op-node: implement new layered p2p connection gater

op-node/metrics/metrics.go

@@ -70,6 +70,10 @@ type Metricer interface {
 	ClientPayloadByNumberEvent(num uint64, resultCode byte, duration time.Duration)
 	ServerPayloadByNumberEvent(num uint64, resultCode byte, duration time.Duration)
 	PayloadsQuarantineSize(n int)
+	RecordPeerUnban()
+	RecordIPUnban()
+	RecordDial(allow bool)
+	RecordAccept(allow bool)
 }
 
 // Metrics tracks all the metrics for the op-node.
@@ -133,6 +137,10 @@ type Metrics struct {
 	PeerScores        *prometheus.GaugeVec
 	GossipEventsTotal *prometheus.CounterVec
 	BandwidthTotal    *prometheus.GaugeVec
+	PeerUnbans        prometheus.Counter
+	IPUnbans          prometheus.Counter
+	Dials             *prometheus.CounterVec
+	Accepts           *prometheus.CounterVec
 
 	ChannelInputBytes prometheus.Counter
 
@@ -335,6 +343,30 @@ func NewMetrics(procName string) *Metrics {
 		}, []string{
 			"direction",
 		}),
+		PeerUnbans: factory.NewCounter(prometheus.CounterOpts{
+			Namespace: ns,
+			Subsystem: "p2p",
+			Name:      "peer_unbans",
+			Help:      "Count of peer unbans",
+		}),
+		IPUnbans: factory.NewCounter(prometheus.CounterOpts{
+			Namespace: ns,
+			Subsystem: "p2p",
+			Name:      "ip_unbans",
+			Help:      "Count of IP unbans",
+		}),
+		Dials: factory.NewCounterVec(prometheus.CounterOpts{
+			Namespace: ns,
+			Subsystem: "p2p",
+			Name:      "dials",
+			Help:      "Count of outgoing dial attempts, with label to filter to allowed attempts",
+		}, []string{"allow"}),
+		Accepts: factory.NewCounterVec(prometheus.CounterOpts{
+			Namespace: ns,
+			Subsystem: "p2p",
+			Name:      "accepts",
+			Help:      "Count of incoming dial attempts to accept, with label to filter to allowed attempts",
+		}, []string{"allow"}),
 
 		ChannelInputBytes: factory.NewCounter(prometheus.CounterOpts{
 			Namespace: ns,
@@ -663,6 +695,30 @@ func (m *Metrics) RecordChannelInputBytes(inputCompressedBytes int) {
 	m.ChannelInputBytes.Add(float64(inputCompressedBytes))
 }
 
+func (m *Metrics) RecordPeerUnban() {
+	m.PeerUnbans.Inc()
+}
+
+func (m *Metrics) RecordIPUnban() {
+	m.IPUnbans.Inc()
+}
+
+func (m *Metrics) RecordDial(allow bool) {
+	if allow {
+		m.Dials.WithLabelValues("true").Inc()
+	} else {
+		m.Dials.WithLabelValues("false").Inc()
+	}
+}
+
+func (m *Metrics) RecordAccept(allow bool) {
+	if allow {
+		m.Accepts.WithLabelValues("true").Inc()
+	} else {
+		m.Accepts.WithLabelValues("false").Inc()
+	}
+}
+
 type noopMetricer struct{}
 
 var NoopMetrics Metricer = new(noopMetricer)
@@ -768,3 +824,15 @@ func (n *noopMetricer) PayloadsQuarantineSize(int) {
 
 func (n *noopMetricer) RecordChannelInputBytes(int) {
 }
+
+func (n *noopMetricer) RecordPeerUnban() {
+}
+
+func (n *noopMetricer) RecordIPUnban() {
+}
+
+func (n *noopMetricer) RecordDial(allow bool) {
+}
+
+func (n *noopMetricer) RecordAccept(allow bool) {
+}

op-node/p2p/gating/blocking.go

+package gating
+
+import (
+	"net"
+
+	ds "github.com/ipfs/go-datastore"
+	"github.com/libp2p/go-libp2p/core/connmgr"
+	"github.com/libp2p/go-libp2p/core/peer"
+	"github.com/libp2p/go-libp2p/p2p/net/conngater"
+)
+
+//go:generate mockery --name BlockingConnectionGater --output mocks/ --with-expecter=true
+type BlockingConnectionGater interface {
+	connmgr.ConnectionGater
+
+	// BlockPeer adds a peer to the set of blocked peers.
+	// Note: active connections to the peer are not automatically closed.
+	BlockPeer(p peer.ID) error
+	UnblockPeer(p peer.ID) error
+	ListBlockedPeers() []peer.ID
+
+	// BlockAddr adds an IP address to the set of blocked addresses.
+	// Note: active connections to the IP address are not automatically closed.
+	BlockAddr(ip net.IP) error
+	UnblockAddr(ip net.IP) error
+	ListBlockedAddrs() []net.IP
+
+	// BlockSubnet adds an IP subnet to the set of blocked addresses.
+	// Note: active connections to the IP subnet are not automatically closed.
+	BlockSubnet(ipnet *net.IPNet) error
+	UnblockSubnet(ipnet *net.IPNet) error
+	ListBlockedSubnets() []*net.IPNet
+}
+
+func NewBlockingConnectionGater(store ds.Batching) (BlockingConnectionGater, error) {
+	return conngater.NewBasicConnectionGater(store)
+}

