): client_mss_bulk — fragment only the handshake, restore MSS for bulk data (cuts pps)
 2026-06-20 22:10:04 +03:00
Andrey Osipuk 50b67a93d6 feat(server): client_mss_bulk — raise MSS after handshake to cut pps 
client_mss (e.g. "tspu", MSS=92) fragments the whole connection to evade
DPI on the ServerHello, but it also fragments bulk payload, multiplying
outgoing packets-per-second ~10x. On hosts whose abuse detection counts
pps (not bandwidth) this trips packet-flood limits.

Add an optional [server].client_mss_bulk: keep the low client_mss for the
handshake (ServerHello stays fragmented => DPI bypass intact), then raise
the client socket MSS to client_mss_bulk once the connection enters the
post-handshake (bulk transfer) phase, so bulk data uses normal-size
segments and pps drops back to normal. Same preset/int grammar as
client_mss. Opt-in: when unset, the handshake MSS is kept for the whole
connection (unchanged behavior).

Linux-only (setsockopt TCP_MAXSEG via raw fd, mirroring TCP_USER_TIMEOUT);
no-op on other unix. Documented in CONFIG_PARAMS.{en,ru}.
 2026-06-19 11:11:01 +03:00
Alexey 72800e4aa7 Harden masking fallback and frame readers after flow sync 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-17 21:48:57 +03:00
Mirotin Artem 869d8517a0 Rustfmt 2026-06-15 10:40:45 +03:00
Mirotin Artem e82ce634d6 Use tokio::fs for I/O in config API tests 
The save and patch paths under test are async, so the tests now use tokio::fs instead of blocking std::fs. The config_store tests also switch to tempfile::tempdir() for panic-safe cleanup instead of manual remove_dir_all.
 2026-06-15 10:05:09 +03:00
Mirotin Artem f1f46fac42 Fix config API corrupting nested sub-tables on save 
render_top_level_section serialized a section in isolation, so nested sub-tables ([general.links], [general.modes]) were emitted as bare [links]/[modes] top-level headers and duplicated on load. Serialize the section inside a wrapper keyed by its name to keep dotted headers.

find_toml_table_bounds only spanned the first contiguous block, leaving scattered sub-tables behind as duplicates on repeated saves. Replace it with find_all_table_blocks and drop every block belonging to the section during upsert.

show_link is a legacy top-level scalar/array, not a [table]; the upsert machinery appended a bare key at EOF (landing inside the previous table) and duplicated it on repeat. Remove it from EDITABLE_SECTIONS; the editable general.links.show sub-table covers the case.

Add tests for dotted sub-tables, idempotent saves, non-contiguous layouts, show_link rejection, and integer/float/string coercion of public_port.
 2026-06-15 09:49:47 +03:00
Alexey 37d0184a0b Implement shared MTProto framing and ME address role separation 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-15 08:50:08 +03:00
Alexey d81d7dba62 Rustfmt 2026-06-14 19:59:06 +03:00
Alexey 04b8d8365c Account for full-word paddings in roundtrip tests 2026-06-14 19:38:54 +03:00
Alexey 2e26bfb86e Updated secure padding expectations for VersionD 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-14 16:33:41 +03:00
Alexey d414c73c9b Hardened KDF-Tuple + NAT Probing + Paddings 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-14 16:15:41 +03:00
Alexey b153782597 More efficient Relay Mode 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-13 23:22:50 +03:00
Alexey 2675779915 Fix SYN limiter lifecycle and default burst 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-12 14:40:26 +03:00
Alexey c4954f745f Restore single-record TLS-F primary application flight 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-12 12:44:22 +03:00
Alexey 9904da737a Rustfmt 2026-06-12 01:28:41 +03:00
Alexey 9a3ff726b2 Use token-bucket SYN limiter backends 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-12 01:27:03 +03:00
Alexey 942882f9de SYN Limiter interval and hitcount in Config 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-12 00:29:23 +03:00
Alexey eeff16c3fd Rustfmt 2026-06-12 00:01:01 +03:00
Alexey 1cbde70a14 Add per-listener SYN limiter for Netfilter control 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-11 23:58:48 +03:00
Alexey 26cd4734de Update tls.rs 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-11 23:29:10 +03:00
Alexey 52a1b66ad7 Syntactic key shares for TLS-F 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-11 23:13:21 +03:00
Alexey b43c683615 Rustfmt 2026-06-11 19:59:48 +03:00
Alexey e41470fb4c Update fetcher.rs 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-11 19:52:23 +03:00
Alexey 09dc0cb76c Update handshake_security_tests.rs 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-11 19:44:39 +03:00