fix: ignore observed IPv6 addresses that are not global unicast (#2873)

Only add public IPv4 or global unicast IPv6 addresses to the list
of observed external addresses.

Author: achingbrain

packages/protocol-identify/src/identify.ts

@@ -4,9 +4,10 @@ import { publicKeyFromProtobuf, publicKeyToProtobuf } from '@libp2p/crypto/keys'
 import { InvalidMessageError, UnsupportedProtocolError, serviceCapabilities, setMaxListeners } from '@libp2p/interface'
 import { peerIdFromCID } from '@libp2p/peer-id'
 import { RecordEnvelope, PeerRecord } from '@libp2p/peer-record'
+import { isGlobalUnicast } from '@libp2p/utils/multiaddr/is-global-unicast'
 import { isPrivate } from '@libp2p/utils/multiaddr/is-private'
 import { protocols } from '@multiformats/multiaddr'
-import { IP_OR_DOMAIN } from '@multiformats/multiaddr-matcher'
+import { IP_OR_DOMAIN, TCP } from '@multiformats/multiaddr-matcher'
 import { pbStream } from 'it-protobuf-stream'
 import {
   MULTICODEC_IDENTIFY_PROTOCOL_NAME,
@@ -18,6 +19,8 @@ import type { Identify as IdentifyInterface, IdentifyComponents, IdentifyInit }
 import type { IdentifyResult, AbortOptions, Connection, Stream, Startable } from '@libp2p/interface'
 import type { IncomingStreamData } from '@libp2p/interface-internal'
 
+const CODEC_IP6 = 0x29
+
 export class Identify extends AbstractIdentify implements Startable, IdentifyInterface {
   constructor (components: IdentifyComponents, init: IdentifyInit = {}) {
     super(components, {
@@ -105,22 +108,45 @@ export class Identify extends AbstractIdentify implements Startable, IdentifyInt
     }
 
     // Get the observedAddr if there is one
-    const cleanObservedAddr = getCleanMultiaddr(observedAddr)
+    this.maybeAddObservedAddress(observedAddr)
 
     this.log('identify completed for peer %p and protocols %o', id, protocols)
 
-    if (cleanObservedAddr != null) {
-      this.log('our observed address was %a', cleanObservedAddr)
+    return consumeIdentifyMessage(this.peerStore, this.events, this.log, connection, message)
+  }
 
-      if (isPrivate(cleanObservedAddr)) {
-        this.log('our observed address was private')
-      } else if (this.addressManager.getObservedAddrs().length < (this.maxObservedAddresses ?? Infinity)) {
-        this.log('storing our observed address')
-        this.addressManager.addObservedAddr(cleanObservedAddr)
-      }
+  private maybeAddObservedAddress (observedAddr: Uint8Array | undefined): void {
+    // Get the observedAddr if there is one
+    const cleanObservedAddr = getCleanMultiaddr(observedAddr)
+
+    if (cleanObservedAddr == null) {
+      return
     }
 
-    return consumeIdentifyMessage(this.peerStore, this.events, this.log, connection, message)
+    this.log.trace('our observed address was %a', cleanObservedAddr)
+
+    if (isPrivate(cleanObservedAddr)) {
+      this.log.trace('our observed address was private')
+      return
+    }
+
+    const tuples = cleanObservedAddr.stringTuples()
+
+    if (tuples[0][0] === CODEC_IP6 && !isGlobalUnicast(cleanObservedAddr)) {
+      this.log.trace('our observed address was IPv6 but not a global unicast address')
+      return
+    }
+
+    if (TCP.exactMatch(cleanObservedAddr)) {
+      // TODO: because socket dials can't use the same local port as the TCP
+      // listener, many unique observed addresses are reported so ignore all
+      // TCP addresses until https://github.com/libp2p/js-libp2p/issues/2620
+      // is resolved
+      return
+    }
+
+    this.log.trace('storing the observed address')
+    this.addressManager.addObservedAddr(cleanObservedAddr)
   }
 
   /**

packages/protocol-identify/test/index.spec.ts

@@ -373,4 +373,28 @@ describe('identify', () => {
 
     expect(result.observedAddr).to.be.undefined()
   })
+
+  it('should ignore observed non global unicast IPv6 addresses', async () => {
+    identify = new Identify(components)
+
+    await start(identify)
+
+    const remotePeer = peerIdFromPrivateKey(await generateKeyPair('Ed25519'))
+
+    const message: IdentifyMessage = {
+      protocolVersion: 'protocol version',
+      agentVersion: 'agent version',
+      listenAddrs: [multiaddr('/ip4/127.0.0.1/tcp/1234').bytes],
+      protocols: ['protocols'],
+      publicKey: publicKeyToProtobuf(remotePeer.publicKey),
+      observedAddr: multiaddr('/ip6/fe80::2892:aef3:af04:735a%en').bytes
+    }
+
+    const connection = identifyConnection(remotePeer, message)
+
+    // run identify
+    await identify.identify(connection)
+
+    expect(components.addressManager.addObservedAddr.called).to.be.false()
+  })
 })