op-node/p2p/gating/expiry.go

+package gating
+
+import (
+	"errors"
+	"net"
+	"time"
+
+	"github.com/ethereum-optimism/optimism/op-service/clock"
+	"github.com/ethereum/go-ethereum/log"
+	"github.com/libp2p/go-libp2p/core/network"
+	"github.com/libp2p/go-libp2p/core/peer"
+	"github.com/multiformats/go-multiaddr"
+	manet "github.com/multiformats/go-multiaddr/net"
+)
+
+type UnbanMetrics interface {
+	RecordPeerUnban()
+	RecordIPUnban()
+}
+
+var UnknownExpiry = errors.New("unknown ban expiry")
+
+//go:generate mockery --name ExpiryStore --output mocks/ --with-expecter=true
+type ExpiryStore interface {
+	PeerBanExpiry(id peer.ID) (time.Time, error)
+	IPBanExpiry(ip net.IP) (time.Time, error)
+}
+
+// ExpiryConnectionGater enhances a BlockingConnectionGater by implementing ban-expiration
+type ExpiryConnectionGater struct {
+	BlockingConnectionGater
+	store ExpiryStore
+	log   log.Logger
+	clock clock.Clock
+	m     UnbanMetrics
+}
+
+func AddBanExpiry(gater BlockingConnectionGater, store ExpiryStore, log log.Logger, clock clock.Clock, m UnbanMetrics) *ExpiryConnectionGater {
+	return &ExpiryConnectionGater{
+		BlockingConnectionGater: gater,
+		store:                   store,
+		log:                     log,
+		clock:                   clock,
+		m:                       m,
+	}
+}
+
+func (g *ExpiryConnectionGater) peerBanExpiryCheck(p peer.ID) (allow bool) {
+	// if the peer is blocked, check if it's time to unblock
+	expiry, err := g.store.PeerBanExpiry(p)
+	if err != nil {
+		if errors.Is(err, UnknownExpiry) {
+			return false // peer is permanently banned if no expiry time is set.
+		}
+		g.log.Warn("failed to load peer-ban expiry time", "peer_id", p, "err", err)
+		return false
+	}
+	if g.clock.Now().Before(expiry) {
+		return false
+	}
+	g.log.Info("peer-ban expired, unbanning peer", "peer_id", p, "expiry", expiry)
+	if err := g.BlockingConnectionGater.UnblockPeer(p); err != nil {
+		g.log.Warn("failed to unban peer", "peer_id", p, "err", err)
+		return false // if we ignored the error, then the inner connection-gater would drop them
+	}
+	g.m.RecordPeerUnban()
+	return true
+}
+
+func (g *ExpiryConnectionGater) addrBanExpiryCheck(ma multiaddr.Multiaddr) (allow bool) {
+	ip, err := manet.ToIP(ma)
+	if err != nil {
+		g.log.Error("tried to check multi-addr with bad IP", "addr", ma)
+		return false
+	}
+	// Check if it's a subnet-wide ban first. Subnet-bans do not expire.
+	for _, ipnet := range g.BlockingConnectionGater.ListBlockedSubnets() {
+		if ipnet.Contains(ip) {
+			return false // peer is still in banned subnet
+		}
+	}
+	// if just the IP is blocked, check if it's time to unblock
+	expiry, err := g.store.IPBanExpiry(ip)
+	if err != nil {
+		if errors.Is(err, UnknownExpiry) {
+			return false // IP is permanently banned if no expiry time is set.
+		}
+		g.log.Warn("failed to load IP-ban expiry time", "ip", ip, "err", err)
+		return false
+	}
+	if g.clock.Now().Before(expiry) {
+		return false
+	}
+	g.log.Info("IP-ban expired, unbanning IP", "ip", ip, "expiry", expiry)
+	if err := g.BlockingConnectionGater.UnblockAddr(ip); err != nil {
+		g.log.Warn("failed to unban IP", "ip", ip, "err", err)
+		return false // if we ignored the error, then the inner connection-gater would drop them
+	}
+	g.m.RecordIPUnban()
+	return true
+}
+
+func (g *ExpiryConnectionGater) InterceptPeerDial(p peer.ID) (allow bool) {
+	// if not allowed, and not expired, then do not allow the dial
+	return g.BlockingConnectionGater.InterceptPeerDial(p) || g.peerBanExpiryCheck(p)
+}
+
+func (g *ExpiryConnectionGater) InterceptAddrDial(id peer.ID, ma multiaddr.Multiaddr) (allow bool) {
+	if !g.BlockingConnectionGater.InterceptAddrDial(id, ma) {
+		// Check if it was intercepted because of a peer ban
+		if !g.BlockingConnectionGater.InterceptPeerDial(id) {
+			if !g.peerBanExpiryCheck(id) {
+				return false // peer is still peer-banned
+			}
+			if g.BlockingConnectionGater.InterceptAddrDial(id, ma) { // allow dial if peer-ban was everything
+				return true
+			}
+		}
+		// intercepted because of addr ban still, check if it is expired
+		if !g.addrBanExpiryCheck(ma) {
+			return false // peer is still addr-banned
+		}
+	}
+	return true
+}
+
+func (g *ExpiryConnectionGater) InterceptAccept(mas network.ConnMultiaddrs) (allow bool) {
+	return g.BlockingConnectionGater.InterceptAccept(mas) || g.addrBanExpiryCheck(mas.RemoteMultiaddr())
+}
+
+func (g *ExpiryConnectionGater) InterceptSecured(direction network.Direction, id peer.ID, mas network.ConnMultiaddrs) (allow bool) {
+	// Outbound dials are always accepted: the dial intercepts handle it before the connection is made.
+	if direction == network.DirOutbound {
+		return true
+	}
+	// InterceptSecured is called after InterceptAccept, we already checked the addrs.
+	// This leaves just the peer-ID expiry to check on inbound connections.
+	return g.BlockingConnectionGater.InterceptSecured(direction, id, mas) || g.peerBanExpiryCheck(id)
+}

