.

12 files changed, 77 insertions, 168 deletions

diff --git a/node/Constants.hpp b/node/Constants.hpp
index c7ebe347..e8a3e020 100644
--- a/node/Constants.hpp
+++ b/node/Constants.hpp
@@ -187,19 +187,13 @@
 
 /**
  * Size of RX queue
- *
- * This is about 2mb, and can be decreased for small devices. A queue smaller
- * than about 4 is probably going to cause a lot of lost packets.
  */
-#define ZT_RX_QUEUE_SIZE 64
+#define ZT_RX_QUEUE_SIZE 32
 
 /**
  * Size of TX queue
- *
- * This is about 2mb, and can be decreased for small devices. A queue smaller
- * than about 4 is probably going to cause a lot of lost packets.
  */
-#define ZT_TX_QUEUE_SIZE 64
+#define ZT_TX_QUEUE_SIZE 32
 
 /**
  * Length of secret key in bytes -- 256-bit -- do not change
diff --git a/node/IncomingPacket.cpp b/node/IncomingPacket.cpp
index 2ee56af8..aec37a6b 100644
--- a/node/IncomingPacket.cpp
+++ b/node/IncomingPacket.cpp
@@ -91,31 +91,37 @@ bool IncomingPacket::tryDecode(const RuntimeEnvironment *RR,void *tPtr)
 			}
 
