astelm/telemt
1
0
Fork 0
mirror of https://github.com/telemt/telemt.git synced 2026-11-03 22:31:59 +03:00
Code Issues Packages Projects Releases Wiki Activity
1,996 Commits 1 Branch 120 Tags
3.5.15
Commit Graph

139 Commits

Author SHA1 Message Date
Alexey 5a5009174a Rustfmt 2026-10-30 22:34:37 +03:00
Alexey 199cc641d5 Unlimited ME client admission 2026-10-22 19:23:57 +03:00
Alexey 0416de3c27 Retain Policy Freshness after Schedule Activation for Quotas 2026-10-19 23:11:25 +03:00
Alexey 6fdc2a5ba4 Rustfmt 2026-10-19 00:15:27 +03:00
Alexey a99b548aa1 Maestro Reload: preserve admission epoch rejection during activation 2026-10-18 23:37:07 +03:00
Alexey 9738244285 WEB: bounded opt-in wildcard host routing added 2026-10-17 23:42:26 +03:00
Alexey 831cd0f1a7 WEB: share immutable profiles + decoys across exact host lists 2026-10-15 07:05:36 +03:00
Alexey bc1c130f38 WEB: Resolve opt-in decoy hostnames during config preparation #929 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-10-04 14:32:06 +03:00
Alexey d65efcc479 Fix autonomous ME recovery from Direct fallback 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-10-02 23:51:14 +03:00
Alexey 53f131e34d Runtime Paths Checks as opt-in #935 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-09-29 19:24:29 +03:00
Alexey 38eabc50e3 WEB: Base Path: security + reload coverage fixes&tests 2026-09-26 14:25:24 +03:00
Alexey 5feded2919 WEB: Base Path added 2026-09-26 13:49:28 +03:00
Alexey 326c0ecdb9 Rustfmt 2026-09-25 19:49:36 +03:00
Alexey c12c5c73c1 Conntrack: Firewall reconciliation process-owned&transactional 2026-09-25 19:35:31 +03:00
Alexey f1107c21d9 Process-wide concurrency + Cancellation ownership fixes 2026-09-23 22:30:51 +03:00
Alexey d706b3f3ba Hardswap Invariants in tests + Quota fixes 2026-09-20 00:28:52 +03:00
Alexey 89dacbd17e TOCTOU and lifecycle races across runtime boundaries fixes 2026-09-19 22:37:22 +03:00
Alexey acad414cc7 Runtime paths symlink preserved + User Admission Registration 2026-09-18 23:11:09 +03:00
Alexey 02f66c542e Descriptor-anchored Secured Filesystem Operations 2026-09-17 22:45:48 +03:00
Alexey 55f3d19ee0 Direct-since-epoch 2026-09-15 20:37:41 +03:00
Alexey 0ac236955a Proxy Shared User Drafts 2026-09-14 20:19:48 +03:00
Alexey 844e41ea34 Races in admission + accounting + publication,+ PID fixed 2026-09-09 22:45:02 +03:00
Alexey 20a4d50524 Restart-gated Decoy Fast-Track 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-09-06 18:51:13 +03:00
Alexey 106b26a5b7 Decoy Fasttrack Drafts 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-09-05 21:18:48 +03:00
Alexey 9f023ff9c7 WEB Bounded Bridge Recovery added 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-09-04 19:01:56 +03:00
Alexey 718ce0847e WEB Carrier Counters + Status 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-31 21:39:09 +03:00
Alexey 66f2b8889f Split oversized runtime modules + Async tests hardened 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-30 09:39:33 +03:00
Alexey 281f63f940 Runtime Ownership hardened 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-30 08:38:03 +03:00
Alexey 084834f5ec API for WEB: bounded lifecycle and overload observability added 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-29 16:19:21 +03:00
Alexey cf0cd08387 WEB Knobs in API 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-27 21:42:14 +03:00
Alexey f73f52a033 WEB: Lifecycle + Lane ownership + Diag fixes 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-27 09:02:19 +03:00
Alexey d2edd90479 WEB: websocket + websocket-lanes as Carrier 2026-08-26 09:16:06 +03:00
Alexey e774bc8c9a WEB Debug + Trace 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-25 12:59:41 +03:00
Alexey 1a18f2452f Fixed routing across endpoint refresh 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-08-23 20:43:22 +03:00
Alexey 840b6f563a Rustfmt 2026-08-23 10:56:00 +03:00
Alexey 1029703c2c WEB 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
Co-Authored-By: John Preston <17900494+john-preston@users.noreply.github.com>
 2026-08-23 03:12:53 +03:00
Alexey fb47ad149c Rustfmt 2026-08-22 16:31:49 +03:00
Alexey 7f4b87bea4 Redesign runtime w/ include-aware config + Module Split + Listener Lifecycle + Atomic Reload 2026-08-22 16:13:25 +03:00
Alexey 189e10800a Hardened listener reload + config persistence + SYN Limit startup safety 2026-08-22 13:45:57 +03:00
Alexey 25e76a3afb Merge pull request #884 from vgrebenschikov/feature/synlimit-pf-support 
Add PF synlimit backend
 2026-08-12 21:17:40 +03:00
Alexey 064cd0da61 Merge branch 'flow/3.5.0' into flow-bulk-mss 2026-08-12 21:05:14 +03:00
Alexey 7289621458 Update listeners.rs 2026-08-12 21:03:51 +03:00
Vladimir Grebenshchikov e2eec67a33 Add PF synlimit backend 
Implement synlimit = "pf" for PF-based firewalls using per-listener source tracking rules in a Telemt-owned anchor.

PF evaluates max-src-conn-rate through source tracking when creating
tates for completed TCP connections. Telemt installs a rate-limited pass
rule followed by a reject fallback rule in the listener anchor:

  - under-limit new connections create PF state and pass;
  - over-limit new connections fall through to block return-rst;
  - access resumes automatically when the source rate drops below the configured window.

Keep Linux iptables/nftables behavior unchanged.
PF maps synlimit_hitcount / synlimit_seconds to max-src-conn-rate and intentionally has
no direct equivalent for Linux-only burst/hashlimit knobs.
 2026-07-20 09:43:46 +02:00
Alexey a5216d77fb Rustfmt 2026-07-19 18:41:23 +03:00
Alexey 4679bdcfd5 Atomic Maestro Sessions + Shutdown gate 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-19 16:10:42 +03:00
Alexey c6f40e3717 Harden Maestro reload lifecycle and readiness barriers 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-18 14:27:24 +03:00
Alexey 61ec46c2db Merge pull request #871 from xaer981/fix/client-mss-bulk 
fix(server): client_mss_bulk — fragment only ServerHello, keep bulk MSS from start
 2026-07-18 14:02:03 +03:00
Alexey 991d5b2c38 Maestro: add in-process runtime generation reload 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
 2026-07-17 23:56:00 +03:00
Alexey 73afeccae1 Rustfmt 2026-07-13 12:20:24 +03:00
Yaroslav Petrovskikh 5e9d99bb4d fix(server): fragment only the initial FakeTLS response 2026-07-13 11:26:48 +03:00