Skip to content

Commit ba07064

Browse files
the-headless-ghostthe-headless-ghost
committed
Add behind firewall conf to prevent node from initiating connection to behind-firewall remote peers.
1 parent 440ffb8 commit ba07064

File tree

31 files changed

+541
-311
lines changed

31 files changed

+541
-311
lines changed

‎cardano-diffusion/cardano-diffusion.cabal‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -449,7 +449,7 @@ library cardano-diffusion-tests-lib
449449
monoidal-synchronisation,
450450
network,
451451
network-mux,
452-
ouroboros-network:{ouroboros-network, api, api-tests-lib, framework, framework-tests-lib, orphan-instances, ouroboros-network-tests-lib, protocols, protocols-tests-lib, tests-lib},
452+
ouroboros-network:{ouroboros-network, api, api-tests-lib, framework, framework-tests-lib, ouroboros-network-tests-lib, protocols, protocols-tests-lib, tests-lib},
453453
pipes,
454454
pretty-simple,
455455
psqueues,

‎cardano-diffusion/changelog.d/20251108_103013_edgr_behind_firewall.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<!--
2+
A new scriv changelog fragment.
3+
4+
Uncomment the section that is right (remove the HTML comment wrapper).
5+
For top level release notes, leave all the headers commented out.
6+
-->
7+
8+
### Non-Breaking
9+
10+
- Added a property test to verify that the node never connects to peers behind a firewall.
11+
- Added a round-trip property test to verify that topology file decoding and encoding are correct.

‎cardano-diffusion/lib/Cardano/Network/Diffusion/Topology.hs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,5 +30,6 @@ isValidTrustedPeerConfiguration
3030
IsTrustable -> not
3131
. null
3232
. rootAccessPoints
33+
. rootConfig
3334
$ localRoots
3435
) lprgs

‎cardano-diffusion/tests/lib/Test/Cardano/Network/Diffusion/Testnet.hs‎

Lines changed: 128 additions & 30 deletions
Large diffs are not rendered by default.

‎cardano-diffusion/tests/lib/Test/Cardano/Network/Diffusion/Testnet/Simulation.hs‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -137,8 +137,7 @@ import Test.Ouroboros.Network.Diffusion.Node.Kernel (NtCAddr, NtCVersion,
137137
NtNVersionData, ppNtNAddr)
138138
import Test.Ouroboros.Network.LedgerPeers (LedgerPools (..), cardanoSRVPrefix,
139139
genLedgerPoolsFrom)
140-
import Test.Ouroboros.Network.PeerSelection.Instances (PeerAddr (..))
141-
import Test.Ouroboros.Network.PeerSelection.Instances qualified as PeerSelection
140+
import Test.Ouroboros.Network.OrphanInstances (genIPv4, genIPv6)
142141
import Test.Ouroboros.Network.PeerSelection.LocalRootPeers ()
143142
import Test.Ouroboros.Network.PeerSelection.RootPeersDNS (DNSLookupDelay (..),
144143
DNSTimeout (..), DomainAccessPoint (..), MockDNSMap, genDomainName)
@@ -546,9 +545,9 @@ genDomainMapScript relays = do
546545
case v of
547546
Left _ipsttls -> case relays of
548547
TestnetRelays4 {} ->
549-
(k,) . Left . singleton . (, ttl) <$> PeerSelection.genIPv4
548+
(k,) . Left . singleton . (, ttl) <$> genIPv4
550549
TestnetRelays6 {} ->
551-
(k,) . Left . singleton . (, ttl) <$> PeerSelection.genIPv6
550+
(k,) . Left . singleton . (, ttl) <$> genIPv6
552551
Right doms -> do
553552
(k,) . Right . singleton <$> do
554553
case listToMaybe doms of
@@ -746,8 +745,8 @@ data TestnetRelayInfos = TestnetRelays4 { unTestnetRelays :: [TestnetRelayInfo]
746745
| TestnetRelays6 { unTestnetRelays :: [TestnetRelayInfo] }
747746

