feat(p2p): RLPx IPv6 dual-stack TCP binding and fix DiscV5 ENR tcp/tcp6 port fields

CHANGELOG.md

@@ -41,7 +41,7 @@
 
 
 ### Additions and Improvements
-- Add IPv6 dual-stack support for DiscV5 peer discovery (enabled via `--Xv5-discovery-enabled`): new `--p2p-host-ipv6`, `--p2p-interface-ipv6`, and `--p2p-port-ipv6` CLI options enable a second UDP discovery socket; `--p2p-ipv6-outbound-enabled` controls whether IPv6 is preferred for outbound connections when a peer advertises both address families [#9763](https://github.com/hyperledger/besu/pull/9763)
+- Add IPv6 dual-stack support for DiscV5 peer discovery (enabled via `--Xv5-discovery-enabled`): new `--p2p-host-ipv6`, `--p2p-interface-ipv6`, and `--p2p-port-ipv6` CLI options enable a second UDP discovery socket; `--p2p-ipv6-outbound-enabled` controls whether IPv6 is preferred for outbound connections when a peer advertises both address families [#9763](https://github.com/hyperledger/besu/pull/9763); RLPx now also binds a second TCP socket on the IPv6 interface so IPv6-only peers can establish connections [#9873](https://github.com/hyperledger/besu/pull/9873)
 - Support substring and glob matching for `--test-name` in `block-test` evmtool subcommand [#9790](https://github.com/hyperledger/besu/pull/9790)
 - Improve performance of snap sync chain download [#9510](https://github.com/hyperledger/besu/pull/9510) and [#9621](https://github.com/hyperledger/besu/pull/9621)
 - Add ability to pass a custom tracer to block simulation [#9708](https://github.com/hyperledger/besu/pull/9708)
@@ -55,6 +55,7 @@
 - EVM optimisations - Improve SAR, SHR and SHL opcodes performance [#9796](https://github.com/hyperledger/besu/pull/9796)
 
 ### Bug fixes
+- Fix DiscV5 ENR `tcp`/`tcp6` fields: previously these reflected the UDP discovery bind port instead of the actual RLPx listening port; ENR initialisation is now deferred until the RLPx TCP port is known [#9873](https://github.com/hyperledger/besu/pull/9873)
 - Fix QBFT Shanghai support by reintroducing NotApplicableWithdrawals withdrawals validator [#9830](https://github.com/hyperledger/besu/pull/9830)
 - Fix callTracer handling of failed CREATE operations, including correct input field extraction and proper error reporting for both soft failures and revert reasons
 - Upgrade netty to 4.2.10-Final - Fixes `setsockopt() failed: Protocol not available` [#9783](https://github.com/hyperledger/besu/pull/9783)

app/src/main/java/org/hyperledger/besu/RunnerBuilder.java

@@ -706,10 +706,21 @@ public Runner build() {
             .flatMap(protocolManager -> protocolManager.getSupportedCapabilities().stream())
             .collect(Collectors.toSet());
 
+    // IPv6 dual-stack support (a second UDP socket + a second TCP socket) was introduced
+    // alongside DiscV5. Besu does not implement dual-stack for DiscV4, so RLPx should only
+    // bind a second TCP socket when DiscV5 is active. This guard can be dropped once DiscV4
+    // is removed.
+    final boolean rlpxDualStackEnabled =
+        discoveryEnabled && networkingConfiguration.discoveryConfiguration().isDiscoveryV5Enabled();
     final RlpxConfiguration rlpxConfiguration =
         RlpxConfiguration.create()
             .setBindHost(p2pListenInterface)
             .setBindPort(p2pListenPort)
+            .setBindHostIpv6(rlpxDualStackEnabled ? p2pListenInterfaceIpv6 : Optional.empty())
+            .setBindPortIpv6(
+                rlpxDualStackEnabled
+                    ? p2pListenInterfaceIpv6.map(ignored -> p2pListenPortIpv6)
+                    : Optional.empty())
             .setSupportedProtocols(subProtocols)
             .setClientId(BesuVersionUtils.nodeName(identityString));
     networkingConfiguration =

ethereum/p2p/src/main/java/org/hyperledger/besu/ethereum/p2p/config/RlpxConfiguration.java

