251        if (node.IsInboundConn()) {
252            // For inbound connections, assume both the address and the port
253            // as seen from the peer.
254            addrLocal = CService{node.GetAddrLocal()};
255        } else {
256            // For outbound connections, assume just the address as seen from
257            // the peer and leave the port in `addrLocal` as returned by
258            // `GetLocalAddress()` above. The peer has no way to observe our
259            // listening port when we have initiated the connection.
260            addrLocal.SetIP(node.GetAddrLocal());
261        }
262    }
263    if (addrLocal.IsRoutable()) {
264        LogDebug(BCLog::NET, "Advertising address %s to peer=%d\n", addrLocal.ToStringAddrPort(), node.GetId());
265        return addrLocal;
266    }
267    // Address is unroutable. Don't advertise.
268    return std::nullopt;
269}
270
271void ClearLocal()
272{
273    LOCK(g_maplocalhost_mutex);
274    return mapLocalHost.clear();
275}
276
277// learn a new local address
278bool AddLocal(const CService& addr_, int nScore, bool add_even_if_unreachable)
279{
280    CService addr{MaybeFlipIPv6toCJDNS(addr_)};
281
282    if (!addr.IsRoutable())
283        return false;
284
285    if (!fDiscover && nScore < LOCAL_MANUAL)
286        return false;
287
288    if (!g_reachable_nets.Contains(addr) && !add_even_if_unreachable)
289        return false;
290
291    if (fLogIPs) {
292        LogInfo("AddLocal(%s,%i)\n", addr.ToStringAddrPort(), nScore);
293    }
294
295    {
296        LOCK(g_maplocalhost_mutex);
297        const auto [it, is_newly_added] = mapLocalHost.emplace(addr, LocalServiceInfo());
298        LocalServiceInfo &info = it->second;
299        if (is_newly_added || nScore >= info.nScore) {
300            info.nScore = SaturatingAdd(nScore, is_newly_added ? 0 : 1);
301            info.nPort = addr.GetPort();
302        }
303    }
304
305    return true;
306}
307
308bool AddLocal(const CNetAddr& addr, int nScore, bool add_even_if_unreachable)
309{
310    return AddLocal(CService(addr, GetListenPort()), nScore, add_even_if_unreachable);
311}
312
313void RemoveLocal(const CService& addr)
314{
315    LOCK(g_maplocalhost_mutex);
316    if (fLogIPs) {
317        LogInfo("RemoveLocal(%s)\n", addr.ToStringAddrPort());
318    }
319
320    mapLocalHost.erase(addr);
321}
322
323/** vote for a local address */
324bool SeenLocal(const CService& addr)
325{
326    LOCK(g_maplocalhost_mutex);
327    const auto it = mapLocalHost.find(addr);
328    if (it == mapLocalHost.end()) return false;
329    it->second.nScore = SaturatingAdd(it->second.nScore, 1);
330    return true;
331}
332
333
334/** check whether a given address is potentially local */
335bool IsLocal(const CService& addr)
336{
337    LOCK(g_maplocalhost_mutex);
338    return mapLocalHost.contains(addr);
339}
340
341bool CConnman::AlreadyConnectedToHost(std::string_view host) const
342{
343    LOCK(m_nodes_mutex);
344    return std::ranges::any_of(m_nodes, [&host](CNode* node) { return node->m_addr_name == host; });
345}
346
347bool CConnman::AlreadyConnectedToAddressPort(const CService& addr_port) const
348{
349    LOCK(m_nodes_mutex);
350    return std::ranges::any_of(m_nodes, [&addr_port](CNode* node) { return node->addr == addr_port; });
351}
352
353bool CConnman::AlreadyConnectedToAddress(const CNetAddr& addr) const
354{
355    LOCK(m_nodes_mutex);
356    return std::ranges::any_of(m_nodes, [&addr](CNode* node) { return node->addr == addr; });
357}
358
359bool CConnman::CheckIncomingNonce(uint64_t nonce)
360{
361    LOCK(m_nodes_mutex);
362    for (const CNode* pnode : m_nodes) {
363        // Omit private broadcast connections from this check to prevent this privacy attack:
364        // - We connect to a peer in an attempt to privately broadcast a transaction. From our
365        //   VERSION message the peer deducts that this is a short-lived connection for
366        //   broadcasting a transaction, takes our nonce and delays their VERACK.
367        // - The peer starts connecting to (clearnet) nodes and sends them a VERSION message
368        //   which contains our nonce. If the peer manages to connect to us we would disconnect.
369        // - Upon a disconnect, the peer knows our clearnet address. They go back to the short
370        //   lived privacy broadcast connection and continue with VERACK.