748747
instance Arbitrary TestnetRelayInfos where
749-
arbitrary = oneof [ TestnetRelays4 <$> gen PeerSelection.genIPv4
750-
, TestnetRelays6 <$> gen PeerSelection.genIPv6
748+
arbitrary = oneof [ TestnetRelays4 <$> gen genIPv4
749+
, TestnetRelays6 <$> gen genIPv6
751750
]
752751
where
753752
uniqueIps xs =

‎cardano-diffusion/tests/lib/Test/Cardano/Network/OrphanInstances/Tests.hs‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,32 @@
11
module Test.Cardano.Network.OrphanInstances.Tests (tests) where
22

33
import Data.Aeson
4+
import Data.Aeson.Types (parse)
45

5-
import Ouroboros.Network.OrphanInstances ()
6+
import Ouroboros.Network.Diffusion.Topology
67

78
import Cardano.Network.OrphanInstances ()
9+
import Cardano.Network.PeerSelection.Bootstrap
10+
import Cardano.Network.PeerSelection.PeerTrustable
811
import Cardano.Network.Protocol.Handshake.Test hiding (tests)
912

10-
import Test.QuickCheck
13+
import Test.Cardano.Network.PeerSelection.Instances ()
1114
import Test.Tasty
1215
import Test.Tasty.QuickCheck
1316

14-
1517
tests :: TestTree
1618
tests = testGroup "Cardano.Network.OrphanInstances"
1719
[ testProperty "NodeToNodeVersion" prop_json_NodeToNodeVersion
1820
, testProperty "NodeToClientVersion" prop_json_NodeToClientVersion
21+
, testProperty "NetworkTopology" prop_json_NetworkTopology
1922
]
2023

2124

25+
prop_json_NetworkTopology :: NetworkTopology UseBootstrapPeers PeerTrustable -> Property
26+
prop_json_NetworkTopology topo =
27+
parse (parseJSON . toJSON) topo === Data.Aeson.Success topo
28+
29+
2230
prop_json_NodeToNodeVersion
2331
:: ArbitraryNodeToNodeVersion
2432
-> Property

‎cardano-diffusion/tests/lib/Test/Cardano/Network/PeerSelection.hs‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ import Cardano.Network.PeerSelection
5454
-- import Cardano.Network.PeerSelection.PublicRootPeers (PublicRootPeers (..))
5555
import Cardano.Network.PeerSelection.PublicRootPeers qualified as Cardano.PublicRootPeers
5656

57+
import Ouroboros.Network.ConnectionManager.Types (Provenance(Outbound))
5758
import Ouroboros.Network.DiffusionMode
5859
import Ouroboros.Network.ExitPolicy (RepromoteDelay (..))
5960
import Ouroboros.Network.PeerSelection
@@ -3201,7 +3202,6 @@ prop_governor_target_established_above (MaxTime maxTime) env =
32013202
<*> govInProgressIneligibleSig
32023203
<*> demotionOpportunitiesIgnoredTooLong)
32033204