@@ -21,12 +21,15 @@
 import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
+import java.util.Optional;
 
 public class RlpxConfiguration {
   public static final float DEFAULT_FRACTION_REMOTE_CONNECTIONS_ALLOWED = 0.6f;
   private String clientId = "TestClient/1.0.0";
   private String bindHost = NetworkUtility.INADDR_ANY;
   private int bindPort = 30303;
+  private Optional<String> bindHostIpv6 = Optional.empty();
+  private Optional<Integer> bindPortIpv6 = Optional.empty();
   private List<SubProtocol> supportedProtocols = Collections.emptyList();
 
   public static RlpxConfiguration create() {
@@ -65,6 +68,28 @@ public RlpxConfiguration setBindPort(final int bindPort) {
     return this;
   }
 
+  public Optional<String> getBindHostIpv6() {
+    return bindHostIpv6;
+  }
+
+  public RlpxConfiguration setBindHostIpv6(final Optional<String> bindHostIpv6) {
+    this.bindHostIpv6 = bindHostIpv6;
+    return this;
+  }
+
+  public Optional<Integer> getBindPortIpv6() {
+    return bindPortIpv6;
+  }
+
+  public RlpxConfiguration setBindPortIpv6(final Optional<Integer> bindPortIpv6) {
+    this.bindPortIpv6 = bindPortIpv6;
+    return this;
+  }
+
+  public boolean isDualStackEnabled() {
+    return bindHostIpv6.isPresent() && bindPortIpv6.isPresent();
+  }
+
   public String getClientId() {
     return clientId;
   }
@@ -83,19 +108,24 @@ public boolean equals(final Object o) {
       return false;
     }
     final RlpxConfiguration that = (RlpxConfiguration) o;
-    return bindPort == that.bindPort && Objects.equals(bindHost, that.bindHost);
+    return bindPort == that.bindPort
+        && Objects.equals(bindHost, that.bindHost)
+        && Objects.equals(bindHostIpv6, that.bindHostIpv6)
+        && Objects.equals(bindPortIpv6, that.bindPortIpv6);
   }
 
   @Override
   public int hashCode() {
-    return Objects.hash(bindHost, bindPort);
+    return Objects.hash(bindHost, bindPort, bindHostIpv6, bindPortIpv6);
   }
 
   @Override
   public String toString() {
     final StringBuilder sb = new StringBuilder("RlpxConfiguration{");
     sb.append("bindHost='").append(bindHost).append('\'');
     sb.append(", bindPort=").append(bindPort);
+    bindHostIpv6.ifPresent(h -> sb.append(", bindHostIpv6='").append(h).append('\''));
+    bindPortIpv6.ifPresent(p -> sb.append(", bindPortIpv6=").append(p));
     sb.append('}');
     return sb.toString();
   }

ethereum/p2p/src/main/java/org/hyperledger/besu/ethereum/p2p/discovery/discv5/PeerDiscoveryAgentFactoryV5.java

@@ -14,45 +14,25 @@
  */
 package org.hyperledger.besu.ethereum.p2p.discovery.discv5;
 
-import org.hyperledger.besu.crypto.SECPPublicKey;
-import org.hyperledger.besu.crypto.SignatureAlgorithm;
-import org.hyperledger.besu.crypto.SignatureAlgorithmFactory;
 import org.hyperledger.besu.cryptoservices.NodeKey;
 import org.hyperledger.besu.ethereum.forkid.ForkIdManager;
-import org.hyperledger.besu.ethereum.p2p.config.DiscoveryConfiguration;
 import org.hyperledger.besu.ethereum.p2p.config.NetworkingConfiguration;
-import org.hyperledger.besu.ethereum.p2p.discovery.DiscoveryPeer;
-import org.hyperledger.besu.ethereum.p2p.discovery.HostEndpoint;
 import org.hyperledger.besu.ethereum.p2p.discovery.NodeRecordManager;
 import org.hyperledger.besu.ethereum.p2p.discovery.PeerDiscoveryAgent;
 import org.hyperledger.besu.ethereum.p2p.discovery.PeerDiscoveryAgentFactory;
 import org.hyperledger.besu.ethereum.p2p.rlpx.RlpxAgent;
 import org.hyperledger.besu.ethereum.storage.StorageProvider;
 import org.hyperledger.besu.nat.NatService;
 
-import java.net.InetSocketAddress;
-import java.util.Optional;
-
-import org.apache.tuweni.bytes.Bytes;
-import org.apache.tuweni.bytes.Bytes32;
-import org.ethereum.beacon.discovery.AddressAccessPolicy;
-import org.ethereum.beacon.discovery.DiscoverySystemBuilder;
-import org.ethereum.beacon.discovery.MutableDiscoverySystem;
-import org.ethereum.beacon.discovery.schema.NodeRecord;
-
 /**
- * Factory for creating DiscV5 {@link PeerDiscoveryAgent} instances backed by the Ethereum Discovery
- * v5 {@link DiscoverySystemBuilder}.
- *
- * <p>This factory is responsible for:
+ * Factory for creating DiscV5 {@link PeerDiscoveryAgent} instances.
  *
- * <ul>
- *   <li>Initializing the local {@link NodeRecord} via {@link NodeRecordManager}
- *   <li>Configuring and building a mutable DiscV5 discovery system
- *   <li>Wiring Besu-specific components such as fork ID handling and node key services
- * </ul>
+ * <p>This factory is responsible for wiring together the dependencies needed by {@link
+ * PeerDiscoveryAgentV5}. It intentionally does <em>not</em> initialize the local node record or
+ * build the {@link org.ethereum.beacon.discovery.MutableDiscoverySystem} — both are deferred to
+ * {@link PeerDiscoveryAgentV5#start(int)}, where the actual RLPx TCP port is known.
  *
- * <p>The resulting {@link PeerDiscoveryAgent} integrates DiscV5 discovery with Besu’s P2P
+ * <p>The resulting {@link PeerDiscoveryAgent} integrates DiscV5 discovery with Besu's P2P
  * networking stack.
  */
 public final class PeerDiscoveryAgentFactoryV5 implements PeerDiscoveryAgentFactory {
@@ -85,116 +65,23 @@ public PeerDiscoveryAgentFactoryV5(
   }
 
   /**
-   * Creates and configures a DiscV5 {@link PeerDiscoveryAgent}.
+   * Creates a DiscV5 {@link PeerDiscoveryAgent}.
+   *
+   * <p>The local node record and discovery system are built lazily during {@link
+   * PeerDiscoveryAgentV5#start(int)} so that the ENR {@code tcp}/{@code tcp6} fields receive the
+   * actual RLPx TCP port rather than the discovery bind port.
    *
    * @param rlpxAgent the RLPx agent
-   * @return a fully configured DiscV5 peer discovery agent
-   * @throws IllegalStateException if the local node record has not been initialized
+   * @return a configured DiscV5 peer discovery agent ready to be started
    */
   @Override
   public PeerDiscoveryAgent create(final RlpxAgent rlpxAgent) {
-    final NodeRecord localNodeRecord = initializeLocalNodeRecord();
-
-    final DiscoveryConfiguration disc = config.discoveryConfiguration();
-    final DiscoverySystemBuilder builder =
-        new DiscoverySystemBuilder()
-            .signer(new LocalNodeKeySigner(nodeKey))
-            .localNodeRecord(localNodeRecord)
-            .localNodeRecordListener((previous, updated) -> nodeRecordManager.updateNodeRecord())
-            .newAddressHandler((nodeRecord, newAddress) -> Optional.of(nodeRecord))
-            // TODO Integrate address filtering based on peer permissions
-            .addressAccessPolicy(AddressAccessPolicy.ALLOW_ALL);
-
-    if (disc.isDualStackEnabled()) {
-      final InetSocketAddress ipv4 = new InetSocketAddress(disc.getBindHost(), disc.getBindPort());
-      final InetSocketAddress ipv6 =
-          new InetSocketAddress(disc.getBindHostIpv6().orElseThrow(), disc.getBindPortIpv6());
-      builder.listen(ipv4, ipv6);
-    } else {
-      builder.listen(disc.getBindHost(), disc.getBindPort());
-    }
-
-    final MutableDiscoverySystem discoverySystem = builder.buildMutable();
-
     return new PeerDiscoveryAgentV5(
-        discoverySystem,
+        nodeKey,
         config,
         forkIdManager,
         nodeRecordManager,
         rlpxAgent,
-        disc.isPreferIpv6Outbound());
-  }
-
-  /**
-   * Initializes the local node record using the {@link NodeRecordManager}.
-   *
-   * @return the initialized local {@link NodeRecord}
-   * @throws IllegalStateException if the local node record has not been initialized
-   */
-  private NodeRecord initializeLocalNodeRecord() {
-    final DiscoveryConfiguration disc = config.discoveryConfiguration();
-    nodeRecordManager.initializeLocalNode(
-        new HostEndpoint(disc.getAdvertisedHost(), disc.getBindPort(), disc.getBindPort()),
-        disc.getAdvertisedHostIpv6()
-            .map(host -> new HostEndpoint(host, disc.getBindPortIpv6(), disc.getBindPortIpv6())));
-
-    return nodeRecordManager
-        .getLocalNode()
-        .flatMap(DiscoveryPeer::getNodeRecord)
-        .orElseThrow(() -> new IllegalStateException("Local node record not initialized"));
-  }
-
-  /**
-   * An implementation of the {@link org.ethereum.beacon.discovery.crypto.Signer} interface that
-   * uses a local {@link NodeKey} for signing and key agreement.
-   */
-  private static class LocalNodeKeySigner implements org.ethereum.beacon.discovery.crypto.Signer {
-    private final SignatureAlgorithm signatureAlgorithm = SignatureAlgorithmFactory.getInstance();
-
-    private final NodeKey nodeKey;
-
-    /**
-     * Creates a new LocalNodeKeySigner.
-     *
-     * @param nodeKey the node key to use for signing and key agreement
-     */
-    public LocalNodeKeySigner(final NodeKey nodeKey) {
-      this.nodeKey = nodeKey;
-    }
-
-    /**
-     * Derives a shared secret using ECDH with the given peer public key.
-     *
-     * @param remotePubKey the destination peer's public key
-     * @return the derived shared secret
-     */
-    @Override
-    public Bytes deriveECDHKeyAgreement(final Bytes remotePubKey) {
-      SECPPublicKey publicKey = signatureAlgorithm.createPublicKey(remotePubKey);
-      return nodeKey.calculateECDHKeyAgreement(publicKey);
-    }
-
-    /**
-     * Creates a signature of message `x`.
-     *
-     * @param messageHash message, hashed
-     * @return ECDSA signature with properties merged together: r || s
-     */
-    @Override
-    public Bytes sign(final Bytes32 messageHash) {
-      Bytes signature = nodeKey.sign(messageHash).encodedBytes();
-      return signature.slice(0, 64);
-    }
-
-    /**
-     * Derives the compressed public key corresponding to the private key held by this module.
-     *
-     * @return the compressed public key
-     */
-    @Override
-    public Bytes deriveCompressedPublicKeyFromPrivate() {
-      return Bytes.wrap(
-          signatureAlgorithm.publicKeyAsEcPoint(nodeKey.getPublicKey()).getEncoded(true));
-    }
+        config.discoveryConfiguration().isPreferIpv6Outbound());
   }
 }