#35578 net: don’t self advertise tor exit node ip addresses in outbound connections

• Prevent nodes using proxies or Tor from self-advertising unreachable exit node IPs on outbound connections
• Stops network-wide address table pollution and reduces wasted failed connection attempts across the network

This pull request prevents nodes from self-advertising proxy IP addresses (such as Tor exit nodes) on outbound connections. In `GetLocalAddrForPeer`, the node now avoids replacing its known local address with the address reported by an outbound peer whenever a proxy is configured for that network. It also adds unit test coverage, a documentation fix for Tor configuration parameters, and a release note.

Problem: When a node establishes outbound connections via a SOCKS5 proxy such as Tor, outbound peers report seeing the proxy exit IP rather than the node's true reachable address. If discovery is active, the node can gossip this unreachable proxy address across the network, leading to significant addrman pollution where up to three quarters of all Tor exit nodes appear in network address tables and trigger failed connection attempts.

P3 · bug fix

• P3 because it fixes address table pollution that causes peers to repeatedly attempt doomed connections
• Reduces widespread network waste where up to three quarters of all Tor exit nodes fill address tables

Self-advertising unreachable exit addresses pollutes peer address managers across the network, causing nodes to repeatedly attempt doomed outbound connections. Author and reviewer telemetry confirmed high prevalence of Tor exit nodes in addrman snapshots, making this a worthwhile hygiene and bug fix.

Membership: Modifies peer address self-advertisement logic in src/net.cpp and network address options in src/netbase.

Factors: security/stability 1, bug 2, performance 1, user value 1, leverage 0

• Ready to review with clean tests and mergeability, and all earlier feedback addressed

The PR has passing tests, clean mergeability, and the author addressed all reviewer feedback in the latest push.

Author status: active

Resolved concerns:

• Clarified parameter interaction where discover=1 or listen=1 overrides soft-set defaults
• Acknowledged that transparent torification (e.g. Whonix) will not be prevented by this change
• Added inline comments and test coverage using a newly added ResetProxy test helper
• Added release note warning operators of reachable proxies that -externalip is now required to advertise them

• Broad agreement that gossiping unreachable proxy exit IPs is harmful
• Concept approval supported by data showing frequent failed connections to exit nodes (0xB10C)
• Concept approval after verifying behavior locally and contributing test code (naiyoma)
• Concept approval noting that transparent torification will remain unaffected (mzumsande)

Multiple Concept ACKs with empirical data supporting the problem, and all review suggestions implemented.

Reviewers agreed that self-announcing unreachable proxy exit IPs is detrimental. 0xB10C provided empirical connection failure metrics, and naiyoma tested the behavior and proposed test cases that were integrated.

• 0xB10C Concept ACKed and noted that nodes make 7.5 to 12.5 failed connection attempts daily to exit nodes
• naiyoma Concept ACKed, verified behavior locally, and provided test code
• mzumsande Concept ACKed and noted limitations around transparent torification

Review verdicts (DrahtBot): 0

• Concept ACK: 0xB10C, naiyoma, mzumsande

29 lines under test/bench/ci.

• src/test/net_tests.cpp +29/-0
• doc/release-notes-35578.md +10/-0
• src/netbase.cpp +7/-0
• doc/tor.md +2/-2
• src/net.cpp +2/-1
• src/init.cpp +1/-1
• src/netbase.h +2/-0

PR 35578 prevents nodes connecting over a proxy (such as Tor) from self-advertising the proxy's IP address on outbound connections. This stops nodes from gossiping unreachable Tor exit node IPs into global address managers, saving peers from making repeated failed connection attempts. Telemetry from reviewers shows nodes currently attempt multiple connections to dead exit IPs per day. The PR has strong support from several reviewers and includes unit tests and release notes.