Skip to content

Add P2P security options#1764

Merged
abitmore merged 87 commits intodevelopfrom
jmj_659c
Sep 12, 2022
Merged

Add P2P security options#1764
abitmore merged 87 commits intodevelopfrom
jmj_659c

Conversation

@jmjatlanta
Copy link
Copy Markdown
Contributor

@jmjatlanta jmjatlanta commented May 17, 2019

Fixes #659

This PR adds startup options (available via both command line and the config.ini configuration file) to witness_node:

  1. p2p-accept-incoming-connections will allow peers to request a connection to your node (default is true). Set to false, your node will not listen for incoming connections. The "accept-incoming-connections" is an existing field in the node configuration file (p2p/node_config.json), now accessible from the command line and the config.ini configuration file.
  2. p2p-inbound-endpoint, used to specify the node's "external" IP address and listening port when it is behind DNAT or a reverse proxy.
  3. p2p-connect-to-new-peers will allow the node to connect to new peers advertised by other peers (default is true). Set to false, the node will ignore all peer advertisements.
  4. p2p-advertise-peer-algorithm determines how peers are selected to be advertised.
  5. p2p-advertise-peer-endpoint and p2p-exclude-peer-endpoint work in conjunction with some of the peer algorithms.

The peer algorithms that can be used are:

  1. nothing which will respond to the requesting peer with an empty list
  2. list which will respond with a list of connected peers which are also in the list provided by p2p-advertise-peer-endpoint
  3. exclude_list which will respond with a list of connected peers which are not in the list provided by p2p-exclude-peer-endpoint
  4. all, or any other value, or if no peer algorithm is provided, all connected peers are advertised as they were before this enhancement.

Other changes and improvements:

  • Node will listen to the default port (1776) by default, rather than a random port. If p2p-endpoint option is not specified, when the default port is unavailable, the node will listen on a random port.
  • Node no longer performs firewall check requested by other peers, nor ask other peers to perform firewall check for itself or another peer. The node will perform firewall check / detection on its own on incoming peers.
  • Node will only accept an address_message if it has just requested one
  • Node only handles at most 200 addresses for each address_message
  • Added some gate-keeping code, to disconnect or ignore when received unexpected messages
  • Node will advertise other peers' inbound endpoints but not necessarily the remote endpoints of the current connections. If a peer's inbound port is 0, its address will still be advertised.
  • If node is not connected to any peer, it rechecks its seed node list every 5 minutes; otherwise it rechecks the seed node list every 1 hour (was always recheck every 3 hours)
  • Node will try to guess and verify the inbound peers' inbound (listening) endpoints
  • Peer's number_of_failed_connection_attempts will be halved on successful outbound connection
  • Refactored & optimized the network_mapper program
  • Added fc::ip::address::is_loopback_address() (127.*.*.*), fixed is_public_address() to detect loopback addresses

Loading
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants