The Connection Gater interface.

connmgr/conngating.go

@@ -0,0 +1,63 @@
+package connmgr
+
+import (
+	"github.com/libp2p/go-libp2p-core/control"
+	"github.com/libp2p/go-libp2p-core/network"
+	"github.com/libp2p/go-libp2p-core/peer"
+	"github.com/libp2p/go-libp2p-core/transport"
+
+	ma "github.com/multiformats/go-multiaddr"
+)
+
+// ConnectionGater can be implemented by a type that supports active
+// inbound or outbound connection gating.
+//
+// A ConnectionGater will be consulted at various stages in the life cycle of a connection.
+// The specific gating function that will be called depends on the lifecycle state of the
+// connection during which Gating needs to be applied.
+//
+// `InterceptDial` and `InterceptPeerDial` are called when we try an outbound dial.
+//
+// `InterceptAccept` is called after we've accepted an inbound connection from a socket but before we
+// begin upgrading it.
+//
+// `InterceptSecured` is called for inbound and outbound connections after we've negotiated
+// the security protocol to use for the connection.
+//
+// `InterceptUpgraded` is called for inbound and outbound connections after we've finished upgrading
+// a connection to have both security and stream multiplexing.
+//
+// This feature can be used to implement *strict* connection management
+// behaviours, such as hard limiting of connections once a max count has been
+// reached.
+type ConnectionGater interface {
+	// InterceptDial tests whether we're permitted to dial the specified multiaddr.
+	// Insofar filter.Filters is concerned, this would map to its AddrBlock method,
+	// with the inverse condition.
+	// This is to be called by the network/swarm when dialling.
+	InterceptDial(ma.Multiaddr) (allow bool)
+
+	// InterceptPeerDial tests whether we're permitted to Dial the specified peer.
+	// This is to be called by the network/swarm when dialling.
+	InterceptPeerDial(p peer.ID) (allow bool)
+
+	// InterceptAccept tests whether an incipient inbound connection is allowed.
+	// network.ConnMultiaddrs is what we pass to the upgrader.
+	// This is intended to be called by the upgrader, or by the transport
+	// directly (e.g. QUIC, Bluetooth), straight after it's accepted a connection
+	// from its socket.
+	InterceptAccept(network.ConnMultiaddrs) (allow bool)
+
+	// InterceptSecured tests whether a given connection, now authenticated,
+	// is allowed.
+	// This is intended to be called by the upgrader, after it has negotiated crypto,
+	// and before it negotiates the muxer, or by the directly by the transport,
+	// at the exact same checkpoint.
+	InterceptSecured(network.Direction, peer.ID, network.ConnMultiaddrs) (allow bool)
+
+	// InterceptUpgraded tests whether a fully capable connection is allowed.
+	// At this point, we have a multiplexer, so the middleware can
+	// return a DisconnectReason and the swarm would use the control stream to convey
+	// it to the peer.
+	InterceptUpgraded(transport.CapableConn) (allow bool, reason control.DisconnectReason)
+}

control/disconnect.go

@@ -0,0 +1,4 @@
+package control
+
+// DisconnectReason informs the receiver of the reason the connectedness is being terminated by the sender.
+type DisconnectReason int