astelm/telemt
1
0
Fork 0
mirror of https://github.com/telemt/telemt.git synced 2026-11-01 13:21:58 +03:00
Code Issues Packages Projects Releases Wiki Activity
1,912 Commits 1 Branch 120 Tags
9a683d8b3d6241a38734628fcc43c3077a5b51a7
Commit Graph

271 Commits

Author SHA1 Message Date
Alexey 9a683d8b3d Slot Budget + Config Store Atomic Writer fixes + Trusted Command 2026-09-16 22:06:59 +03:00
Alexey 0ac236955a Proxy Shared User Drafts 2026-09-14 20:19:48 +03:00
Alexey 844e41ea34 Races in admission + accounting + publication,+ PID fixed 2026-09-09 22:45:02 +03:00
Alexey 021ad1fe68 WEB Bridge Sideband 2026-09-08 21:29:32 +03:00
Alexey 20a4d50524 Restart-gated Decoy Fast-Track 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-09-06 18:51:13 +03:00
Alexey 106b26a5b7 Decoy Fasttrack Drafts 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-09-05 21:18:48 +03:00
Alexey 9f023ff9c7 WEB Bounded Bridge Recovery added 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-09-04 19:01:56 +03:00
Alexey 9170e347f5 Concurrent Uplinks w/ wrong single-flight recovery fixes 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-09-02 18:55:32 +03:00
Alexey 01ffca5d34 WEB Session Lifecycle Observability + Bridge Recovery Drafts 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-09-01 19:19:52 +03:00
Alexey 718ce0847e WEB Carrier Counters + Status 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-31 21:39:09 +03:00
Alexey 66f2b8889f Split oversized runtime modules + Async tests hardened 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-30 09:39:33 +03:00
Alexey 281f63f940 Runtime Ownership hardened 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-30 08:38:03 +03:00
Alexey 084834f5ec API for WEB: bounded lifecycle and overload observability added 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-29 16:19:21 +03:00
Alexey cf0cd08387 WEB Knobs in API 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-27 21:42:14 +03:00
Alexey c75cf5cc9d Carrier negotiation + WebSocket lifecycle 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-27 07:38:42 +03:00
Alexey 14e8d10ad3 Rustfmt 2026-08-27 00:06:37 +03:00
Alexey 34eeb2d856 WEB Carriers Safe-matrix Refactored 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-26 20:33:33 +03:00
Alexey f180057973 Carriers Auto-negotiation Aggressiveness 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-26 18:33:56 +03:00
Alexey 923c79796a Bounded Debugging + Websocket Carriers + Carriers Negotiation 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-26 17:00:20 +03:00
Alexey d2edd90479 WEB: websocket + websocket-lanes as Carrier 2026-08-26 09:16:06 +03:00
Alexey e774bc8c9a WEB Debug + Trace 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-25 12:59:41 +03:00
Alexey 1bd85535f4 WEB Handshake OPEN -> DATA Misuse fixed 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-23 17:09:45 +03:00
Alexey 840b6f563a Rustfmt 2026-08-23 10:56:00 +03:00
Alexey 030466603f WEB Carrier behavior aligned w/ reference 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-23 10:22:13 +03:00
Alexey 90c0d65e1b WEB Carrier: https-lanes 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-23 09:04:53 +03:00
Alexey 1029703c2c WEB 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
Co-Authored-By: John Preston <17900494+john-preston@users.noreply.github.com>
 2026-08-23 03:12:53 +03:00
Alexey fb47ad149c Rustfmt 2026-08-22 16:31:49 +03:00
Alexey 7f4b87bea4 Redesign runtime w/ include-aware config + Module Split + Listener Lifecycle + Atomic Reload 2026-08-22 16:13:25 +03:00
Alexey 189e10800a Hardened listener reload + config persistence + SYN Limit startup safety 2026-08-22 13:45:57 +03:00
Alexey c488970569 Merge pull request #877 from anton-vinogradov/fix/synlimit-default-burst 
fix(synlimit): raise default synlimit_burst from 1 to 24
 2026-08-12 21:26:16 +03:00
Alexey 25e76a3afb Merge pull request #884 from vgrebenschikov/feature/synlimit-pf-support 
Add PF synlimit backend
 2026-08-12 21:17:40 +03:00
Alexey 064cd0da61 Merge branch 'flow/3.5.0' into flow-bulk-mss 2026-08-12 21:05:14 +03:00
Vladimir Grebenshchikov e2eec67a33 Add PF synlimit backend 
Implement synlimit = "pf" for PF-based firewalls using per-listener source tracking rules in a Telemt-owned anchor.

