Repository navigation
fix(defaultServerFilters): strip loopback and non-public - #11286
Merged
Merged
Conversation
Rework the `server` profile, `Addresses.NoAnnounce`, and `Swarm.AddrFilters` docs to make the default filter list scrutable, and annotate each entry in `defaultServerFilters` with its RFC origin. - profile.go: per-entry RFC inline comments on defaultServerFilters; godoc points at IANA special-purpose registries and cautions that changes here affect every server-profile user. - config.md NoAnnounce/AddrFilters: active-voice rewrites; cross-link publish-side and dial-side filters; consolidated tip pointing to the server profile section. - config.md server profile: IPv4 and IPv6 prefix tables with RFC references (multiaddr ipcidr notation); scenarios table for overriding specific entries; prose section for optional entries (IPv4 loopback, IPv6 outside 2000::/3) with trade-offs, motivated by loopback and unallocated IPv6 leaking into DHT announces since go-libp2p v0.47.
lidel
force-pushed
the
fix/server-profile-filters
branch
from
April 17, 2026 01:17
a948538 to
df0f80d
Compare
v0.40 switched libp2p to enumerate all interface addresses, which started leaking loopback, unallocated IPv6 space (e.g. 1e::/16), and other non-globally-reachable addresses into DHT and identify records of public IPFS nodes including bootstrap peers. adds three entries to defaultServerFilters applied to both Swarm.AddrFilters and Addresses.NoAnnounce: - /ip4/127.0.0.0/ipcidr/8: IPv4 loopback (RFC 1122) - /ip6/::1/ipcidr/128: IPv6 loopback (kept for documentation; subset of ::/3) - /ip6/::/ipcidr/3: everything outside global unicast 2000::/3 docs/config.md: overhaul server-profile section with per-entry RFC references, override guidance for Yggdrasil/NAT64/co-located loopback, and notes on /ip6/::/ipcidr/3 blast radius. docs/changelogs/v0.42.md: highlight entry with upgrade instructions for operators who already applied server profile before v0.42.
lidel
force-pushed
the
fix/server-profile-filters
branch
from
April 17, 2026 01:55
df0f80d to
f9fbb80
Compare
guillaumemichel
approved these changes
Apr 20, 2026
The /ip6/::/ipcidr/3 CIDR matches only the IANA-reserved 0000::/3 block. Prior wording "everything outside global unicast 2000::/3" implied wider coverage; other non-2000::/3 blocks are IANA-reserved or already covered by fc00::/7 and fe80::/10, so behavior is unchanged. Also sort new entries into their numeric positions within the IPv4 and IPv6 blocks in both profile.go and the config.md tables.
Move the server profile changelog entry from v0.42 to v0.41 since the fix ships in v0.41. Also rewrite to lead with the concrete filter list addition, link to the server profile docs section for full details and override guidance, and warn that applying the profile disables LAN and localhost peer discovery.
lidel
added a commit
that referenced
this pull request
Apr 20, 2026
* docs(server): document defaultServerFilters with RFC references Rework the `server` profile, `Addresses.NoAnnounce`, and `Swarm.AddrFilters` docs to make the default filter list scrutable, and annotate each entry in `defaultServerFilters` with its RFC origin. - profile.go: per-entry RFC inline comments on defaultServerFilters; godoc points at IANA special-purpose registries and cautions that changes here affect every server-profile user. - config.md NoAnnounce/AddrFilters: active-voice rewrites; cross-link publish-side and dial-side filters; consolidated tip pointing to the server profile section. - config.md server profile: IPv4 and IPv6 prefix tables with RFC references (multiaddr ipcidr notation); scenarios table for overriding specific entries; prose section for optional entries (IPv4 loopback, IPv6 outside 2000::/3) with trade-offs, motivated by loopback and unallocated IPv6 leaking into DHT announces since go-libp2p v0.47. * feat(server): strip loopback and non-public IPv6 from announces v0.40 switched libp2p to enumerate all interface addresses, which started leaking loopback, unallocated IPv6 space (e.g. 1e::/16), and other non-globally-reachable addresses into DHT and identify records of public IPFS nodes including bootstrap peers. adds three entries to defaultServerFilters applied to both Swarm.AddrFilters and Addresses.NoAnnounce: - /ip4/127.0.0.0/ipcidr/8: IPv4 loopback (RFC 1122) - /ip6/::1/ipcidr/128: IPv6 loopback (kept for documentation; subset of ::/3) - /ip6/::/ipcidr/3: everything outside global unicast 2000::/3 docs/config.md: overhaul server-profile section with per-entry RFC references, override guidance for Yggdrasil/NAT64/co-located loopback, and notes on /ip6/::/ipcidr/3 blast radius. docs/changelogs/v0.42.md: highlight entry with upgrade instructions for operators who already applied server profile before v0.42. * docs(server): sort filters, correct ::/3 wording The /ip6/::/ipcidr/3 CIDR matches only the IANA-reserved 0000::/3 block. Prior wording "everything outside global unicast 2000::/3" implied wider coverage; other non-2000::/3 blocks are IANA-reserved or already covered by fc00::/7 and fe80::/10, so behavior is unchanged. Also sort new entries into their numeric positions within the IPv4 and IPv6 blocks in both profile.go and the config.md tables. * docs(v0.41): server profile filter highlight Move the server profile changelog entry from v0.42 to v0.41 since the fix ships in v0.41. Also rewrite to lead with the concrete filter list addition, link to the server profile docs section for full details and override guidance, and warn that applying the profile disables LAN and localhost peer discovery. (cherry picked from commit 61018d7)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR improves opt-in
serverprofile and its documentation.There is no change to the default behavior.
Summary
Since v0.40.0, go-libp2p enumerates all interface addresses.
As a side-effect, public Kubo nodes running defaults, including IPFS bootstrap peers, started advertising loopback (
127.0.0.1,::1) and unallocated IPv6 prefixes (e.g.1e::/16) via libp2p identify; peers gossip those records in kad-dhtFindPeerresponses, so the noise shows up in DHT lookups too.AllAddrsmethod to return all interface addrs and not just the primary interface libp2p/go-libp2p#3460Changes in this PR
Three entries are added to
defaultServerFilters(applied to bothSwarm.AddrFiltersandAddresses.NoAnnounce):/ip4/127.0.0.0/ipcidr/8: IPv4 loopback (RFC 1122 §3.2.1.3)./ip6/::1/ipcidr/128: IPv6 loopback (RFC 4291 §2.4), subset of::/3, kept explicit for readability./ip6/::/ipcidr/3: everything outside global unicast2000::/3(RFC 4291 §2.4). Covers::1, unspecified, IPv4-mapped, NAT64, and unallocated space (where1e::/16leaks live).docs/config.md#server-profileis rewritten to document each filter, and a new override table spells out exactly which prefix to remove when a node needs to peer over Yggdrasil (0200::/7), NAT64, IPv6 loopback between co-located daemons, or any other non-public range. All other common IPv6 overlays (WireGuard, Tailscale, Nebula, ZeroTier, cjdns) use ULAfc00::/7, already filtered, so no regression for them, but we added clear docs how to re-enable routing for them.References
1e::/16and::5054:...are now covered by/ip6/::/ipcidr/3in bothSwarm.AddrFiltersandAddresses.NoAnnounce, soserver-profile nodes no longer dial or announce them). Hetzner complaints about dials to public IPv4 are legitimate DHT activity and out of scope.