Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(connection-limit): set bypass rules for connections #5720

Draft
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

drHuangMHT
Copy link
Contributor

Description

Add BypassRules for connection_limit::Behaviour to allow bypasses.
May close #5605

Notes & open questions

This implememtation does not distingush between local addresses and remote addresses, will that be a problem?

Change checklist

  • I have performed a self-review of my own code
  • I have made corresponding changes to the documentation
  • I have added tests that prove my fix is effective or that my feature works
  • A changelog entry has been made in the appropriate crates

@drHuangMHT drHuangMHT changed the title feat(connection-limit): set bypass rules for connection by PeerId or Multiaddr feat(connection-limit): set bypass rules for connections Dec 6, 2024
@drHuangMHT
Copy link
Contributor Author

I also found that you can get a mutable reference to the ConnectionLimits at runtime but since all fields are private and all methods require ownership, you need to do clone and replace to actually modifiy it. Is that intentional?

@drHuangMHT drHuangMHT marked this pull request as draft December 6, 2024 08:06
Copy link
Contributor

@elenaf9 elenaf9 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think adding bypass rules for a PeerId makes sense. I am not sure about having them for a MultiAddr as well.
When would one know the address of a trusted peer, but not it's PeerId?

@drHuangMHT
Copy link
Contributor Author

I think adding bypass rules for a PeerId makes sense. I am not sure about having them for a MultiAddr as well. When would one know the address of a trusted peer, but not it's PeerId?

I don't know, but trusting an address also kind of makes sense? Though this behaviour is not primarily used for managing trusts between peers.
Also this is brought up by the issue itself, @dariusc93 what do you think?

@drHuangMHT
Copy link
Contributor Author

I think adding bypass rules for a PeerId makes sense. I am not sure about having them for a MultiAddr as well. When would one know the address of a trusted peer, but not it's PeerId?

Also you can use the rule to allow a range of peers from an address, for example behind a load balancer and such, or a domain(I guess it only works for dialing). Allowing a range of addresses will grant even greater flexibility but it will be a bit difficult to implement.
We can also allow all connections from specific listeners.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

connection-limits: whitelist PeerId or Multiaddr to bypass checks.
3 participants