Repository navigation
id(abuse): enforce operator IP blocks at connection admission (#2245) - #4972
Conversation
AbuseEvaluator::open_connection consulted only peer_blocked; the BlockList ip_blocked seam landed in Phase 1 (PR #4874) had no admission call site. Add open_connection_with_direct_ip: when a listener directly observed the remote IP and the block list blocks it, the connection is refused with Refusal::blocked_by_operator() before any bucket or cap; relayed connections (no IP) are judged exactly as before. open_connection delegates with None, so existing callers are unchanged. world_net accept now supplies the selected paths direct IP (TransportAddr::Ip) via direct_ip_of; relay/custom selected paths yield None. The shared StubBlocks test double gains an IP arm (stub_blocks_with_ips). Tests (laptop): cargo test --lib block — 21 passed incl. new abuse::tests::a_blocked_direct_ip_is_refused_a_new_connection; cargo test --lib abuse:: — 22 passed.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 6 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. CodeRabbit Verify
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
What
Phase 1 follow-up for #2245 (queue task 8075): the persisted operator block list landed in PR #4874 with peer-key enforcement at session admission, but the
BlockList::ip_blockedseam had no admission call site —AbuseEvaluator::open_connectiontook no IP. This wires it.pkgs/id/src/abuse.rs: newAbuseEvaluator::open_connection_with_direct_ip(endpoint, direct_ip, now_ms). Whendirect_ipisSomeand the attached block list blocks that IP, the connection is refused withRefusal::blocked_by_operator()before any bucket or cap is consulted.open_connectiondelegates withNone, so every existing caller behaves exactly as before; relayed connections (no observed IP) are never refused by an IP block.pkgs/id/src/world_net.rs:acceptsupplies the direct IP viadirect_ip_of— the selected path'sTransportAddr::Ipaddress; a relay or custom-transport selected path yieldsNone. Best-effort at the listener, exactly as id(comms): operator block list by public key, with one-button block in the web UI (P0 of #2032) #2245 scopes IP enforcement ("a relayed peer has no visible IP"); a direct path that opens after admission is not re-judged.pkgs/id/src/pull_policy.rs(+ one literal inlog_sync.rs): the sharedStubBlockstest double gains an IP arm and astub_blocks_with_ipsconstructor (it previously answeredfalsefor every IP).Tests
On the laptop, against this branch:
cargo test --lib blockinpkgs/id— 21 passed, including the new targeted testabuse::tests::a_blocked_direct_ip_is_refused_a_new_connection(blocked direct IP refused at admission with no connection registered; unblocked direct IP admitted; relayedNoneadmitted) and all pre-existing block tests.cargo test --lib abuse::— 22 passed (no regression in the evaluator).Scope notes
In scope only: no change to block storage, no web UI (Phase 2), no author muting. Issue #2245 stays open — the web-UI phase remains; this closes the last unwired Phase 1 admission seam named by task 5848's packet.
Open in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.