manager: Expose option to forbid dialing private IP addresses

Cargo.toml

@@ -51,6 +51,7 @@ x509-parser = "0.17.0"
 yasna = "0.5.0"
 zeroize = "1.8.1"
 yamux = "0.13.7"
+ip_network = "0.4.1"
 
 # Websocket related dependencies.
 tokio-tungstenite = { version = "0.27.0", features = ["rustls-tls-native-roots", "url"], optional = true }

src/config.rs

@@ -29,7 +29,8 @@ use crate::{
         notification, request_response, UserProtocol,
     },
     transport::{
-        manager::limits::ConnectionLimitsConfig, tcp::config::Config as TcpConfig,
+        manager::{limits::ConnectionLimitsConfig, IpDialingMode},
+        tcp::config::Config as TcpConfig,
         KEEP_ALIVE_TIMEOUT, MAX_PARALLEL_DIALS,
     },
     types::protocol::ProtocolName,
@@ -125,6 +126,9 @@ pub struct ConfigBuilder {
     /// Close the connection if no substreams are open within this time frame.
     keep_alive_timeout: Duration,
 
+    /// IP dialing mode.
+    ip_dialing_mode: IpDialingMode,
+
     /// Use system's DNS config.
     use_system_dns_config: bool,
 }
@@ -160,6 +164,7 @@ impl ConfigBuilder {
             known_addresses: Vec::new(),
             connection_limits: ConnectionLimitsConfig::default(),
             keep_alive_timeout: KEEP_ALIVE_TIMEOUT,
+            ip_dialing_mode: IpDialingMode::All,
             use_system_dns_config: false,
         }
     }
@@ -282,6 +287,23 @@ impl ConfigBuilder {
         self
     }
 
+    /// Set the ip dialing mode.
+    ///
+    /// When the private IP is enabled, litep2p will attempt to dial local addresses.
+    /// This is useful for testing or when you want to preserve local connections.
+    ///
+    /// However, for production use, it is recommended to disable the private IP dialing
+    /// to avoid unnecessary local traffic. Furthermore, it is not recommended
+    /// to enable private IP dialing when running a validator in a cloud provider, as this behavior
+    /// might be misinterpreted by the cloud provider's network policies as port scanning.
+    ///
+    /// Address allocation for private networks is specified by
+    /// [RFC1918](https://tools.ietf.org/html/rfc1918)).
+    pub fn with_ip_dialing_mode(mut self, mode: IpDialingMode) -> Self {
+        self.ip_dialing_mode = mode;
+        self
+    }
+
     /// Set DNS resolver according to system configuration instead of default (Google).
     pub fn with_system_resolver(mut self) -> Self {
         self.use_system_dns_config = true;
@@ -317,6 +339,7 @@ impl ConfigBuilder {
             known_addresses: self.known_addresses,
             connection_limits: self.connection_limits,
             keep_alive_timeout: self.keep_alive_timeout,
+            ip_dialing_mode: self.ip_dialing_mode,
             use_system_dns_config: self.use_system_dns_config,
         }
     }
@@ -381,6 +404,9 @@ pub struct Litep2pConfig {
     /// Close the connection if no substreams are open within this time frame.
     pub(crate) keep_alive_timeout: Duration,
 
+    /// IP dialing mode.
+    pub(crate) ip_dialing_mode: IpDialingMode,
+
     /// Use system's DNS config.
     pub(crate) use_system_dns_config: bool,
 }

src/error.rs

@@ -78,8 +78,6 @@ pub enum Error {
     Timeout,
     #[error("Invalid state transition")]
     InvalidState,
-    #[error("DNS address resolution failed")]
-    DnsAddressResolutionFailed,
     #[error("Transport error: `{0}`")]
     TransportError(String),
     #[cfg(feature = "quic")]

src/lib.rs

@@ -176,6 +176,7 @@ impl Litep2p {
             bandwidth_sink.clone(),
             litep2p_config.max_parallel_dials,
             litep2p_config.connection_limits,
+            litep2p_config.ip_dialing_mode,
         );
 
         // add known addresses to `TransportManager`, if any exist
@@ -642,6 +643,7 @@ mod tests {
             .with_notification_protocol(config1)
             .with_notification_protocol(config2)
             .with_libp2p_ping(ping_config)
+            .with_ip_dialing_mode(crate::transport::manager::IpDialingMode::All)
             .build();
 
         let peer = PeerId::random();

src/protocol/libp2p/identify.rs

@@ -474,6 +474,7 @@ mod tests {
                 ..Default::default()
             })
             .with_libp2p_identify(identify_config)
+            .with_ip_dialing_mode(crate::transport::manager::IpDialingMode::All)
             .build();
 
         (Litep2p::new(config).unwrap(), identify, peer)

src/protocol/libp2p/kademlia/mod.rs

@@ -1257,7 +1257,7 @@ mod tests {
         codec::ProtocolCodec,
         crypto::ed25519::Keypair,
         transport::{
-            manager::{limits::ConnectionLimitsConfig, TransportManager},
+            manager::{limits::ConnectionLimitsConfig, IpDialingMode, TransportManager},
             KEEP_ALIVE_TIMEOUT,
         },
         types::protocol::ProtocolName,
@@ -1281,6 +1281,7 @@ mod tests {
             BandwidthSink::new(),
             8usize,
             ConnectionLimitsConfig::default(),
+            IpDialingMode::All,
         );
 
         let peer = PeerId::random();

src/protocol/mdns.rs

@@ -365,7 +365,7 @@ mod tests {
     use super::*;
     use crate::{
         crypto::ed25519::Keypair,
-        transport::manager::{limits::ConnectionLimitsConfig, TransportManager},
+        transport::manager::{limits::ConnectionLimitsConfig, IpDialingMode, TransportManager},
         BandwidthSink,
     };
     use futures::StreamExt;
@@ -384,6 +384,7 @@ mod tests {
             BandwidthSink::new(),
             8usize,
             ConnectionLimitsConfig::default(),
+            IpDialingMode::All,
         );
 
         let mdns1 = Mdns::new(
@@ -406,6 +407,7 @@ mod tests {
             BandwidthSink::new(),
             8usize,
             ConnectionLimitsConfig::default(),
+            IpDialingMode::All,
         );
 
         let mdns2 = Mdns::new(

src/protocol/notification/tests/mod.rs

@@ -30,7 +30,7 @@ use crate::{
         InnerTransportEvent, ProtocolCommand, TransportService,
     },
     transport::{
-        manager::{limits::ConnectionLimitsConfig, TransportManager},
+        manager::{limits::ConnectionLimitsConfig, IpDialingMode, TransportManager},
         KEEP_ALIVE_TIMEOUT,
     },
     types::protocol::ProtocolName,
@@ -57,6 +57,7 @@ fn make_notification_protocol() -> (
         BandwidthSink::new(),
         8usize,
         ConnectionLimitsConfig::default(),
+        IpDialingMode::All,
     );
 
     let peer = PeerId::random();

src/protocol/request_response/tests.rs

@@ -30,7 +30,7 @@ use crate::{
     },
     substream::Substream,
     transport::{
-        manager::{limits::ConnectionLimitsConfig, TransportManager},
+        manager::{limits::ConnectionLimitsConfig, IpDialingMode, TransportManager},
         KEEP_ALIVE_TIMEOUT,
     },
     types::{RequestId, SubstreamId},
@@ -55,6 +55,7 @@ fn protocol() -> (
         BandwidthSink::new(),
         8usize,
         ConnectionLimitsConfig::default(),
+        IpDialingMode::All,
     );
 
     let peer = PeerId::random();