 			const Packet::Verb v = verb();
+			bool r = true;
 			switch(v) {
 				//case Packet::VERB_NOP:
 				default: // ignore unknown verbs, but if they pass auth check they are "received"
 					peer->received(tPtr,_path,hops(),packetId(),payloadLength(),v,0,Packet::VERB_NOP,false,0);
-					return true;
-				case Packet::VERB_HELLO:                      return _doHELLO(RR,tPtr,true);
-				case Packet::VERB_ACK:                        return _doACK(RR,tPtr,peer);
-				case Packet::VERB_QOS_MEASUREMENT:            return _doQOS_MEASUREMENT(RR,tPtr,peer);
-				case Packet::VERB_ERROR:                      return _doERROR(RR,tPtr,peer);
-				case Packet::VERB_OK:                         return _doOK(RR,tPtr,peer);
-				case Packet::VERB_WHOIS:                      return _doWHOIS(RR,tPtr,peer);
-				case Packet::VERB_RENDEZVOUS:                 return _doRENDEZVOUS(RR,tPtr,peer);
-				case Packet::VERB_FRAME:                      return _doFRAME(RR,tPtr,peer);
-				case Packet::VERB_EXT_FRAME:                  return _doEXT_FRAME(RR,tPtr,peer);
-				case Packet::VERB_ECHO:                       return _doECHO(RR,tPtr,peer);
-				case Packet::VERB_MULTICAST_LIKE:             return _doMULTICAST_LIKE(RR,tPtr,peer);
-				case Packet::VERB_NETWORK_CREDENTIALS:        return _doNETWORK_CREDENTIALS(RR,tPtr,peer);
-				case Packet::VERB_NETWORK_CONFIG_REQUEST:     return _doNETWORK_CONFIG_REQUEST(RR,tPtr,peer);
-				case Packet::VERB_NETWORK_CONFIG:             return _doNETWORK_CONFIG(RR,tPtr,peer);
-				case Packet::VERB_MULTICAST_GATHER:           return _doMULTICAST_GATHER(RR,tPtr,peer);
-				case Packet::VERB_MULTICAST_FRAME:            return _doMULTICAST_FRAME(RR,tPtr,peer);
-				case Packet::VERB_PUSH_DIRECT_PATHS:          return _doPUSH_DIRECT_PATHS(RR,tPtr,peer);
-				case Packet::VERB_USER_MESSAGE:               return _doUSER_MESSAGE(RR,tPtr,peer);
-				case Packet::VERB_REMOTE_TRACE:               return _doREMOTE_TRACE(RR,tPtr,peer);
+					break;
+				case Packet::VERB_HELLO:                      r = _doHELLO(RR,tPtr,true); break;
+				case Packet::VERB_ACK:                        r = _doACK(RR,tPtr,peer); break;
+				case Packet::VERB_QOS_MEASUREMENT:            r = _doQOS_MEASUREMENT(RR,tPtr,peer); break;
+				case Packet::VERB_ERROR:                      r = _doERROR(RR,tPtr,peer); break;
+				case Packet::VERB_OK:                         r = _doOK(RR,tPtr,peer); break;
+				case Packet::VERB_WHOIS:                      r = _doWHOIS(RR,tPtr,peer); break;
+				case Packet::VERB_RENDEZVOUS:                 r = _doRENDEZVOUS(RR,tPtr,peer); break;
+				case Packet::VERB_FRAME:                      r = _doFRAME(RR,tPtr,peer); break;
+				case Packet::VERB_EXT_FRAME:                  r = _doEXT_FRAME(RR,tPtr,peer); break;
+				case Packet::VERB_ECHO:                       r = _doECHO(RR,tPtr,peer); break;
+				case Packet::VERB_MULTICAST_LIKE:             r = _doMULTICAST_LIKE(RR,tPtr,peer); break;
+				case Packet::VERB_NETWORK_CREDENTIALS:        r = _doNETWORK_CREDENTIALS(RR,tPtr,peer); break;
+				case Packet::VERB_NETWORK_CONFIG_REQUEST:     r = _doNETWORK_CONFIG_REQUEST(RR,tPtr,peer); break;
+				case Packet::VERB_NETWORK_CONFIG:             r = _doNETWORK_CONFIG(RR,tPtr,peer); break;
+				case Packet::VERB_MULTICAST_GATHER:           r = _doMULTICAST_GATHER(RR,tPtr,peer); break;
+				case Packet::VERB_MULTICAST_FRAME:            r = _doMULTICAST_FRAME(RR,tPtr,peer); break;
+				case Packet::VERB_PUSH_DIRECT_PATHS:          r = _doPUSH_DIRECT_PATHS(RR,tPtr,peer); break;
+				case Packet::VERB_USER_MESSAGE:               r = _doUSER_MESSAGE(RR,tPtr,peer); break;
+				case Packet::VERB_REMOTE_TRACE:               r = _doREMOTE_TRACE(RR,tPtr,peer); break;
+			}
+			if (r) {
+				RR->node->statsLogVerb((unsigned int)v,(unsigned int)size());
+				return true;
 			}
+			return false;
 		} else {
 			RR->sw->requestWhois(tPtr,RR->node->now(),sourceAddress);
 			return false;
@@ -172,7 +178,7 @@ bool IncomingPacket::_doERROR(const RuntimeEnvironment *RR,void *tPtr,const Shar
 			networkId = at<uint64_t>(ZT_PROTO_VERB_ERROR_IDX_PAYLOAD);
 			const SharedPtr<Network> network(RR->node->network(networkId));
 			const int64_t now = RR->node->now();
-			if ( (network) && (network->config().com) && (peer->rateGateIncomingComRequest(now)) )
+			if ((network)&&(network->config().com))
 				network->pushCredentialsNow(tPtr,peer->address(),now);
 		}	break;
 
@@ -644,7 +650,7 @@ bool IncomingPacket::_doFRAME(const RuntimeEnvironment *RR,void *tPtr,const Shar
 			}
 		} else {
 			_sendErrorNeedCredentials(RR,tPtr,peer,nwid);
-			RR->t->incomingNetworkAccessDenied(tPtr,network,_path,packetId(),size(),peer->address(),Packet::VERB_FRAME,true);
+			return false;
 		}
 	}
 
@@ -671,8 +677,7 @@ bool IncomingPacket::_doEXT_FRAME(const RuntimeEnvironment *RR,void *tPtr,const
 		if (!network->gate(tPtr,peer)) {
 			RR->t->incomingNetworkAccessDenied(tPtr,network,_path,packetId(),size(),peer->address(),Packet::VERB_EXT_FRAME,true);
 			_sendErrorNeedCredentials(RR,tPtr,peer,nwid);
-			peer->received(tPtr,_path,hops(),packetId(),payloadLength(),Packet::VERB_EXT_FRAME,0,Packet::VERB_NOP,false,nwid);
-			return true;
+			return false;
 		}
 