3204-
32053205
-- | Like 'prop_governor_target_established_above' but for big ledger peers.
32063206
--
32073207
prop_governor_target_established_big_ledger_peers_above
@@ -4423,8 +4423,8 @@ prop_issue_3550 = prop_governor_target_established_below defaultMaxTime $
44234423
(PeerAddr 29,[],GovernorScripts {peerShareScript = Script (Nothing :| []), peerSharingScript = Script (PeerSharingDisabled :| []), connectionScript = Script ((ToWarm,NoDelay) :| [(ToCold,NoDelay),(Noop,NoDelay)])})
44244424
],
44254425
localRootPeers = LocalRootPeers.fromGroups
4426-
[ (1, 1, Map.fromList [(PeerAddr 16, LocalRootConfig DoAdvertisePeer InitiatorAndResponderDiffusionMode IsNotTrustable)])
4427-
, (1, 1, Map.fromList [(PeerAddr 4, LocalRootConfig DoAdvertisePeer InitiatorAndResponderDiffusionMode IsNotTrustable)])
4426+
[ (1, 1, Map.fromList [(PeerAddr 16, LocalRootConfig DoAdvertisePeer InitiatorAndResponderDiffusionMode Outbound IsNotTrustable)])
4427+
, (1, 1, Map.fromList [(PeerAddr 4, LocalRootConfig DoAdvertisePeer InitiatorAndResponderDiffusionMode Outbound IsNotTrustable)])
44284428
],
44294429
publicRootPeers = Cardano.PublicRootPeers.fromPublicRootPeers
44304430
(Map.fromList [ (PeerAddr 14, DoNotAdvertisePeer)
@@ -4471,7 +4471,7 @@ prop_issue_3515 = prop_governor_nolivelock $
44714471
peerSharingScript = Script (PeerSharingDisabled :| []),
44724472
connectionScript = Script ((ToCold,NoDelay) :| [(Noop,NoDelay)])
44734473
})],
4474-
localRootPeers = LocalRootPeers.fromGroups [(1,1,Map.fromList [(PeerAddr 10, LocalRootConfig DoAdvertisePeer InitiatorAndResponderDiffusionMode IsNotTrustable)])],
4474+
localRootPeers = LocalRootPeers.fromGroups [(1,1,Map.fromList [(PeerAddr 10, LocalRootConfig DoAdvertisePeer InitiatorAndResponderDiffusionMode Outbound IsNotTrustable)])],
44754475
publicRootPeers = PublicRootPeers.empty Cardano.ExtraPeers.empty,
44764476
targets = Script . NonEmpty.fromList $ targets'',
44774477
pickKnownPeersForPeerShare = Script (PickFirst :| []),
@@ -4513,7 +4513,7 @@ prop_issue_3494 = prop_governor_nofail $
45134513
peerSharingScript = Script (PeerSharingDisabled :| []),
45144514
connectionScript = Script ((ToCold,NoDelay) :| [(Noop,NoDelay)])
45154515
})],
4516-
localRootPeers = LocalRootPeers.fromGroups [(1,1,Map.fromList [(PeerAddr 64, LocalRootConfig DoAdvertisePeer InitiatorAndResponderDiffusionMode IsNotTrustable)])],
4516+
localRootPeers = LocalRootPeers.fromGroups [(1,1,Map.fromList [(PeerAddr 64, LocalRootConfig DoAdvertisePeer InitiatorAndResponderDiffusionMode Outbound IsNotTrustable)])],
45174517
publicRootPeers = PublicRootPeers.empty Cardano.ExtraPeers.empty,
45184518
targets = Script . NonEmpty.fromList $ targets'',
45194519
pickKnownPeersForPeerShare = Script (PickFirst :| []),
@@ -4563,8 +4563,8 @@ prop_issue_3233 = prop_governor_nolivelock $
45634563
(PeerAddr 15,[],GovernorScripts {peerShareScript = Script (Just ([],PeerShareTimeSlow) :| []), peerSharingScript = Script (PeerSharingDisabled :| []), connectionScript = Script ((Noop,NoDelay) :| [])})
45644564
],
45654565
localRootPeers = LocalRootPeers.fromGroups
4566-
[ (1, 1, Map.fromList [(PeerAddr 15, LocalRootConfig DoAdvertisePeer InitiatorAndResponderDiffusionMode IsNotTrustable)])
4567-
, (1, 1, Map.fromList [(PeerAddr 13, LocalRootConfig DoAdvertisePeer InitiatorAndResponderDiffusionMode IsNotTrustable)])
4566+
[ (1, 1, Map.fromList [(PeerAddr 15, LocalRootConfig DoAdvertisePeer InitiatorAndResponderDiffusionMode Outbound IsNotTrustable)])
4567+
, (1, 1, Map.fromList [(PeerAddr 13, LocalRootConfig DoAdvertisePeer InitiatorAndResponderDiffusionMode Outbound IsNotTrustable)])
45684568
],
45694569
publicRootPeers = Cardano.PublicRootPeers.fromPublicRootPeers
45704570
(Map.fromList [(PeerAddr 4, DoNotAdvertisePeer)]),

