feat: add configurable subnet limit overrides for IP diversity

Introduces optional floor and ceiling overrides for IPv4 and IPv6 subnet limits:
- `ipv4_limit_floor` and `ipv4_limit_ceiling`
- `ipv6_limit_floor` and `ipv6_limit_ceiling`

Overrides allow stricter or more permissive network configurations by adjusting computed dynamic limits. For example, `floor` ensures a minimum limit, while `ceiling` enforces a strict upper cap.

Includes updates to the `IPDiversityConfig` structure, relevant test cases, and dynamic adjustment logic with the new `clamp_limit` utility function.

Author: mickvandijke

src/adaptive/trust.rs

@@ -175,10 +175,10 @@ impl TrustEngine {
     #[cfg(test)]
     pub async fn simulate_elapsed(&self, node_id: &PeerId, elapsed: std::time::Duration) {
         let mut peers = self.peers.write().await;
-        if let Some(trust) = peers.get_mut(node_id) {
-            if let Some(past) = Instant::now().checked_sub(elapsed) {
-                trust.last_updated = past;
-            }
+        if let Some(trust) = peers.get_mut(node_id)
+            && let Some(past) = Instant::now().checked_sub(elapsed)
+        {
+            trust.last_updated = past;
         }
     }
 }

src/bootstrap/manager.rs

@@ -534,12 +534,16 @@ mod tests {
         // Very restrictive rate limiting - only 2 joins per /24 subnet per hour
         // Use permissive diversity config to isolate rate limiting behavior
         let diversity_config = IPDiversityConfig {
-            max_nodes_per_64: 100,
-            max_nodes_per_48: 100,
-            max_nodes_per_32: 100,
+            max_nodes_per_ipv6_64: 100,
+            max_nodes_per_ipv6_48: 100,
+            max_nodes_per_ipv6_32: 100,
             max_nodes_per_ipv4_32: None, // No static cap for rate limit test
             max_nodes_per_ipv4_24: None,
             max_nodes_per_ipv4_16: None,
+            ipv4_limit_floor: None,
+            ipv4_limit_ceiling: None,
+            ipv6_limit_floor: None,
+            ipv6_limit_ceiling: None,
             max_per_ip_cap: 100,
             max_network_fraction: 1.0,
             max_nodes_per_asn: 1000,

src/dht/core_engine.rs

@@ -299,6 +299,20 @@ fn mask_ipv6(addr: Ipv6Addr, prefix_len: u8) -> Ipv6Addr {
     Ipv6Addr::from(bits & mask)
 }
 
+/// Apply optional floor/ceiling overrides to a computed subnet limit.
+/// Floor is applied first (raising the value), then ceiling (lowering it).
+/// When both are set, ceiling wins if floor > ceiling.
+fn clamp_limit(limit: usize, floor: Option<usize>, ceiling: Option<usize>) -> usize {
+    let mut result = limit;
+    if let Some(f) = floor {
+        result = result.max(f);
+    }
+    if let Some(c) = ceiling {
+        result = result.min(c);
+    }
+    result
+}
+
 /// Default maximum nodes per geographic region. Matches
 /// `GeographicRoutingConfig::max_nodes_per_region` default.
 const GEO_DEFAULT_MAX_PER_REGION: usize = 50;
@@ -546,19 +560,28 @@ impl DhtCoreEngine {
         match candidate_ip {
             IpAddr::V4(v4) => {
                 let cfg = &self.ip_diversity_config;
-                let limit_32 = cfg
-                    .max_nodes_per_ipv4_32
-                    .map_or(per_ip, |cap| cap.min(per_ip));
-                let limit_24 = cfg
-                    .max_nodes_per_ipv4_24
-                    .map_or(per_ip * SUBNET_NARROW_MULTIPLIER, |cap| {
-                        cap.min(per_ip * SUBNET_NARROW_MULTIPLIER)
-                    });
-                let limit_16 = cfg
-                    .max_nodes_per_ipv4_16
-                    .map_or(per_ip * SUBNET_MEDIUM_MULTIPLIER, |cap| {
-                        cap.min(per_ip * SUBNET_MEDIUM_MULTIPLIER)
-                    });
+                let limit_32 = clamp_limit(
+                    cfg.max_nodes_per_ipv4_32
+                        .map_or(per_ip, |cap| cap.min(per_ip)),
+                    cfg.ipv4_limit_floor,
+                    cfg.ipv4_limit_ceiling,
+                );
+                let limit_24 = clamp_limit(
+                    cfg.max_nodes_per_ipv4_24
+                        .map_or(per_ip * SUBNET_NARROW_MULTIPLIER, |cap| {
+                            cap.min(per_ip * SUBNET_NARROW_MULTIPLIER)
+                        }),
+                    cfg.ipv4_limit_floor,
+                    cfg.ipv4_limit_ceiling,
+                );
+                let limit_16 = clamp_limit(
+                    cfg.max_nodes_per_ipv4_16
+                        .map_or(per_ip * SUBNET_MEDIUM_MULTIPLIER, |cap| {
+                            cap.min(per_ip * SUBNET_MEDIUM_MULTIPLIER)
+                        }),
+                    cfg.ipv4_limit_floor,
+                    cfg.ipv4_limit_ceiling,
+                );
 
                 if v4_counts.exact >= limit_32 {
                     return Err(anyhow!(
@@ -580,11 +603,21 @@ impl DhtCoreEngine {
             }
             IpAddr::V6(_) => {
                 let cfg = &self.ip_diversity_config;
-                let limit_64 =
-                    std::cmp::min(cfg.max_nodes_per_64, per_ip * SUBNET_NARROW_MULTIPLIER);
-                let limit_48 =
-                    std::cmp::min(cfg.max_nodes_per_48, per_ip * SUBNET_MEDIUM_MULTIPLIER);
-                let limit_32 = std::cmp::min(cfg.max_nodes_per_32, per_ip * SUBNET_WIDE_MULTIPLIER);
+                let limit_64 = clamp_limit(
+                    std::cmp::min(cfg.max_nodes_per_ipv6_64, per_ip * SUBNET_NARROW_MULTIPLIER),
+                    cfg.ipv6_limit_floor,
+                    cfg.ipv6_limit_ceiling,
+                );
+                let limit_48 = clamp_limit(
+                    std::cmp::min(cfg.max_nodes_per_ipv6_48, per_ip * SUBNET_MEDIUM_MULTIPLIER),
+                    cfg.ipv6_limit_floor,
+                    cfg.ipv6_limit_ceiling,
+                );
+                let limit_32 = clamp_limit(
+                    std::cmp::min(cfg.max_nodes_per_ipv6_32, per_ip * SUBNET_WIDE_MULTIPLIER),
+                    cfg.ipv6_limit_floor,
+                    cfg.ipv6_limit_ceiling,
+                );
 
                 if v6_counts.slash_64 >= limit_64 {
                     return Err(anyhow!("IP diversity: /64 limit ({limit_64}) exceeded"));

src/dht/security_tests.rs

@@ -1,5 +1,6 @@
 use crate::PeerId;
 use crate::dht::core_engine::{DhtCoreEngine, NodeCapacity, NodeInfo};
+use crate::security::IPDiversityConfig;
 use std::time::SystemTime;
 
