feat: option to limit local announcements (fixes #10195) - #10802
feat: option to limit local announcements (fixes #10195)#10802legacylynx wants to merge 3 commits into
Conversation
Sorry, something went wrong.
See issue syncthing#10195 Currently, there is no way to prevent local announcements from being broadcast/multicast on the specific interfaces. Syncthing sends the announcements on all running broadcast/multicast-capable (and, in case of Android, non-cellular) interfaces, which may be undesirable. The proposed change should eliminate that traffic, which is noise, especially in a conservatively configured firewall scenario. This change allows to set a whitelist or blacklist of network interfaces that will (not) send announcements. If both lists are specified, whitelist takes precedence. It is possible to use globs in network interfaces names, e.g. `eth*` will match `eth0`, `eth1`, etc, or `enp*s[0-9]` will match `enp34s0`, `enp2s1`, etc. Signed-off-by: legacylynx <254520357+legacylynx@users.noreply.github.com>
|
Sounds reasonable, though I'm not excited about passing around the globs and the slight duplication of matching logic. There's some precedent here in the XattrFilter. It seems like we could refactor that to break out the []XattrFilterEntry to a more generic item filter, and then use it for both the xattrs and your thing. |
Sorry, something went wrong.
I agree. I just wasn't sure how to do it better, so I did... simpler?
Yes, it should be much better. |
Sorry, something went wrong.
Purpose
Currently, there is no way to prevent local announcements from being broadcast/multicast on the specific interfaces.
Syncthing sends the announcements on all running broadcast/multicast-capable (and, in case of Android, non-cellular) interfaces, which may be undesirable.
The proposed change should eliminate that traffic, which is noise, especially in a conservatively configured firewall scenario.
This change allows to set a whitelist or blacklist of network interfaces that will (not) send announcements. If both lists are specified, whitelist takes precedence. It is possible to use globs in network interfaces names, e.g. eth* will match eth0, eth1, etc, or enp*s[0-9] will match enp34s0, enp2s1, etc.
Testing
Updated tests for the configuration in accordance with the new directives.
Updated tests for LocalInstanceID according to the new arguments of the NewLocal function.
I'm not sure if it's possible to check the rest using automated tests.
If we talk about manual checks directly using the Syncthing, then the logs of interest are shown with the STTRACE=beacon,discover,config environment variable - which interfaces are ignored, which broadcast addresses are added as a result and what happens when the configuration is commited.
And as an another option, we can check the fact of a broadcast using firewall logs (for example, with log prefix "NFT LOG " rules in nftables chains) or a traffic analyzer.
Screenshots
Documentation
At the moment, help for new fields has been added to the GUI, as you can see in the screenshot 1 2.
But I guess it's better to be in the documentation, right?
There is no PR in the docs repository yet.
Authorship
legacylynx 254520357+legacylynx@users.noreply.github.com