Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IPv6 By Default #6808

Open
wants to merge 1 commit into
base: unstable
Choose a base branch
from
Open

Conversation

AgeManning
Copy link
Member

Description

This enables ipv4 and ipv6 by default in Lighthouse.

However, after finishing this PR, I think maybe this isn't a good idea.

Motivation

IPv6 has been around for quite a few years now and most parts of the internet are supporting it. It is strange that a cutting-edge blockchain such as Ethereum doesn't support it natively. I've tested Lighthouse quite a bit and our recent upgrades should have no problem supporting IPv6. The problem is that we need a few more nodes on our DHT to also support IPv6 for some of the discovery mechanisms to function. So we need to bootstrap the network with a few IPv6 nodes and our original plan was to make lighthouse do this by default if the host system supports a globally routable IPV6 address.

What this PR does

If a user has specified a listening address of 0.0.0.0 and their node also has a globally routable IPv6 address (i.e their ISP and router is configured for IPv6, then we also listen on :: and go to dual stack mode. This also adds a CLI to disable this default behaviour --disable-ipv6.

Why I no longer like this approach

  • Security - If a user has opened their IPv6 firewall, and run lighthouse to listen on ipv4 0.0.0.0 they may not expect us to secretly also open :: and expose those ports when they have not specifically set it. I think if users are exposing ports on their computers they need to do it explicitly rather than us trying to force ipv6 on them.
  • Practicality - I think even if we do dual-stack by default, the majority of users who are behind a normal firewall, will still not see IPv6 traffic. They will need to manually intervene to allow IPv6 traffic through their firewall. If they are manually doing this, then they can just set --ip-address :: also to enable dual stack.

After some thought I think the best approach is just via education rather than code. We should make announcements and encourage users to support dual stack, rather than set it by default.

I'll leave this PR around in case others feel differently.

Also, this should not be merged until: sigp/discv5#275

Copy link
Member

@jxs jxs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi age! Left comment comments :D

@@ -224,6 +224,13 @@ pub fn cli_app() -> Command {
.action(ArgAction::Set)
.display_order(0)
)
.arg(
Arg::new("disable-ipv6")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

taking into consideration the description you wrote on the PR, should we then update this PR to make this optional? I.e add instead an option to enable ipv6

// then we also listen on IPv6.
// Note that we will only listen on all interfaces if the IPv4 counterpart is also listening on
// all interfaces, to prevent accidental exposure of ports.
if maybe_ipv4 == Some(Ipv4Addr::UNSPECIFIED)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we could then also re-write this logic to log when user enables ipv6 but doesn't support it

/// returns true.
pub fn is_ipv6_supported() -> bool {
// If IPv6 is supported
let Ok(std::net::IpAddr::V6(local_ip)) = local_ipv6() else {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: we already depend on rtnetlink via rust-libp2p and if-watch.
There's an example on how to do it here, we could implement it here, or upsteam it as they mention in the discussion

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants