fix(network): canonicalize inbound peer addresses at the accept boundary (#11129)

Author: mergify[bot]

CHANGELOG.md

@@ -34,6 +34,15 @@ and this project adheres to [Semantic Versioning](https://semver.org).
   enforcing the cap on the total monetary base
   ([#10817](https://github.com/ZcashFoundation/zebra/pull/10817))
 
+### Security
+
+- Inbound connections are canonicalized when they are accepted, so an IPv4 peer that connects to a
+  dual-stack listener as an IPv4-mapped IPv6 address (`::ffff:A.B.C.D`) is keyed on its canonical
+  IPv4 address. Previously the mapped address became the peer set key, so a ban issued for that
+  peer's IPv4 address did not disconnect it while it stayed connected, and the same peer counted
+  twice towards the per-IP inbound connection limit
+  ([#10695](https://github.com/ZcashFoundation/zebra/issues/10695)).
+
 ## [Zebra 6.2.3](https://github.com/ZcashFoundation/zebra/releases/tag/v6.2.3) - 2026-07-27
 
 This is an optional release with network hardenings for operators that experience issues with their nodes peer set connectivity or otherwise want to be proactive about avoiding such issues.

zebra-network/CHANGELOG.md

@@ -14,12 +14,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   ([#11096](https://github.com/ZcashFoundation/zebra/pull/11096)).
 - Connection-attempt, terminal-outcome, and remote-version metrics with bounded network,
   direction, address-family, lifecycle-stage, outcome, and implementation labels.
+- `constants::MISBEHAVIOR_FLUSH_INTERVAL`, the interval between flushes of batched peer
+  misbehaviour updates into the address book. This was previously an unnamed literal in
+  `init_with_block_gossip_peer_ips()`; the value is unchanged outside this crate's tests
+  ([#11129](https://github.com/ZcashFoundation/zebra/pull/11129)).
 
 ### Changed
 
 - Peer-set, crawler-handshake, and address-book gauges now include a `network` label, so multiple
   network instances in one process do not overwrite each other's values.
 
+### Security
+
+- Inbound connections are canonicalized at the accept boundary, so an IPv4 peer that connects to a
+  dual-stack listener as an IPv4-mapped IPv6 address (`::ffff:A.B.C.D`) is keyed on its canonical
+  IPv4 address. Previously the mapped address became the peer set key, so a ban issued for that
+  peer's IPv4 address did not disconnect it while it stayed connected, and the same peer counted
+  twice towards the per-IP inbound connection limit
+  ([#10695](https://github.com/ZcashFoundation/zebra/issues/10695)).
+
 ## [11.0.0] - 2026-07-27
 
 ### Breaking Changes

zebra-network/src/constants.rs

@@ -401,6 +401,20 @@ pub const MIN_PEER_SET_LOG_INTERVAL: Duration = Duration::from_secs(60);
 /// disconnected and banned.
 pub const MAX_PEER_MISBEHAVIOR_SCORE: u32 = 100;
 
+/// The interval between flushes of batched peer misbehaviour updates into the address book.
+///
+/// Misbehaviour updates are batched so peers can't keep the address book mutex locked by
+/// repeatedly sending invalid blocks or transactions.
+#[cfg(not(test))]
+pub const MISBEHAVIOR_FLUSH_INTERVAL: Duration = Duration::from_secs(30);
+
+/// The interval between flushes of batched peer misbehaviour updates into the address book.
+///
+/// Tests use a much shorter interval, so that tests which wait for a misbehaviour update to
+/// turn into a ban don't have to wait for a production flush cycle.
+#[cfg(test)]
+pub const MISBEHAVIOR_FLUSH_INTERVAL: Duration = Duration::from_millis(100);
+
 /// The maximum number of banned IP addresses to be stored in-memory at any time.
 pub const MAX_BANNED_IPS: usize = 20_000;
 

zebra-network/src/peer_set/initialize.rs

@@ -48,7 +48,7 @@ use crate::{
     },
     peer_cache_updater::peer_cache_updater,
     peer_set::{set::MorePeers, ActiveConnectionCounter, CandidateSet, ConnectionTracker, PeerSet},
-    protocol::external::canonical_socket_addr,
+    protocol::external::{canonical_peer_addr, canonical_socket_addr},
     AddressBook, BoxError, Config, PeerSocketAddr, Request, Response,
 };
 
@@ -172,7 +172,7 @@ where
             // Batch misbehaviour updates so peers can't keep the address book mutex locked
             // by repeatedly sending invalid blocks or transactions.
             let mut flush_timer =
-                IntervalStream::new(tokio::time::interval(Duration::from_secs(30)));
+                IntervalStream::new(tokio::time::interval(constants::MISBEHAVIOR_FLUSH_INTERVAL));
 
             loop {
                 tokio::select! {
@@ -711,7 +711,14 @@ where
         };
 
         if let Ok((tcp_stream, addr)) = inbound_result {
-            let addr: PeerSocketAddr = addr.into();
+            // # Security
+            //
+            // Canonicalize the accepted address before it is used as a key. On a
+            // dual-stack listener an IPv4 peer connects as IPv4-mapped IPv6, but
+            // bans and misbehaviour updates are keyed on the canonical IPv4 address.
+            // This address also becomes the peer set key and the per-IP limiter key
+            // below, so canonicalizing once here keeps all of them in the same form.
+            let addr: PeerSocketAddr = canonical_peer_addr(addr);
             record_connection_attempt_started(&config.network, ConnectionDirection::Inbound, addr);
 
             // # Security