Skip to content
Bitcoin Roots

v29.4-roots.1 · Commit 3: [PATCH 03/13] policy: restore conservative relay and network controls

src/init.cpp

Before: src/init.cpp · After: src/init.cpp

File metadata
index 70615a191be113c4a17938cf76da6667a3878737..c2ca0ad27b3bbd5941825281792ce2b9c5923bbf 100644

Download original patch · Release notes

Diff rows 1–325 of 325. Line numbers refer to the original before/after files.

+ Added− RemovedUnmarked lines are context.

Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.

src/init.cpp CHANGED
@@ -483,6 +483,10 @@ void SetupServerArgs(ArgsManager& argsman, bool can_listen_ipc)
483
483
  argsman.AddArg("-blocknotify=<cmd>", "Execute command when the best block changes (%s in cmd is replaced by block hash)", ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
484
484
  #endif
485
485
  argsman.AddArg("-blockreconstructionextratxn=<n>", strprintf("Extra transactions to keep in memory for compact block reconstructions (default: %u)", DEFAULT_BLOCK_RECONSTRUCTION_EXTRA_TXN), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
486
+ argsman.AddArg("-blockreconstructionextratxnsize=<n>",
487
+ strprintf("Upper limit of memory usage (in megabytes) for keeping extra transactions in memory for compact block reconstructions (default: %s)",
488
+ DEFAULT_BLOCK_RECONSTRUCTION_EXTRA_TXN_SIZE / 1000000),
489
+ ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
486
490
  argsman.AddArg("-blocksonly", strprintf("Whether to reject transactions from network peers. Disables automatic broadcast and rebroadcast of transactions, unless the source peer has the 'forcerelay' permission. RPC transactions are not affected. (default: %u)", DEFAULT_BLOCKSONLY), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
487
491
  argsman.AddArg("-coinstatsindex", strprintf("Maintain coinstats index used by the gettxoutsetinfo RPC (default: %u)", DEFAULT_COINSTATSINDEX), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
488
492
  argsman.AddArg("-conf=<file>", strprintf("Specify path to read-only configuration file. Relative paths will be prefixed by datadir location (only useable from command line, not configuration file) (default: %s)", BITCOIN_CONF_FILENAME), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
@@ -548,15 +552,32 @@ void SetupServerArgs(ArgsManager& argsman, bool can_listen_ipc)
548
552
  argsman.AddArg("-i2pacceptincoming", strprintf("Whether to accept inbound I2P connections (default: %i). Ignored if -i2psam is not set. Listening for inbound I2P connections is done through the SAM proxy, not by binding to a local address and port.", DEFAULT_I2P_ACCEPT_INCOMING), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
549
553
  argsman.AddArg("-onlynet=<net>", "Make automatic outbound connections only to network <net> (" + Join(GetNetworkNames(), ", ") + "). Inbound and manual connections are not affected by this option. It can be specified multiple times to allow multiple networks.", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
550
554
  argsman.AddArg("-v2transport", strprintf("Support v2 transport (default: %u)", DEFAULT_V2_TRANSPORT), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
551
- argsman.AddArg("-peerbloomfilters", strprintf("Support filtering of blocks and transaction with bloom filters (default: %u)", DEFAULT_PEERBLOOMFILTERS), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
555
+ argsman.AddArg("-v2onlyclearnet", strprintf("Disallow outbound v1 connections on IPV4/IPV6 (default: %u). Enable this option only if you really need it. Use -listen=0 to disable inbound connections since they can be unencrypted.", false), ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::CONNECTION);
556
+ argsman.AddArg("-peerbloomfilters", strprintf("Support filtering of blocks and transactions with bloom filters (default: %s)", DEFAULT_PEERBLOOMFILTERS ? "1" : "localhost only"), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
552
557
  argsman.AddArg("-peerblockfilters", strprintf("Serve compact block filters to peers per BIP 157 (default: %u)", DEFAULT_PEERBLOCKFILTERS), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
558
+ argsman.AddArg("-feefilter", strprintf("Tell other nodes to filter invs to us by our mempool min fee (default: %u)", DEFAULT_FEEFILTER), ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::CONNECTION);
553
559
  argsman.AddArg("-txreconciliation", strprintf("Enable transaction reconciliations per BIP 330 (default: %d)", DEFAULT_TXRECONCILIATION_ENABLE), ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::CONNECTION);
554
560
  argsman.AddArg("-port=<port>", strprintf("Listen for connections on <port> (default: %u, testnet3: %u, testnet4: %u, signet: %u, regtest: %u). Not relevant for I2P (see doc/i2p.md). If set to a value x, the default onion listening port will be set to x+1.", defaultChainParams->GetDefaultPort(), testnetChainParams->GetDefaultPort(), testnet4ChainParams->GetDefaultPort(), signetChainParams->GetDefaultPort(), regtestChainParams->GetDefaultPort()), ArgsManager::ALLOW_ANY | ArgsManager::NETWORK_ONLY, OptionsCategory::CONNECTION);
561
+ const std::string proxy_doc_for_value =
562
+ #ifdef HAVE_SOCKADDR_UN
563
+ "<ip>[:<port>]|unix:<path>";
564
+ #else
565
+ "<ip>[:<port>]";
566
+ #endif
567
+ const std::string proxy_doc_for_unix_socket =
555
568
  #ifdef HAVE_SOCKADDR_UN
556
- argsman.AddArg("-proxy=<ip:port|path>", "Connect through SOCKS5 proxy, set -noproxy to disable (default: disabled). May be a local file path prefixed with 'unix:' if the proxy supports it.", ArgsManager::ALLOW_ANY | ArgsManager::DISALLOW_ELISION, OptionsCategory::CONNECTION);
569
+ "May be a local file path prefixed with 'unix:' if the proxy supports it. ";
557
570
  #else
558
- argsman.AddArg("-proxy=<ip:port>", "Connect through SOCKS5 proxy, set -noproxy to disable (default: disabled)", ArgsManager::ALLOW_ANY | ArgsManager::DISALLOW_ELISION, OptionsCategory::CONNECTION);
571
+ "";
559
572
  #endif
573
+ argsman.AddArg("-proxy=" + proxy_doc_for_value + "[=<network>]",
574
+ "Connect through SOCKS5 proxy, set -noproxy to disable. " +
575
+ proxy_doc_for_unix_socket +
576
+ "Could end in =network to set the proxy only for that network. " +
577
+ "The network can be any of ipv4, ipv6, tor or cjdns. " +
578
+ "(default: disabled)",
579
+ ArgsManager::ALLOW_ANY | ArgsManager::DISALLOW_ELISION,
580
+ OptionsCategory::CONNECTION);
560
581
  argsman.AddArg("-proxyrandomize", strprintf("Randomize credentials for every proxy connection. This enables Tor stream isolation (default: %u)", DEFAULT_PROXYRANDOMIZE), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
561
582
  argsman.AddArg("-seednode=<ip>", "Connect to a node to retrieve peer addresses, and disconnect. This option can be specified multiple times to connect to multiple nodes. During startup, seednodes will be tried before dnsseeds.", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
562
583
  argsman.AddArg("-networkactive", "Enable all P2P network activity (default: 1). Can be changed by the setnetworkactive RPC command", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
@@ -634,23 +655,38 @@ void SetupServerArgs(ArgsManager& argsman, bool can_listen_ipc)
634
655
  argsman.AddArg("-dustrelayfee=<amt>", strprintf("Fee rate (in %s/kvB) used to define dust, the value of an output such that it will cost more than its value in fees at this fee rate to spend it. (default: %s)", CURRENCY_UNIT, FormatMoney(DUST_RELAY_TX_FEE)), ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::NODE_RELAY);
635
656
  argsman.AddArg("-acceptstalefeeestimates", strprintf("Read fee estimates even if they are stale (%sdefault: %u) fee estimates are considered stale if they are %s hours old", "regtest only; ", DEFAULT_ACCEPT_STALE_FEE_ESTIMATES, Ticks<std::chrono::hours>(MAX_FILE_AGE)), ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::DEBUG_TEST);
636
657
  argsman.AddArg("-bytespersigop", strprintf("Equivalent bytes per sigop in transactions for relay and mining (default: %u)", DEFAULT_BYTES_PER_SIGOP), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
658
+ argsman.AddArg("-bytespersigopstrict", strprintf("Minimum bytes per sigop in transactions we relay and mine (default: %u)", DEFAULT_BYTES_PER_SIGOP_STRICT), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
637
659
  argsman.AddArg("-datacarrier", strprintf("Relay and mine data carrier transactions (default: %u)", DEFAULT_ACCEPT_DATACARRIER), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
660
+ argsman.AddArg("-datacarriercost", strprintf("Treat data carrier bytes as at least N vbytes each (default: %s)", DEFAULT_WEIGHT_PER_DATA_BYTE / 4.0), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
638
661
  argsman.AddArg("-datacarriersize",
639
662
  strprintf("Relay and mine transactions whose data-carrying raw scriptPubKey "
640
663
  "is of this size or less (default: %u)",
641
664
  MAX_OP_RETURN_RELAY),
642
665
  ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
666
+ argsman.AddArg("-permitbaredatacarrier", strprintf("Relay data carrier outputs without OP_RETURN (default: %u)", DEFAULT_PERMITBAREDATACARRIER), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
667
+ argsman.AddArg("-acceptnonstddatacarrier", strprintf("Relay nonstandard data carrier outputs (default: %u)", DEFAULT_ACCEPT_NON_STD_DATACARRIER), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
668
+ argsman.AddArg("-permitephemeral", "Permit ephemeral policy exceptions: send, dust, and anchor", ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
669
+ argsman.AddArg("-subdustfeepenalty", strprintf("Apply the sub-dust fee penalty to relay policy (default: %u)", DEFAULT_SUBDUSTFEEPENALTY), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
670
+ argsman.AddArg("-maxscriptsize=<n>", strprintf("Maximum size of scripts (including the witness stack) we relay and mine (default: %s)", DEFAULT_SCRIPT_SIZE_POLICY_LIMIT), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
671
+ argsman.AddArg("-maxtxlegacysigops", strprintf("Maximum legacy sigops in transactions we relay and mine (default: %s)", MAX_TX_LEGACY_SIGOPS), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
672
+ argsman.AddArg("-mempoolreplacement", "Set RBF policy: 0 disables, fee,optin honors signaling, and fee,-optin enables full RBF (default: fee,-optin)", ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
673
+ argsman.AddArg("-mempooltruc", "Set TRUC policy: reject, accept, or enforce (default: enforce)", ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
674
+ argsman.AddArg("-minrelaycoinblocks=<n>", strprintf("Minimum coin blocks a transaction must spend to be relayed (default: %s)", DEFAULT_MINRELAYCOINBLOCKS), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
675
+ argsman.AddArg("-minrelaymaturity=<n>", strprintf("Minimum input maturity before relay (default: %s)", DEFAULT_MINRELAYMATURITY), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
643
676
  argsman.AddArg("-permitbaremultisig", strprintf("Relay transactions creating non-P2SH multisig outputs (default: %u)", DEFAULT_PERMIT_BAREMULTISIG), ArgsManager::ALLOW_ANY,
644
677
  OptionsCategory::NODE_RELAY);
678
+ argsman.AddArg("-spkreuse=<policy>", "Set script reuse policy: allow or conflict (default: allow)", ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
645
679
  argsman.AddArg("-minrelaytxfee=<amt>", strprintf("Fees (in %s/kvB) smaller than this are considered zero fee for relaying, mining and transaction creation (default: %s)",
646
680
  CURRENCY_UNIT, FormatMoney(DEFAULT_MIN_RELAY_TX_FEE)), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
647
681
  argsman.AddArg("-whitelistforcerelay", strprintf("Add 'forcerelay' permission to whitelisted peers with default permissions. This will relay transactions even if the transactions were already in the mempool. (default: %d)", DEFAULT_WHITELISTFORCERELAY), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
648
682
  argsman.AddArg("-whitelistrelay", strprintf("Add 'relay' permission to whitelisted peers with default permissions. This will accept relayed transactions even when not relaying transactions (default: %d)", DEFAULT_WHITELISTRELAY), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
649
683
 
650
684
 
685
+ argsman.AddArg("-blockmaxsize=<n>", strprintf("Set maximum block size in bytes (default: %d)", DEFAULT_BLOCK_MAX_SIZE), ArgsManager::ALLOW_ANY, OptionsCategory::BLOCK_CREATION);
651
686
  argsman.AddArg("-blockmaxweight=<n>", strprintf("Set maximum BIP141 block weight (default: %d)", DEFAULT_BLOCK_MAX_WEIGHT), ArgsManager::ALLOW_ANY, OptionsCategory::BLOCK_CREATION);
652
687
  argsman.AddArg("-blockreservedweight=<n>", strprintf("Reserve space for the fixed-size block header plus the largest coinbase transaction the mining software may add to the block. (default: %d).", DEFAULT_BLOCK_RESERVED_WEIGHT), ArgsManager::ALLOW_ANY, OptionsCategory::BLOCK_CREATION);
653
688
  argsman.AddArg("-blockmintxfee=<amt>", strprintf("Set lowest fee rate (in %s/kvB) for transactions to be included in block creation. (default: %s)", CURRENCY_UNIT, FormatMoney(DEFAULT_BLOCK_MIN_TX_FEE)), ArgsManager::ALLOW_ANY, OptionsCategory::BLOCK_CREATION);
689
+ argsman.AddArg("-blockprioritysize=<n>", strprintf("Set maximum size of high-priority/low-fee transactions in bytes (default: %d)", DEFAULT_BLOCK_PRIORITY_SIZE), ArgsManager::ALLOW_ANY, OptionsCategory::BLOCK_CREATION);
654
690
  argsman.AddArg("-blockversion=<n>", "Override block version to test forking scenarios", ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::BLOCK_CREATION);
655
691
 
656
692
  argsman.AddArg("-rest", strprintf("Accept public REST requests (default: %u)", DEFAULT_REST_ENABLE), ArgsManager::ALLOW_ANY, OptionsCategory::RPC);
@@ -953,6 +989,8 @@ bool AppInitParameterInteraction(const ArgsManager& args)
953
989
  // Signal NODE_P2P_V2 if BIP324 v2 transport is enabled.
954
990
  if (args.GetBoolArg("-v2transport", DEFAULT_V2_TRANSPORT)) {
955
991
  g_local_services = ServiceFlags(g_local_services | NODE_P2P_V2);
992
+ } else if (args.GetBoolArg("-v2onlyclearnet", false)) {
993
+ return InitError(_("Cannot set -v2onlyclearnet to true when v2transport is disabled."));
956
994
  }
957
995
 
958
996
  // Signal NODE_COMPACT_FILTERS if peerblockfilters and basic filters index are both enabled.
@@ -1045,6 +1083,13 @@ bool AppInitParameterInteraction(const ArgsManager& args)
1045
1083
  }
1046
1084
  }
1047
1085
 
1086
+ if (args.IsArgSet("-blockmaxsize")) {
1087
+ const auto max_block_size = args.GetIntArg("-blockmaxsize", DEFAULT_BLOCK_MAX_SIZE);
1088
+ if (max_block_size > MAX_BLOCK_SERIALIZED_SIZE) {
1089
+ return InitError(strprintf(_("Specified -blockmaxsize (%d) exceeds consensus maximum block size (%d)"), max_block_size, MAX_BLOCK_SERIALIZED_SIZE));
1090
+ }
1091
+ }
1092
+
1048
1093
  if (args.IsArgSet("-blockreservedweight")) {
1049
1094
  const auto block_reserved_weight = args.GetIntArg("-blockreservedweight", DEFAULT_BLOCK_RESERVED_WEIGHT);
1050
1095
  if (block_reserved_weight > MAX_BLOCK_WEIGHT) {
@@ -1055,7 +1100,12 @@ bool AppInitParameterInteraction(const ArgsManager& args)
1055
1100
  }
1056
1101
  }
1057
1102
 
1103
+ g_script_size_policy_limit = args.GetIntArg("-maxscriptsize", g_script_size_policy_limit);
1058
1104
  nBytesPerSigOp = args.GetIntArg("-bytespersigop", nBytesPerSigOp);
1105
+ nBytesPerSigOpStrict = args.GetIntArg("-bytespersigopstrict", nBytesPerSigOpStrict);
1106
+
1107
+ const std::string spk_reuse = args.GetArg("-spkreuse", DEFAULT_SPKREUSE);
1108
+ SpkReuseMode = (spk_reuse == "allow" || args.GetBoolArg("-spkreuse", false)) ? SRM_ALLOW : SRM_REJECT;
1059
1109
 
1060
1110
  if (!g_wallet_init_interface.ParameterInteraction()) return false;
1061
1111
 
@@ -1186,24 +1236,31 @@ bool CheckHostPortOptions(const ArgsManager& args) {
1186
1236
  }
1187
1237
  }
1188
1238
 
