In this commit, we move btcd past the v0.26.1 release candidate and set
the development version to v0.26.2-beta. This keeps the daemon and RPC
server version on the next patch series as work resumes on master.
In this commit, we bump btcd from v0.26.0-beta to
v0.26.1-beta.rc1 for the next release candidate. This puts the version
reported by the daemon and RPC server in sync with the release series
prepared by this PR.
In this commit, we include periods in the alphabet accepted by
normalizeVerString. SemVer uses periods to separate pre-release identifiers,
but the old filter silently collapsed beta.rc1 into betarc1.
We add a focused test for the dotted RC suffix before using it for the next
release candidate.
In this commit, we pin btcutil and wire to their freshly tagged v2.0.1
releases. We also remove the root module's remaining local replace
directives now that all three in-tree modules have published versions.
This makes local builds and downstream module consumers resolve the same
btcutil, v2transport, and wire code. The regenerated checksums cover each
published module.
In this commit, we bump the root module requirement to the freshly tagged
v2transport v1.1.0 release. This exposes the responder handshake admission
APIs added in #2576 when btcd is built as a downstream module, where the
repository-local replace directive does not apply.
In this commit, we make the DisableAuth tests observe successful
requests instead of inferring them from an empty header. This closes a
false-positive path where credential lookup could fail before the
request reached the server.
We also cover the WebSocket handshake, cookie bypass, and
caller-provided headers across enabled and disabled auth. The public
comment now makes clear that DisableAuth only suppresses
rpcclient-generated Basic auth.
In this commit, we wrap the new DisableAuth regression tests to the
btcd 80-column formatting convention. We also split the nested handler
setup and assertions into logical stanzas so the tests match the
surrounding style.
Add table-driven tests that verify:
- Authorization header is omitted when DisableAuth is true
- Authorization header is present when DisableAuth is false
- Default (zero value) behavior includes Authorization header
Suggested by @TechLateef in #2514.
Add a DisableAuth field to ConnConfig that, when set to true, skips
setting the Authorization header on RPC requests.
This enables connecting to third-party RPC providers (e.g. Alchemy,
GetBlock) that authenticate via API key in the URL path and reject
requests containing an Authorization header with 401 errors.
Previously, getAuth() unconditionally set BasicAuth or attempted
cookie auth, leaving no way to disable authentication entirely.
Fixes#2505
In this commit, we make the pre-verack lifecycle test count only peers that
btcd has admitted and processed through version exchange.
The source handshake limit can close a rapid follow-up socket while the
previous disconnect is still unwinding. This made the client-side version
write fail with EPIPE before the intended lifecycle path ran. We now wait for
a version response from btcd, retry rejected attempts under a deadline, and
still disconnect without sending verack.
This preserves all 50 peerDone without peerAdd cycles while removing the
scheduler-dependent admission race from the test.
In this commit, we reject maxpeers values that cannot represent a usable
peer budget.
A zero value reached connmgr as TargetOutbound=0, where zero means to use
the default target of eight. The server then rejected every completed
peer and immediately created a replacement request. Rejecting the value
during configuration avoids that outbound reconnect loop.
In this commit, we define TargetOutbound as the number of automatic
connections and treat explicit Connect requests as additional peers.
Permanent requests could previously consume connection IDs before Start
sampled the shared counter. The resulting automatic count depended on
goroutine scheduling, while the listener reserved the worst-case total.
We now start the configured automatic count directly and cap it by the
peer budget left after permanent peers.
The composition test covers permanent requests on both sides of Start and
pins the same automatic+permanent total for either ordering.
In this commit, we make each stress wave establish its full set of peers
before disconnecting them together. A ping/pong barrier proves the server
processed each verack, while RPC connection-count barriers prove
registration and removal completed before the next wave starts.
We bound concurrent handshakes from the shared source, drain every worker on
failure, and wait for server-side cleanup. This keeps the test compatible
with the admission limits it exercises and makes a passing run evidence of
the intended NewPeer/DonePeer ordering.
In this commit, we send the responder key as soon as the initiator diverges
from the v1 prefix. This avoids the BIP324 deadlock where both sides can wait
for the other to write before the initiator has sent its complete 64-byte
key.
We split key generation and key agreement into separate admission leases,
and release each lease before the intervening network I/O. The regression
test stops after the first mismatch, requires the responder to make
progress, then completes key agreement and verifies the resulting packet
ciphers interoperate.
In this commit, we keep loopback and whitelisted peers inside the ordinary
pending-handshake and V2 source budgets, while preserving their existing
no-ban behavior.
We also derive the listener reservation from the configured peer mode.
Connect-only and simnet nodes now reserve just their permanent peers, while
automatic mode accounts for both its target and addpeers without exceeding
MaxPeers.
Finally, a bound V2 handshake consumes its rate budgets once, but reacquires
the concurrency slot for each CPU-bound responder phase. This keeps rate
limiting scoped to the handshake while bounding both expensive phases.
In this commit, we decode base64 PSBT packets as a stream instead of
reading the full encoded input into memory first.
The previous aggregate bound reused wire.MaxMessagePayload, even though
BIP-174 doesn't bind PSBT packet size to the P2P message limit. This made
the base64 path reject packets that the raw path accepted. We now feed
decoded bytes through the same per-field parser used for raw packets,
while retaining strict base64 and trailing-data checks.
We also add a regression test with nine individually valid 4,000,000-byte
unknown values to pin raw and base64 parsing to the same behavior.