 		if (size() > ZT_PROTO_VERB_EXT_FRAME_IDX_PAYLOAD) {
@@ -953,9 +958,12 @@ bool IncomingPacket::_doMULTICAST_GATHER(const RuntimeEnvironment *RR,void *tPtr
 
 	bool trustEstablished = false;
 	if (network) {
-		if (network->gate(tPtr,peer))
+		if (network->gate(tPtr,peer)) {
 			trustEstablished = true;
-		else _sendErrorNeedCredentials(RR,tPtr,peer,nwid);
+		} else {
+			_sendErrorNeedCredentials(RR,tPtr,peer,nwid);
+			return false;
+		}
 	}
 
 	const int64_t now = RR->node->now();
@@ -997,10 +1005,8 @@ bool IncomingPacket::_doMULTICAST_FRAME(const RuntimeEnvironment *RR,void *tPtr,
 		}
 
 		if (!network->gate(tPtr,peer)) {
-			RR->t->incomingNetworkAccessDenied(tPtr,network,_path,packetId(),size(),peer->address(),Packet::VERB_MULTICAST_FRAME,true);
 			_sendErrorNeedCredentials(RR,tPtr,peer,nwid);
-			peer->received(tPtr,_path,hops(),packetId(),payloadLength(),Packet::VERB_MULTICAST_FRAME,0,Packet::VERB_NOP,false,nwid);
-			return true;
+			return false;
 		}
 
 		unsigned int gatherLimit = 0;
@@ -1075,7 +1081,7 @@ bool IncomingPacket::_doMULTICAST_FRAME(const RuntimeEnvironment *RR,void *tPtr,
 		peer->received(tPtr,_path,hops(),packetId(),payloadLength(),Packet::VERB_MULTICAST_FRAME,0,Packet::VERB_NOP,true,nwid);
 	} else {
 		_sendErrorNeedCredentials(RR,tPtr,peer,nwid);
-		peer->received(tPtr,_path,hops(),packetId(),payloadLength(),Packet::VERB_MULTICAST_FRAME,0,Packet::VERB_NOP,false,nwid);
+		return false;
 	}
 
 	return true;
@@ -1187,16 +1193,13 @@ bool IncomingPacket::_doREMOTE_TRACE(const RuntimeEnvironment *RR,void *tPtr,con
 
 void IncomingPacket::_sendErrorNeedCredentials(const RuntimeEnvironment *RR,void *tPtr,const SharedPtr<Peer> &peer,const uint64_t nwid)
 {
-	const int64_t now = RR->node->now();
-	if (peer->rateGateOutgoingComRequest(now)) {
-		Packet outp(source(),RR->identity.address(),Packet::VERB_ERROR);
-		outp.append((uint8_t)verb());
-		outp.append(packetId());
-		outp.append((uint8_t)Packet::ERROR_NEED_MEMBERSHIP_CERTIFICATE);
-		outp.append(nwid);
-		outp.armor(peer->key(),true);
-		_path->send(RR,tPtr,outp.data(),outp.size(),now);
-	}
+	Packet outp(source(),RR->identity.address(),Packet::VERB_ERROR);
+	outp.append((uint8_t)verb());
+	outp.append(packetId());
+	outp.append((uint8_t)Packet::ERROR_NEED_MEMBERSHIP_CERTIFICATE);
+	outp.append(nwid);
+	outp.armor(peer->key(),true);
+	_path->send(RR,tPtr,outp.data(),outp.size(),RR->node->now());
 }
 
 } // namespace ZeroTier
diff --git a/node/Membership.cpp b/node/Membership.cpp
index 35785283..aa6d4359 100644
--- a/node/Membership.cpp
+++ b/node/Membership.cpp
@@ -35,61 +35,41 @@
 #include "Node.hpp"
 #include "Trace.hpp"
 
-#define ZT_CREDENTIAL_PUSH_EVERY (ZT_NETWORK_AUTOCONF_DELAY / 3)
-
 namespace ZeroTier {
 
 Membership::Membership() :
 	_lastUpdatedMulticast(0),
-	_lastPushedCom(0),
 	_comRevocationThreshold(0),
 	_revocations(4),
 	_remoteTags(4),
 	_remoteCaps(4),
 	_remoteCoos(4)
 {
-	resetPushState();
 }
 