op-node/p2p/gating/expiry_test.go

+package gating
+
+import (
+	"net"
+	"testing"
+	"time"
+
+	"github.com/ethereum-optimism/optimism/op-node/metrics"
+	"github.com/ethereum-optimism/optimism/op-node/p2p/gating/mocks"
+	"github.com/ethereum-optimism/optimism/op-node/testlog"
+	"github.com/ethereum-optimism/optimism/op-service/clock"
+	log "github.com/ethereum/go-ethereum/log"
+	"github.com/libp2p/go-libp2p/core/network"
+	"github.com/libp2p/go-libp2p/core/peer"
+	"github.com/multiformats/go-multiaddr"
+	"github.com/stretchr/testify/require"
+)
+
+func expiryTestSetup(t *testing.T) (*clock.DeterministicClock, *mocks.ExpiryStore, *mocks.BlockingConnectionGater, *ExpiryConnectionGater) {
+	mockGater := mocks.NewBlockingConnectionGater(t)
+	log := testlog.Logger(t, log.LvlError)
+	cl := clock.NewDeterministicClock(time.Now())
+	mockExpiryStore := mocks.NewExpiryStore(t)
+	gater := AddBanExpiry(mockGater, mockExpiryStore, log, cl, metrics.NoopMetrics)
+	return cl, mockExpiryStore, mockGater, gater
+}
+
+func TestExpiryConnectionGater_InterceptPeerDial(t *testing.T) {
+	mallory := peer.ID("malllory")
+	t.Run("expired peer ban", func(t *testing.T) {
+		cl, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptPeerDial(mallory).Return(false)
+		mockExpiryStore.EXPECT().PeerBanExpiry(mallory).Return(cl.Now().Add(-time.Second), nil)
+		mockGater.EXPECT().UnblockPeer(mallory).Return(nil)
+		allow := gater.InterceptPeerDial(mallory)
+		require.True(t, allow)
+	})
+	t.Run("active peer ban", func(t *testing.T) {
+		cl, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptPeerDial(mallory).Return(false)
+		mockExpiryStore.EXPECT().PeerBanExpiry(mallory).Return(cl.Now().Add(time.Second), nil)
+		allow := gater.InterceptPeerDial(mallory)
+		require.False(t, allow)
+	})
+	t.Run("unknown expiry", func(t *testing.T) {
+		_, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptPeerDial(mallory).Return(false)
+		mockExpiryStore.EXPECT().PeerBanExpiry(mallory).Return(time.Time{}, UnknownExpiry)
+		allow := gater.InterceptPeerDial(mallory)
+		require.False(t, allow)
+	})
+	t.Run("no ban", func(t *testing.T) {
+		_, _, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptPeerDial(mallory).Return(true)
+		allow := gater.InterceptPeerDial(mallory)
+		require.True(t, allow)
+	})
+}
+
+func TestExpiryConnectionGater_InterceptAddrDial(t *testing.T) {
+	ip := net.IPv4(1, 2, 3, 4)
+	mallory := peer.ID("7y9Qv7mG2h6fnzcDkeqVsEvW2rU9PdybSZ8y1dCrB9p")
+	addr, err := multiaddr.NewMultiaddr("/ip4/1.2.3.4/tcp/9000")
+	require.NoError(t, err)
+
+	t.Run("expired IP ban", func(t *testing.T) {
+		cl, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAddrDial(mallory, addr).Return(false)
+		mockGater.EXPECT().InterceptPeerDial(mallory).Return(true)
+		mockGater.EXPECT().ListBlockedSubnets().Return(nil)
+		mockExpiryStore.EXPECT().IPBanExpiry(ip.To4()).Return(cl.Now().Add(-time.Second), nil)
+		mockGater.EXPECT().UnblockAddr(ip.To4()).Return(nil)
+		allow := gater.InterceptAddrDial(mallory, addr)
+		require.True(t, allow)
+	})
+	t.Run("active IP ban", func(t *testing.T) {
+		cl, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAddrDial(mallory, addr).Return(false)
+		mockGater.EXPECT().InterceptPeerDial(mallory).Return(true)
+		mockGater.EXPECT().ListBlockedSubnets().Return(nil)
+		mockExpiryStore.EXPECT().IPBanExpiry(ip.To4()).Return(cl.Now().Add(time.Second), nil)
+		allow := gater.InterceptAddrDial(mallory, addr)
+		require.False(t, allow)
+	})
+	t.Run("unknown expiry", func(t *testing.T) {
+		_, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAddrDial(mallory, addr).Return(false)
+		mockGater.EXPECT().InterceptPeerDial(mallory).Return(true)
+		mockGater.EXPECT().ListBlockedSubnets().Return(nil)
+		mockExpiryStore.EXPECT().IPBanExpiry(ip.To4()).Return(time.Time{}, UnknownExpiry)
+		allow := gater.InterceptAddrDial(mallory, addr)
+		require.False(t, allow)
+	})
+	t.Run("no ban", func(t *testing.T) {
+		_, _, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAddrDial(mallory, addr).Return(true)
+		allow := gater.InterceptAddrDial(mallory, addr)
+		require.True(t, allow)
+	})
+	t.Run("subnet ban", func(t *testing.T) {
+		_, _, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAddrDial(mallory, addr).Return(false)
+		mockGater.EXPECT().InterceptPeerDial(mallory).Return(true)
+		mockGater.EXPECT().ListBlockedSubnets().Return([]*net.IPNet{
+			{IP: net.IPv4(1, 2, 0, 0), Mask: net.IPv4Mask(0xff, 0xff, 0, 0)},
+		})
+		allow := gater.InterceptAddrDial(mallory, addr)
+		require.False(t, allow)
+	})
+
+	t.Run("expired peer ban but active ip ban", func(t *testing.T) {
+		cl, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAddrDial(mallory, addr).Return(false)
+		mockGater.EXPECT().InterceptPeerDial(mallory).Return(false)
+		mockExpiryStore.EXPECT().PeerBanExpiry(mallory).Return(cl.Now().Add(-time.Second), nil)
+		mockGater.EXPECT().UnblockPeer(mallory).Return(nil)
+		mockGater.EXPECT().InterceptAddrDial(mallory, addr).Return(false)
+		mockGater.EXPECT().ListBlockedSubnets().Return(nil)
+		mockExpiryStore.EXPECT().IPBanExpiry(ip.To4()).Return(cl.Now().Add(time.Second), nil)
+
+		allow := gater.InterceptAddrDial(mallory, addr)
+		require.False(t, allow)
+	})
+	t.Run("active peer ban", func(t *testing.T) {
+		cl, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAddrDial(mallory, addr).Return(false)
+		mockGater.EXPECT().InterceptPeerDial(mallory).Return(false)
+		mockExpiryStore.EXPECT().PeerBanExpiry(mallory).Return(cl.Now().Add(time.Second), nil)
+		allow := gater.InterceptAddrDial(mallory, addr)
+		require.False(t, allow)
+	})
+	t.Run("expired peer ban and expired ip ban", func(t *testing.T) {
+		cl, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAddrDial(mallory, addr).Return(false)
+		mockGater.EXPECT().InterceptPeerDial(mallory).Return(false)
+		mockExpiryStore.EXPECT().PeerBanExpiry(mallory).Return(cl.Now().Add(-time.Second), nil)
+		mockGater.EXPECT().UnblockPeer(mallory).Return(nil)
+		mockGater.EXPECT().InterceptAddrDial(mallory, addr).Return(false)
+		mockGater.EXPECT().ListBlockedSubnets().Return(nil)
+		mockExpiryStore.EXPECT().IPBanExpiry(ip.To4()).Return(cl.Now().Add(-time.Second), nil)
+		mockGater.EXPECT().UnblockAddr(ip.To4()).Return(nil)
+
+		allow := gater.InterceptAddrDial(mallory, addr)
+		require.True(t, allow)
+	})
+}
+
+type localRemoteAddrs struct {
+	local  multiaddr.Multiaddr
+	remote multiaddr.Multiaddr
+}
+
+func (l localRemoteAddrs) LocalMultiaddr() multiaddr.Multiaddr {
+	return l.local
+}
+
+func (l localRemoteAddrs) RemoteMultiaddr() multiaddr.Multiaddr {
+	return l.remote
+}
+
+var _ network.ConnMultiaddrs = localRemoteAddrs{}
+
+func TestExpiryConnectionGater_InterceptAccept(t *testing.T) {
+	ip := net.IPv4(1, 2, 3, 4)
+	addr, err := multiaddr.NewMultiaddr("/ip4/1.2.3.4/tcp/9000")
+	require.NoError(t, err)
+	mas := localRemoteAddrs{remote: addr}
+
+	t.Run("expired IP ban", func(t *testing.T) {
+		cl, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAccept(mas).Return(false)
+		mockGater.EXPECT().ListBlockedSubnets().Return(nil)
+		mockExpiryStore.EXPECT().IPBanExpiry(ip.To4()).Return(cl.Now().Add(-time.Second), nil)
+		mockGater.EXPECT().UnblockAddr(ip.To4()).Return(nil)
+		allow := gater.InterceptAccept(mas)
+		require.True(t, allow)
+	})
+	t.Run("active IP ban", func(t *testing.T) {
+		cl, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAccept(mas).Return(false)
+		mockGater.EXPECT().ListBlockedSubnets().Return(nil)
+		mockExpiryStore.EXPECT().IPBanExpiry(ip.To4()).Return(cl.Now().Add(time.Second), nil)
+		allow := gater.InterceptAccept(mas)
+		require.False(t, allow)
+	})
+	t.Run("unknown expiry", func(t *testing.T) {
+		_, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAccept(mas).Return(false)
+		mockGater.EXPECT().ListBlockedSubnets().Return(nil)
+		mockExpiryStore.EXPECT().IPBanExpiry(ip.To4()).Return(time.Time{}, UnknownExpiry)
+		allow := gater.InterceptAccept(mas)
+		require.False(t, allow)
+	})
+	t.Run("no ban", func(t *testing.T) {
+		_, _, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAccept(mas).Return(true)
+		allow := gater.InterceptAccept(mas)
+		require.True(t, allow)
+	})
+	t.Run("subnet ban", func(t *testing.T) {
+		_, _, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptAccept(mas).Return(false)
+		mockGater.EXPECT().ListBlockedSubnets().Return([]*net.IPNet{
+			{IP: net.IPv4(1, 2, 0, 0), Mask: net.IPv4Mask(0xff, 0xff, 0, 0)},
+		})
+		allow := gater.InterceptAccept(mas)
+		require.False(t, allow)
+	})
+}
+
+func TestExpiryConnectionGater_InterceptSecured(t *testing.T) {
+	mallory := peer.ID("7y9Qv7mG2h6fnzcDkeqVsEvW2rU9PdybSZ8y1dCrB9p")
+	addr, err := multiaddr.NewMultiaddr("/ip4/1.2.3.4/tcp/9000")
+	require.NoError(t, err)
+	mas := localRemoteAddrs{remote: addr}
+
+	t.Run("expired peer ban", func(t *testing.T) {
+		cl, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptSecured(network.DirInbound, mallory, mas).Return(false)
+		mockExpiryStore.EXPECT().PeerBanExpiry(mallory).Return(cl.Now().Add(-time.Second), nil)
+		mockGater.EXPECT().UnblockPeer(mallory).Return(nil)
+		allow := gater.InterceptSecured(network.DirInbound, mallory, mas)
+		require.True(t, allow)
+	})
+	t.Run("active peer ban", func(t *testing.T) {
+		cl, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptSecured(network.DirInbound, mallory, mas).Return(false)
+		mockExpiryStore.EXPECT().PeerBanExpiry(mallory).Return(cl.Now().Add(time.Second), nil)
+		allow := gater.InterceptSecured(network.DirInbound, mallory, mas)
+		require.False(t, allow)
+	})
+	t.Run("unknown expiry", func(t *testing.T) {
+		_, mockExpiryStore, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptSecured(network.DirInbound, mallory, mas).Return(false)
+		mockExpiryStore.EXPECT().PeerBanExpiry(mallory).Return(time.Time{}, UnknownExpiry)
+		allow := gater.InterceptSecured(network.DirInbound, mallory, mas)
+		require.False(t, allow)
+	})
+	t.Run("no ban", func(t *testing.T) {
+		_, _, mockGater, gater := expiryTestSetup(t)
+		mockGater.EXPECT().InterceptSecured(network.DirInbound, mallory, mas).Return(true)
+		allow := gater.InterceptSecured(network.DirInbound, mallory, mas)
+		require.True(t, allow)
+	})
+	t.Run("accept outbound", func(t *testing.T) {
+		_, _, _, gater := expiryTestSetup(t)
+		allow := gater.InterceptSecured(network.DirOutbound, mallory, mas)
+		require.True(t, allow)
+	})
+}

