add in basic address dial filtering

[whyrusleeping]

So this works but i'm not sure if i like the construction. Its probably fine, because we are going to redo the daemon init/construction at some point anyways.

License: MIT
Signed-off-by: Jeromy [email protected]

[jbenet]

can probably pull this into multiaddr or multiaddr-net. though i do like the modularity. multiaddr right now isn't very modular. maybe should have a pluggable table or something.

[whyrusleeping]

it would be nice if there was an AddProtocol method that extension libs could call in an init function. So importing my lib would add my libs protocol to multiaddrs parsing table.

[jbenet]

comments above.

This may be overkill, but may be nice to have both block + allow. harder, but something like chaining:

filters:
  0.0.0.0/0      // allow everything at the beginning. implicit, dont need to state it.
  10.0.0.0/8     // allow only 10.0.0.0/8
  !10.10.0.0/16  // disallow 10.10.0.0/16

[jbenet]

we may want to special case the error here, where we may have addrs, but if we filter them all out, state that as a different error. basically:

remoteAddrs = addrutil.Subtract(remoteAddrs, ila)
remoteAddrs = addrutil.Subtract(remoteAddrs, s.peers.Addrs(s.local))
if len(remoteAddrs) == 0 {
  err := errors.New("peer has no addresses")
  logdial["error"] = err
  return nil, err
}

remoteAddrs = s.filterAddrs(remoteAddrs)
if len(remoteAddrs) == 0 {
  err := errors.New("all peer addresses filtered out")
  logdial["error"] = err
  return nil, err
}

[whyrusleeping]

good point. 👍

[jbenet]

This prevents dialing out but AFAICT, not listening to a conn from a filtered addr. will want to do this to listeners too

[whyrusleeping]

@jbenet that feels a little out of scope for this PR. Listening on a given addr isnt really causing us issues right now. Whats the reasoning?

[jbenet]

@jbenet that feels a little out of scope for this PR. Listening on a given addr isnt really causing us issues right now. Whats the reasoning?

i dont mean "listening on a particular addr" i mean "if we get dialed by an addr in our filter". its not what we want all of the time (i.e. not for the people who're running into host scanning problems), but it is what users who want to setup entirely private networks want.

[whyrusleeping]

oh!! that makes more sense. Will do.

[whyrusleeping]

alright, addressed comments mostly. Do we want to try and modularize multiaddr? or worry about that later?

[jbenet]

Do we want to try and modularize multiaddr? or worry about that later?

i'd worry about that later.

Also, we should have tests for this:

• being able to dial out addresses not filtered
• not being able to dial out addresses filtered
• being able to accept addresses not filtered
• not being able to accept addresses filtered

[whyrusleeping]

@jbenet ping

[jbenet]

@whyrusleeping does this pass tests? (gpe)

[GitCop]

There were the following issues with your Pull Request

• Commit: 0bf6b39
  • Invalid signoff. Commit message must end with License: MIT
    Signed-off-by: .* <.*>

Guidelines are available to help. Your feedback on GitCop is welcome on this issue

---

This message was auto-generated by https://gitcop.com

[jbenet]

ddc7aac and 1064110 didn't build so i squashed them.

[jbenet]

I also rebased on master