1189
- for ([[maybe_unused]] const auto& [arg, unix] : std::vector<std::pair<std::string, bool>>{
1190
- // arg name UNIX socket support
1191
- {"-i2psam", false},
1192
- {"-onion", true},
1193
- {"-proxy", true},
1194
- {"-rpcbind", false},
1195
- {"-torcontrol", false},
1196
- {"-whitebind", false},
1197
- {"-zmqpubhashblock", true},
1198
- {"-zmqpubhashtx", true},
1199
- {"-zmqpubrawblock", true},
1200
- {"-zmqpubrawtx", true},
1201
- {"-zmqpubsequence", true},
1239
+ if (auto parsed = args.GetFixedPointArg("-datacarriercost", 2)) {
1240
+ g_weight_per_data_byte = ((*parsed * WITNESS_SCALE_FACTOR) + 99) / 100;
1241
+ }
1242
+
1243
+ for ([[maybe_unused]] const auto& [arg, unix, suffix_allowed] : std::vector<std::tuple<std::string, bool, bool>>{
1244
+ // arg name UNIX socket support =suffix allowed
1245
+ {"-i2psam", false, false},
1246
+ {"-onion", true, false},
1247
+ {"-proxy", true, true},
1248
+ {"-bind", false, true},
1249
+ {"-rpcbind", false, false},
1250
+ {"-torcontrol", false, false},
1251
+ {"-whitebind", false, false},
1252
+ {"-zmqpubhashblock", true, false},
1253
+ {"-zmqpubhashtx", true, false},
1254
+ {"-zmqpubrawblock", true, false},
1255
+ {"-zmqpubrawtx", true, false},
1256
+ {"-zmqpubsequence", true, false},
1202
1257
  }) {
1203
1258
  for (const std::string& socket_addr : args.GetArgs(arg)) {
1259
+ const std::string param_value_hostport{
1260
+ suffix_allowed ? socket_addr.substr(0, socket_addr.rfind('=')) : socket_addr};
1204
1261
  std::string host_out;
1205
1262
  uint16_t port_out{0};
1206
- if (!SplitHostPort(socket_addr, port_out, host_out)) {
1263
+ if (!SplitHostPort(param_value_hostport, port_out, host_out)) {
1207
1264
  #ifdef HAVE_SOCKADDR_UN
1208
1265
  // Allow unix domain sockets for some options e.g. unix:/some/file/path
1209
1266
  if (!unix || !socket_addr.starts_with(ADDR_PREFIX_UNIX)) {
@@ -1578,30 +1635,64 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
1578
1635
  Proxy onion_proxy;
1579
1636
 
1580
1637
  bool proxyRandomize = args.GetBoolArg("-proxyrandomize", DEFAULT_PROXYRANDOMIZE);
1581
- // -proxy sets a proxy for all outgoing network traffic
1582
- // -noproxy (or -proxy=0) as well as the empty string can be used to not set a proxy, this is the default
1583
- std::string proxyArg = args.GetArg("-proxy", "");
1584
- if (proxyArg != "" && proxyArg != "0") {
1638
+ // -proxy sets a proxy for outgoing network traffic, possibly per network.
1639
+ // -noproxy, -proxy=0 or -proxy="" can be used to remove the proxy setting, this is the default.
1640
+ Proxy ipv4_proxy;
1641
+ Proxy ipv6_proxy;
1642
+ Proxy name_proxy;
1643
+ Proxy cjdns_proxy;
1644
+ for (const std::string& param_value : args.GetArgs("-proxy")) {
1645
+ const auto eq_pos{param_value.rfind('=')};
1646
+ const std::string proxyArg{param_value.substr(0, eq_pos)};
1647
+ std::string net_str;
1648
+ if (eq_pos != std::string::npos) {
1649
+ if (eq_pos + 1 == param_value.length()) {
1650
+ return InitError(strprintf(_("Invalid -proxy address or hostname, ends with '=': '%s'"), param_value));
1651
+ }
1652
+ net_str = ToLower(param_value.substr(eq_pos + 1));
1653
+ }
1654
+
1585
1655
  Proxy addrProxy;
1586
- if (IsUnixSocketPath(proxyArg)) {
1587
- addrProxy = Proxy(proxyArg, proxyRandomize);
1588
- } else {
1589
- const std::optional<CService> proxyAddr{Lookup(proxyArg, 9050, fNameLookup)};
1590
- if (!proxyAddr.has_value()) {
1656
+ if (!proxyArg.empty() && proxyArg != "0") {
1657
+ if (IsUnixSocketPath(proxyArg)) {
1658
+ addrProxy = Proxy(proxyArg, proxyRandomize);
1659
+ } else {
1660
+ const std::optional<CService> proxyAddr{Lookup(proxyArg, 9050, fNameLookup)};
1661
+ if (!proxyAddr.has_value()) {
1662
+ return InitError(strprintf(_("Invalid -proxy address or hostname: '%s'"), proxyArg));
1663
+ }
1664
+ addrProxy = Proxy(proxyAddr.value(), proxyRandomize);
1665
+ }
1666
+ if (!addrProxy.IsValid()) {
1591
1667
  return InitError(strprintf(_("Invalid -proxy address or hostname: '%s'"), proxyArg));
1592
1668
  }
1593
-
1594
- addrProxy = Proxy(proxyAddr.value(), proxyRandomize);
1595
1669
  }
1596
1670
 
