-
Notifications
You must be signed in to change notification settings - Fork 808
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove naughty peers from the DHT #629
Comments
This is a two part issue. Firstly, our peer management is quite basic. We ban and kick peers. See here: https://github.com/sigp/lighthouse/blob/enr-v0.2.0/beacon_node/eth2-libp2p/src/service.rs#L168 We should implement a method on our behaviour that tells discovery to remove the peer from our local routing table. This is fine, but we would also need to modify our discv5 protocol itself to allow the application to remove peers from the local routing table. To do this, we'd need to add a public function to the behaviour not too dis-similar to the |
Discv5 now supports removing nodes from the routing table and adding peers to a ban list. When a peer gets banned, it should be removed from the local routing table and added to the ban list. When a peer becomes unbanned, it should be removed from the discv5 ban list. See the |
Hey @AgeManning do you think we need this before the sec review in Oct? |
Yeah, lets add it in. Its a small change |
## Issue Addressed #629 ## Proposed Changes This removes banned peers from the DHT and informs discovery to block the node_id and the known source IP's associated with this node. It has the capabilities of un banning this peer after a period of time. This also corrects the logic about banning specific IP addresses. We now use seen_ip addresses from libp2p rather than those sent to us via identify (which also include local addresses).
closed by #1656 |
If a peer has performed a malicious action, they become banned for a period of time.
We should also remove them from the DHT if they exist in a particular bucket so that other nodes also don't find the malicious peer.
The text was updated successfully, but these errors were encountered: