Only let the configured peer connect #5

Merged

balint merged 1 commit from fix/peer-ip-filter into main

2026-06-06 21:13:06 +01:00

balint commented

2026-06-06 20:20:36 +01:00

Owner

A node configured to call 192.168.1.92 connected fine to a different host (.198) on the same LAN — the peer_host setting effectively didn't matter.

Why

SignalingChannel listens on 0.0.0.0 and _handle_inbound adopted any inbound TCP connection as "the peer", never checking where it came from. So the control link (and the call) could run over a connection from any host on the network. Binding to a specific local IP wouldn't fix it — that constrains which local interface accepts, not which remote may connect.

Change

Resolve peer_host once at start() (via getaddrinfo, off the event loop) into the set of source IPs we accept — covers an IP literal or a hostname with several addresses.
In _handle_inbound, reject (log + close, don't adopt) any inbound connection whose source IP isn't in that set.

Localhost dev/smoke configs (127.0.0.1 both sides) still match and connect. Verified directly: a channel configured for 127.0.0.1 adopts a loopback inbound; one configured for a different IP rejects and closes it.

🤖 Generated with Claude Code

A node configured to call `192.168.1.92` connected fine to a different host (`.198`) on the same LAN — the `peer_host` setting effectively didn't matter. ## Why `SignalingChannel` listens on `0.0.0.0` and `_handle_inbound` adopted *any* inbound TCP connection as "the peer", never checking where it came from. So the control link (and the call) could run over a connection from any host on the network. Binding to a specific local IP wouldn't fix it — that constrains which local interface accepts, not which remote may connect. ## Change - Resolve `peer_host` once at `start()` (via `getaddrinfo`, off the event loop) into the set of source IPs we accept — covers an IP literal or a hostname with several addresses. - In `_handle_inbound`, reject (log + close, don't adopt) any inbound connection whose source IP isn't in that set. Localhost dev/smoke configs (`127.0.0.1` both sides) still match and connect. Verified directly: a channel configured for `127.0.0.1` adopts a loopback inbound; one configured for a different IP rejects and closes it. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

balint added 1 commit

2026-06-06 20:20:37 +01:00

Only let the configured peer connect 321a311320

The signaling server binds 0.0.0.0 and adopted any inbound TCP connection as
"the peer", so a node configured to talk to .92 would silently accept and run
its call over a connection from any other host on the LAN (.198 in testing) —
the peer_host setting effectively didn't matter.

Resolve peer_host once at start and reject inbound connections whose source IP
isn't among the resolved addresses, closing them without adopting. Binding to a
specific local IP wouldn't help here — that constrains the local interface, not
who may connect — so the check is on the connection's source address.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>