net: un-default the OpenNetworkConnection()'s proxy_override argument
What the developer wrote
Authored by Eugene Siegel
net: un-default the OpenNetworkConnection()'s proxy_override argument
This way callers will not forget to set it.
What changed, and why it matters
This change removes a default value for a network-connection setting called proxy_override. Previously, callers could leave it unset without thinking. Now every caller must explicitly pass a value, which helps prevent accidental mistakes about which proxy a connection uses. It is a defensive code-quality fix, not a patch for a known active bug or attack.
No urgent action needed. Treat as normal code-quality/maintenance improvement. Reviewers of future call sites should verify that proxy_override is intentionally set rather than silently defaulting.
Security signals we found
Defensive API hardening: removing a default argument to force explicit decisions about proxy routing
No functional change: all call sites pass std::nullopt, matching the previous default
Potential future security relevance: prevents accidental omission of proxy_override in new call sites, which could affect network privacy or reachability
Evidence from the diff
The commit removes the default argument proxy_override = std::nullopt from CConnman::OpenNetworkConnection() in src/net.h and updates all call sites in src/net.cpp and src/rpc/net.cpp to pass /*proxy_override=*/std::nullopt explicitly. The behavior is unchanged: all existing callers already used the default value, so the effective proxy selection remains the same. The change is purely compile-time enforcement to ensure future callers consider the proxy override parameter.
Changed components
src/net.h: CConnman::OpenNetworkConnection() declarationsrc/net.cpp: AddConnection, ProcessAddrFetch, ThreadOpenConnections, ThreadOpenAddedConnections call sitessrc/rpc/net.cpp: addnode RPC call siteInspect captured patch +43 / −9
diff --git a/src/net.cpp b/src/net.cpp
index 3e2b81b0..6fb54118 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -1919,7 +1919,13 @@ bool CConnman::AddConnection(const std::string& address, ConnectionType conn_typ
CountingSemaphoreGrant<> grant(*semOutbound, true);
if (!grant) return false;
- OpenNetworkConnection(CAddress(), false, std::move(grant), address.c_str(), conn_type, /*use_v2transport=*/use_v2transport);
+ OpenNetworkConnection(/*addrConnect=*/CAddress{},
+ /*fCountFailure=*/false,
+ /*grant_outbound=*/std::move(grant),
+ /*pszDest=*/address.c_str(),
+ /*conn_type=*/conn_type,
+ /*use_v2transport=*/use_v2transport,
+ /*proxy_override=*/std::nullopt);
return true;
}
@@ -2443,7 +2449,13 @@ void CConnman::ProcessAddrFetch()
CAddress addr;
CountingSemaphoreGrant<> grant(*semOutbound, /*fTry=*/true);
if (grant) {
- OpenNetworkConnection(addr, false, std::move(grant), strDest.c_str(), ConnectionType::ADDR_FETCH, use_v2transport);
+ OpenNetworkConnection(/*addrConnect=*/addr,
+ /*fCountFailure=*/false,
+ /*grant_outbound=*/std::move(grant),
+ /*pszDest=*/strDest.c_str(),
+ /*conn_type=*/ConnectionType::ADDR_FETCH,
+ /*use_v2transport=*/use_v2transport,
+ /*proxy_override=*/std::nullopt);
}
}
@@ -2571,8 +2583,13 @@ void CConnman::ThreadOpenConnections(const std::vector<std::string> connect, std
{
for (const std::string& strAddr : connect)
{
- CAddress addr(CService(), NODE_NONE);
- OpenNetworkConnection(addr, false, {}, strAddr.c_str(), ConnectionType::MANUAL, /*use_v2transport=*/use_v2transport);
+ OpenNetworkConnection(/*addrConnect=*/CAddress{CService{}, NODE_NONE},
+ /*fCountFailure=*/false,
+ /*grant_outbound=*/{},
+ /*pszDest=*/strAddr.c_str(),
+ /*conn_type=*/ConnectionType::MANUAL,
+ /*use_v2transport=*/use_v2transport,
+ /*proxy_override=*/std::nullopt);
for (int i = 0; i < 10 && i < nLoop; i++)
{
if (!m_interrupt_net->sleep_for(500ms)) {
@@ -2922,7 +2939,13 @@ void CConnman::ThreadOpenConnections(const std::vector<std::string> connect, std
const bool count_failures{((int)outbound_ipv46_peer_netgroups.size() + outbound_privacy_network_peers) >= std::min(m_max_automatic_connections - 1, 2)};
// Use BIP324 transport when both us and them have NODE_V2_P2P set.
const bool use_v2transport(addrConnect.nServices & GetLocalServices() & NODE_P2P_V2);
- OpenNetworkConnection(addrConnect, count_failures, std::move(grant), /*pszDest=*/nullptr, conn_type, use_v2transport);
+ OpenNetworkConnection(/*addrConnect=*/addrConnect,
+ /*fCountFailure=*/count_failures,
+ /*grant_outbound=*/std::move(grant),
+ /*pszDest=*/nullptr,
+ /*conn_type=*/conn_type,
+ /*use_v2transport=*/use_v2transport,
+ /*proxy_override=*/std::nullopt);
}
}
}
@@ -3021,8 +3044,13 @@ void CConnman::ThreadOpenAddedConnections()
break;
}
tried = true;
- CAddress addr(CService(), NODE_NONE);
- OpenNetworkConnection(addr, false, std::move(grant), info.m_params.m_added_node.c_str(), ConnectionType::MANUAL, info.m_params.m_use_v2transport);
+ OpenNetworkConnection(/*addrConnect=*/CAddress{CService{}, NODE_NONE},
+ /*fCountFailure=*/false,
+ /*grant_outbound=*/std::move(grant),
+ /*pszDest=*/info.m_params.m_added_node.c_str(),
+ /*conn_type=*/ConnectionType::MANUAL,
+ /*use_v2transport=*/info.m_params.m_use_v2transport,
+ /*proxy_override=*/std::nullopt);
if (!m_interrupt_net->sleep_for(500ms)) return;
grant = CountingSemaphoreGrant<>(*semAddnode, /*fTry=*/true);
}
diff --git a/src/net.h b/src/net.h
index fe8322d1..a56f9a20 100644
--- a/src/net.h
+++ b/src/net.h
@@ -1191,7 +1191,7 @@ public:
const char* pszDest,
ConnectionType conn_type,
bool use_v2transport,
- const std::optional<Proxy>& proxy_override = std::nullopt)
+ const std::optional<Proxy>& proxy_override)
EXCLUSIVE_LOCKS_REQUIRED(!m_nodes_mutex, !m_unused_i2p_sessions_mutex);
/// Group of private broadcast related members.
diff --git a/src/rpc/net.cpp b/src/rpc/net.cpp
index 20bb1cb4..ba1080ed 100644
--- a/src/rpc/net.cpp
+++ b/src/rpc/net.cpp
@@ -358,7 +358,13 @@ static RPCMethod addnode()
if (command == "onetry")
{
CAddress addr;
- connman.OpenNetworkConnection(addr, /*fCountFailure=*/false, /*grant_outbound=*/{}, std::string{node_arg}.c_str(), ConnectionType::MANUAL, use_v2transport);
+ connman.OpenNetworkConnection(/*addrConnect=*/addr,
+ /*fCountFailure=*/false,
+ /*grant_outbound=*/{},
+ /*pszDest=*/std::string{node_arg}.c_str(),
+ /*conn_type=*/ConnectionType::MANUAL,
+ /*use_v2transport=*/use_v2transport,
+ /*proxy_override=*/std::nullopt);
return UniValue::VNULL;
}
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.