{ "number": 36675, "repo": "bitcoin/bitcoin", "url": "https://github.com/bitcoin/bitcoin/pull/36675", "title": "bugfix: send shortened IPv6 addresses to SOCKS5 proxies in full", "author": "instagibbs", "author_association": "MEMBER", "created_at": "2026-10-27T14:30:52Z", "updated_at": "2026-10-27T18:11:43Z", "description_hash": "78d600984172cf92", "age_days": 5, "draft": false, "labels": [], "milestone": null, "base": "master", "head_sha": "721e2f5051142c2194838dd06fe0a86a07621c14", "head_ref": "2026-10-socks5-ipv6-expand", "head_repo": "instagibbs/bitcoin", "head_history": [ { "t": "2026-10-27T14:52:59Z", "sha": "721e2f5051142c2194838dd06fe0a86a07621c14" } ], "additions": 80, "deletions": 3, "changed_files": 3, "commit_count": 1, "size_bucket": "S", "mergeable_state": "clean", "bot": { "drahtbot": { "present": true, "reviews": { "concept_ack": [ { "login": "darosior", "url": "https://github.com/bitcoin/bitcoin/pull/36675#issuecomment-6445417783" } ] }, "conflicts": [] } }, "acks_parsed": { "darosior": { "kind": "concept_ack", "hash": null, "t": "2026-10-27T15:01:35Z", "stale": false } }, "acks_tally": { "ack": 0, "stale_ack": 0, "concept_ack": 1, "approach_ack": 0, "nack": 0, "concept_nack": 0, "approach_nack": 0 }, "reviews": { "approved": 0, "changes_requested": 0, "distinct_reviewers": [ "darosior" ] }, "signals": { "needs_rebase": false, "ci_failed": false, "mergeable_state": "clean", "last_author_activity": "2026-10-27T14:58:18Z", "last_reviewer_activity": "2026-10-27T15:01:35Z", "last_reviewer": "darosior", "author_silent_days": 5, "waiting_on_author_days": 5, "days_since_update": 5 }, "refs": { "mentioned": [ 36628 ], "depends_on": [], "fixes": [], "linked_issues": [], "references": [ { "number": 36628, "type": "pull", "state": "open", "merged": false, "merged_at": null, "title": "net: reimplement private broadcast as jobs isolated from the node" } ], "conflicts": [] }, "stack": { "shares_commits_with": [], "based_on": [], "base_for": [] }, "review_paths": [], "body": "Found while auditing #36628\n\nAlready known upstream issue with C-tor: https://gitlab.torproject.org/tpo/core/tor/-/issues/32314\n\nWith `-proxy` pointed at Tor, outbound connections to IPv6 peers whose\n address contains an inner `::` always fail with \"general failure\".\n\n Core sends every SOCKS5 destination as a DOMAINNAME, with IPv6 in its\n compressed form. Tor copies the name into its relay BEGIN cell as\n `:`, and the exit's `tor_addr_port_split` first tries to parse\n the whole string as an IPv6 address. `2001:db8::1:8333` is a valid one,\n because the `::` absorbs the port as an eighth group. The exit then sees no\n port and closes the stream. Addresses written with all eight groups, or\n ending in `::`, are unaffected: appending `:port` to them does not give a\n valid address.\n\n About 20% of the IPv6 addresses in a gossip-filled addrman, and 29% of\n current IPv6 DNS seed answers, have an inner `::`. The failure is closed;\n there is no fallback to a direct connection.\n\n Note that this also effects private broadcast by default.\n\n This PR sends such addresses with all eight groups written out\n (`2001:db8:0:0:0:0:0:1`). `:` then has nine groups, so the exit\n splits at the last colon. Other forms:\n\n | Form | Tor | Tor, SafeSocks 1 | getaddrinfo-based proxies |\n |-----------------------|-------------|------------------|---------------------------|\n | `2001:db8::1` (today) | fails | fails | works |\n | `[2001:db8::1]` | works | works | fails |\n | ATYP IPv6 | works, logs a DNS-leak warning | refused | works |\n | eight groups (this PR)| works | works | works |\n\n Tested against tor 0.4.9.13: on mainnet, master could not reach four\n seed-provided peers with inner-`::` addresses (30 \"general failure\"); with\n this change all four connected and completed the version handshake.