gating handshakes

[y0sher]

I’ve implemented a p2p network using go-libp2p. I have an issue where I want to have an application layer handshake, for example - check network ID, or verify a certain type of cryptographic identity. I used streams to do it but as soon as a peer is added it is automatically exposed to all procotols which means that during my protocol handshake I can receive messages from this peer in pubsub for example.
Is there an easy way to add application-layer handshake? or should I just guard pubsub for example using a whitelist that is generated from my application-handshake?

I found there is ConnectionGater but haven't found an example of the usage.

Any pointing to resources will be very helpful.

[master255]

If you have Stream, you can send and receive any data you want. Use it for a handshake.

[y0sher]

Can you elaborate please? I can't find anything about steam regarding libp2p. if you are referring Streams, then is what I'm doing currently, but its not enough, because when a peer is already upgraded to the point you can open a stream with, it means other protocols (like pubsub) are also exposed to messages from this peer. I want my handshake to an actual barrier to all the rest.

[master255]

You can transfer data through Stream. What are you not satisfied with? Pubsub - it has a different protocol name and does not interfere with Stream.

[sukunrt]

You can use InterceptUpgraded on the ConnectionGater to run your own handshake. This is called before the connection is added to the swarm for wider use.
https://github.com/libp2p/go-libp2p/blob/master/core/connmgr/gater.go#L88
You'll have to implement this interface and use the InterceptUpgraded call to do the auth.
You can pass this to the libp2p constructor using libp2p.ConnectionGater option.

Otherwise, I think you'll have to maintain some kind of application state to check if the peer has been authenticated yet. You can also see if the pnet capability in go-libp2p is what you want. https://github.com/libp2p/go-libp2p/blob/master/options.go#L211
For gossip sub, you might be able to tweak Peer Score to ensure that an unauthenticated peer is rated so low that messages from it are discarded. My understanding here is very superficial though. Here's an example of lotus using PeerScore gossip sub option: https://github.com/filecoin-project/lotus/blob/master/node/modules/lp2p/pubsub.go#L269