op-node/p2p/gating/metrics.go

+package gating
+
+import (
+	"github.com/libp2p/go-libp2p/core/network"
+	"github.com/libp2p/go-libp2p/core/peer"
+	"github.com/multiformats/go-multiaddr"
+)
+
+type ConnectionGaterMetrics interface {
+	RecordDial(allow bool)
+	RecordAccept(allow bool)
+}
+
+type MeteredConnectionGater struct {
+	BlockingConnectionGater
+	m ConnectionGaterMetrics
+}
+
+func AddMetering(gater BlockingConnectionGater, m ConnectionGaterMetrics) *MeteredConnectionGater {
+	return &MeteredConnectionGater{BlockingConnectionGater: gater, m: m}
+}
+
+func (g *MeteredConnectionGater) InterceptPeerDial(p peer.ID) (allow bool) {
+	allow = g.BlockingConnectionGater.InterceptPeerDial(p)
+	g.m.RecordDial(allow)
+	return allow
+}
+
+func (g *MeteredConnectionGater) InterceptAddrDial(id peer.ID, ma multiaddr.Multiaddr) (allow bool) {
+	allow = g.BlockingConnectionGater.InterceptAddrDial(id, ma)
+	g.m.RecordDial(allow)
+	return allow
+}
+
+func (g *MeteredConnectionGater) InterceptAccept(mas network.ConnMultiaddrs) (allow bool) {
+	allow = g.BlockingConnectionGater.InterceptAccept(mas)
+	g.m.RecordAccept(allow)
+	return allow
+}
+
+func (g *MeteredConnectionGater) InterceptSecured(dir network.Direction, id peer.ID, mas network.ConnMultiaddrs) (allow bool) {
+	allow = g.BlockingConnectionGater.InterceptSecured(dir, id, mas)
+	g.m.RecordAccept(allow)
+	return allow
+}

