From 9b0535312a77a97b06837bbef51c1fe4b7f3b0da Mon Sep 17 00:00:00 2001 From: bitflash-maintainer Date: Wed, 26 Aug 2026 22:44:31 +0000 Subject: net: bind INADDR_ANY only when this node advertises an onion endpoint Upstream 1.2.19 made the P2P listener wildcard-bind unconditionally because managed Tor forwards hidden-service traffic to 127.0.0.1, which a LAN-only bind cannot receive. That also widened every non-Tor node to listen on VPN tunnels, docker bridges and secondary NICs. The onion endpoint is always configured (or the managed-Tor hidden service established) before StartNode, so the predicate is ready when the bind happens. --- src/net.cpp | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) (limited to 'src/net.cpp') diff --git a/src/net.cpp b/src/net.cpp index 35baf21..fed6123 100644 --- a/src/net.cpp +++ b/src/net.cpp @@ -2038,11 +2038,14 @@ bool StartNode(string& strError) // IP address, and port for the socket that is being bound int nRetryLimit = 15; struct sockaddr_in sockaddr = addrLocalHost.GetSockAddr(); - // Keep addrLocalHost as this node's advertised address, but listen on all - // local interfaces. Managed Tor forwards hidden-service traffic to - // 127.0.0.1:, and binding only to the LAN address made that onion - // endpoint unreachable even though the P2P listener was running. - sockaddr.sin_addr.s_addr = INADDR_ANY; + // Managed Tor forwards hidden-service traffic to 127.0.0.1:, which a + // LAN-only bind cannot receive -- so a node that advertises an onion + // endpoint must listen on all local interfaces. Upstream 1.2.19 bound + // INADDR_ANY unconditionally, which also widened the P2P listener of every + // non-Tor node to VPN tunnels, docker bridges and secondary NICs. Keep the + // wildcard bind conditional on actually having an onion endpoint. + if (!BtfLocalOnionEndpoint().empty()) + sockaddr.sin_addr.s_addr = INADDR_ANY; if (bind(hListenSocket, (struct sockaddr*)&sockaddr, sizeof(sockaddr)) == SOCKET_ERROR) { int nErr = WSAGetLastError(); -- cgit v1.2.3