feat: resolve /dnsaddr before filtering

AGENTS.md

@@ -4,6 +4,35 @@ someguy is a server implementing the [Delegated Routing V1 HTTP API](https://spe
 It proxies requests to the Amino DHT and other delegated routing endpoints. It
 is a caching proxy, not a libp2p node.
 
+## someguy is a proxy: pass through what you do not understand
+
+someguy sits between clients and other routing systems. Anything it does not
+recognize belongs to somebody else, so it forwards it untouched rather than
+dropping it or normalizing it. someguy is not the only thing that will read
+these records.
+
+**Unknown record schemas.** A record whose `Schema` is not `peer` (or the
+deprecated `bitswap`) arrives as a `types.UnknownRecord` holding its raw JSON,
+and must reach the client with its fields intact. Every place that switches on
+schema has to fall through: `sanitizeRouter`, `dnsAddrRouter`, and boxo's own
+filter all do. Adding a `default` arm that touches the record, or a case that
+rewrites one, breaks forward compatibility for a schema shipped after this
+build.
+
+**Unknown multiaddr components.** An address may carry protocols someguy has no
+handling for. It must survive with its components in order and unmodified.
+`addrSortRank` buckets anything it does not know rather than dropping it, and
+`filterPrivateMultiaddr` removes only private addresses. Nothing may rewrite an
+address it did not parse for a reason.
+
+Note the limit of this: a protocol name absent from the multiaddr registry
+fails to parse in go-multiaddr, so boxo rejects the record before someguy sees
+it. someguy can only pass through what it can parse, and widening that is a
+go-multiaddr concern, not a someguy one.
+
+`TestUnknownSchemaPassesThrough` and `TestUnknownMultiaddrProtocolPassesThrough`
+hold both properties.
+
 ## Build and test
 
 ```bash
@@ -25,5 +54,6 @@ Run `gofmt` and `go vet ./...` before committing.
 
 - [environment-variables.md](docs/environment-variables.md): all config flags and environment variables
 - [peer-address-caching.md](docs/peer-address-caching.md): how `/providers` and `/peers` cache and refresh peer addresses
+- [dnsaddr-resolution.md](docs/dnsaddr-resolution.md): why `/dnsaddr` is resolved before `filter-addrs`, and how it is bounded
 - [metrics.md](docs/metrics.md): Prometheus metrics
 - [tracing.md](docs/tracing.md): OpenTelemetry tracing

CHANGELOG.md

@@ -15,8 +15,13 @@ The following emojis are used to highlight certain changes:
 
 ### Added
 
+- someguy now replaces a `/dnsaddr` provider address with the addresses it names, before it applies `filter-addrs`. A `/dnsaddr` carries no transport component, so a filter could neither match nor exclude it: a provider reachable only through a `/dnsaddr` was dropped from a filtered response, and a provider the client asked to exclude survived one. someguy resolves on every request by default. A request that sends `filter-addrs` gets the `/dnsaddr` replaced, since keeping it would let a record survive a filter meant to exclude it (unless a positive filter entry names `dnsaddr`, the one filter that can match it; then the `/dnsaddr` is kept). A request without a filter gets the resolved addresses added and keeps the `/dnsaddr`, so it can dial straight away and still re-resolve later. Set `SOMEGUY_DNSADDR_RESOLUTION=replace` to drop the `/dnsaddr` from unfiltered responses too, `filtered` to skip the lookup for unfiltered requests, or `never` to disable it (the default is `append`). Lookups are cached and bounded per request, watched by two new metrics: `someguy_routers_dnsaddr_resolutions` and `someguy_routers_dnsaddr_resolution_duration_seconds`. See [`docs/dnsaddr-resolution.md`](https://github.com/ipfs/someguy/blob/main/docs/dnsaddr-resolution.md). [#174](https://github.com/ipfs/someguy/pull/174)
+- Addresses within a record are now ordered by how directly a client can dial them: IP first, then DNS names, then `/dnsaddr`, with `/p2p-circuit` relays last. [#174](https://github.com/ipfs/someguy/pull/174)
+
 ### Changed
 
+- Go 1.26 is now the minimum. [#174](https://github.com/ipfs/someguy/pull/174)
+
 ### Removed
 
 ### Fixed

README.md

@@ -88,6 +88,7 @@ See [environment-variables.md](docs/environment-variables.md) for URL formats an
 
 - [environment-variables.md](docs/environment-variables.md): all config flags and environment variables
 - [peer-address-caching.md](docs/peer-address-caching.md): how `/providers` and `/peers` cache and refresh peer addresses
+- [dnsaddr-resolution.md](docs/dnsaddr-resolution.md): why `/dnsaddr` is resolved before `filter-addrs`, and how it is bounded
 - [metrics.md](docs/metrics.md): Prometheus metrics
 - [tracing.md](docs/tracing.md): OpenTelemetry tracing