fix(gossipsub): reject key field in anonymous validation mode

Cargo.toml

@@ -83,7 +83,7 @@ libp2p-core = { version = "0.44.0", path = "core" }
 libp2p-dcutr = { version = "0.15.0", path = "protocols/dcutr" }
 libp2p-dns = { version = "0.45.0", path = "transports/dns" }
 libp2p-floodsub = { version = "0.48.0", path = "protocols/floodsub" }
-libp2p-gossipsub = { version = "0.50.0", path = "protocols/gossipsub" }
+libp2p-gossipsub = { version = "0.51.0", path = "protocols/gossipsub" }
 libp2p-identify = { version = "0.48.0", path = "protocols/identify" }
 libp2p-identity = { version = "0.3.0" }
 libp2p-kad = { version = "0.49.0", path = "protocols/kad" }

protocols/gossipsub/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.51.0
+- Reject messages carrying a `key` field in `ValidationMode::Anonymous`, aligning with the
+  `StrictNoSign` policy which forbids `from`, `seqno`, `signature` and `key` on the envelope.
+  See [PR 6621](https://github.com/libp2p/rust-libp2p/pull/6621).
+
 ## 0.50.0
 - Fix unbounded growth of per-peer `connected_peer.topics` from GRAFT control messages
   ([GHSA-g3g5-x568-qvqx](https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-g3g5-x568-qvqx)).

protocols/gossipsub/Cargo.toml

@@ -3,7 +3,7 @@ name = "libp2p-gossipsub"
 edition.workspace = true
 rust-version = { workspace = true }
 description = "Gossipsub protocol for libp2p"
-version = "0.50.0"
+version = "0.51.0"
 authors = ["Age Manning <Age@AgeManning.com>"]
 license = "MIT"
 repository = "https://github.com/libp2p/rust-libp2p"

protocols/gossipsub/src/config.rs

@@ -43,8 +43,8 @@ pub enum ValidationMode {
     /// This setting permits messages that have no author, sequence number or signature. If any of
     /// these fields exist in the message these are validated.
     Permissive,
-    /// This setting requires the author, sequence number and signature fields of a message to be
-    /// empty. Any message that contains these fields is considered invalid.
+    /// This setting requires the author, key, sequence number and signature fields of a message to
+    /// be empty. Any message that contains these fields is considered invalid.
     Anonymous,
     /// This setting does not check the author, sequence number or signature fields of incoming
     /// messages. If these fields contain data, they are simply ignored.

protocols/gossipsub/src/error.rs

@@ -103,14 +103,17 @@ pub enum ValidationError {
     /// The PeerId was invalid
     InvalidPeerId,
     /// Signature existed when validation has been sent to
-    /// [`crate::behaviour::MessageAuthenticity::Anonymous`].
+    /// [`crate::ValidationMode::Anonymous`].
     SignaturePresent,
     /// Sequence number existed when validation has been sent to
-    /// [`crate::behaviour::MessageAuthenticity::Anonymous`].
+    /// [`crate::ValidationMode::Anonymous`].
     SequenceNumberPresent,
     /// Message source existed when validation has been sent to
-    /// [`crate::behaviour::MessageAuthenticity::Anonymous`].
+    /// [`crate::ValidationMode::Anonymous`].
     MessageSourcePresent,
+    /// Message key existed when validation has been sent to
+    /// [`crate::ValidationMode::Anonymous`].
+    KeyPresent,
     /// The data transformation failed.
     TransformFailed,
     /// Message size was too large for topic

protocols/gossipsub/src/protocol.rs

@@ -434,6 +434,11 @@ impl Decoder for GossipsubCodec {
                             "Message dropped. Message source was non-empty and anonymous validation mode is set"
                         );
                         invalid_kind = Some(ValidationError::MessageSourcePresent);
+                    } else if message.key.is_some() {
+                        tracing::warn!(
+                            "Message dropped. Message key was non-empty and anonymous validation mode is set"
+                        );
+                        invalid_kind = Some(ValidationError::KeyPresent);
                     }
                 }
                 ValidationMode::None => {}