Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deprecate mplex #3866

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

Conversation

AgeManning
Copy link
Contributor

@AgeManning AgeManning commented Aug 5, 2024

Mplex was a simple stream multiplexer created in the early days of libp2p.

It has since been deprecated and is now potentially becoming a security vulnerability as it is inefficient and unmaintained.

The general recommendations are to use yamux or QUIC.

Lighthouse currently supports mplex and yamux over TCP and QUIC. We are hoping to deprecate mplex and remove support for it in the near future.

We don't want to harm other clients in this process, so we are hoping for some visibility on this deprecation.

Current Progress

Client Mplex Yamux QUIC
Lighthouse ✔️ ✔️ ✔️
Prysm ✔️ ✔️
Nimbus ✔️ 🚧
Teku ✔️ 🚧
Grandine ✔️ ✔️ ✔️

Comment on lines -1135 to -1136
Overlay multiplexers are not necessary with QUIC since the protocol provides native multiplexing,
but they need to be layered atop TCP, WebSockets, and other transports that lack such support.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this paragraph about QUIC is valuable. I think we shouldn't lose it. Maybe should we change the topic to "Why are we using yamux?" instead and remove the mplex part?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A better question might be "why don't we go straight to QUIC and skip yamux as a requirement"

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A better question might be "why don't we go straight to QUIC and skip yamux as a requirement"

Yeah, and the answer is that it's not easy to find a stable QUIC library for some programming languages and we decide to make QUIC optional instead, but preferable.

Copy link
Contributor

@arnetheduck arnetheduck Aug 8, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the rarity-of-implementation argument can be said of yamux too which is libp2p-only - https://blog.cloudflare.com/http3-usage-one-year-on saw 30% quic traffic share last year, meaning that any language that doesn't have a quic will have one soon.

ie in nim-libp2p, we have a yamux that hasn't been battle-tested really but it's kind of pointless spending time on it knowing that it's on its way out and entirely useless outside of a narrow libp2p window.

mplex otoh has been working for the consensus layer for years now so a few more months to get quic in place is not going to make any difference.

@AgeManning
Copy link
Contributor Author

From what I gather
@philknows : Lodestar is ready, but needs to support just yamux and remove mplex at once
@nisdas : Prysm is ready
@arnetheduck : Nimbus is testing yamux but its not quite ready for production yet
@lucassaldanha : Teku has yamux in experimental phase, needs a bit of time to complete it.

I guess it would be nice to set a rough timeframe for Nimbus and Teku to be ready. Would someone like to suggest a rough time frame? We can also target a fork if we want?

@arnetheduck
Copy link
Contributor

From nimbus, our preference would probably be to go straight to QUIC and skip the yamux step, given that yamux is pretty much a dead end anyway (de-facto unmaintained). mplex can hang on for a bit longer given its simplicity and battle-testing so far.

@ppopth
Copy link
Member

ppopth commented Sep 19, 2024

I would support going straight to QUIC and skipping yamux as well.

@StefanBratanov
Copy link
Contributor

From Teku perspective, as mentioned we still have work to do on yamux so just going straight to QUIC would be preferable for us since it looks like the way forward anyways.

@AgeManning
Copy link
Contributor Author

Ok. Looks like consensus is to move straight to QUIC.

I'll keep this issue open and try and make a tally of progress. So we know how close we are to being able to shift.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants