#36675 bugfix: send shortened IPv6 addresses to SOCKS5 proxies in full

Expands compressed IPv6 addresses into full eight-group notation when sending destination hostnames in SOCKS5 CONNECT requests. This works around an upstream Tor issue where relay exit nodes mistakenly parse `<name>:<port>` as a single IPv6 address if `::` absorbs the port as an eighth group, dropping the connection.

Problem: Outbound connections routed through Tor SOCKS5 proxies fail with "general failure" for IPv6 peers whose addresses contain an inner `::`. Tor exit relays attempt to parse `<name>:<port>` as an address, causing the compressed address to absorb the port number and fail port extraction, dropping roughly 20% of IPv6 peers in addrman and ~29% of DNS seed IPv6 answers.

Evidence of importance:

• Author references upstream Tor issue https://gitlab.torproject.org/tpo/core/tor/-/issues/32314: Tor exit's `tor_addr_port_split` parses `2001:db8::1:8333` as a valid IPv6 address without a port and terminates the stream.
• Author measurement: "About 20% of the IPv6 addresses in a gossip-filled addrman, and 29% of current IPv6 DNS seed answers, have an inner `::`."
• Author test against Tor 0.4.9.13 on mainnet: master failed to connect to four seed-provided peers with inner-`::` addresses (30 "general failure" errors), whereas this change allowed all four to connect and complete the version handshake.

Risk of a mistake: low (p2p). A formatting error in SOCKS5 destination names could fail outbound connections over SOCKS5 proxies.

Changed since the previous assessment: Initial description with diff.

Ready

Nothing known that would invalidate a review now.

Waiting on (from the thread read):

• reviewer: code review and testing 2026-10-27

Positive

support without stated reasons, no open objection (darosior)

Thread notes: Initial record: darosior suggested upstreaming the Tor bug report, which instagibbs confirmed was already known and closed upstream, after which darosior Concept ACKed. / Initial record. darosior suggested reporting the issue upstream to Tor, which instagibbs pointed out was already reported and closed; darosior then Concept ACKed.

Objections, suggestions, and questions:

Support:

• darosior (member) (Concept ACK, 2026-10-27): (no reason given) [not substantive]

Participants:

• darosior (member, support, 2 statements 2026-10-27 to 2026-10-27): supported workaround with Concept ACK after checking upstream Tor status

52 lines under test/bench/ci.

• src/test/netbase_tests.cpp +40/-0
• src/netbase.cpp +28/-3
• test/functional/feature_proxy.py +12/-0

The short text the ranking pass compares across PRs.

Expands shortened IPv6 addresses into full eight-group notation when passing them to SOCKS5 proxies. Nodes using Tor as an outbound proxy fail to connect to IPv6 peers whose addresses contain an inner `::` because Tor exit relays mistake the appended port for an eighth address group and close the stream. This bug prevents connection to an estimated 20% to 30% of reachable IPv6 peers on mainnet. Author verified against Tor 0.4.9.13 that connections failing on master connect and handshake with this change.

P2 · bug fix (ranking pass: A concrete connectivity failure against 20-30% of IPv6 peers via Tor outranks the opt-in features later in the band.)

Fixes outbound connection failures over Tor SOCKS5 proxies to IPv6 peers with compressed addresses. As measured by the author, roughly 20% of addrman IPv6 addresses and 29% of DNS seed answers have an inner `::`, which previously caused Tor exit nodes to drop connections with general failure errors.

Membership: Touches `src/netbase.cpp` handling proxy connections and SOCKS5 destination address formatting for Tor outbound peer connectivity.

Factors: security/stability 1, bug 2, performance 0, user value 2, leverage 0