Always accept incoming connections from trusted peers

[mattsse]

Describe the feature

currently we're always rejecting incoming connections if we're at capacity

reth/crates/net/network/src/peers/manager.rs

Lines 226 to 228 in e42fb32

	if !self.connection_info.has_in_capacity() {
	return Err(InboundConnectionError::ExceedsLimit(self.connection_info.max_inbound))
	}

this makes it impossible to accept connections from trusted peers

the problem is that we only get the peer id after negotiating the rlpx session

so we can't directly disconnect these connections as long as the ip is not banned:

reth/crates/net/network/src/swarm.rs

Lines 198 to 201 in e42fb32

	// ensure we can handle an incoming connection from this address
	if let Err(err) =
	self.state_mut().peers_mut().on_incoming_pending_session(remote_addr.ip())
	{

reth/crates/net/network/src/session/mod.rs

Lines 313 to 318 in e42fb32

	/// Sends a disconnect message to the peer with the given [DisconnectReason].
	pub(crate) fn disconnect_incoming_connection(
	&mut self,
	stream: TcpStream,
	reason: DisconnectReason,
	) {

instead we need to establish them and then apply the capacity check here, if the peer is not trusted:

reth/crates/net/network/src/peers/manager.rs

Line 269 in e42fb32

pub(crate) fn on_incoming_session_established(&mut self, peer_id: PeerId, addr: SocketAddr) {

the expected behaviour should mimic:

https://github.com/ethereum/go-ethereum/blob/b590cae89232299d54aac8aada88c66d00c5b34c/p2p/server.go#L817-L829

TODO

• only immediately disconnect on incoming if IP is banned
• apply capacity/trusted check on_incoming_session_established

Additional context

No response

[freezlite]

I think in this change port should not be checked because incoming port can be different every time.

For example geth allows to add trusted enodes without IP and Port. But reth requires both.

[mattsse]

For example geth allows to add trusted enodes without IP and Port. But reth requires both.

do you mean via rpc or config?

only checked briefly but unsure where we check the port

[freezlite]

do you mean via rpc or config?

Yes, I tried rpc. At least there empty or 0 port is rejected. I'm fine to put not real one, important just not check the port(and maybe ip) on incoming connection. Probably just public key.

[mattsse]

gotcha, this is a separate issue then, will track this separately:

#7003

[AbnerZheng]

Will try it since it is related to #7003