-void Membership::pushCredentials(const RuntimeEnvironment *RR,void *tPtr,const int64_t now,const Address &peerAddress,const NetworkConfig &nconf,int localCapabilityIndex,const bool force)
+void Membership::pushCredentials(const RuntimeEnvironment *RR,void *tPtr,const int64_t now,const Address &peerAddress,const NetworkConfig &nconf,int localCapabilityIndex)
 {
-	bool sendCom = ( (nconf.com) && ( ((now - _lastPushedCom) >= ZT_CREDENTIAL_PUSH_EVERY) || (force) ) );
-
-	const Capability *sendCap;
-	if (localCapabilityIndex >= 0) {
-		sendCap = &(nconf.capabilities[localCapabilityIndex]);
-		if ( ((now - _localCredLastPushed.cap[localCapabilityIndex]) >= ZT_CREDENTIAL_PUSH_EVERY) || (force) )
-			_localCredLastPushed.cap[localCapabilityIndex] = now;
-		else sendCap = (const Capability *)0;
-	} else sendCap = (const Capability *)0;
+	const Capability *sendCap = (localCapabilityIndex >= 0) ? &(nconf.capabilities[localCapabilityIndex]) : (const Capability *)0;
 
 	const Tag *sendTags[ZT_MAX_NETWORK_TAGS];
 	unsigned int sendTagCount = 0;
-	for(unsigned int t=0;t<nconf.tagCount;++t) {
-		if ( ((now - _localCredLastPushed.tag[t]) >= ZT_CREDENTIAL_PUSH_EVERY) || (force) ) {
-			_localCredLastPushed.tag[t] = now;
-			sendTags[sendTagCount++] = &(nconf.tags[t]);
-		}
-	}
+	for(unsigned int t=0;t<nconf.tagCount;++t)
+		sendTags[sendTagCount++] = &(nconf.tags[t]);
 
 	const CertificateOfOwnership *sendCoos[ZT_MAX_CERTIFICATES_OF_OWNERSHIP];
 	unsigned int sendCooCount = 0;
-	for(unsigned int c=0;c<nconf.certificateOfOwnershipCount;++c) {
-		if ( ((now - _localCredLastPushed.coo[c]) >= ZT_CREDENTIAL_PUSH_EVERY) || (force) ) {
-			_localCredLastPushed.coo[c] = now;
-			sendCoos[sendCooCount++] = &(nconf.certificatesOfOwnership[c]);
-		}
-	}
+	for(unsigned int c=0;c<nconf.certificateOfOwnershipCount;++c)
+		sendCoos[sendCooCount++] = &(nconf.certificatesOfOwnership[c]);
 
 	unsigned int tagPtr = 0;
 	unsigned int cooPtr = 0;
+	bool sendCom = (bool)(nconf.com);
 	while ((tagPtr < sendTagCount)||(cooPtr < sendCooCount)||(sendCom)||(sendCap)) {
 		Packet outp(peerAddress,RR->identity.address(),Packet::VERB_NETWORK_CREDENTIALS);
 
 		if (sendCom) {
 			sendCom = false;
 			nconf.com.serialize(outp);
-			_lastPushedCom = now;
 		}
 		outp.append((uint8_t)0x00);
 
diff --git a/node/Membership.hpp b/node/Membership.hpp
index 7d404e89..55ba5373 100644
--- a/node/Membership.hpp
+++ b/node/Membership.hpp
@@ -67,10 +67,7 @@ public:
 	Membership();
 
