access: bans

_continuum/banned/<node ID>: every node refuses the banned node's
changes from then on (judged as the ban stood) and leaves its
handshakes unanswered.

Auth plan M6.

1 files changed, 20 insertions, 0 deletions

diff --git a/src/swarm/peer/inbound.rs b/src/swarm/peer/inbound.rs
index e261702..9b5db8f 100644
--- a/src/swarm/peer/inbound.rs
+++ b/src/swarm/peer/inbound.rs
@@ -75,6 +75,26 @@ pub(crate) async fn handle_message(
     if !admit(state, &peer, &message).await {
         return Ok(());
     }
+    // A banned node's handshake goes unanswered, and what we had with it ends
+    // (`access::bans`).
+    if matches!(
+        message,
+        ParsedMessage::Hello(_) | ParsedMessage::HelloReply(_)
+    ) && crate::access::bans::banned(&state.doc.read().await.doc, &peer)
+    {
+        if let Some(peer_state) = state.get_peer_state(&peer).await {
+            let mut peer_state = peer_state.lock().await;
+            if peer_state.standing.is_admitted() {
+                tracing::warn!(peer = %peer, "Banned peer: no longer synced with");
+            }
+            crate::swarm::topology::change_peer(state, &mut peer_state, |p| {
+                p.standing = crate::state::Standing::Stranger
+            });
+            peer_state.hello_state = crate::state::HelloState::NotSent;
+            peer_state.reset_sync();
+        }
+        return Ok(());
+    }
 
     remember_peer(state, &peer).await;