@@ -574,9 +574,9 @@ void CNode::CloseSocketDisconnect()
574574 m_i2p_sam_session.reset ();
575575}
576576
577- void CConnman::AddWhitelistPermissionFlags (NetPermissionFlags& flags, const CNetAddr & addr, const std::vector<NetWhitelistPermissions>& ranges) const {
577+ void CConnman::AddWhitelistPermissionFlags (NetPermissionFlags& flags, std::optional< CNetAddr> addr, const std::vector<NetWhitelistPermissions>& ranges) const {
578578 for (const auto & subnet : ranges) {
579- if (subnet.m_subnet .Match (addr)) {
579+ if (addr. has_value () && subnet.m_subnet .Match (addr. value () )) {
580580 NetPermissions::AddFlag (flags, subnet.m_flags );
581581 }
582582 }
@@ -1768,7 +1768,11 @@ void CConnman::CreateNodeFromAcceptedSocket(std::unique_ptr<Sock>&& sock,
17681768{
17691769 int nInbound = 0 ;
17701770
1771- AddWhitelistPermissionFlags (permission_flags, addr, vWhitelistedRangeIncoming);
1771+ const bool inbound_onion = std::find (m_onion_binds.begin (), m_onion_binds.end (), addr_bind) != m_onion_binds.end ();
1772+
1773+ // Tor inbound connections do not reveal the peer's actual network address.
1774+ // Therefore do not apply address-based whitelist permissions to them.
1775+ AddWhitelistPermissionFlags (permission_flags, inbound_onion ? std::optional<CNetAddr>{} : addr, vWhitelistedRangeIncoming);
17721776
17731777 {
17741778 LOCK (m_nodes_mutex);
@@ -1823,7 +1827,6 @@ void CConnman::CreateNodeFromAcceptedSocket(std::unique_ptr<Sock>&& sock,
18231827 NodeId id = GetNewNodeId ();
18241828 uint64_t nonce = GetDeterministicRandomizer (RANDOMIZER_ID_LOCALHOSTNONCE).Write (id).Finalize ();
18251829
1826- const bool inbound_onion = std::find (m_onion_binds.begin (), m_onion_binds.end (), addr_bind) != m_onion_binds.end ();
18271830 // The V2Transport transparently falls back to V1 behavior when an incoming V1 connection is
18281831 // detected, so use it whenever we signal NODE_P2P_V2.
18291832 ServiceFlags local_services = GetLocalServices ();
0 commit comments