 	/**
-	 * Send COM and other credentials to this peer if needed
-	 *
-	 * This checks last pushed times for our COM and for other credentials and
-	 * sends VERB_NETWORK_CREDENTIALS if the recipient might need them.
+	 * Send COM and other credentials to this peer
 	 *
 	 * @param RR Runtime environment
 	 * @param tPtr Thread pointer to be handed through to any callbacks called as a result of this call
@@ -78,9 +75,8 @@ public:
 	 * @param peerAddress Address of member peer (the one that this Membership describes)
 	 * @param nconf My network config
 	 * @param localCapabilityIndex Index of local capability to include (in nconf.capabilities[]) or -1 if none
-	 * @param force If true, send objects regardless of last push time
 	 */
-	void pushCredentials(const RuntimeEnvironment *RR,void *tPtr,const int64_t now,const Address &peerAddress,const NetworkConfig &nconf,int localCapabilityIndex,const bool force);
+	void pushCredentials(const RuntimeEnvironment *RR,void *tPtr,const int64_t now,const Address &peerAddress,const NetworkConfig &nconf,int localCapabilityIndex);
 
 	/**
 	 * Check whether we should push MULTICAST_LIKEs to this peer, and update last sent time if true
@@ -183,17 +179,6 @@ public:
 	void clean(const int64_t now,const NetworkConfig &nconf);
 
 	/**
-	 * Reset last pushed time for local credentials
-	 *
-	 * This is done when we update our network configuration and our credentials have changed
-	 */
-	inline void resetPushState()
-	{
-		_lastPushedCom = 0;
-		memset(&_localCredLastPushed,0,sizeof(_localCredLastPushed));
-	}
-
-	/**
 	 * Generates a key for the internal use in indexing credentials by type and credential ID
 	 */
 	static uint64_t credentialKey(const Credential::Type &t,const uint32_t i) { return (((uint64_t)t << 32) | (uint64_t)i); }
@@ -225,9 +210,6 @@ private:
 	// Last time we pushed MULTICAST_LIKE(s)
 	int64_t _lastUpdatedMulticast;
 
-	// Last time we pushed our COM to this peer
-	int64_t _lastPushedCom;
-
 	// Revocation threshold for COM or 0 if none
 	int64_t _comRevocationThreshold;
 
@@ -242,13 +224,6 @@ private:
 	Hashtable< uint32_t,Capability > _remoteCaps;
 	Hashtable< uint32_t,CertificateOfOwnership > _remoteCoos;
 
-	// Time we last pushed our local credentials to this member
-	struct {
-		int64_t tag[ZT_MAX_NETWORK_TAGS];
-		int64_t cap[ZT_MAX_NETWORK_CAPABILITIES];
-		int64_t coo[ZT_MAX_CERTIFICATES_OF_OWNERSHIP];
-	} _localCredLastPushed;
-
 public:
 	class CapabilityIterator
 	{
diff --git a/node/Network.cpp b/node/Network.cpp
index bbef98dd..617df779 100644
--- a/node/Network.cpp
+++ b/node/Network.cpp
@@ -631,7 +631,6 @@ bool Network::filterOutgoingPacket(
 	const unsigned int vlanId,
 	uint8_t &qosBucket)
 {
-	const int64_t now = RR->node->now();
 	Address ztFinalDest(ztDest);
 	int localCapabilityIndex = -1;
 	int accept = 0;
@@ -664,9 +663,6 @@ bool Network::filterOutgoingPacket(
 						accept = 1;
 
 						if ((!noTee)&&(cc2)) {
-							Membership &m2 = _membership(cc2);
-							m2.pushCredentials(RR,tPtr,now,cc2,_config,localCapabilityIndex,false);
-
 							Packet outp(cc2,RR->identity.address(),Packet::VERB_EXT_FRAME);
 							outp.append(_id);
 							outp.append((uint8_t)(ccWatch2 ? 0x16 : 0x02));
@@ -701,13 +697,7 @@ bool Network::filterOutgoingPacket(
 	}
 
 	if (accept) {
-		if (membership)
-			membership->pushCredentials(RR,tPtr,now,ztDest,_config,localCapabilityIndex,false);
-
 		if ((!noTee)&&(cc)) {
-			Membership &m2 = _membership(cc);
-			m2.pushCredentials(RR,tPtr,now,cc,_config,localCapabilityIndex,false);
-
 			Packet outp(cc,RR->identity.address(),Packet::VERB_EXT_FRAME);
 			outp.append(_id);
 			outp.append((uint8_t)(ccWatch ? 0x16 : 0x02));
@@ -720,9 +710,6 @@ bool Network::filterOutgoingPacket(
 		}
 
