[stable2506] Backport #9281 (#9329)

Backport #9281 into `stable2506` from lexnv.

See the
[documentation](https://github.com/paritytech/polkadot-sdk/blob/master/docs/BACKPORT.md)
on how to use this bot.

<!--
  # To be used by other automation, do not modify:
  original-pr-number: #${pull_number}
-->

Signed-off-by: Alexandru Vasile <[email protected]>
Co-authored-by: Alexandru Vasile <[email protected]>
Co-authored-by: cmd[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Egor_P <[email protected]>

Author: 4 people

prdoc/pr_9281.prdoc

@@ -0,0 +1,16 @@
+title: 'litep2p/discovery: Ensure non-global addresses are not reported as external'
+doc:
+- audience: Node Dev
+  description: "This PR ensures that external addresses discovered by the identify\
+    \ protocol are not propagated to the litep2p backend if they are not global. This\
+    \ leads to a healthier DHT over time, since nodes will not advertise loopback\
+    \ / non-global addresses.\n\nWe have seen various cases were loopback addresses\
+    \ were reported as external:\n\n```\n2025-07-16 16:18:39.765 TRACE tokio-runtime-worker\
+    \ sub-libp2p::discovery: verify new external address: /ip4/127.0.0.1/tcp/30310/p2p/12D3KooWNw19ScMjzNGLnYYLQxWcM9EK9VYPbCq241araUGgbdLM\n\
+    \n2025-07-16 16:18:39.765  INFO tokio-runtime-worker sub-libp2p: \U0001F50D Discovered\
+    \ new external address for our node: /ip4/127.0.0.1/tcp/30310/p2p/12D3KooWNw19ScMjzNGLnYYLQxWcM9EK9VYPbCq241araUGgbdLM\n\
+    ```\n\nThis PR takes into account the network config for `allow_non_global_addresses`.\n\
+    \nCloses: https://github.com/paritytech/polkadot-sdk/issues/9261\n\ncc @paritytech/networking"
+crates:
+- name: sc-network
+  bump: patch

substrate/client/network/src/litep2p/discovery.rs

@@ -493,6 +493,15 @@ impl Discovery {
 	) -> (bool, Option<Multiaddr>) {
 		log::trace!(target: LOG_TARGET, "verify new external address: {address}");
 
+		if !self.allow_non_global_addresses && !Discovery::can_add_to_dht(&address) {
+			log::trace!(
+				target: LOG_TARGET,
+				"ignoring externally reported non-global address {address} from {peer}."
+			);
+
+			return (false, None);
+		}
+
 		// is the address one of our known addresses
 		if self
 			.listen_addresses