net: bind INADDR_ANY only when this node advertises an onion endpoint

Upstream 1.2.19 made the P2P listener wildcard-bind unconditionally because
managed Tor forwards hidden-service traffic to 127.0.0.1, which a LAN-only
bind cannot receive. That also widened every non-Tor node to listen on VPN
tunnels, docker bridges and secondary NICs. The onion endpoint is always
configured (or the managed-Tor hidden service established) before StartNode,
so the predicate is ready when the bind happens.

1 files changed, 8 insertions, 5 deletions

diff --git a/src/net.cpp b/src/net.cpp
index 35baf21..fed6123 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -2038,11 +2038,14 @@ bool StartNode(string& strError)
     // IP address, and port for the socket that is being bound
     int nRetryLimit = 15;
     struct sockaddr_in sockaddr = addrLocalHost.GetSockAddr();
-    // Keep addrLocalHost as this node's advertised address, but listen on all
-    // local interfaces. Managed Tor forwards hidden-service traffic to
-    // 127.0.0.1:<port>, and binding only to the LAN address made that onion
-    // endpoint unreachable even though the P2P listener was running.
-    sockaddr.sin_addr.s_addr = INADDR_ANY;
+    // Managed Tor forwards hidden-service traffic to 127.0.0.1:<port>, which a
+    // LAN-only bind cannot receive -- so a node that advertises an onion
+    // endpoint must listen on all local interfaces. Upstream 1.2.19 bound
+    // INADDR_ANY unconditionally, which also widened the P2P listener of every
+    // non-Tor node to VPN tunnels, docker bridges and secondary NICs. Keep the
+    // wildcard bind conditional on actually having an onion endpoint.
+    if (!BtfLocalOnionEndpoint().empty())
+        sockaddr.sin_addr.s_addr = INADDR_ANY;
     if (bind(hListenSocket, (struct sockaddr*)&sockaddr, sizeof(sockaddr)) == SOCKET_ERROR)
     {
         int nErr = WSAGetLastError();