PF evaluates max-src-conn-rate through source tracking when creating
tates for completed TCP connections. Telemt installs a rate-limited pass
rule followed by a reject fallback rule in the listener anchor:

  - under-limit new connections create PF state and pass;
  - over-limit new connections fall through to block return-rst;
  - access resumes automatically when the source rate drops below the configured window.

Keep Linux iptables/nftables behavior unchanged.
PF maps synlimit_hitcount / synlimit_seconds to max-src-conn-rate and intentionally has
no direct equivalent for Linux-only burst/hashlimit knobs.
 2026-07-20 09:43:46 +02:00
Alexey 61ec46c2db Merge pull request #871 from xaer981/fix/client-mss-bulk 
fix(server): client_mss_bulk — fragment only ServerHello, keep bulk MSS from start
 2026-07-18 14:02:03 +03:00
Alexey 991d5b2c38 Maestro: add in-process runtime generation reload 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-17 23:56:00 +03:00
Anton Vinogradov f770756cba fix(synlimit): raise default synlimit_burst from 1 to 24 
The generic-path SYN limiter default of burst=1 admits only one new
connection per source IP, then refills at 48/minute (0.8/s). Telegram
clients open several connections at once on startup/reconnect, so the
extra SYNs are rejected with TCP RST until a token accrues — clients
intermittently fail to connect until the app is restarted.

The iOS fast-path (meta length 64) does not match real-world traffic
behind carrier NAT/NAT64 (SYNs arrive as 60 bytes), so the generic path
governs all clients, iPhone included. Raise its default burst to 24 —
the value already used by the iOS path — so a legitimate startup fan-out
passes. Steady-state rate (48/minute) is unchanged, preserving the
anti-TSPU posture.

Updates the default constant, the default-assertion test, and the EN/RU/DE
CONFIG_PARAMS docs.
 2026-07-16 13:04:23 +03:00
Alexey 73afeccae1 Rustfmt 2026-07-13 12:20:24 +03:00
Yaroslav Petrovskikh 5e9d99bb4d fix(server): fragment only the initial FakeTLS response 2026-07-13 11:26:48 +03:00
Alexey 96425f15c8 Bound Direct relay buffers with an adaptive global memory envelope 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 20:56:54 +03:00
Alexey d4c4980e5a Bound ME writer queues by resident payload bytes 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-11 18:43:42 +03:00
Alexey b8be805aed Rustfmt 2026-07-06 20:12:36 +03:00
Alexey a1ebd44cee Update load_basic_tests.rs 2026-07-05 19:58:37 +03:00
Alexey 3375017460 Add the new key to the hot-reload snapshot type 2026-07-04 13:11:08 +03:00
Alexey 25e0abae8a Validate duplicate normalized auto-templates 2026-07-04 12:35:22 +03:00
Alexey 50538d234e CidrRateLimitKey with IpNetwork parsing and serialization added 2026-07-04 10:54:55 +03:00
Alexey 81ae483201 Add regression coverage for ME routing, D2C padding, synlimit, and MSS bulk validation 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-30 13:13:11 +03:00
Alexey 82f63d0d8a Split config loader helpers into focused modules 2026-06-28 17:25:03 +03:00
Alexey 558f352a57 Synlimit V2 2026-06-28 12:53:28 +03:00
Alexey 87c82c2a63 Add bounded file logging rotation and retention #832 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-06-24 00:16:02 +03:00
Alexey 840713a359 Merge pull request #847 from AndreyOsipuk/feat/client-mss-relay 
feat(server): client_mss_bulk — fragment only the handshake, restore MSS for bulk data (cuts pps)
 2026-06-20 22:10:04 +03:00