371        if (!pnode->fSuccessfullyConnected && !pnode->IsInboundConn() && !pnode->IsPrivateBroadcastConn() &&
372            pnode->GetLocalNonce() == nonce)
373            return false;
374    }
375    return true;
376}
377
378CNode* CConnman::ConnectNode(CAddress addrConnect,
379                             const char* pszDest,
380                             bool fCountFailure,
381                             ConnectionType conn_type,
382                             bool use_v2transport,
383                             const std::optional<Proxy>& proxy_override)
384{
385    AssertLockNotHeld(m_nodes_mutex);
386    AssertLockNotHeld(m_unused_i2p_sessions_mutex);
387    assert(conn_type != ConnectionType::INBOUND);
388
389    if (pszDest == nullptr) {
390        if (IsLocal(addrConnect))
391            return nullptr;
392
393        // Look for an existing connection
394        if (AlreadyConnectedToAddressPort(addrConnect)) {
395            LogInfo("Failed to open new connection to %s, already connected", addrConnect.ToStringAddrPort());
396            return nullptr;
397        }
398    }
399
400    LogDebug(BCLog::NET, "trying %s connection (%s) to %s, lastseen=%.1fhrs\n",
401        use_v2transport ? "v2" : "v1",
402        ConnectionTypeAsString(conn_type),
403        pszDest ? pszDest : addrConnect.ToStringAddrPort(),
404        Ticks<HoursDouble>(pszDest ? 0h : Now<NodeSeconds>() - addrConnect.nTime));
405
406    // Resolve
407    const uint16_t default_port{pszDest != nullptr ? GetDefaultPort(pszDest) :
408                                                     m_params.GetDefaultPort()};
409
410    // Collection of addresses to try to connect to: either all dns resolved addresses if a domain name (pszDest) is provided, or addrConnect otherwise.
411    std::vector<CAddress> connect_to{};
412    if (pszDest) {
413        std::vector<CService> resolved{Lookup(pszDest, default_port, fNameLookup && !HaveNameProxy(), 256)};
414        if (!resolved.empty()) {
415            std::shuffle(resolved.begin(), resolved.end(), FastRandomContext());
416            // If the connection is made by name, it can be the case that the name resolves to more than one address.
417            // We don't want to connect any more of them if we are already connected to one
418            for (const auto& r : resolved) {
419                addrConnect = CAddress{MaybeFlipIPv6toCJDNS(r), NODE_NONE};
420                if (!addrConnect.IsValid()) {
421                    LogDebug(BCLog::NET, "Resolver returned invalid address %s for %s\n", addrConnect.ToStringAddrPort(), pszDest);
422                    return nullptr;
423                }
424                // It is possible that we already have a connection to the IP/port pszDest resolved to.
425                // In that case, drop the connection that was just created.
426                if (AlreadyConnectedToAddressPort(addrConnect)) {
427                    LogInfo("Not opening a connection to %s, already connected to %s\n", pszDest, addrConnect.ToStringAddrPort());
428                    return nullptr;
429                }
430                // Add the address to the resolved addresses vector so we can try to connect to it later on
431                connect_to.push_back(addrConnect);
432            }
433        } else {
434            // For resolution via proxy
435            connect_to.push_back(addrConnect);
436        }
437    } else {
438        // Connect via addrConnect directly
439        connect_to.push_back(addrConnect);
440    }
441
442    // Connect
443    std::unique_ptr<Sock> sock;
444    CService addr_bind;
445    assert(!addr_bind.IsValid());
446    std::unique_ptr<i2p::sam::Session> i2p_transient_session;
447
448    for (auto& target_addr : connect_to) {
449        if (target_addr.IsValid()) {
450            const std::optional<Proxy> use_proxy{
451                proxy_override.has_value() ? proxy_override : GetProxy(target_addr.GetNetwork()),
452            };
453            bool proxyConnectionFailed = false;
454
455            if (target_addr.IsI2P() && use_proxy) {
456                i2p::Connection conn;
457                bool connected{false};
458
459                // If an I2P SAM session already exists, normally we would re-use it. But in the case of
460                // private broadcast we force a new transient session. A Connect() using m_i2p_sam_session
461                // would use our permanent I2P address as a source address.
462                if (m_i2p_sam_session && conn_type != ConnectionType::PRIVATE_BROADCAST) {
463                    connected = m_i2p_sam_session->Connect(target_addr, conn, proxyConnectionFailed);
464                } else {
465                    {
466                        LOCK(m_unused_i2p_sessions_mutex);
467                        if (m_unused_i2p_sessions.empty()) {
468                            i2p_transient_session =
469                                std::make_unique<i2p::sam::Session>(*use_proxy, m_interrupt_net);
470                        } else {
471                            i2p_transient_session.swap(m_unused_i2p_sessions.front());
472                            m_unused_i2p_sessions.pop();
473                        }
474                    }
475                    connected = i2p_transient_session->Connect(target_addr, conn, proxyConnectionFailed);
476                    if (!connected) {
477                        LOCK(m_unused_i2p_sessions_mutex);
478                        if (m_unused_i2p_sessions.size() < MAX_UNUSED_I2P_SESSIONS_SIZE) {
479                            m_unused_i2p_sessions.emplace(i2p_transient_session.release());
480                        }
481                    }
482                }
483
484                if (connected) {
485                    sock = std::move(conn.sock);
486                    addr_bind = conn.me;
487                }
488            } else if (use_proxy) {
489                LogDebug(BCLog::PROXY, "Using proxy: %s to connect to %s\n", use_proxy->ToString(), target_addr.ToStringAddrPort());
490                sock = ConnectThroughProxy(*use_proxy, target_addr.ToStringAddr(), target_addr.GetPort(), proxyConnectionFailed);
491            } else {
492                // No proxy needed (none set for target network). Private broadcast connections
493                // must always use a proxy, otherwise they would leak the originator's IP address.
494                if (Assume(conn_type != ConnectionType::PRIVATE_BROADCAST)) {
495                    sock = ConnectDirectly(target_addr, conn_type == ConnectionType::MANUAL);
496                }
497            }
498            if (!proxyConnectionFailed) {
499                // If a connection to the node was attempted, and failure (if any) is not caused by a problem connecting to
500                // the proxy, mark this as an attempt.