 		if ((ztDest != ztFinalDest)&&(ztFinalDest)) {
-			Membership &m2 = _membership(ztFinalDest);
-			m2.pushCredentials(RR,tPtr,now,ztFinalDest,_config,localCapabilityIndex,false);
-
 			Packet outp(ztFinalDest,RR->identity.address(),Packet::VERB_EXT_FRAME);
 			outp.append(_id);
 			outp.append((uint8_t)0x04);
@@ -797,8 +784,6 @@ int Network::filterIncomingPacket(
 
 				if (accept) {
 					if (cc2) {
-						_membership(cc2).pushCredentials(RR,tPtr,RR->node->now(),cc2,_config,-1,false);
-
 						Packet outp(cc2,RR->identity.address(),Packet::VERB_EXT_FRAME);
 						outp.append(_id);
 						outp.append((uint8_t)(ccWatch2 ? 0x1c : 0x08));
@@ -830,8 +815,6 @@ int Network::filterIncomingPacket(
 
 	if (accept) {
 		if (cc) {
-			_membership(cc).pushCredentials(RR,tPtr,RR->node->now(),cc,_config,-1,false);
-
 			Packet outp(cc,RR->identity.address(),Packet::VERB_EXT_FRAME);
 			outp.append(_id);
 			outp.append((uint8_t)(ccWatch ? 0x1c : 0x08));
@@ -844,8 +827,6 @@ int Network::filterIncomingPacket(
 		}
 
 		if ((ztDest != ztFinalDest)&&(ztFinalDest)) {
-			_membership(ztFinalDest).pushCredentials(RR,tPtr,RR->node->now(),ztFinalDest,_config,-1,false);
-
 			Packet outp(ztFinalDest,RR->identity.address(),Packet::VERB_EXT_FRAME);
 			outp.append(_id);
 			outp.append((uint8_t)0x0a);
@@ -1050,12 +1031,6 @@ int Network::setConfiguration(void *tPtr,const NetworkConfig &nconf,bool saveToD
 			_portInitialized = true;
 
 			_externalConfig(&ctmp);
-
-			Address *a = (Address *)0;
-			Membership *m = (Membership *)0;
-			Hashtable<Address,Membership>::Iterator i(_memberships);
-			while (i.next(a,m))
-				m->resetPushState();
 		}
 
 		_portError = RR->node->configureVirtualNetworkPort(tPtr,_id,&_uPtr,(oldPortInitialized) ? ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_CONFIG_UPDATE : ZT_VIRTUAL_NETWORK_CONFIG_OPERATION_UP,&ctmp);
@@ -1267,7 +1242,6 @@ bool Network::gate(void *tPtr,const SharedPtr<Peer> &peer)
 				if (!m)
 					m = &(_membership(peer->address()));
 				if (m->multicastLikeGate(now)) {
-					m->pushCredentials(RR,tPtr,now,peer->address(),_config,-1,false);
 					_announceMulticastGroupsTo(tPtr,peer->address(),_allMulticastGroups());
 				}
 				return true;
@@ -1364,14 +1338,8 @@ Membership::AddCredentialResult Network::addCredential(void *tPtr,const Certific
 {
 	if (com.networkId() != _id)
 		return Membership::ADD_REJECTED;
-	const Address a(com.issuedTo());
 	Mutex::Lock _l(_lock);
-	Membership &m = _membership(a);
-	const Membership::AddCredentialResult result = m.addCredential(RR,tPtr,_config,com);
-	if ((result == Membership::ADD_ACCEPTED_NEW)||(result == Membership::ADD_ACCEPTED_REDUNDANT)) {
-		m.pushCredentials(RR,tPtr,RR->node->now(),a,_config,-1,false);
-	}
-	return result;
+	return _membership(com.issuedTo()).addCredential(RR,tPtr,_config,com);
 }
 
