From b88be3ea1b475b1a656298b98708026388eaf2af Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 28 Oct 2026 02:54:55 +0100
Subject: move keepalive and firewall to paths

---
 src/transport/firewall.rs | 107 +++-------------------------------------------
 1 file changed, 6 insertions(+), 101 deletions(-)

(limited to 'src/transport/firewall.rs')

diff --git a/src/transport/firewall.rs b/src/transport/firewall.rs
index 846ae1b..7b0ec0d 100644
--- a/src/transport/firewall.rs
+++ b/src/transport/firewall.rs
@@ -1,13 +1,14 @@
+//! The debug firewall (`/debug/firewall`, with `--debug-api`): drops messages from and
+//! to peers, by node ID, to test partitions on a real swarm. It works at the bottom of
+//! the node, in the paths layer (`transport::paths::Gate`), so it drops everything a
+//! partition would: WHO and ME, PINGs and their PONGs, as well as the node's messages.
+
 use std::collections::HashSet;
-use std::sync::{Arc, RwLock, RwLockReadGuard};
+use std::sync::{RwLock, RwLockReadGuard};
 
-use anyhow::Result;
-use async_trait::async_trait;
 use serde::{Deserialize, Serialize};
 
 use crate::locks::RwLockExt;
-use crate::transport::EncodedMessage;
-use crate::transport::{MessageHandler, ParsedMessage, Transport};
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub(crate) struct FirewallRules {
@@ -46,99 +47,3 @@ impl Firewall {
         self.read().outbound.contains(peer)
     }
 }
-
-pub(crate) struct FirewallTransport {
-    inner: Arc<dyn Transport>,
-    firewall: Arc<Firewall>,
-}
-
-impl FirewallTransport {
-    pub(crate) fn new(inner: Arc<dyn Transport>, firewall: Arc<Firewall>) -> Self {
-        Self { inner, firewall }
-    }
-}
-
-#[async_trait]
-impl Transport for FirewallTransport {
-    fn local_id(&self) -> &str {
-        self.inner.local_id()
-    }
-
-    fn is_peer_id(&self, id: &str) -> bool {
-        self.inner.is_peer_id(id)
-    }
-
-    fn delivery_limit(&self) -> std::time::Duration {
-        self.inner.delivery_limit()
-    }
-
-    fn local_addresses(&self) -> Vec<String> {
-        self.inner.local_addresses()
-    }
-
-    fn addresses_of(&self, peer: &str) -> Vec<String> {
-        self.inner.addresses_of(peer)
-    }
-
-    fn learn_addresses(&self, peer: &str, addresses: &[String]) {
-        self.inner.learn_addresses(peer, addresses)
-    }
-
-    fn can_reach(&self, peer: &str) -> bool {
-        self.inner.can_reach(peer)
-    }
-
-    fn discovered_seeds(&self) -> Vec<String> {
-        self.inner.discovered_seeds()
-    }
-
-    fn transports(&self) -> Vec<String> {
-        self.inner.transports()
-    }
-
-    fn destination(&self, peer: &str) -> Option<crate::transport::Destination> {
-        self.inner.destination(peer)
-    }
-
-    fn connection(&self, target: &str) -> Option<crate::transport::Connection> {
-        self.inner.connection(target)
-    }
-
-    fn stats(&self) -> crate::transport::stats::TransportStats {
-        self.inner.stats()
-    }
-
-    async fn resolve_seed(&self, seed: &str) -> Result<String> {
-        self.inner.resolve_seed(seed).await
-    }
-
-    fn encode(&self, peer: &str, message: &ParsedMessage) -> Result<EncodedMessage> {
-        self.inner.encode(peer, message)
-    }
-
-    async fn send_encoded(&self, message: &EncodedMessage) -> Result<()> {
-        if self.firewall.blocks_outbound(&message.peer) {
-            tracing::trace!(peer = %message.peer, "Firewall dropped outbound message");
-            return Ok(());
-        }
-        self.inner.send_encoded(message).await
-    }
-
-    async fn start_consumer(&self, handler: MessageHandler) -> Result<()> {
-        let firewall = Arc::clone(&self.firewall);
-
-        self.inner
-            .start_consumer(Box::new(move |sender, message, payload_len| {
-                if firewall.blocks_inbound(&sender) {
-                    tracing::trace!(peer = %sender, "Firewall dropped inbound message");
-                    return Box::pin(async { Ok(()) });
-                }
-                handler(sender, message, payload_len)
-            }))
-            .await
-    }
-
-    async fn wait_for_exit(&self) -> std::io::Result<std::process::ExitStatus> {
-        self.inner.wait_for_exit().await
-    }
-}
-- 
cgit v1.3.1