‎cardano-diffusion/tests/lib/Test/Cardano/Network/PeerSelection/MockEnvironment.hs‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ import Control.Monad.IOSim
6262
import Control.Tracer (Tracer (..), contramap, traceWith)
6363

6464
import Ouroboros.Network.BlockFetch (FetchMode (..), PraosFetchMode (..))
65+
import Ouroboros.Network.ConnectionManager.Types (Provenance)
6566
import Ouroboros.Network.DiffusionMode
6667
import Ouroboros.Network.ExitPolicy
6768
import Ouroboros.Network.PeerSelection hiding (requestPublicRootPeers)
@@ -550,8 +551,8 @@ mockPeerSelectionActions' tracer
550551
traceWith tracer (TraceEnvPeerShareResult addr peeraddrs)
551552
return (PeerSharingResult peeraddrs)
552553

553-
establishPeerConnection :: IsBigLedgerPeer -> DiffusionMode -> PeerAddr -> m (PeerConn m)
554-
establishPeerConnection _ _ peeraddr = do
554+
establishPeerConnection :: IsBigLedgerPeer -> DiffusionMode -> Provenance -> PeerAddr -> m (PeerConn m)
555+
establishPeerConnection _ _ _ peeraddr = do
555556
--TODO: add support for variable delays and synchronous failure
556557
traceWith tracer (TraceEnvEstablishConn peeraddr)
557558
threadDelay 1

‎ouroboros-network/api/tests/Test/Ouroboros/Network/PeerSelection/RelayAccessPoint.hs‎

Lines changed: 1 addition & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,15 @@
1-
{-# LANGUAGE OverloadedStrings #-}
2-
{-# LANGUAGE TypeApplications #-}
3-
4-
{-# OPTIONS_GHC -Wno-orphans #-}
5-
61
module Test.Ouroboros.Network.PeerSelection.RelayAccessPoint (tests) where
72

83
import Codec.CBOR.Read as CBOR
94
import Codec.CBOR.Write as CBOR
105
import Data.Aeson qualified as Aeson
116
import Data.ByteString.Char8 qualified as BSC
12-
import Data.IP qualified as IP
13-
import Data.Word
147

158
import Cardano.Binary (FromCBOR (..), ToCBOR (..))
169
import Ouroboros.Network.PeerSelection.PeerAdvertise
1710
import Ouroboros.Network.PeerSelection.RelayAccessPoint
1811

12+
import Test.Ouroboros.Network.OrphanInstances ()
1913
import Test.QuickCheck
2014
import Test.Tasty (TestTree, testGroup)
2115
import Test.Tasty.QuickCheck (testProperty)
@@ -33,54 +27,6 @@ tests = testGroup "Ouroboros.Network.PeerSelection"
3327
]
3428
]
3529

