Skip to content

Conversation

yashksaini-coder
Copy link
Contributor

What was wrong?

My previous PR #811 lacked the code changes on, multiple examples and core modules that were using wildcard addresses (0.0.0.0) for binding, which could expose services on all network interfaces and create security vulnerabilities.

How was it fixed?

I updated all the modules files and refactored to replace all wildcard bind addresses (0.0.0.0) with secure loopback addresses (127.0.0.1) across the entire codebase:

Examples Directory (17 files updated)

  • Core examples: ping.py, chat.py, bootstrap.py, mDNS.py, pubsub.py, random_walk.py, identify.py, identify_push_listener_dialer.py
  • Documentation examples: All 8 files in examples/doc-examples/ directory
  • Advanced examples: network_discover.py (updated fallback functions)

Core Library Updates

  • libp2p/utils/address_validation.py: Updated fallback addresses from 0.0.0.0 to 127.0.0.1

Documentation Updates (5 files)

  • Updated all .rst files in docs/examples.*.rst to reflect new secure addresses

Testing & Validation

  • tests/utils/test_default_bind_address.py: Comprehensive tests for secure address selection
  • tests/examples/test_examples_bind_address.py: Validation that all examples use secure addresses

Release Notes

  • newsfragments/885.feature.rst: Security enhancement notification

To-Do

  • Clean up commit history
  • Add or update documentation related to these changes
  • Add entry to the release notes

cc: @acul71 @seetadev @pacrob

@seetadev
Copy link
Contributor

seetadev commented Sep 2, 2025

@yashksaini-coder : Great contribution, Yash. Appreciate your efforts. This PR is coming along nicely.

Looking forward to detailed review by @acul71 on this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants