filter out bad messages and fix wrap not fwding

lib/holepuncher.js

@@ -111,6 +111,13 @@ module.exports = class Holepuncher {
     this.destroyed = false
     this.punching = false
 
+    const self = this
+
+    this.onmessagebound = function (buf, rinfo) {
+      if (buf.byteLength > 1 && this === self.socket) dht.onmessage(this, buf, rinfo)
+      else self.onmessage(this, buf, rinfo)
+    }
+
     this.reset()
   }
 
@@ -120,14 +127,8 @@ module.exports = class Holepuncher {
     }
 
     const dht = this.dht
-    const self = this
 
     this.socket = this._makeSocket()
-    this.socket.on('message', function (buf, rinfo) {
-      if (buf.byteLength > 1) dht.onmessage(this, buf, rinfo)
-      else self.onmessage(this, buf, rinfo)
-    })
-
     this.allSockets.push(this.socket)
     this.nat = new Nat(this.dht, this.socket)
 
@@ -137,6 +138,10 @@ module.exports = class Holepuncher {
 
   // Note that this never throws so it is safe to run in the background
   async onmessage (socket, buf, rinfo) {
+    // try to filter out spoofed messages
+    if (rinfo.address !== this.remoteAddress.host) return
+    if (this.remoteAddress.port && rinfo.port !== this.remoteAddress.port) return
+
     if (!this.punching) return
     this.punching = false
 
@@ -227,7 +232,9 @@ module.exports = class Holepuncher {
   _makeSocket () {
     const socket = utp()
     socket.bind(0)
-    return new SocketWrap(socket)
+    const wrap = new SocketWrap(socket)
+    wrap.on('message', this.onmessagebound)
+    return wrap
   }
 
   ping (addr, socket = this.socket) {