1597
- if (!addrProxy.IsValid())
1598
- return InitError(strprintf(_("Invalid -proxy address or hostname: '%s'"), proxyArg));
1599
-
1600
- SetProxy(NET_IPV4, addrProxy);
1601
- SetProxy(NET_IPV6, addrProxy);
1602
- SetProxy(NET_CJDNS, addrProxy);
1603
- SetNameProxy(addrProxy);
1604
- onion_proxy = addrProxy;
1671
+ if (net_str.empty()) {
1672
+ ipv4_proxy = ipv6_proxy = name_proxy = cjdns_proxy = onion_proxy = addrProxy;
1673
+ } else if (net_str == "ipv4") {
1674
+ ipv4_proxy = name_proxy = addrProxy;
1675
+ } else if (net_str == "ipv6") {
1676
+ ipv6_proxy = name_proxy = addrProxy;
1677
+ } else if (net_str == "tor" || net_str == "onion") {
1678
+ onion_proxy = addrProxy;
1679
+ } else if (net_str == "cjdns") {
1680
+ cjdns_proxy = addrProxy;
1681
+ } else {
1682
+ return InitError(strprintf(_("Unrecognized network in -proxy='%s': '%s'"), param_value, net_str));
1683
+ }
1684
+ }
1685
+ if (ipv4_proxy.IsValid()) {
1686
+ SetProxy(NET_IPV4, ipv4_proxy);
1687
+ }
1688
+ if (ipv6_proxy.IsValid()) {
1689
+ SetProxy(NET_IPV6, ipv6_proxy);
1690
+ }
1691
+ if (name_proxy.IsValid()) {
1692
+ SetNameProxy(name_proxy);
1693
+ }
1694
+ if (cjdns_proxy.IsValid()) {
1695
+ SetProxy(NET_CJDNS, cjdns_proxy);
1605
1696
  }
1606
1697
 
1607
1698
  const bool onlynet_used_with_onion{!onlynets.empty() && g_reachable_nets.Contains(NET_ONION)};
@@ -1924,6 +2015,7 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
1924
2015
  connOptions.m_peer_connect_timeout = peer_connect_timeout;
1925
2016
  connOptions.whitelist_forcerelay = args.GetBoolArg("-whitelistforcerelay", DEFAULT_WHITELISTFORCERELAY);
1926
2017
  connOptions.whitelist_relay = args.GetBoolArg("-whitelistrelay", DEFAULT_WHITELISTRELAY);
2018
+ connOptions.disable_v1conn_clearnet = args.GetBoolArg("-v2onlyclearnet", false);
1927
2019
 
1928
2020
  // Port to bind to if `-bind=addr` is provided without a `:port` suffix.
1929
2021
  const uint16_t default_bind_port =
@@ -1965,10 +2057,12 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
1965
2057
  return InitError(ResolveErrMsg("bind", bind_arg));
1966
2058
  }
1967
2059
 
