Connections and transport

2751                    // We currently don't take inbound connections into account. Since they are
2752                    // free to make, an attacker could make them to prevent us from connecting to
2753                    // certain peers.
2754                    case ConnectionType::INBOUND:
2755                    // Short-lived outbound connections should not affect how we select outbound
2756                    // peers from addrman.
2757                    case ConnectionType::ADDR_FETCH:
2758                    case ConnectionType::FEELER:
2759                    case ConnectionType::PRIVATE_BROADCAST:
2760                        break;
2761                    case ConnectionType::MANUAL:
2762                    case ConnectionType::OUTBOUND_FULL_RELAY:
2763                    case ConnectionType::BLOCK_RELAY:
2764                        const CAddress address{pnode->addr};
2765                        if (address.IsTor() || address.IsI2P() || address.IsCJDNS()) {
2766                            // Since our addrman-groups for these networks are
2767                            // random, without relation to the route we
2768                            // take to connect to these peers or to the
2769                            // difficulty in obtaining addresses with diverse
2770                            // groups, we don't worry about diversity with
2771                            // respect to our addrman groups when connecting to
2772                            // these networks.
2773                            ++outbound_privacy_network_peers;
2774                        } else {
2775                            outbound_ipv46_peer_netgroups.insert(m_netgroupman.GetGroup(address));
2776                        }
2777                } // no default case, so the compiler can warn about missing cases
2778            }
2779        }
2780
2781        if (!seed_nodes.empty() && nOutboundFullRelay < SEED_OUTBOUND_CONNECTION_THRESHOLD) {
2782            if (NodeClock::now() > seed_node_timer + ADD_NEXT_SEEDNODE) {
2783                seed_node_timer = NodeClock::now();
2784                add_addr_fetch = true;
2785            }
2786        }
2787
2788        ConnectionType conn_type = ConnectionType::OUTBOUND_FULL_RELAY;
2789        auto now = GetTime<std::chrono::microseconds>();
2790        bool anchor = false;
2791        bool fFeeler = false;
2792        std::optional<Network> preferred_net;
2793
2794        // Determine what type of connection to open. Opening
2795        // BLOCK_RELAY connections to addresses from anchors.dat gets the highest
2796        // priority. Then we open OUTBOUND_FULL_RELAY priority until we
2797        // meet our full-relay capacity. Then we open BLOCK_RELAY connection
2798        // until we hit our block-relay-only peer limit.
2799        // GetTryNewOutboundPeer() gets set when a stale tip is detected, so we
2800        // try opening an additional OUTBOUND_FULL_RELAY connection. If none of
2801        // these conditions are met, check to see if it's time to try an extra
2802        // block-relay-only peer (to confirm our tip is current, see below) or the next_feeler
2803        // timer to decide if we should open a FEELER.
2804
2805        if (!m_anchors.empty() && (nOutboundBlockRelay < m_max_outbound_block_relay)) {
2806            conn_type = ConnectionType::BLOCK_RELAY;
2807            anchor = true;
2808        } else if (nOutboundFullRelay < m_max_outbound_full_relay) {
2809            // OUTBOUND_FULL_RELAY
2810        } else if (nOutboundBlockRelay < m_max_outbound_block_relay) {
2811            conn_type = ConnectionType::BLOCK_RELAY;
2812        } else if (GetTryNewOutboundPeer()) {
2813            // OUTBOUND_FULL_RELAY
2814        } else if (now > next_extra_block_relay && m_start_extra_block_relay_peers) {
2815            // Periodically connect to a peer (using regular outbound selection
2816            // methodology from addrman) and stay connected long enough to sync
2817            // headers, but not much else.
2818            //
2819            // Then disconnect the peer, if we haven't learned anything new.
2820            //
2821            // The idea is to make eclipse attacks very difficult to pull off,
2822            // because every few minutes we're finding a new peer to learn headers
2823            // from.
2824            //
2825            // This is similar to the logic for trying extra outbound (full-relay)
2826            // peers, except:
2827            // - we do this all the time on an exponential timer, rather than just when
2828            //   our tip is stale
2829            // - we potentially disconnect our next-youngest block-relay-only peer, if our
2830            //   newest block-relay-only peer delivers a block more recently.
2831            //   See the eviction logic in net_processing.cpp.
2832            //
2833            // Because we can promote these connections to block-relay-only
2834            // connections, they do not get their own ConnectionType enum
2835            // (similar to how we deal with extra outbound peers).