 Membership::AddCredentialResult Network::addCredential(void *tPtr,const Address &sentFrom,const Revocation &rev)
@@ -1494,7 +1462,8 @@ void Network::_sendUpdatesToMembers(void *tPtr,const MulticastGroup *const newMu
 		std::sort(alwaysAnnounceTo.begin(),alwaysAnnounceTo.end());
 
 		for(std::vector<Address>::const_iterator a(alwaysAnnounceTo.begin());a!=alwaysAnnounceTo.end();++a) {
-		 // push COM to non-members so they can do multicast request auth
+			/*
+			// push COM to non-members so they can do multicast request auth
 			if ( (_config.com) && (!_memberships.contains(*a)) && (*a != RR->identity.address()) ) {
 				Packet outp(*a,RR->identity.address(),Packet::VERB_NETWORK_CREDENTIALS);
 				_config.com.serialize(outp);
@@ -1505,6 +1474,7 @@ void Network::_sendUpdatesToMembers(void *tPtr,const MulticastGroup *const newMu
 				outp.append((uint16_t)0); // no certificates of ownership
 				RR->sw->send(tPtr,outp,true);
 			}
+			*/
 			_announceMulticastGroupsTo(tPtr,*a,groups);
 		}
 	}
@@ -1514,7 +1484,6 @@ void Network::_sendUpdatesToMembers(void *tPtr,const MulticastGroup *const newMu
 		Membership *m = (Membership *)0;
 		Hashtable<Address,Membership>::Iterator i(_memberships);
 		while (i.next(a,m)) {
-			m->pushCredentials(RR,tPtr,now,*a,_config,-1,false);
 			if ( ( m->multicastLikeGate(now) || (newMulticastGroup) ) && (m->isAllowedOnNetwork(_config)) && (!std::binary_search(alwaysAnnounceTo.begin(),alwaysAnnounceTo.end(),*a)) )
 				_announceMulticastGroupsTo(tPtr,*a,groups);
 		}
diff --git a/node/Network.hpp b/node/Network.hpp
index eec016c0..9350b3b5 100644
--- a/node/Network.hpp
+++ b/node/Network.hpp
@@ -365,7 +365,7 @@ public:
 	inline void pushCredentialsNow(void *tPtr,const Address &to,const int64_t now)
 	{
 		Mutex::Lock _l(_lock);
-		_membership(to).pushCredentials(RR,tPtr,now,to,_config,-1,true);
+		_membership(to).pushCredentials(RR,tPtr,now,to,_config,-1);
 	}
 
 	/**
diff --git a/node/Node.cpp b/node/Node.cpp
index 54cbd503..c96ae8fd 100644
--- a/node/Node.cpp
+++ b/node/Node.cpp
@@ -76,6 +76,7 @@ Node::Node(void *uptr,void *tptr,const struct ZT_Node_Callbacks *callbacks,int64
 	memset(_expectingRepliesToBucketPtr,0,sizeof(_expectingRepliesToBucketPtr));
 	memset(_expectingRepliesTo,0,sizeof(_expectingRepliesTo));
 	memset(_lastIdentityVerification,0,sizeof(_lastIdentityVerification));
+	memset((void *)(&_stats),0,sizeof(_stats));
 
 	uint64_t idtmp[2];
 	idtmp[0] = 0; idtmp[1] = 0;
@@ -268,6 +269,13 @@ ZT_ResultCode Node::processBackgroundTasks(void *tptr,int64_t now,volatile int64
 			Hashtable< Address,std::vector<InetAddress> > alwaysContact;
 			RR->topology->getUpstreamsToContact(alwaysContact);
 
+			// Uncomment to dump stats
+			for(unsigned int i=0;i<32;i++) {
+				if (_stats.inVerbCounts[i] > 0)
+					printf("%.2x\t%12lld %lld\n",i,(unsigned long long)_stats.inVerbCounts[i],(unsigned long long)_stats.inVerbBytes[i]);
+			}
+			printf("\n");
+
 			// Check last receive time on designated upstreams to see if we seem to be online
 			int64_t lastReceivedFromUpstream = 0;
 			{
diff --git a/node/Node.hpp b/node/Node.hpp
index c3e46deb..a6f92eb1 100644
--- a/node/Node.hpp
+++ b/node/Node.hpp
@@ -273,6 +273,12 @@ public:
 		return false;
 	}
 
