Relay: who may dial the link (RL-33) #272

Merged

jcoffey-dev merged 1 commits from relay/link-allow-from into main

2026-10-31 01:42:36 +00:00

jcoffey-dev commented

2026-10-31 01:22:06 +00:00

Owner

Step 7 of inbuxa Relay, part 1: who may dial the link (RL-33).

The relay

linkAllowFrom is a new setting: a list of addresses and CIDR ranges, at most 64. A link connection from anywhere else is dropped before TLS, with no reply.
- Empty (the default) means anyone.
- A relay that hasn't had its first settings takes anyone too, so it can still join.
- A connection that's already open stays open when the list changes.
run --link-allow-any ignores the list the relay started with, until the downstream sets a different one. It's the way back in from a list that locked the server out.
Relay/get now tells each link where it comes from, as status.linkFrom. Each node keeps that with its link status, so inbuxa:Relay links[].relay.linkFrom holds the addresses the console needs to check a list against.
relay-proto/src/allow.rs holds the list parsing and matching. An IPv4 client of a [::] listener arrives as ::ffff:a.b.c.d and is matched as IPv4.

The downstream takes settings/linkAllowFrom like any other setting. RelaySettings::problems checks it.

Spec gains the details above, linkFrom in the status row, and step 6 marked done.

Checked

relay_end_to_end covers RL-T25:
- linkFrom is 127.0.0.1, and a bad entry is refused.
- A list without the client closes a raw TCP connection with no bytes and refuses TLS.
- --link-allow-any lets the client in until a new list arrives, which then applies.
- A mapped-IPv4 entry works, and setting null goes back to anyone.
The allow unit tests cover ranges and refusals.
relay_tests checks that settings/linkAllowFrom refuses a host name. relay_link_tests checks that the node's link shows linkFrom: 127.0.0.1.
cargo fmt, clippy, the fork checks and expr-schema all pass.

Next: the console field, plus the warning when no node's linkFrom is in the list (inbuxa-admin PR to follow).

Step 7 of inbuxa Relay, part 1: **who may dial the link (RL-33)**. **The relay** - **`linkAllowFrom`** is a new setting: a list of addresses and CIDR ranges, at most 64. A link connection from anywhere else is dropped before TLS, with no reply. - Empty (the default) means anyone. - A relay that hasn't had its first settings takes anyone too, so it can still join. - A connection that's already open stays open when the list changes. - **`run --link-allow-any`** ignores the list the relay started with, until the downstream sets a different one. It's the way back in from a list that locked the server out. - **`Relay/get`** now tells each link where it comes from, as `status.linkFrom`. Each node keeps that with its link status, so `inbuxa:Relay` `links[].relay.linkFrom` holds the addresses the console needs to check a list against. - **`relay-proto/src/allow.rs`** holds the list parsing and matching. An IPv4 client of a `[::]` listener arrives as `::ffff:a.b.c.d` and is matched as IPv4. **The downstream** takes `settings/linkAllowFrom` like any other setting. `RelaySettings::problems` checks it. **Spec** gains the details above, `linkFrom` in the status row, and step 6 marked done. **Checked** - `relay_end_to_end` covers RL-T25: - `linkFrom` is 127.0.0.1, and a bad entry is refused. - A list without the client closes a raw TCP connection with no bytes and refuses TLS. - `--link-allow-any` lets the client in until a new list arrives, which then applies. - A mapped-IPv4 entry works, and setting `null` goes back to anyone. - The `allow` unit tests cover ranges and refusals. - `relay_tests` checks that `settings/linkAllowFrom` refuses a host name. `relay_link_tests` checks that the node's link shows `linkFrom: 127.0.0.1`. - `cargo fmt`, clippy, the fork checks and expr-schema all pass. **Next:** the console field, plus the warning when no node's `linkFrom` is in the list (inbuxa-admin PR to follow).

jcoffey-dev added 1 commit 2026-10-31 01:22:06 +00:00

Relay: who may dial the link (RL-33)

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 10m26s

Details

f3867606f2

The setting linkAllowFrom, a list of addresses and CIDR ranges (at most
64), limits the link port to those sources: others are dropped before
TLS, with no reply. Empty, the default, is anyone, and so is a relay
before its first settings, so it can join. A connection already open
stays open when the list changes.

`inbuxa-relay run --link-allow-any` ignores the list it starts with until
the downstream sets another, for a list that locked the downstream out.

Relay/get answers each link with status.linkFrom, the address that
connection comes from, which each node keeps with its link status: the
addresses the console checks a list against before it is saved.

relay-proto gains allow.rs (AllowList, matching an IPv4 client of a [::]
listener as IPv4). The downstream takes settings/linkAllowFrom like any
setting, checked by RelaySettings::problems. Tested in the relay's end to
end test (RL-T25) and the server's relay system tests.

The spec records step 6 as done.

jcoffey-dev merged commit 97c62c800f into main

2026-10-31 01:42:36 +00:00

jcoffey-dev deleted branch relay/link-allow-from

2026-10-31 01:42:36 +00:00

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: inbuxa/inbuxa-server#272