op-node/p2p/gating/mocks/BlockingConnectionGater.go

+// Code generated by mockery v2.28.0. DO NOT EDIT.
+
+package mocks
+
+import (
+	control "github.com/libp2p/go-libp2p/core/control"
+
+	mock "github.com/stretchr/testify/mock"
+
+	multiaddr "github.com/multiformats/go-multiaddr"
+
+	net "net"
+
+	network "github.com/libp2p/go-libp2p/core/network"
+
+	peer "github.com/libp2p/go-libp2p/core/peer"
+)
+
+// BlockingConnectionGater is an autogenerated mock type for the BlockingConnectionGater type
+type BlockingConnectionGater struct {
+	mock.Mock
+}
+
+type BlockingConnectionGater_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *BlockingConnectionGater) EXPECT() *BlockingConnectionGater_Expecter {
+	return &BlockingConnectionGater_Expecter{mock: &_m.Mock}
+}
+
+// BlockAddr provides a mock function with given fields: ip
+func (_m *BlockingConnectionGater) BlockAddr(ip net.IP) error {
+	ret := _m.Called(ip)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(net.IP) error); ok {
+		r0 = rf(ip)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_BlockAddr_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'BlockAddr'
+type BlockingConnectionGater_BlockAddr_Call struct {
+	*mock.Call
+}
+
+// BlockAddr is a helper method to define mock.On call
+//   - ip net.IP
+func (_e *BlockingConnectionGater_Expecter) BlockAddr(ip interface{}) *BlockingConnectionGater_BlockAddr_Call {
+	return &BlockingConnectionGater_BlockAddr_Call{Call: _e.mock.On("BlockAddr", ip)}
+}
+
+func (_c *BlockingConnectionGater_BlockAddr_Call) Run(run func(ip net.IP)) *BlockingConnectionGater_BlockAddr_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(net.IP))
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_BlockAddr_Call) Return(_a0 error) *BlockingConnectionGater_BlockAddr_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_BlockAddr_Call) RunAndReturn(run func(net.IP) error) *BlockingConnectionGater_BlockAddr_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// BlockPeer provides a mock function with given fields: p
+func (_m *BlockingConnectionGater) BlockPeer(p peer.ID) error {
+	ret := _m.Called(p)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(peer.ID) error); ok {
+		r0 = rf(p)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_BlockPeer_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'BlockPeer'
+type BlockingConnectionGater_BlockPeer_Call struct {
+	*mock.Call
+}
+
+// BlockPeer is a helper method to define mock.On call
+//   - p peer.ID
+func (_e *BlockingConnectionGater_Expecter) BlockPeer(p interface{}) *BlockingConnectionGater_BlockPeer_Call {
+	return &BlockingConnectionGater_BlockPeer_Call{Call: _e.mock.On("BlockPeer", p)}
+}
+
+func (_c *BlockingConnectionGater_BlockPeer_Call) Run(run func(p peer.ID)) *BlockingConnectionGater_BlockPeer_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(peer.ID))
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_BlockPeer_Call) Return(_a0 error) *BlockingConnectionGater_BlockPeer_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_BlockPeer_Call) RunAndReturn(run func(peer.ID) error) *BlockingConnectionGater_BlockPeer_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// BlockSubnet provides a mock function with given fields: ipnet
+func (_m *BlockingConnectionGater) BlockSubnet(ipnet *net.IPNet) error {
+	ret := _m.Called(ipnet)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(*net.IPNet) error); ok {
+		r0 = rf(ipnet)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_BlockSubnet_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'BlockSubnet'
+type BlockingConnectionGater_BlockSubnet_Call struct {
+	*mock.Call
+}
+
+// BlockSubnet is a helper method to define mock.On call
+//   - ipnet *net.IPNet
+func (_e *BlockingConnectionGater_Expecter) BlockSubnet(ipnet interface{}) *BlockingConnectionGater_BlockSubnet_Call {
+	return &BlockingConnectionGater_BlockSubnet_Call{Call: _e.mock.On("BlockSubnet", ipnet)}
+}
+
+func (_c *BlockingConnectionGater_BlockSubnet_Call) Run(run func(ipnet *net.IPNet)) *BlockingConnectionGater_BlockSubnet_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(*net.IPNet))
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_BlockSubnet_Call) Return(_a0 error) *BlockingConnectionGater_BlockSubnet_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_BlockSubnet_Call) RunAndReturn(run func(*net.IPNet) error) *BlockingConnectionGater_BlockSubnet_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// InterceptAccept provides a mock function with given fields: _a0
+func (_m *BlockingConnectionGater) InterceptAccept(_a0 network.ConnMultiaddrs) bool {
+	ret := _m.Called(_a0)
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func(network.ConnMultiaddrs) bool); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_InterceptAccept_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'InterceptAccept'
+type BlockingConnectionGater_InterceptAccept_Call struct {
+	*mock.Call
+}
+
+// InterceptAccept is a helper method to define mock.On call
+//   - _a0 network.ConnMultiaddrs
+func (_e *BlockingConnectionGater_Expecter) InterceptAccept(_a0 interface{}) *BlockingConnectionGater_InterceptAccept_Call {
+	return &BlockingConnectionGater_InterceptAccept_Call{Call: _e.mock.On("InterceptAccept", _a0)}
+}
+
+func (_c *BlockingConnectionGater_InterceptAccept_Call) Run(run func(_a0 network.ConnMultiaddrs)) *BlockingConnectionGater_InterceptAccept_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(network.ConnMultiaddrs))
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_InterceptAccept_Call) Return(allow bool) *BlockingConnectionGater_InterceptAccept_Call {
+	_c.Call.Return(allow)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_InterceptAccept_Call) RunAndReturn(run func(network.ConnMultiaddrs) bool) *BlockingConnectionGater_InterceptAccept_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// InterceptAddrDial provides a mock function with given fields: _a0, _a1
+func (_m *BlockingConnectionGater) InterceptAddrDial(_a0 peer.ID, _a1 multiaddr.Multiaddr) bool {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func(peer.ID, multiaddr.Multiaddr) bool); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_InterceptAddrDial_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'InterceptAddrDial'
+type BlockingConnectionGater_InterceptAddrDial_Call struct {
+	*mock.Call
+}
+
+// InterceptAddrDial is a helper method to define mock.On call
+//   - _a0 peer.ID
+//   - _a1 multiaddr.Multiaddr
+func (_e *BlockingConnectionGater_Expecter) InterceptAddrDial(_a0 interface{}, _a1 interface{}) *BlockingConnectionGater_InterceptAddrDial_Call {
+	return &BlockingConnectionGater_InterceptAddrDial_Call{Call: _e.mock.On("InterceptAddrDial", _a0, _a1)}
+}
+
