logging: Add canonical log for misbehaving peers

[MarcoPolo]

Adds logging when a peer fails our security handshake or fails to setup a muxer

[marten-seemann]

Can we somehow filter out multistream errors here? Setup can fail if there's no compatible security protocol / muxer between those two peers. It seems odd to block a peer for that, doesn't it?

[MarcoPolo]

Setup can fail if there's no compatible security protocol / muxer between those two peers. It seems odd to block a peer for that, doesn't it?

If a peer doesn't have compatible security or muxer, will it ever successfully connect? We close the connection here right after a failure.

The idea with tools like fail2ban is that they won't ban a node for misbehaving once, but many times. For example, if I mistyped my password once, I wouldn't want to ban myself for N minutes. But if a node sends 100 wrong password attempts it is probably malicious.

Likewise here. If a node is constantly hitting this it's probably doing something bad. Right? Or am I missing something?

[marten-seemann]

If a peer doesn't have compatible security or muxer, will it ever successfully connect? We close the connection here right after a failure.

That peer might not, but there might be other peers running on the same machine (Hydras?), with potentially different configurations.

The idea with tools like fail2ban is that they won't ban a node for misbehaving once, but many times. For example, if I mistyped my password once, I wouldn't want to ban myself for N minutes. But if a node sends 100 wrong password attempts it is probably malicious.

This alleviates a lot of my concerns. I'm still wondering if we should move this into the security handshake implementation (TLS and Noise). What do you think?

[MarcoPolo]

@marten-seemann updated