Why is whitelisting needed?

nbxplorer suggests whitelisting its address for bitcoind peer connections:

Your NBXplorer server is not whitelisted by your node, you should add "whitelist=127.0.0.1" to the configuration file of your node`

The permissions granted by whitelist=127.0.0.1 are:

• noban: do not ban for misbehavior
• download: allow getheaders during IBD, no disconnect after maxuploadtarget limit
• mempool: allow requesting BIP35 mempool contents
• relay: relay even in -blocksonly mode, and unlimited transaction announcements

Which of these are actually required by nbxplorer? Whitelisting 127.0.0.1 with default permissions is problematic when running a bitcoind onion service that connects to localhost. In this case inbound onion connections won’t be banned when misbehaving.

There are two possible workarounds in bitcoind:

• Whitebind localhost and add a separate onion socket (whitebind=127.0.0.1:8333, bind=127.0.0.1:8334=onion) This is incompatible with accepting inbound connections on all interfaces bind=0.0.0.0:8333 due to the port clash.
• Bind the onion socket to a separate address on the loopback device (bind=10.0.0.1:8334=onion). This is requires changing the local interface configuration.

Both workarounds are unsatisfying, so it would be great to get rid of whitelisting or to only grant the minimum required permissions.

[NicolasDorier]

@Kixunil yes I would connect on unix socket if it was available. I don’t know about Electrs and the details of how bitcoin core work. I just know that when connection slots are full, you can’t connect unless you have some permissions (which I think is noban)

[Kixunil]

Is NBXplorer doing anything else beyond downloading blocks? Electrs should be similar and it only requires download. Would be nice to understand this.

Side note: I was already thinking of making a PR to Core that’d allow bind another P2P interface on Unix socket. That should resolve various permission issues. Would it be useful to you, @erikarvstedt? @NicolasDorier would you be willing to support it?

CC @romanz - you may be interested in this too.