Add p2p-denylist flag - Githubissues

ChainSafe / lodestar

🌟 TypeScript Implementation of Ethereum Consensus

https://lodestar.chainsafe.io

Apache License 2.0

1.14k stars 279 forks source link

Add p2p-denylist flag #3536

Open dapplion opened 2 years ago

dapplion commented 2 years ago

See https://github.com/ipfs/js-ipfs/issues/3982 for context

Implementation example from Prysm https://github.com/prysmaticlabs/prysm/blob/23e39d3d6451aff2dc302f78923abdc13767237d/cmd/flags.go#L167

Potential library to use (used by libp2p in their address sorter https://github.com/libp2p/js-libp2p-utils/blob/master/src/address-sort.js) https://www.npmjs.com/package/private-ip

TODO

Benchmark the performance cost of private-ip
Ensure that libp2p only runs the address sorter once per peer

dapplion commented 2 years ago

Setting to low since this can be tackled for now with a firewall. For reference we use

# From https://github.com/MinaProtocol/mina/issues/7053#issuecomment-749087798
# `ufw deny out from any to {{item}}`
firewall_deny_ip_ranges:
  - 10.0.0.0/8
  - 172.16.0.0/12
  - 192.168.0.0/16
  - 100.64.0.0/10
  - 198.18.0.0/15
  - 169.254.0.0/16

Longer term libp2p should include native support for this in the identify protocol