multi+server.go: add initial permissions for some peers #9458

Crypt-iQ · 2025-01-29T18:09:53Z

This patch adds initial access permissions in the server for some peers:

If the peer has ever had a channel with us that has confirmed on-chain, they'll be given protected access.
If it has a pending-open channel, it'll be given temporary status.
Otherwise, it'll get restricted status.

In the future, we can tune this criteria. Some of the discovery ban code has also been moved to server.go so that it is somewhat unified.

coderabbitai · 2025-01-29T18:10:01Z

Important

Review skipped

Auto reviews are limited to specific labels.

🏷️ Labels to auto review (1)

llm-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Generate unit testing code for this file.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai generate unit testing code for this file.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and generate unit testing code.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR. (Beta)
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

bhandras

First shallow pass done, great work! Concept ACK! 🎉 Going to spend some more time with the details. I think in the mean time feel free to reply to my comments with your thoughts/ideas.

channeldb/db.go

brontide/listener.go

server.go

bhandras

Looks pretty good! Could you please add an itest covering the added functionality?

server.go

channeldb/db.go

channeldb/db_test.go

server.go

Crypt-iQ · 2025-02-12T14:59:51Z

I tested the code in a different way and found that the demotion logic for NotifyFundingTimeout only notifies if we are the recipient of a pending channel rather than the initiator. I think this is fine since we have initiated this and the channel potentially could become active as the spec uses a SHOULD for fundee forgetting requirements rather than a MUST.

ziggie1984

Great work ⚡️, the overall PR looks really good, was having mostly comments about naming and maybe add more unit tests.

brontide/listener.go

server.go

channeldb/channel_test.go

server.go

funding/manager.go

We introduce a new func FetchPermAndTempPeers that returns two maps. The first map indicates the nodes that will have "protected" access to the server. The second map indicates the nodes that have "temporary" access to the server. This will be used in a future commit in the server.go code.

This signal will be used in the server.go code to potentially demote temporary-access peers to restricted-access peers.

Here we introduce the access manager which has caches that will determine the access control status of our peers. Peers that have had their funding transaction confirm with us are protected. Peers that only have pending-open channels with us are temporary access and can have their access revoked. The rest of the peers are granted restricted access.

This modifies the various channelnotifier notification functions to instead hit the server and then call the notification routine. This allows us to accurately modify the server's maps.

ziggie1984

Looks good from my side - pending failing lint/unit tests

ziggie1984 · 2025-02-21T15:39:05Z

server.go

-		srvrLog.Debugf("Dropping connection for %v since they are "+
-			"banned.", pubSer)
+		srvrLog.Debugf("Dropping connection for %v since we are out "+
+			"of restricted-access connection slots: %v.", pubSer,


Nit: should be %x

ziggie1984 · 2025-02-21T15:39:25Z

server.go

-		srvrLog.Debugf("Dropping connection for %v since they are "+
-			"banned.", pubSer)
+		srvrLog.Debugf("Dropping connection for %v since we are out "+
+			"of restricted-access connection slots: %v.", pubSer,


Nit: should be %x

ziggie1984 · 2025-02-21T16:18:57Z

accessman.go

+		// stay temporary.
+		peerCount, found := a.peerCounts[peerMapKey]
+		if !found {
+			// Error if we did not find any info in peerCounts.


I guess this should never happen ?

ziggie1984 · 2025-02-21T16:35:54Z

accessman_test.go

+// TestAccessManRestrictedSlots tests that the configurable number of
+// restricted slots are properly allocated. It also tests that certain peers
+// with access permissions are allowed to bypass the slot mechanism.
+func TestAccessManRestrictedSlots(t *testing.T) {


Nice test 🎉

saubyk assigned Crypt-iQ Jan 29, 2025

saubyk added this to the v0.19.0 milestone Jan 29, 2025

saubyk requested review from bhandras and ziggie1984 January 30, 2025 15:27

Crypt-iQ marked this pull request as ready for review January 30, 2025 16:25

bhandras reviewed Jan 31, 2025

View reviewed changes

Crypt-iQ force-pushed the banning_010072025 branch from 77c8555 to cbd7d60 Compare February 4, 2025 18:24

Crypt-iQ requested a review from bhandras February 4, 2025 18:27

Crypt-iQ force-pushed the banning_010072025 branch from cbd7d60 to 15e16ae Compare February 10, 2025 15:14

bhandras reviewed Feb 11, 2025

View reviewed changes

Crypt-iQ force-pushed the banning_010072025 branch 3 times, most recently from 72ec6df to 5a7b753 Compare February 13, 2025 19:04

ziggie1984 requested changes Feb 18, 2025

View reviewed changes

Crypt-iQ added 7 commits February 20, 2025 15:35

channelnotifier: add FundingTimeout and NotifyFundingTimeout

3df5579

This signal will be used in the server.go code to potentially demote temporary-access peers to restricted-access peers.

funding+server.go: modify notifications to pass through server

7973341

This modifies the various channelnotifier notification functions to instead hit the server and then call the notification routine. This allows us to accurately modify the server's maps.

itest: new test to check server access perms

c2461bf

sample-lnd.conf: update for num-restricted-slots

c5fbca2

release-notes: update for 0.19.0

82896f5

Crypt-iQ force-pushed the banning_010072025 branch from 5a7b753 to 82896f5 Compare February 20, 2025 20:38

Crypt-iQ requested review from bhandras and ziggie1984 February 20, 2025 20:41

ziggie1984 requested changes Feb 21, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

multi+server.go: add initial permissions for some peers #9458

multi+server.go: add initial permissions for some peers #9458

Crypt-iQ commented Jan 29, 2025 •

edited

Loading

coderabbitai bot commented Jan 29, 2025 •

edited

Loading

Review skipped

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

bhandras left a comment

bhandras left a comment

Crypt-iQ commented Feb 12, 2025

ziggie1984 left a comment

ziggie1984 left a comment

ziggie1984 Feb 21, 2025

ziggie1984 Feb 21, 2025

ziggie1984 Feb 21, 2025

ziggie1984 Feb 21, 2025

multi+server.go: add initial permissions for some peers #9458

Are you sure you want to change the base?

multi+server.go: add initial permissions for some peers #9458

Conversation

Crypt-iQ commented Jan 29, 2025 • edited Loading

coderabbitai bot commented Jan 29, 2025 • edited Loading

Review skipped

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

bhandras left a comment

Choose a reason for hiding this comment

bhandras left a comment

Choose a reason for hiding this comment

Crypt-iQ commented Feb 12, 2025

ziggie1984 left a comment

Choose a reason for hiding this comment

ziggie1984 left a comment

Choose a reason for hiding this comment

ziggie1984 Feb 21, 2025

Choose a reason for hiding this comment

ziggie1984 Feb 21, 2025

Choose a reason for hiding this comment

ziggie1984 Feb 21, 2025

Choose a reason for hiding this comment

ziggie1984 Feb 21, 2025

Choose a reason for hiding this comment

Crypt-iQ commented Jan 29, 2025 •

edited

Loading

coderabbitai bot commented Jan 29, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)