+func (_c *BlockingConnectionGater_InterceptAddrDial_Call) Run(run func(_a0 peer.ID, _a1 multiaddr.Multiaddr)) *BlockingConnectionGater_InterceptAddrDial_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(peer.ID), args[1].(multiaddr.Multiaddr))
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_InterceptAddrDial_Call) Return(allow bool) *BlockingConnectionGater_InterceptAddrDial_Call {
+	_c.Call.Return(allow)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_InterceptAddrDial_Call) RunAndReturn(run func(peer.ID, multiaddr.Multiaddr) bool) *BlockingConnectionGater_InterceptAddrDial_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// InterceptPeerDial provides a mock function with given fields: p
+func (_m *BlockingConnectionGater) InterceptPeerDial(p peer.ID) bool {
+	ret := _m.Called(p)
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func(peer.ID) bool); ok {
+		r0 = rf(p)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_InterceptPeerDial_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'InterceptPeerDial'
+type BlockingConnectionGater_InterceptPeerDial_Call struct {
+	*mock.Call
+}
+
+// InterceptPeerDial is a helper method to define mock.On call
+//   - p peer.ID
+func (_e *BlockingConnectionGater_Expecter) InterceptPeerDial(p interface{}) *BlockingConnectionGater_InterceptPeerDial_Call {
+	return &BlockingConnectionGater_InterceptPeerDial_Call{Call: _e.mock.On("InterceptPeerDial", p)}
+}
+
+func (_c *BlockingConnectionGater_InterceptPeerDial_Call) Run(run func(p peer.ID)) *BlockingConnectionGater_InterceptPeerDial_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(peer.ID))
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_InterceptPeerDial_Call) Return(allow bool) *BlockingConnectionGater_InterceptPeerDial_Call {
+	_c.Call.Return(allow)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_InterceptPeerDial_Call) RunAndReturn(run func(peer.ID) bool) *BlockingConnectionGater_InterceptPeerDial_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// InterceptSecured provides a mock function with given fields: _a0, _a1, _a2
+func (_m *BlockingConnectionGater) InterceptSecured(_a0 network.Direction, _a1 peer.ID, _a2 network.ConnMultiaddrs) bool {
+	ret := _m.Called(_a0, _a1, _a2)
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func(network.Direction, peer.ID, network.ConnMultiaddrs) bool); ok {
+		r0 = rf(_a0, _a1, _a2)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_InterceptSecured_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'InterceptSecured'
+type BlockingConnectionGater_InterceptSecured_Call struct {
+	*mock.Call
+}
+
+// InterceptSecured is a helper method to define mock.On call
+//   - _a0 network.Direction
+//   - _a1 peer.ID
+//   - _a2 network.ConnMultiaddrs
+func (_e *BlockingConnectionGater_Expecter) InterceptSecured(_a0 interface{}, _a1 interface{}, _a2 interface{}) *BlockingConnectionGater_InterceptSecured_Call {
+	return &BlockingConnectionGater_InterceptSecured_Call{Call: _e.mock.On("InterceptSecured", _a0, _a1, _a2)}
+}
+
+func (_c *BlockingConnectionGater_InterceptSecured_Call) Run(run func(_a0 network.Direction, _a1 peer.ID, _a2 network.ConnMultiaddrs)) *BlockingConnectionGater_InterceptSecured_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(network.Direction), args[1].(peer.ID), args[2].(network.ConnMultiaddrs))
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_InterceptSecured_Call) Return(allow bool) *BlockingConnectionGater_InterceptSecured_Call {
+	_c.Call.Return(allow)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_InterceptSecured_Call) RunAndReturn(run func(network.Direction, peer.ID, network.ConnMultiaddrs) bool) *BlockingConnectionGater_InterceptSecured_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// InterceptUpgraded provides a mock function with given fields: _a0
+func (_m *BlockingConnectionGater) InterceptUpgraded(_a0 network.Conn) (bool, control.DisconnectReason) {
+	ret := _m.Called(_a0)
+
+	var r0 bool
+	var r1 control.DisconnectReason
+	if rf, ok := ret.Get(0).(func(network.Conn) (bool, control.DisconnectReason)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(network.Conn) bool); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	if rf, ok := ret.Get(1).(func(network.Conn) control.DisconnectReason); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Get(1).(control.DisconnectReason)
+	}
+
+	return r0, r1
+}
+
+// BlockingConnectionGater_InterceptUpgraded_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'InterceptUpgraded'
+type BlockingConnectionGater_InterceptUpgraded_Call struct {
+	*mock.Call
+}
+
+// InterceptUpgraded is a helper method to define mock.On call
+//   - _a0 network.Conn
+func (_e *BlockingConnectionGater_Expecter) InterceptUpgraded(_a0 interface{}) *BlockingConnectionGater_InterceptUpgraded_Call {
+	return &BlockingConnectionGater_InterceptUpgraded_Call{Call: _e.mock.On("InterceptUpgraded", _a0)}
+}
+
+func (_c *BlockingConnectionGater_InterceptUpgraded_Call) Run(run func(_a0 network.Conn)) *BlockingConnectionGater_InterceptUpgraded_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(network.Conn))
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_InterceptUpgraded_Call) Return(allow bool, reason control.DisconnectReason) *BlockingConnectionGater_InterceptUpgraded_Call {
+	_c.Call.Return(allow, reason)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_InterceptUpgraded_Call) RunAndReturn(run func(network.Conn) (bool, control.DisconnectReason)) *BlockingConnectionGater_InterceptUpgraded_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ListBlockedAddrs provides a mock function with given fields:
+func (_m *BlockingConnectionGater) ListBlockedAddrs() []net.IP {
+	ret := _m.Called()
+
+	var r0 []net.IP
+	if rf, ok := ret.Get(0).(func() []net.IP); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]net.IP)
+		}
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_ListBlockedAddrs_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListBlockedAddrs'
+type BlockingConnectionGater_ListBlockedAddrs_Call struct {
+	*mock.Call
+}
+
+// ListBlockedAddrs is a helper method to define mock.On call
+func (_e *BlockingConnectionGater_Expecter) ListBlockedAddrs() *BlockingConnectionGater_ListBlockedAddrs_Call {
+	return &BlockingConnectionGater_ListBlockedAddrs_Call{Call: _e.mock.On("ListBlockedAddrs")}
+}
+
+func (_c *BlockingConnectionGater_ListBlockedAddrs_Call) Run(run func()) *BlockingConnectionGater_ListBlockedAddrs_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_ListBlockedAddrs_Call) Return(_a0 []net.IP) *BlockingConnectionGater_ListBlockedAddrs_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_ListBlockedAddrs_Call) RunAndReturn(run func() []net.IP) *BlockingConnectionGater_ListBlockedAddrs_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ListBlockedPeers provides a mock function with given fields:
+func (_m *BlockingConnectionGater) ListBlockedPeers() []peer.ID {
+	ret := _m.Called()
+
+	var r0 []peer.ID
+	if rf, ok := ret.Get(0).(func() []peer.ID); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]peer.ID)
+		}
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_ListBlockedPeers_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListBlockedPeers'
+type BlockingConnectionGater_ListBlockedPeers_Call struct {
+	*mock.Call
+}
+
+// ListBlockedPeers is a helper method to define mock.On call
+func (_e *BlockingConnectionGater_Expecter) ListBlockedPeers() *BlockingConnectionGater_ListBlockedPeers_Call {
+	return &BlockingConnectionGater_ListBlockedPeers_Call{Call: _e.mock.On("ListBlockedPeers")}
+}
+
+func (_c *BlockingConnectionGater_ListBlockedPeers_Call) Run(run func()) *BlockingConnectionGater_ListBlockedPeers_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_ListBlockedPeers_Call) Return(_a0 []peer.ID) *BlockingConnectionGater_ListBlockedPeers_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_ListBlockedPeers_Call) RunAndReturn(run func() []peer.ID) *BlockingConnectionGater_ListBlockedPeers_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ListBlockedSubnets provides a mock function with given fields:
+func (_m *BlockingConnectionGater) ListBlockedSubnets() []*net.IPNet {
+	ret := _m.Called()
+
+	var r0 []*net.IPNet
+	if rf, ok := ret.Get(0).(func() []*net.IPNet); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]*net.IPNet)
+		}
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_ListBlockedSubnets_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListBlockedSubnets'
+type BlockingConnectionGater_ListBlockedSubnets_Call struct {
+	*mock.Call
+}
+
+// ListBlockedSubnets is a helper method to define mock.On call
+func (_e *BlockingConnectionGater_Expecter) ListBlockedSubnets() *BlockingConnectionGater_ListBlockedSubnets_Call {
+	return &BlockingConnectionGater_ListBlockedSubnets_Call{Call: _e.mock.On("ListBlockedSubnets")}
+}
+
+func (_c *BlockingConnectionGater_ListBlockedSubnets_Call) Run(run func()) *BlockingConnectionGater_ListBlockedSubnets_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run()
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_ListBlockedSubnets_Call) Return(_a0 []*net.IPNet) *BlockingConnectionGater_ListBlockedSubnets_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_ListBlockedSubnets_Call) RunAndReturn(run func() []*net.IPNet) *BlockingConnectionGater_ListBlockedSubnets_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// UnblockAddr provides a mock function with given fields: ip
+func (_m *BlockingConnectionGater) UnblockAddr(ip net.IP) error {
+	ret := _m.Called(ip)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(net.IP) error); ok {
+		r0 = rf(ip)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_UnblockAddr_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'UnblockAddr'
+type BlockingConnectionGater_UnblockAddr_Call struct {
+	*mock.Call
+}
+
+// UnblockAddr is a helper method to define mock.On call
+//   - ip net.IP
+func (_e *BlockingConnectionGater_Expecter) UnblockAddr(ip interface{}) *BlockingConnectionGater_UnblockAddr_Call {
+	return &BlockingConnectionGater_UnblockAddr_Call{Call: _e.mock.On("UnblockAddr", ip)}
+}
+
+func (_c *BlockingConnectionGater_UnblockAddr_Call) Run(run func(ip net.IP)) *BlockingConnectionGater_UnblockAddr_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(net.IP))
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_UnblockAddr_Call) Return(_a0 error) *BlockingConnectionGater_UnblockAddr_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_UnblockAddr_Call) RunAndReturn(run func(net.IP) error) *BlockingConnectionGater_UnblockAddr_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// UnblockPeer provides a mock function with given fields: p
+func (_m *BlockingConnectionGater) UnblockPeer(p peer.ID) error {
+	ret := _m.Called(p)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(peer.ID) error); ok {
+		r0 = rf(p)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_UnblockPeer_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'UnblockPeer'
+type BlockingConnectionGater_UnblockPeer_Call struct {
+	*mock.Call
+}
+
+// UnblockPeer is a helper method to define mock.On call
+//   - p peer.ID
+func (_e *BlockingConnectionGater_Expecter) UnblockPeer(p interface{}) *BlockingConnectionGater_UnblockPeer_Call {
+	return &BlockingConnectionGater_UnblockPeer_Call{Call: _e.mock.On("UnblockPeer", p)}
+}
+
+func (_c *BlockingConnectionGater_UnblockPeer_Call) Run(run func(p peer.ID)) *BlockingConnectionGater_UnblockPeer_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(peer.ID))
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_UnblockPeer_Call) Return(_a0 error) *BlockingConnectionGater_UnblockPeer_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_UnblockPeer_Call) RunAndReturn(run func(peer.ID) error) *BlockingConnectionGater_UnblockPeer_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// UnblockSubnet provides a mock function with given fields: ipnet
+func (_m *BlockingConnectionGater) UnblockSubnet(ipnet *net.IPNet) error {
+	ret := _m.Called(ipnet)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(*net.IPNet) error); ok {
+		r0 = rf(ipnet)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// BlockingConnectionGater_UnblockSubnet_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'UnblockSubnet'
+type BlockingConnectionGater_UnblockSubnet_Call struct {
+	*mock.Call
+}
+
+// UnblockSubnet is a helper method to define mock.On call
+//   - ipnet *net.IPNet
+func (_e *BlockingConnectionGater_Expecter) UnblockSubnet(ipnet interface{}) *BlockingConnectionGater_UnblockSubnet_Call {
+	return &BlockingConnectionGater_UnblockSubnet_Call{Call: _e.mock.On("UnblockSubnet", ipnet)}
+}
+
+func (_c *BlockingConnectionGater_UnblockSubnet_Call) Run(run func(ipnet *net.IPNet)) *BlockingConnectionGater_UnblockSubnet_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(*net.IPNet))
+	})
+	return _c
+}
+
+func (_c *BlockingConnectionGater_UnblockSubnet_Call) Return(_a0 error) *BlockingConnectionGater_UnblockSubnet_Call {
+	_c.Call.Return(_a0)
+	return _c
+}
+
+func (_c *BlockingConnectionGater_UnblockSubnet_Call) RunAndReturn(run func(*net.IPNet) error) *BlockingConnectionGater_UnblockSubnet_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+type mockConstructorTestingTNewBlockingConnectionGater interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewBlockingConnectionGater creates a new instance of BlockingConnectionGater. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewBlockingConnectionGater(t mockConstructorTestingTNewBlockingConnectionGater) *BlockingConnectionGater {
+	mock := &BlockingConnectionGater{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