 #[tokio::test]
@@ -241,3 +242,181 @@ async fn test_geographic_diversity_counts_region_nodes() -> anyhow::Result<()> {
     // All should succeed since geographic limit is 50 and we're only adding 3
     Ok(())
 }
+
+#[tokio::test]
+async fn test_ipv4_floor_override_raises_limit() -> anyhow::Result<()> {
+    // Default dynamic limit for a small network is 1 per /32.
+    // Setting ipv4_limit_floor = 3 should allow 3 nodes on the same IP.
+    let mut engine = DhtCoreEngine::new_for_tests(PeerId::random())?;
+    engine.set_ip_diversity_config(IPDiversityConfig {
+        ipv4_limit_floor: Some(3),
+        ..IPDiversityConfig::default()
+    });
+
+    for i in 0..3u8 {
+        let node = NodeInfo {
+            id: PeerId::random(),
+            address: format!("/ip4/192.168.1.1/udp/{}/quic", 9000 + u16::from(i))
+                .parse()
+                .unwrap(),
+            last_seen: SystemTime::now(),
+            capacity: NodeCapacity::default(),
+        };
+        engine.add_node(node).await?;
+    }
+
+    // Fourth node should fail (floor is 3, so limit is 3)
+    let node4 = NodeInfo {
+        id: PeerId::random(),
+        address: "/ip4/192.168.1.1/udp/9003/quic".parse().unwrap(),
+        last_seen: SystemTime::now(),
+        capacity: NodeCapacity::default(),
+    };
+    let result = engine.add_node(node4).await;
+    assert!(result.is_err());
+    assert!(result.unwrap_err().to_string().contains("IP diversity:"));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_ipv4_ceiling_override_lowers_limit() -> anyhow::Result<()> {
+    // With a large network, dynamic per-IP would be high.
+    // Setting ipv4_limit_ceiling = 1 should cap all subnet limits at 1.
+    let mut engine = DhtCoreEngine::new_for_tests(PeerId::random())?;
+    engine.set_ip_diversity_config(IPDiversityConfig {
+        ipv4_limit_ceiling: Some(1),
+        // Raise the dynamic limit so ceiling actually constrains it
+        max_per_ip_cap: 100,
+        max_network_fraction: 1.0,
+        ..IPDiversityConfig::default()
+    });
+
+    // First node on 10.0.1.1
+    let node1 = NodeInfo {
+        id: PeerId::random(),
+        address: "/ip4/10.0.1.1/udp/9000/quic".parse().unwrap(),
+        last_seen: SystemTime::now(),
+        capacity: NodeCapacity::default(),
+    };
+    engine.add_node(node1).await?;
+
+    // Second node on different IP but same /24 — should fail because ceiling=1
+    let node2 = NodeInfo {
+        id: PeerId::random(),
+        address: "/ip4/10.0.1.2/udp/9000/quic".parse().unwrap(),
+        last_seen: SystemTime::now(),
+        capacity: NodeCapacity::default(),
+    };
+    let result = engine.add_node(node2).await;
+    assert!(result.is_err());
+    assert!(result.unwrap_err().to_string().contains("IP diversity:"));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_ipv6_floor_override_raises_limit() -> anyhow::Result<()> {
+    // Default IPv6 /64 limit is 1. Setting ipv6_limit_floor = 5 should allow
+    // 5 nodes in the same /64 subnet.
+    let mut engine = DhtCoreEngine::new_for_tests(PeerId::random())?;
+    engine.set_ip_diversity_config(IPDiversityConfig {
+        ipv6_limit_floor: Some(5),
+        ..IPDiversityConfig::default()
+    });
+
+    for i in 1..=5u128 {
+        let node = NodeInfo {
+            id: PeerId::random(),
+            address: format!("/ip6/2001:db8::{i}/udp/9000/quic").parse().unwrap(),
+            last_seen: SystemTime::now(),
+            capacity: NodeCapacity::default(),
+        };
+        engine.add_node(node).await?;
+    }
+
+    // Sixth node should fail
+    let node6 = NodeInfo {
+        id: PeerId::random(),
+        address: "/ip6/2001:db8::6/udp/9000/quic".parse().unwrap(),
+        last_seen: SystemTime::now(),
+        capacity: NodeCapacity::default(),
+    };
+    let result = engine.add_node(node6).await;
+    assert!(result.is_err());
+    assert!(result.unwrap_err().to_string().contains("IP diversity:"));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_ipv6_ceiling_override_lowers_limit() -> anyhow::Result<()> {
+    // With permissive IPv6 config (max_nodes_per_ipv6_64 = usize::MAX),
+    // setting ipv6_limit_ceiling = 2 should cap at 2.
+    let mut engine = DhtCoreEngine::new_for_tests(PeerId::random())?;
+    engine.set_ip_diversity_config(IPDiversityConfig {
+        max_nodes_per_ipv6_64: usize::MAX,
+        max_nodes_per_ipv6_48: usize::MAX,
+        max_nodes_per_ipv6_32: usize::MAX,
+        max_per_ip_cap: 100,
+        max_network_fraction: 1.0,
+        ipv6_limit_ceiling: Some(2),
+        ..IPDiversityConfig::default()
+    });
+
+    let node1 = NodeInfo {
+        id: PeerId::random(),
+        address: "/ip6/2001:db8::1/udp/9000/quic".parse().unwrap(),
+        last_seen: SystemTime::now(),
+        capacity: NodeCapacity::default(),
+    };
+    engine.add_node(node1).await?;
+
+    let node2 = NodeInfo {
+        id: PeerId::random(),
+        address: "/ip6/2001:db8::2/udp/9000/quic".parse().unwrap(),
+        last_seen: SystemTime::now(),
+        capacity: NodeCapacity::default(),
+    };
+    engine.add_node(node2).await?;
+
+    // Third should fail due to ceiling
+    let node3 = NodeInfo {
+        id: PeerId::random(),
+        address: "/ip6/2001:db8::3/udp/9000/quic".parse().unwrap(),
+        last_seen: SystemTime::now(),
+        capacity: NodeCapacity::default(),
+    };
+    let result = engine.add_node(node3).await;
+    assert!(result.is_err());
+    assert!(result.unwrap_err().to_string().contains("IP diversity:"));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn test_no_override_preserves_dynamic_behavior() -> anyhow::Result<()> {
+    // When no overrides are set, behavior should be identical to before.
+    // Default dynamic limit for small network = 1 per /32, 3 per /24.
+    let mut engine = DhtCoreEngine::new_for_tests(PeerId::random())?;
+
+    let node1 = NodeInfo {
+        id: PeerId::random(),
+        address: "/ip4/192.168.1.1/udp/9000/quic".parse().unwrap(),
+        last_seen: SystemTime::now(),
+        capacity: NodeCapacity::default(),
+    };
+    engine.add_node(node1).await?;
+
+    // Same IP should fail (dynamic limit = 1)
+    let node2 = NodeInfo {
+        id: PeerId::random(),
+        address: "/ip4/192.168.1.1/udp/9001/quic".parse().unwrap(),
+        last_seen: SystemTime::now(),
+        capacity: NodeCapacity::default(),
+    };
+    let result = engine.add_node(node2).await;
+    assert!(result.is_err());
+
+    Ok(())
+}