\n `feature_proxy.py` and a new `netbase_tests` case check the bytes sent.", "commits": [ { "sha": "721e2f5051142c2194838dd06fe0a86a07621c14", "date": "2026-10-27T14:50:41Z", "message": "netbase: send shortened IPv6 addresses to SOCKS5 proxies in full\n\nTor copies a SOCKS5 DOMAINNAME into its relay BEGIN cell as\n\":\", and an exit parses \"2001:db8::1:8333\" as an IPv6\naddress with no port and closes the stream. Outbound connections\nthrough a Tor -proxy to IPv6 addresses that contain \"::\" therefore fail\nwith \"general failure\". About a third of the IPv6 addresses the DNS\nseeds return have this form.\n\nWrite such addresses with all eight groups. \":\" is then not\nan IPv6 address, so the exit splits it at the last colon, and the name\nis still an address to proxies that resolve it with getaddrinfo, which\nbrackets would break." } ], "timeline": [ { "t": "2026-10-27T14:46:30Z", "kind": "review", "who": "darosior", "assoc": "MEMBER", "state": "COMMENTED", "commit": "592d2779d4459ec57a16a862e31e55334852d0d6", "text": "Workaround seems fine to do. But it's surprising the Tor daemon does not follow [its own spec](https://torspec-b24541.pages.torproject.net/tor-spec/opening-streams.html) and format the IPv6 with brackets.\n\nEDIT: had bot lookup the Tor sources and even the [latest version still formats](https://tpo.pages.torproject.net/core/doc/tor/connection__edge_8c_source.html#l03448) IPv6:port ambiguously, contrary to the spec. Arti [does implement](https://tpo.pages.torproject.net/core/doc/rust/private/src/tor_cell/relaycell/msg.rs.html#285) the spec correctly. May be worth upstreaming a bug report.", "id": "r:5669053406", "url": "https://github.com/bitcoin/bitcoin/pull/36675#pullrequestreview-5669053406", "hash": "eaba88906fd1481c", "edited": "2026-10-27T14:55:28Z" }, { "t": "2026-10-27T14:52:59Z", "kind": "force_push", "who": "instagibbs", "commit": "721e2f5051142c2194838dd06fe0a86a07621c14", "id": "push:721e2f5051142c2194838dd06fe0a86a07621c14" }, { "t": "2026-10-27T14:58:18Z", "kind": "comment", "who": "instagibbs", "assoc": "MEMBER", "text": "@darosior https://gitlab.torproject.org/tpo/core/tor/-/issues/32314 already known and closed. \"Just use Arti\"", "id": "c:6445339269", "url": "https://github.com/bitcoin/bitcoin/pull/36675#issuecomment-6445339269", "hash": "f65f414857232120", "edited": null }, { "t": "2026-10-27T15:01:35Z", "kind": "comment", "who": "darosior", "assoc": "MEMBER", "text": "Concept ACK", "id": "c:6445417783", "url": "https://github.com/bitcoin/bitcoin/pull/36675#issuecomment-6445417783", "hash": "e8334cc43879b73c", "edited": null } ], "labels_log": [ { "t": "2026-10-27T14:53:54Z", "action": "labeled", "label": "CI failed", "who": "DrahtBot" }, { "t": "2026-10-27T15:58:13Z", "action": "unlabeled", "label": "CI failed", "who": "DrahtBot" } ], "state_log": [ { "t": "2026-10-27T18:11:43Z", "kind": "renamed", "who": "instagibbs", "from": "netbase: send shortened IPv6 addresses to SOCKS5 proxies in full", "to": "bugfix: send shortened IPv6 addresses to SOCKS5 proxies in full" } ], "text_chars": 3491, "text_tokens_estimate": 872, "changed_paths": [ "src/netbase.cpp", "src/test/netbase_tests.cpp", "test/functional/feature_proxy.py" ], "files": [ { "path": "src/netbase.cpp", "add": 28, "del": 3 }, { "path": "src/test/netbase_tests.cpp", "add": 40, "del": 0 }, { "path": "test/functional/feature_proxy.py", "add": 12, "del": 0 } ], "test_lines": 52, "git": { "head": "721e2f5051142c2194838dd06fe0a86a07621c14", "head_matches_backup": true, "base": "2b5b6fe231ff45a09d9e24411e4420d51ed45cab", "patch_id": "4958209a1dd41614", "commits": [ { "sha": "721e2f5051", "subject": "netbase: send shortened IPv6 addresses to SOCKS5 proxies in full", "files": 3, "add": 80, "del": 3 } ], "patch_truncated": false }, "patch_id": "4958209a1dd41614", "input_hash": "253c06bdb97439ed", "extracted_at": "2026-11-02T01:09:49+00:00" }