Skip to content

fix(http-routing): keep browser transports in provider records#11394

Draft
lidel wants to merge 2 commits into
masterfrom
fix/http-router-announce-all-transports
Draft

fix(http-routing): keep browser transports in provider records#11394
lidel wants to merge 2 commits into
masterfrom
fix/http-router-announce-all-transports

Conversation

@lidel

@lidel lidel commented Jul 15, 2026

Copy link
Copy Markdown
Member

Problem

A publicly reachable node with AutoTLS or webrtc-direct enabled left those addresses out of the provider records it sent to delegated HTTP routers. The record carried only tcp, quic-v1, and webtransport, none of which a browser can dial, so browser and Helia clients that found the node through a router had no way to connect, even though ipfs id showed the addresses (#11369).

Two causes:

  • kubo narrowed the record to AutoNAT-confirmed addresses, which can never include the AutoTLS /tls/ws address (AutoNAT only sees listen addresses, and p2p-forge synthesizes that one later),
  • and go-libp2p drops webrtc-direct from the confirmed set on the way out

Fix

  • provider records now carry host.Addrs(), the same set identify and the DHT announce, narrowed to public addresses when the node has any
  • AppendAnnounce entries appear exactly once and cannot evict a LAN-only node's real addresses
  • go-libp2p pinned to the head of the upstream fix: fix(basichost): sort confirmed addrs libp2p/go-libp2p#3526

Closes #11369

TODO

lidel added 2 commits July 15, 2026 23:19
Pin the head commit of libp2p/go-libp2p#3526: AutoNAT V2's
ConfirmedAddrs returned unsorted buckets, and removeNotInSource
silently dropped webrtc-direct from the confirmed set. Switch to a
master pseudo-version once the PR merges.
Provider records sent to HTTP routers were narrowed to the addresses
AutoNAT V2 confirmed reachable, which silently dropped the only two
transports a browser can dial: the AutoTLS /tls/ws address and
webrtc-direct. A publicly reachable node was invisible to browser and
Helia clients that found it through a delegated router, even though
ipfs id and the DHT both advertised those addresses.

AutoNAT only ever sees listen addresses, so the AutoTLS address, which
the AddrsFactory synthesizes afterwards, can never reach the confirmed
set. webrtc-direct does get confirmed, but go-libp2p loses it again in
getConfirmedAddrs, which feeds an unsorted slice to a scan that assumes
sorted input; that one is fixed upstream in libp2p/go-libp2p#3526.

Announce host.Addrs() instead, the same set identify sends to peers and
the DHT already publishes, narrowed to globally routable addresses so
loopback and LAN entries stay out of a public index. Nodes with no
public address keep announcing what they have, so LAN-only setups
pointing at a local router are unaffected.

- core/node/libp2p/routingopt.go: drop the ConfirmedAddrs branch from
  httpRouterAddrFunc, filter host.Addrs() with manet.IsPublicAddr;
  AppendAnnounce is emitted exactly once and does not count toward
  the public-addr check
- core/commands/swarm_addrs_autonat.go: take over the BasicHost
  compile-time assertion, now the only ConfirmedAddrs consumer

Fixes #11369
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedgithub.com/​libp2p/​go-libp2p@​v0.48.1-0.20260708062241-95be6665b014 ⏵ v0.48.1-0.20260715204039-42aa212c564674 +110010075100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

webrtc-direct and AutoTLS /tls/ws missing from provider records announced to delegated HTTP routers on AutoNAT-confirmed-public nodes

1 participant