relay: don't advertise non-global observed addresses#40
Merged
Conversation
The identify handler added every observed_addr as an external address. Peers in the same VPC observe the node's private interface IP (e.g. 10.0.8.121), which then gets advertised in relay reservations — clients compose circuit addresses from the relay's advertised addrs, so undialable /ip4/10.x.x.x/.../p2p-circuit records end up in rendezvous and Kademlia, breaking cross-NAT joins via the devnet relay. Filter observed addresses through a global-reachability check before adding them: private/loopback/link-local/CGNAT IPv4, and loopback/ULA/link-local IPv6 are ignored. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The devnet boot-node (
12D3KooWR5V4...@ 63.181.86.34) hands out rendezvous registrations whose relay circuit addresses start with its private VPC IP:Root cause: the identify handler blindly promotes every
observed_addrto an external address. Any peer in the same VPC (relayer, monitoring, co-located nodes) observes the boot-node's private interface IP and reports it back via identify; the boot-node then advertises it. Relay reservation clients compose their circuit addresses from the relay's advertised addrs, so undialable/ip4/10.x.x.x/.../p2p-circuitrecords propagate into rendezvous + Kademlia, and NAT-bound peers can't be reached through the relay.Observed on 2026-07-06 while debugging namespace-invite join failures (calimero-network/core#3211 context): the global-discovery fallback couldn't rescue joins because the discovered circuit addresses pointed at
10.0.8.121.Fix
Filter observed addresses through a global-reachability check before
add_external_address:100.64/10), unspecified, broadcast, documentation rangesfc00::/7), link-local (fe80::/10)Rejected addresses are logged at info level so misconfigured deployments stay visible.
Testing
cargo testgreen)cargo check --releasegreenDeployment note
This needs a release + AMI rebuild + instance roll to take effect on the devnet relay. Separately, the devnet relay was still returning
ResourceLimitExceededon 2026-07-06, which suggests the instance may still be running a pre-0.8.0 binary despite infrastructure#91 — worth verifying the deployed version while rolling this out.🤖 Generated with Claude Code