2060
+ NetPermissionFlags all_permission_flags{NetPermissionFlags::None};
1968
2061
  for (const std::string& strBind : args.GetArgs("-whitebind")) {
1969
2062
  NetWhitebindPermissions whitebind;
1970
2063
  bilingual_str error;
1971
2064
  if (!NetWhitebindPermissions::TryParse(strBind, whitebind, error)) return InitError(error);
2065
+ NetPermissions::AddFlag(all_permission_flags, whitebind.m_flags);
1972
2066
  connOptions.vWhiteBinds.push_back(whitebind);
1973
2067
  }
1974
2068
 
@@ -1985,17 +2079,31 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
1985
2079
  }
1986
2080
  }
1987
2081
 
2082
+ connOptions.listenonion = args.GetBoolArg("-listenonion", DEFAULT_LISTEN_ONION);
2083
+
1988
2084
  CService onion_service_target;
1989
2085
  if (!connOptions.onion_binds.empty()) {
1990
2086
  onion_service_target = connOptions.onion_binds.front();
1991
2087
  } else if (!connOptions.vBinds.empty()) {
1992
2088
  onion_service_target = connOptions.vBinds.front();
2089
+ if (connOptions.listenonion) {
2090
+ std::string alternate_connections{"clearnet"}, only_from_localhost;
2091
+ if (onion_service_target.IsBindAny()) {
2092
+ only_from_localhost = " from localhost";
2093
+ } else if (onion_service_target.IsLocal()) {
2094
+ alternate_connections = "local";
2095
+ }
2096
+ InitWarning(strprintf(_("You are using a common listening port (%s) for both Tor and %s connections. All connections to this port%s will be assumed to be Tor connections, and will be denied any whitelist permissions. If this is not your intent, setup a separate -bind=<addr>[:<port>]=onion configuration, or set -listenonion=0."),
2097
+ onion_service_target.ToStringAddrPort(),
2098
+ alternate_connections,
2099
+ only_from_localhost));
2100
+ }
1993
2101
  } else {
1994
2102
  onion_service_target = DefaultOnionServiceTarget(default_bind_port_onion);
1995
2103
  connOptions.onion_binds.push_back(onion_service_target);
1996
2104
  }
1997
2105
 
1998
- if (args.GetBoolArg("-listenonion", DEFAULT_LISTEN_ONION)) {
2106
+ if (connOptions.listenonion) {
1999
2107
  if (connOptions.onion_binds.size() > 1) {
2000
2108
  InitWarning(strprintf(_("More than one onion bind address is provided. Using %s "
2001
2109
  "for the automatically created Tor onion service."),
@@ -2010,11 +2118,18 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
2010
2118
  Discover();
2011
2119
  }
2012
2120
 
2013
- for (const auto& net : args.GetArgs("-whitelist")) {
2121
+ std::vector<std::string> whitelist_opts = args.GetArgs("-whitelist");
2122
+ if ((g_local_services & NODE_BLOOM) != NODE_BLOOM && args.GetBoolArg("-peerbloomfilters", true)) {
2123
+ // If peerbloomfilters isn't specified, enable it only for localhost by default.
2124
+ whitelist_opts.emplace_back("in,out,bloomfilter@127.0.0.0/8");
2125
+ whitelist_opts.emplace_back("in,out,bloomfilter@[::1]/128");
2126
+ }
2127
+ for (const auto& net : whitelist_opts) {
2014
2128
  NetWhitelistPermissions subnet;
2015
2129
  ConnectionDirection connection_direction;
2016
2130
  bilingual_str error;
2017
2131
  if (!NetWhitelistPermissions::TryParse(net, subnet, connection_direction, error)) return InitError(error);
2132
+ NetPermissions::AddFlag(all_permission_flags, subnet.m_flags);
2018
2133
  if (connection_direction & ConnectionDirection::In) {
2019
2134
  connOptions.vWhitelistedRangeIncoming.push_back(subnet);
2020
2135
  }
@@ -2023,6 +2138,11 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
2023
2138
  }
2024
2139
  }
2025
2140
 
2141
+ if (NetPermissions::HasFlag(all_permission_flags, NetPermissionFlags::BlockFilters_Explicit) &&
2142
+ g_enabled_filter_types.count(BlockFilterType::BASIC) != 1) {
2143
+ return InitError(_("Cannot grant blockfilters permission without -blockfilterindex."));
2144
+ }
2145
+
2026
2146
  connOptions.vSeedNodes = args.GetArgs("-seednode");
2027
2147
 
2028
2148
  const auto connect = args.GetArgs("-connect");