Should `onlynet=onion` allow incoming non-tor connections? #13436

It is noted in #13378 (comment) that onlynet only affects outgoing connections. I take this to mean a user running onlynet=onion will happily accept incoming, non-tor connections on their node. It feels like a user running with onlynet=onion option would not want their node to accept incoming non-tor connections.

doc/tor.md explains this and suggests using -bind=127.0.0.1 to mitigate this.

In general, it is not possible to control what networks incoming connections are from, because they're not observable. Some best guesses could be implemented, but I fear that adding this into -onlynet may also lead to less predictable behaviour.

When you have a manually run Tor instance, configured with a Bitcoin hidden service, you generally run it on localhost. Bitcoin Core can be configured to only accept incoming connections from localhost, but that's independent from the Tor configuration - it does not actually at any point in time know that these connections are Tor ones. In theory, someome can also run their Tor instance elsewhere (on a local network, for example).

I didn't realize it wasn't possible to determine what incoming connections are coming from. I thought connections always had a source, and I assumed it was different for Tor connections... The only thing that could be leaked by this is if someone is careless to not do -bind, and someone else tries to see if they are running bitcoin. Could be bad for e.g. an exchange node with a fat wallet but they'd presumably be careful.

Right, you can see the source of an incoming connection, but that source may be a proxy. Tor connections always come through tor which acts as proxy, so bitcoind just sees the IP address of the proxy. There may be other reasons why connections seem to come from a known or unknown proxy.

Got it. Perhaps it would be useful with a warning when seeing -onlynet=onion if it is not also seeing -bind=localhost.

I don't think onlynet affects binding at all, that's seperate.

Maybe it should, but it'd be a change from current behavior.

Regarding detection of incoming Tor connections (at least from the automatic Tor hidden sevice setup), see #8973 "Incoming tor connections should use alternative port".

Nit: I guess You mean onlynet=onion

I don't think this issue will find a resolution here, so I'm closing.