This pull request introduces a new feature for managing peer permissions based on IP subnet configurations in the networking layer. The core addition is the PeerPermissionSubnet class, which extends the existing PeerPermissions class to allow for the specification of allowed IP subnets. Peers whose IP addresses fall within these allowed subnets are granted access, enhancing the network's security by ensuring that only peers from specific, trusted IP ranges can interact with the node.
Fixed Issue(s)
Fixes #6620
Key Changes:
PeerPermissionSubnet Class: This class implements logic to control access based on IP subnet configurations. It applies restrictions to all peer actions, including but not limited to, sending and receiving messages in both the discovery protocol and the RLPx transport layer. If no subnets are specified, the default behaviour permits all peers.
CLI Configuration: The introduction of the --net-restrict CLI option allows network administrators to specify allowed IP subnets directly through the CLI. This option accepts a comma-separated list of subnet specifications (e.g., --net-restrict=192.168.1.0/24,10.0.0.0/8), converting them into SubnetInfo objects using the SubnetInfoConverter. If this option is not utilised, no subnet-based peer permission restrictions will be applied, allowing the network to operate without these specific constraints.
PR description
This pull request introduces a new feature for managing peer permissions based on IP subnet configurations in the networking layer. The core addition is the
PeerPermissionSubnetclass, which extends the existingPeerPermissionsclass to allow for the specification of allowed IP subnets. Peers whose IP addresses fall within these allowed subnets are granted access, enhancing the network's security by ensuring that only peers from specific, trusted IP ranges can interact with the node.Fixed Issue(s)
Fixes #6620
Key Changes:
PeerPermissionSubnetClass: This class implements logic to control access based on IP subnet configurations. It applies restrictions to all peer actions, including but not limited to, sending and receiving messages in both the discovery protocol and the RLPx transport layer. If no subnets are specified, the default behaviour permits all peers.CLI Configuration: The introduction of the
--net-restrictCLI option allows network administrators to specify allowed IP subnets directly through the CLI. This option accepts a comma-separated list of subnet specifications (e.g., --net-restrict=192.168.1.0/24,10.0.0.0/8), converting them intoSubnetInfoobjects using theSubnetInfoConverter. If this option is not utilised, no subnet-based peer permission restrictions will be applied, allowing the network to operate without these specific constraints.