2836            next_extra_block_relay = now + rng.rand_exp_duration(EXTRA_BLOCK_RELAY_ONLY_PEER_INTERVAL);
2837            conn_type = ConnectionType::BLOCK_RELAY;
2838        } else if (now > next_feeler) {
2839            next_feeler = now + rng.rand_exp_duration(FEELER_INTERVAL);
2840            conn_type = ConnectionType::FEELER;
2841            fFeeler = true;
2842        } else if (nOutboundFullRelay == m_max_outbound_full_relay &&
2843                   m_max_outbound_full_relay == MAX_OUTBOUND_FULL_RELAY_CONNECTIONS &&
2844                   now > next_extra_network_peer &&
2845                   MaybePickPreferredNetwork(preferred_net)) {
2846            // Full outbound connection management: Attempt to get at least one
2847            // outbound peer from each reachable network by making extra connections
2848            // and then protecting "only" peers from a network during outbound eviction.
2849            // This is not attempted if the user changed -maxconnections to a value
2850            // so low that less than MAX_OUTBOUND_FULL_RELAY_CONNECTIONS are made,
2851            // to prevent interactions with otherwise protected outbound peers.
2852            next_extra_network_peer = now + rng.rand_exp_duration(EXTRA_NETWORK_PEER_INTERVAL);
2853        } else {
2854            // skip to next iteration of while loop
2855            continue;
2856        }
2857
2858        addrman.get().ResolveCollisions();
2859
2860        const auto current_time{NodeClock::now()};
2861        int nTries = 0;
2862        const auto reachable_nets{g_reachable_nets.All()};
2863
2864        while (!m_interrupt_net->interrupted()) {
2865            if (anchor && !m_anchors.empty()) {
2866                const CAddress addr = m_anchors.back();
2867                m_anchors.pop_back();
2868                if (!addr.IsValid() || IsLocal(addr) || !g_reachable_nets.Contains(addr) ||
2869                    !m_msgproc->HasAllDesirableServiceFlags(addr.nServices) ||
2870                    outbound_ipv46_peer_netgroups.contains(m_netgroupman.GetGroup(addr))) continue;
2871                addrConnect = addr;
2872                LogDebug(BCLog::NET, "Trying to make an anchor connection to %s\n", addrConnect.ToStringAddrPort());
2873                break;
2874            }
2875
2876            // If we didn't find an appropriate destination after trying 100 addresses fetched from addrman,
2877            // stop this loop, and let the outer loop run again (which sleeps, adds seed nodes, recalculates
2878            // already-connected network ranges, ...) before trying new addrman addresses.
2879            nTries++;
2880            if (nTries > 100)
2881                break;
2882
2883            CAddress addr;
2884            NodeSeconds addr_last_try{0s};
2885
2886            if (fFeeler) {
2887                // First, try to get a tried table collision address. This returns
2888                // an empty (invalid) address if there are no collisions to try.
2889                std::tie(addr, addr_last_try) = addrman.get().SelectTriedCollision();
2890
2891                if (!addr.IsValid()) {
2892                    // No tried table collisions. Select a new table address
2893                    // for our feeler.
2894                    std::tie(addr, addr_last_try) = addrman.get().Select(true, reachable_nets);
2895                } else if (AlreadyConnectedToAddress(addr)) {
2896                    // If test-before-evict logic would have us connect to a
2897                    // peer that we're already connected to, just mark that
2898                    // address as Good(). We won't be able to initiate the
2899                    // connection anyway, so this avoids inadvertently evicting
2900                    // a currently-connected peer.
2901                    addrman.get().Good(addr);
2902                    // Select a new table address for our feeler instead.
2903                    std::tie(addr, addr_last_try) = addrman.get().Select(true, reachable_nets);
2904                }
2905            } else {
2906                // Not a feeler
2907                // If preferred_net has a value set, pick an extra outbound
2908                // peer from that network. The eviction logic in net_processing
2909                // ensures that a peer from another network will be evicted.