36-
-- TODO:
37-
-- These instances & generators belong to `ouroboros-network-testing`, but we
38-
-- cannot put them there until we pack all packages as a one package with
39-
-- sublibraries (due to cyclic depndecies).
40-
--
41-
-- These instances are also useful in `ouroboros-network:testlib`, and for now
42-
-- they are duplicated.
43-
44-
genIPv4 :: Gen IP.IP
45-
genIPv4 =
46-
IP.IPv4 . IP.toIPv4w <$> resize 200 arbitrary `suchThat` (> 100)
47-
48-
genIPv6 :: Gen IP.IP
49-
genIPv6 =
50-
IP.IPv6 . IP.toIPv6w <$> genFourWord32
51-
where
52-
genFourWord32 :: Gen (Word32, Word32, Word32, Word32)
53-
genFourWord32 =
54-
(,,,) <$> resize 200 arbitrary `suchThat` (> 100)
55-
<*> arbitrary
56-
<*> arbitrary
57-
<*> arbitrary
58-
59-
instance Arbitrary PortNumber where
60-
arbitrary = elements [1000..1100]
61-
shrink = map fromIntegral
62-
. filter (>=1000)
63-
. shrink
64-
. fromIntegral @PortNumber @Word16
65-
66-
instance Arbitrary RelayAccessPoint where
67-
arbitrary = prefixLedgerRelayAccessPoint "_prefix._tcp" <$> arbitrary
68-
69-
instance Arbitrary LedgerRelayAccessPoint where
70-
arbitrary =
71-
frequency [ (4, LedgerRelayAccessAddress <$> oneof [genIPv4, genIPv6] <*> arbitrary)
72-
, (4, LedgerRelayAccessDomain <$> genDomainName <*> arbitrary)
73-
, (1, LedgerRelayAccessSRVDomain <$> genDomainName)]
74-
where
75-
genDomainName = elements $ (\i -> "test" <> (BSC.pack . show $ i)) <$> [1..6 :: Int]
76-
77-
instance Arbitrary PeerAdvertise where
78-
arbitrary = elements [ DoAdvertisePeer, DoNotAdvertisePeer ]
79-
80-
shrink DoAdvertisePeer = []
81-
shrink DoNotAdvertisePeer = [DoAdvertisePeer]
82-
83-
8430
prop_cbor_LedgerRelayAccessPoint :: LedgerRelayAccessPoint
8531
-> Property
8632
prop_cbor_LedgerRelayAccessPoint ap =

‎ouroboros-network/changelog.d/20251108_101451_edgr_behind_firewall.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<!--
2+
A new scriv changelog fragment.
3+
4+
Uncomment the section that is right (remove the HTML comment wrapper).
5+
For top level release notes, leave all the headers commented out.
6+
-->
7+
8+
### Breaking
9+
10+
- Changed the type of `localRoots` to `LocalRoots`.
11+
- Modified `AcquireOutboundConnection` to include an additional parameter: `Provenance`.
12+
- `acquireOutboundConnectionImpl` only creates a new connection if `Provenance` permits it.
13+
- `jobPromoteColdPeer` only creates a new connection if no inbound connection is found and provenance is set to `Outbound`.
14+
15+
### Non-Breaking
16+
17+
- Added `LocalRoots` type in `Ouroboros.Network.PeerSelection.State.LocalRootPeers` with the following fields:
18+
- `rootConfig` of type `RootConfig`
19+
- `provenance` of type `Provenance`
20+
- Added `localProvenance` field to `LocalRootConfig`.
21+
- Added a new constructor `InboundConnectionNotFound` for `ConnectionManagerError`.
22+
- Renamed `Test.Ouroboros.Network.Orphans` to `Test.Ouroboros.Network.OrphanInstances`.
23+
- Moved the following instances from `Test.Ouroboros.Network.PeerSelection.LocalRootPeers` to `Test.Ouroboros.Network.OrphanInstances`:
24+
- `Arbitrary WarmValency`
25+
- `Arbitrary HotValency`
26+
- Removed duplicated code from `Test.Ouroboros.Network.PeerSelection.Instances` and `Test.Ouroboros.Network.PeerSelection.RelayAccessPoint`, and moved it to `Test.Ouroboros.Network.OrphanInstances`:
27+
- `genIPv4`
28+
- `genIPv6`
29+
- `Arbitrary SlotNo`
30+
- `Arbitrary PeerAdvertise`
31+
- `Arbitrary PeerSharing`
32+
- `Arbitrary AfterSlot`
33+
- `Arbitrary UseLedgerPeers`
34+
- `Arbitrary PortNumber`
35+
- `Arbitrary RelayAccessPoint`
36+
- `Arbitrary LedgerRelayAccessPoint`
37+
- `Arbitrary (LocalRootConfig extraFlags)`

0 commit comments

Comments
 (0)