net: peer resolution, getpeerinfo, locators and the outbound cap (#668, #691)

[bkeroack]

Closes #668. Closes #691.

Seventh in the 0.5.2 close-out stack. Based on fix/664-compat-notifications-timeouts (#717) — merge that first.

Name resolution honours -proxy and -dns, and stops blocking the runtime

-addnode, -connect and the addnode RPC all went through
PeerAddr::parse_with_default_port, which did three things it must not:

• resolved hostnames with the blocking std::net::ToSocketAddrs from
  inside async handlers, so a slow resolver parked a tokio worker;
• resolved them with the local resolver even under -proxy, handing
  whoever watches that resolver the peers a proxied node exists to hide —
  the same leak resolve_operator_seeds already refuses for -seednode;
• ignored -dns=0, which was parsed and then consulted only for DNS seeding.

net::dns::resolve_peer_target is now the single async entry point for every
operator-supplied peer target, and parse_with_default_port is a pure parser.
Literal IPs and .onion targets never touch a resolver and work in every
mode; a clearnet hostname is refused under -proxy and under -dns=0, with a
message saying which.

Not done here: handing the hostname to the proxy for it to resolve (Core's
by-name SOCKS5 ConnectThroughProxy). PeerAddr has no clearnet-by-name
variant and the dial/dedupe bookkeeping is keyed on either a socket or an
onion host, so that is its own change. The leak is closed by refusal in the
meantime, which is the behaviour satd already documents for -seednode.

getpeerinfo

Field	Was	Now
network	address family only	Core's CNetAddr::GetNetwork — every unroutable address is not_publicly_routable, via a new net::is_routable
addr_relay_enabled	direction == Outbound	the latch Core's SetupAddressRelay sets, so an inbound peer exchanging addrs reports true
servicesnames	ad-hoc	one bit-ordered 0..64 walk, with Core's UNKNOWN[2^n] fallback
last_block / last_transaction	stamped on receipt	stamped on acceptance, as Core does
relay_txes (field)	dead, never read	removed

last_block/last_transaction are eviction inputs. Stamped on receipt, a
peer could keep its own eviction protection alive with blocks the node
already had or transactions it rejects — the peer eviction exists to shed.
Carrying that meant the block-processing channel now carries the sending
peer's stats handle alongside the block.

net::is_routable also replaces the loopback-only proxy bypass in
dial_direct. That bypass happened to match Core (GetNetwork() returns
NET_UNROUTABLE for loopback, and GetProxy(NET_UNROUTABLE) is false) but
only for loopback; RFC1918 and link-local peers were being sent through the
proxy where Core dials them directly.

getconnectioncount now counts the same set getpeerinfo lists.

getblocks / getheaders answer from Core's fork point

locator_fork_height is CChain::FindForkInGlobalIndex:

• a locator entry on a stale fork is no longer a fork point (it made the
  reply start at stale_height + 1 on the active chain, which the peer
  cannot connect to anything it holds);
• an unmatched locator falls back to genesis and the reply starts at height
  1, instead of re-announcing the genesis block;
• getblocks breaks before pushing hashStop, instead of announcing the
  requester the block it named as already held;
• getheaders honours hashStop at all — it was answering every request
  with up to 2000 headers.

addnode <peer> remove left the peer manual

remove_peer_addr cleared the reconnect list but not manual_addrs /
manual_onion_hosts, so a removed added-node kept being dialled as a manual
connection and kept bypassing -connect gating.

Total outbound cap (#691)

Core bounds automatic outbound connections twice: per type, and with the
semOutbound counting semaphore sized
min(m_max_automatic_outbound, m_max_automatic_connections). satd had only
the per-type limits — and addr-fetch and feeler, the two types Core caps
only through that semaphore, returned "capacity fine" unconditionally, so
addconnection could open them until the process ran out of sockets. The
total check now runs under the same lock that reserves the per-type slot.
MANUAL stays exempt, as in Core.

Tests

New, each perturbation-proven (delete the guard, a named test fails):

• net::dns — dns_disabled_refuses_a_hostname_but_not_a_literal,
  a_hostname_is_not_resolved_locally_under_a_proxy,
  a_hostname_still_resolves_with_no_proxy_and_dns_on,
  only_real_names_are_classified_as_needing_a_lookup
• net::peer — unroutable_peers_are_not_reported_as_ipv4_or_ipv6,
  servicesnames_is_emitted_in_bit_order,
  addr_relay_enabled_reports_the_latch_not_the_direction
• net::manager — getblocks_answers_from_cores_fork_point,
  getheaders_honours_the_stop_hash,
  removing_an_added_node_drops_its_manual_status
• regtest — a_peers_last_block_and_last_tx_only_move_on_acceptance,
  addconnection_stops_at_the_total_outbound_capacity

Core-functional inventory

Two rows re-measured, both still skip but for different reasons than
recorded:

• feature_proxy.py — the proxy-dial failure it was filed under is gone; it
  now cannot start, because its setup_nodes passes -i2psam (I2P is out of
  scope for satd). It also needs -cjdnsreachable and unix-socket proxies.
• rpc_net.py — likewise past the proxy stage; it now fails asserting that
  help("getpeerinfo") contains Core's network list. satd's help <command>
  returns the method name, not per-method help text.

🤖 Generated with Claude Code

https://claude.ai/code/session_011H5HUWaezLTYJCZDpgaioL

[bkeroack]

Rebased onto the updated fix/664-compat-notifications-timeouts (#717), which picked up two follow-up commits. No changes to this branch's own content.

🤖 Generated with Claude Code

https://claude.ai/code/session_011H5HUWaezLTYJCZDpgaioL

[bkeroack]

Independent review pass — one fix landed on this branch.

• IPv4-mapped IPv6 peers (::ffff:a.b.c.d) were classified as IPv6 in getpeerinfo and passed the routability check even when the embedded IPv4 address was private or loopback. Core's CNetAddr unwraps the mapping first; satd now canonicalises the address before both the network label and the routability check, and 0.0.0.0/8 is refused like 127/8.
• SIGHUP addnode reload dialled the added peers serially, so one unreachable host stalled the rest. Each dial is now its own task.

Verified against Core v31.1 netaddress.cpp.

🤖 Generated with Claude Code

https://claude.ai/code/session_011H5HUWaezLTYJCZDpgaioL