Phase 8 networking security

[nnlgsakib]

Summary by CodeRabbit

Release Notes

New Features

• Added QUIC transport support alongside TCP for improved connectivity options
• Enabled NAT traversal through hole punching and relay services to improve peer discovery behind firewalls
• Introduced peer reputation-based connection gating with configurable peer allowlist/blocklist capabilities
• Added per-peer rate limiting for protocol handlers to prevent abuse
• Enabled configurable peer reputation thresholds and per-peer connection/stream resource limits

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b2aa1465-fce8-4ddf-9282-dc29f0d6aa78

📥 Commits

Reviewing files that changed from the base of the PR and between 2fd9a70 and d180e2e.

📒 Files selected for processing (21)

• .planning/REQUIREMENTS.md
• .planning/ROADMAP.md
• .planning/STATE.md
• .planning/phases/08-networking-enhancements/08-01-PLAN.md
• .planning/phases/08-networking-enhancements/08-02-PLAN.md
• .planning/phases/08-networking-enhancements/08-03-PLAN.md
• .planning/phases/08-networking-enhancements/08-04-PLAN.md
• .planning/phases/08-networking-enhancements/08-05-PLAN.md
• .planning/phases/08-networking-enhancements/08-CONTEXT.md
• .planning/phases/08-networking-enhancements/08-DISCUSSION-LOG.md
• .planning/phases/08-networking-enhancements/08-RESEARCH.md
• .planning/phases/08-networking-enhancements/08-VALIDATION.md
• internal/config/config.go
• internal/daemon/daemon.go
• pkg/network/gater.go
• pkg/network/gater_test.go
• pkg/network/host.go
• pkg/network/host_test.go
• pkg/network/protocols.go
• pkg/network/ratelimit.go
• pkg/network/ratelimit_test.go

---

📝 Walkthrough

Walkthrough

This pull request implements Phase 8 "Networking Enhancements," introducing QUIC transport, NAT traversal (Circuit Relay v2, hole punching), and security controls (reputation-based connection gating, per-peer rate limiting, peer blocklists/allowlists) through new configuration fields, network components, daemon integration, and comprehensive test coverage.

Changes

Cohort / File(s)	Summary
Planning & Documentation .planning/REQUIREMENTS.md, .planning/ROADMAP.md, .planning/STATE.md, .planning/phases/08-networking-enhancements/*	Added Phase 8 roadmap structure with four new networking requirements (NETW-06 through NETW-09), context documentation defining QUIC/NAT/security scope, detailed implementation plans across five tasks, research notes, validation strategy, and discussion log for transport and NAT mechanism decisions.
Configuration internal/config/config.go	Added nine new fields to Config struct: ListenAddrs, EnableHolePunching, EnableRelayService, RelayServers, BlockedPeers, AllowedPeers, ReputationThreshold, MaxConnectionsPerPeer, MaxStreamsPerPeer. Added GetListenAddrs() helper for backward-compatible fallback to legacy ListenAddr.
Connection Gater pkg/network/gater.go, pkg/network/gater_test.go	Introduced ReputationGater implementing connmgr.ConnectionGater with reputation-threshold and blocklist/allowlist enforcement. Centralized isAllowed() decision logic gates peers via blocklist, allowlist, or reputation score. Added unit tests for blocked/allowed peer behavior, reputation gating, and dynamic block/unblock operations.
Rate Limiting pkg/network/ratelimit.go, pkg/network/ratelimit_test.go	Added PeerRateLimiter with per-peer token-bucket rate limiting using rate.Limiter pool. Methods Allow() (per-peer check), Cleanup() (remove stale peers), and Count() (tracked peer count). Tests verify burst allowance, peer independence, cleanup mechanics, and token recovery.
Host Configuration & Integration pkg/network/host.go, pkg/network/host_test.go	Extended HostConfig with relay/transport flags (EnableHolePunching, EnableRelayService, RelayServers, ConnectionGater). NewHost() conditionally appends libp2p options (relay service, hole punching, auto-relay). Added SetRateLimiters() method and parseRelayAddrs() helper. Tests verify QUIC/TCP listen addresses, peer connectivity, and gater-based connection blocking.
Protocol Handler Rate Limiting pkg/network/protocols.go	Added rate-limit checks at start of StoreProtocol and FetchProtocol handlers; rejected rate-limited peers receive error responses without processing requests.
Daemon Integration internal/daemon/daemon.go	Wired ReputationGater into libp2p host config. Replaced single ListenAddr with GetListenAddrs(). Enabled hole punching/relay via new HostConfig fields. After host start, set per-protocol rate limiters. Updated persistMultiaddrs() to derive TCP/UDP/QUIC endpoints into cfg.ListenAddrs while maintaining backward compatibility with cfg.ListenAddr.

Sequence Diagram(s)

sequenceDiagram
    participant App as Application
    participant Cfg as Config
    participant Daemon as Daemon
    participant Host as libp2p Host
    participant Gater as ReputationGater
    participant RateLim as PeerRateLimiter
    participant Handler as Protocol Handler

    App->>Cfg: Load config (listen_addrs, enable_hole_punching, etc.)
    App->>Daemon: Start(ctx)
    Daemon->>Cfg: GetListenAddrs()
    Cfg-->>Daemon: []string{TCP, QUIC, ...}
    Daemon->>Gater: NewReputationGater(blocked, allowed, threshold)
    Daemon->>Host: NewHost(ctx, cfg with Gater + relay opts)
    Host->>Host: Apply relay service, hole punching, auto-relay
    Host->>Host: Register Gater for dial/secured checks
    Host-->>Daemon: *Host{storeLimiter: nil, fetchLimiter: nil}
    Daemon->>RateLim: NewPeerRateLimiter(rps, burst)
    Daemon->>Host: SetRateLimiters(storeLim, fetchLim)
    Host-->>Daemon: (limiters set)
    Daemon->>Host: Start listening (persists multiaddrs to cfg.ListenAddrs)
    
    Note over App: Incoming request from peer P
    Handler->>RateLim: Allow(P)
    alt Rate limit exceeded
        RateLim-->>Handler: false
        Handler->>Handler: Send error response ("rate limited")
    else Within limit
        RateLim-->>Handler: true
        Handler->>Handler: Process request normally
    end
    
    Note over App: Peer connects
    Gater->>Gater: isAllowed(peer_id)
    alt Peer blocked
        Gater-->>Host: false (reject)
    else Peer in allowlist/above threshold
        Gater-->>Host: true (allow)
    end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

Poem

🐰 The warren now stands tall with QUIC so swift,
Gatekeepers check each peer's reputation gift,
Rate limits keep the crowds from overwhelming our store,
NAT traversal opens paths to distant shores—
Phase Eight hops forward with networking might! 🌐✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch phase-8-networking-security

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}