op-node/p2p/gating/mocks/ExpiryStore.go

+// Code generated by mockery v2.28.0. DO NOT EDIT.
+
+package mocks
+
+import (
+	net "net"
+
+	mock "github.com/stretchr/testify/mock"
+
+	peer "github.com/libp2p/go-libp2p/core/peer"
+
+	time "time"
+)
+
+// ExpiryStore is an autogenerated mock type for the ExpiryStore type
+type ExpiryStore struct {
+	mock.Mock
+}
+
+type ExpiryStore_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *ExpiryStore) EXPECT() *ExpiryStore_Expecter {
+	return &ExpiryStore_Expecter{mock: &_m.Mock}
+}
+
+// IPBanExpiry provides a mock function with given fields: ip
+func (_m *ExpiryStore) IPBanExpiry(ip net.IP) (time.Time, error) {
+	ret := _m.Called(ip)
+
+	var r0 time.Time
+	var r1 error
+	if rf, ok := ret.Get(0).(func(net.IP) (time.Time, error)); ok {
+		return rf(ip)
+	}
+	if rf, ok := ret.Get(0).(func(net.IP) time.Time); ok {
+		r0 = rf(ip)
+	} else {
+		r0 = ret.Get(0).(time.Time)
+	}
+
+	if rf, ok := ret.Get(1).(func(net.IP) error); ok {
+		r1 = rf(ip)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// ExpiryStore_IPBanExpiry_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'IPBanExpiry'
+type ExpiryStore_IPBanExpiry_Call struct {
+	*mock.Call
+}
+
+// IPBanExpiry is a helper method to define mock.On call
+//   - ip net.IP
+func (_e *ExpiryStore_Expecter) IPBanExpiry(ip interface{}) *ExpiryStore_IPBanExpiry_Call {
+	return &ExpiryStore_IPBanExpiry_Call{Call: _e.mock.On("IPBanExpiry", ip)}
+}
+
+func (_c *ExpiryStore_IPBanExpiry_Call) Run(run func(ip net.IP)) *ExpiryStore_IPBanExpiry_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(net.IP))
+	})
+	return _c
+}
+
+func (_c *ExpiryStore_IPBanExpiry_Call) Return(_a0 time.Time, _a1 error) *ExpiryStore_IPBanExpiry_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *ExpiryStore_IPBanExpiry_Call) RunAndReturn(run func(net.IP) (time.Time, error)) *ExpiryStore_IPBanExpiry_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// PeerBanExpiry provides a mock function with given fields: id
+func (_m *ExpiryStore) PeerBanExpiry(id peer.ID) (time.Time, error) {
+	ret := _m.Called(id)
+
+	var r0 time.Time
+	var r1 error
+	if rf, ok := ret.Get(0).(func(peer.ID) (time.Time, error)); ok {
+		return rf(id)
+	}
+	if rf, ok := ret.Get(0).(func(peer.ID) time.Time); ok {
+		r0 = rf(id)
+	} else {
+		r0 = ret.Get(0).(time.Time)
+	}
+
+	if rf, ok := ret.Get(1).(func(peer.ID) error); ok {
+		r1 = rf(id)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// ExpiryStore_PeerBanExpiry_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'PeerBanExpiry'
+type ExpiryStore_PeerBanExpiry_Call struct {
+	*mock.Call
+}
+
+// PeerBanExpiry is a helper method to define mock.On call
+//   - id peer.ID
+func (_e *ExpiryStore_Expecter) PeerBanExpiry(id interface{}) *ExpiryStore_PeerBanExpiry_Call {
+	return &ExpiryStore_PeerBanExpiry_Call{Call: _e.mock.On("PeerBanExpiry", id)}
+}
+
+func (_c *ExpiryStore_PeerBanExpiry_Call) Run(run func(id peer.ID)) *ExpiryStore_PeerBanExpiry_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(peer.ID))
+	})
+	return _c
+}
+
+func (_c *ExpiryStore_PeerBanExpiry_Call) Return(_a0 time.Time, _a1 error) *ExpiryStore_PeerBanExpiry_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *ExpiryStore_PeerBanExpiry_Call) RunAndReturn(run func(peer.ID) (time.Time, error)) *ExpiryStore_PeerBanExpiry_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+type mockConstructorTestingTNewExpiryStore interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewExpiryStore creates a new instance of ExpiryStore. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewExpiryStore(t mockConstructorTestingTNewExpiryStore) *ExpiryStore {
+	mock := &ExpiryStore{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

op-node/p2p/gating/mocks/Scores.go

+// Code generated by mockery v2.28.0. DO NOT EDIT.
+
+package mocks
+
+import (
+	peer "github.com/libp2p/go-libp2p/core/peer"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// Scores is an autogenerated mock type for the Scores type
+type Scores struct {
+	mock.Mock
+}
+
+type Scores_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *Scores) EXPECT() *Scores_Expecter {
+	return &Scores_Expecter{mock: &_m.Mock}
+}
+
+// GetPeerScore provides a mock function with given fields: id
+func (_m *Scores) GetPeerScore(id peer.ID) (float64, error) {
+	ret := _m.Called(id)
+
+	var r0 float64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(peer.ID) (float64, error)); ok {
+		return rf(id)
+	}
+	if rf, ok := ret.Get(0).(func(peer.ID) float64); ok {
+		r0 = rf(id)
+	} else {
+		r0 = ret.Get(0).(float64)
+	}
+
+	if rf, ok := ret.Get(1).(func(peer.ID) error); ok {
+		r1 = rf(id)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Scores_GetPeerScore_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetPeerScore'
+type Scores_GetPeerScore_Call struct {
+	*mock.Call
+}
+
+// GetPeerScore is a helper method to define mock.On call
+//   - id peer.ID
+func (_e *Scores_Expecter) GetPeerScore(id interface{}) *Scores_GetPeerScore_Call {
+	return &Scores_GetPeerScore_Call{Call: _e.mock.On("GetPeerScore", id)}
+}
+
+func (_c *Scores_GetPeerScore_Call) Run(run func(id peer.ID)) *Scores_GetPeerScore_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		run(args[0].(peer.ID))
+	})
+	return _c
+}
+
+func (_c *Scores_GetPeerScore_Call) Return(_a0 float64, _a1 error) *Scores_GetPeerScore_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *Scores_GetPeerScore_Call) RunAndReturn(run func(peer.ID) (float64, error)) *Scores_GetPeerScore_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+type mockConstructorTestingTNewScores interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewScores creates a new instance of Scores. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewScores(t mockConstructorTestingTNewScores) *Scores {
+	mock := &Scores{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

op-node/p2p/gating/scoring.go

+package gating
+
+import (
+	"github.com/libp2p/go-libp2p/core/network"
+	"github.com/libp2p/go-libp2p/core/peer"
+	"github.com/multiformats/go-multiaddr"
+)
+
+//go:generate mockery --name Scores --output mocks/ --with-expecter=true
+type Scores interface {
+	GetPeerScore(id peer.ID) (float64, error)
+}
+
+// ScoringConnectionGater enhances a ConnectionGater by enforcing a minimum score for peer connections
+type ScoringConnectionGater struct {
+	BlockingConnectionGater
+	scores   Scores
+	minScore float64
+}
+
+func AddScoring(gater BlockingConnectionGater, scores Scores, minScore float64) *ScoringConnectionGater {
+	return &ScoringConnectionGater{BlockingConnectionGater: gater, scores: scores, minScore: minScore}
+}
+
+func (g *ScoringConnectionGater) checkScore(p peer.ID) (allow bool) {
+	score, err := g.scores.GetPeerScore(p)
+	if err != nil {
+		return false
+	}
+	return score >= g.minScore
+}
+
+func (g *ScoringConnectionGater) InterceptPeerDial(p peer.ID) (allow bool) {
+	return g.BlockingConnectionGater.InterceptPeerDial(p) && g.checkScore(p)
+}
+
+func (g *ScoringConnectionGater) InterceptAddrDial(id peer.ID, ma multiaddr.Multiaddr) (allow bool) {
+	return g.BlockingConnectionGater.InterceptAddrDial(id, ma) && g.checkScore(id)
+}
+
+func (g *ScoringConnectionGater) InterceptSecured(dir network.Direction, id peer.ID, mas network.ConnMultiaddrs) (allow bool) {
+	return g.BlockingConnectionGater.InterceptSecured(dir, id, mas) && g.checkScore(id)
+}