Application specific handshake

[y0sher]

I’ve implemented a p2p network using go-libp2p. I want to have an application layer handshake, for example:

• check network ID.
• verify a certain type of cryptographic identity.
  I used streams to do it but as soon as a peer is added it is automatically exposed to all procotols which means that during my protocol handshake I can receive messages from this peer in pubsub for example.
  Is there an easy way to add application-layer handshake? or should I just guard pubsub for example using a whitelist that is generated from my application-handshake?

I have also took a look on ConnGater which seems like the right place to put my handshake code, but even there it seems like either I intercept before there is a libp2p stream to use, or I intercept after the peer is "upgraded" which means it is already getting messages from pubsub.

Any pointing to resources will be very helpful.

[thomaseizinger]

I don't know about go-libp2p specifically but your best bet might be to have two hosts: One that only supports the handshake protocol where you validate the identity and a 2nd one that has a connection management policy to only allow connections from a certain allow-list.

Validated peers from the first host feed into the second one.