+	inline void statsLogVerb(const unsigned int v,const unsigned int bytes)
+	{
+		++_stats.inVerbCounts[v];
+		_stats.inVerbBytes[v] += (uint64_t)bytes;
+	}
+
 private:
 	RuntimeEnvironment _RR;
 	RuntimeEnvironment *RR;
@@ -286,6 +292,9 @@ private:
 	// Time of last identity verification indexed by InetAddress.rateGateHash() -- used in IncomingPacket::_doHELLO() via rateGateIdentityVerification()
 	int64_t _lastIdentityVerification[16384];
 
+	// Statistics about stuff happening
+	volatile ZT_NodeStatistics _stats;
+
 	// Map that remembers if we have recently sent a network config to someone
 	// querying us as a controller.
 	struct _LocalControllerAuth
diff --git a/node/Packet.hpp b/node/Packet.hpp
index 50b8927f..ef52d87d 100644
--- a/node/Packet.hpp
+++ b/node/Packet.hpp
@@ -755,7 +755,7 @@ public:
 		 * For patches and other updates a NETWORK_CONFIG is sent instead.
 		 *
 		 * It would be valid and correct as of 1.2.0 to use NETWORK_CONFIG always,
-		 * but OK(NTEWORK_CONFIG_REQUEST) should be sent for compatibility.
+		 * but OK(NETWORK_CONFIG_REQUEST) should be sent for compatibility.
 		 *
 		 * OK response payload:
 		 *   <[8] 64-bit network ID>
diff --git a/node/Peer.cpp b/node/Peer.cpp
index aecbd3a0..ba8918bc 100644
--- a/node/Peer.cpp
+++ b/node/Peer.cpp
@@ -49,8 +49,6 @@ Peer::Peer(const RuntimeEnvironment *renv,const Identity &myIdentity,const Ident
 	_lastCredentialRequestSent(0),
 	_lastWhoisRequestReceived(0),
 	_lastEchoRequestReceived(0),
-	_lastComRequestReceived(0),
-	_lastComRequestSent(0),
 	_lastCredentialsReceived(0),
 	_lastTrustEstablishedPacketReceived(0),
 	_lastSentFullHello(0),
diff --git a/node/Peer.hpp b/node/Peer.hpp
index ae8f1e78..9afae56a 100644
--- a/node/Peer.hpp
+++ b/node/Peer.hpp
@@ -514,30 +514,6 @@ public:
 	}
 
 	/**
-	 * Rate gate incoming requests for network COM
-	 */
-	inline bool rateGateIncomingComRequest(const int64_t now)
-	{
-		if ((now - _lastComRequestReceived) >= ZT_PEER_GENERAL_RATE_LIMIT) {
-			_lastComRequestReceived = now;
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * Rate gate outgoing requests for network COM
-	 */
-	inline bool rateGateOutgoingComRequest(const int64_t now)
-	{
-		if ((now - _lastComRequestSent) >= ZT_PEER_GENERAL_RATE_LIMIT) {
-			_lastComRequestSent = now;
-			return true;
-		}
-		return false;
-	}
-
-	/**
 	 * Rate limit gate for VERB_ACK
 	 */
 	inline bool rateGateACK(const int64_t now)
@@ -665,8 +641,6 @@ private:
 	int64_t _lastCredentialRequestSent;
 	int64_t _lastWhoisRequestReceived;
 	int64_t _lastEchoRequestReceived;
-	int64_t _lastComRequestReceived;
-	int64_t _lastComRequestSent;
 	int64_t _lastCredentialsReceived;
 	int64_t _lastTrustEstablishedPacketReceived;
 	int64_t _lastSentFullHello;
diff --git a/node/Switch.cpp b/node/Switch.cpp
index 3a4f8276..55275dc3 100644
--- a/node/Switch.cpp
+++ b/node/Switch.cpp
@@ -816,7 +816,6 @@ void Switch::doAnythingWaitingForPeer(void *tPtr,const SharedPtr<Peer> &peer)
 
 	{
 		Mutex::Lock _l(_txQueue_m);
-
 		for(std::list< TXQueueEntry >::iterator txi(_txQueue.begin());txi!=_txQueue.end();) {
 			if (txi->dest == peer->address()) {
 				if (_trySend(tPtr,txi->packet,txi->encrypt)) {