2910                std::tie(addr, addr_last_try) = preferred_net.has_value()
2911                    ? addrman.get().Select(false, {*preferred_net})
2912                    : addrman.get().Select(false, reachable_nets);
2913            }
2914
2915            // Require outbound IPv4/IPv6 connections, other than feelers, to be to distinct network groups
2916            if (!fFeeler && outbound_ipv46_peer_netgroups.contains(m_netgroupman.GetGroup(addr))) {
2917                continue;
2918            }
2919
2920            // if we selected an invalid or local address, restart
2921            if (!addr.IsValid() || IsLocal(addr)) {
2922                break;
2923            }
2924
2925            if (!g_reachable_nets.Contains(addr)) {
2926                continue;
2927            }
2928
2929            // only consider very recently tried nodes after 30 failed attempts
2930            if (current_time - addr_last_try < 10min && nTries < 30) {
2931                continue;
2932            }
2933
2934            // for non-feelers, require all the services we'll want,
2935            // for feelers, only require they be a full node (only because most
2936            // SPV clients don't have a good address DB available)
2937            if (!fFeeler && !m_msgproc->HasAllDesirableServiceFlags(addr.nServices)) {
2938                continue;
2939            } else if (fFeeler && !MayHaveUsefulAddressDB(addr.nServices)) {
2940                continue;
2941            }
2942
2943            // Do not connect to bad ports, unless 50 invalid addresses have been selected already.
2944            if (nTries < 50 && (addr.IsIPv4() || addr.IsIPv6()) && IsBadPort(addr.GetPort())) {
2945                continue;
2946            }
2947
2948            // Do not make automatic outbound connections to addnode peers, to
2949            // not use our limited outbound slots for them and to ensure
2950            // addnode connections benefit from their intended protections.
2951            if (AddedNodesContain(addr)) {
2952                LogDebug(BCLog::NET, "Not making automatic %s%s connection to %s peer selected for manual (addnode) connection%s\n",
2953                              preferred_net.has_value() ? "network-specific " : "",
2954                              ConnectionTypeAsString(conn_type), GetNetworkName(addr.GetNetwork()),
2955                              fLogIPs ? strprintf(": %s", addr.ToStringAddrPort()) : "");
2956                continue;
2957            }
2958
2959            addrConnect = addr;
2960            break;
2961        }
2962
2963        if (addrConnect.IsValid()) {
2964            if (fFeeler) {
2965                // Add small amount of random noise before connection to avoid synchronization.
2966                if (!m_interrupt_net->sleep_for(rng.rand_uniform_duration<CThreadInterrupt::Clock>(FEELER_SLEEP_WINDOW))) {
2967                    return;
2968                }
2969                LogDebug(BCLog::NET, "Making feeler connection to %s\n", addrConnect.ToStringAddrPort());
2970            }
2971
2972            if (preferred_net != std::nullopt) LogDebug(BCLog::NET, "Making network specific connection to %s on %s.\n", addrConnect.ToStringAddrPort(), GetNetworkName(preferred_net.value()));
2973
2974            // Record addrman failure attempts when node has at least 2 persistent outbound connections to peers with
2975            // different netgroups in ipv4/ipv6 networks + all peers in Tor/I2P/CJDNS networks.
2976            // Don't record addrman failure attempts when node is offline. This can be identified since all local
2977            // network connections (if any) belong in the same netgroup, and the size of `outbound_ipv46_peer_netgroups` would only be 1.
2978            const bool count_failures{((int)outbound_ipv46_peer_netgroups.size() + outbound_privacy_network_peers) >= std::min(m_max_automatic_connections - 1, 2)};
2979            // Use BIP324 transport when both us and them have NODE_V2_P2P set.
2980            const bool use_v2transport(addrConnect.nServices & GetLocalServices() & NODE_P2P_V2);
2981            OpenNetworkConnection(/*addrConnect=*/addrConnect,
2982                                  /*fCountFailure=*/count_failures,
2983                                  /*grant_outbound=*/std::move(grant),
2984                                  /*pszDest=*/nullptr,
2985                                  /*conn_type=*/conn_type,
2986                                  /*use_v2transport=*/use_v2transport,
2987                                  /*proxy_override=*/std::nullopt);
2988        }
2989    }
2990}
2991
2992std::vector<CAddress> CConnman::GetCurrentBlockRelayOnlyConns() const
2993{
2994    AssertLockNotHeld(m_nodes_mutex);
2995    std::vector<CAddress> ret;
2996    LOCK(m_nodes_mutex);
2997    for (const CNode* pnode : m_nodes) {
2998        if (pnode->IsBlockOnlyConn()) {
2999            ret.push_back(pnode->addr);
3000        }