BIP-350 requires that segregated witness outputs of version 1 through 16
use the bech32m checksum, while only version 0 uses bech32. decodeSegWitAddress
only special-cased versions 0 and 1, so a witness program with version 2-16
encoded using the legacy bech32 checksum decoded successfully, in violation of
the spec and contrary to the BIP-350 reference decoder (which rejects any
non-zero witness version that is not bech32m).
Generalize the version 1 check to cover all versions >= 1, matching the
reference decode() function. Add the relevant BIP-350 INVALID_ADDRESS vectors
(v2 and v16 encoded with bech32) as a regression test; they decoded
successfully before this change and are now rejected.
Signed-off-by: Lrifton92 <Lrifton92@users.noreply.github.com>
In this commit, we propagate errors returned while cataloging index
buckets, matching the bucket deletion path fixed by the preceding commit.
We also add fault-injected regression coverage for both paths so neither
error can silently report a successful index drop.
In this commit, we extend taproot PSBT serialization and finalization to reject nil script spend signatures, leaf scripts, and BIP32 derivations before any sort or dereference. We return wrapped ErrInvalidPsbtFormat errors so callers can identify malformed packet state without parsing strings.
We also make FindLeafScript reject nil inputs and leaf entries. This keeps both the direct finalizer and MaybeFinalize paths from panicking on malformed in-memory packets.
In this commit, we extend the lenient database block parser to the remaining call sites that re-read blocks from the node's own database.
The getblock RPC now copies FetchBlock bytes before its read transaction ends, since database buffers are not valid outside that lifetime. We then strip any legacy trailing data and serve the exact block serialization at every verbosity level. A regression database invalidates its buffer as View returns, pinning the required copy.
The index manager uses the same parser while rolling an index tip back to the main chain. We also place DBBlockFromBytes before its first caller and log legacy trailing data at debug level, since a frequently fetched dirty block should not flood operator logs.
In this commit, we serialize connection association with peer
disconnection. Previously, Disconnect could run before
AssociateConnection, close quit without a socket, and leave a later
connection published with no remaining path that could close it.
We now close connections handed to a peer that is already disconnecting,
and publish the connected flag only after the socket and connection time
are initialized. The tests pin both call orderings and race the
transitions to verify the socket closes exactly once.
In this commit, we introduce a server-wide admission policy for
incomplete inbound handshakes and the CPU-bound portion of v2 responder
setup. Source accounting uses normalized IPv4 and IPv6 prefixes, while
global, per-source, and concurrent v2 budgets remain independent and
bounded.
Peer construction passes the policy through a small interface only for
inbound v2 responders. Handshake slots release on verack or disconnect,
and the connection manager reserves MaxPeers capacity for automatic
outbound peers.
In this commit, we add an optional inbound connection limit at the
listener boundary. Each accepted socket owns a slot until Close releases
it exactly once, which makes connection lifetime, rather than accept
rate, the accounting unit.
The default remains unlimited for existing callers. The new tests cover
the configured bound, concurrent admission, callback ordering, and slot
reuse.
In this commit, we split the responder handshake into transport
classification, key setup, and wire completion phases. This lets callers
install a narrow admission interface after the full v2 candidate is
available, while preserving NewPeer compatibility and the existing
transcript.
We also propagate handshake write failures, reject short writes, and
cover v1 fallback, incomplete candidates, admission lifetime, and
end-to-end v2 interoperability.
In this commit, we address two issues with the strict parsing recently
added to NewFromRawBytes.
First, the trailing data check probed the caller supplied reader with a
blocking one byte read. A reader without a Len method (net.Conn,
io.Pipe) that stays open after delivering a complete packet would hang
the parser forever. We now only enforce the check when the reader can
report its remaining length without an additional read, which covers
in-memory readers along with the decoded base64 path. Plain streams are
left positioned directly after the packet, and the reader contract is
now documented on NewFromRawBytes.
Second, the base64 path read the entire input into memory before any
validation ran, so a very large input could force an arbitrarily large
allocation before the first validity check. We now bound the read to
wire.MaxMessagePayload expanded by the base64 encoding overhead.
Along the way, we simplify assertFullyConsumed down to the bytes.Reader
case that all remaining callers use.
In this commit, we relax the strict block deserialization introduced as
part of the trailing byte hardening. Databases written by older
versions of btcd may have persisted blocks with trailing bytes, so
refusing to load them would prevent a node from ever starting (or
serving such a block) after an upgrade, with no recovery path short of
a full resync.
We instead introduce a new dbBlockFromBytes helper, used by both
initChainState and dbFetchBlockByNode, that deserializes the block
leniently: any trailing bytes are logged, ignored, and excluded from
the serialization cached on the returned block, so downstream consumers
of the raw bytes never observe them.
ParseSignature documents that it enforces the BIP-340 requirement that
the s component lie in the range [0, n-1], and the r component is
already checked against the field prime accordingly. However, the
overflow return value of s.SetByteSlice was discarded, so an s value
greater than or equal to the group order n was silently reduced modulo
n and accepted instead of being rejected.
This restores parity with the reference implementation in
decred/dcrd/dcrec/secp256k1/schnorr (of which this code is a port) and
with Bitcoin Core, both of which reject such encodings at parse time.
The ErrSigSTooBig error kind is already defined in the imported schnorr
package but was previously unused here.
A regression test covering the s == n and s > n encodings is added; it
fails before this change (the signatures are silently accepted) and
passes after.
Signed-off-by: Lrifton92 <Lrifton92@users.noreply.github.com>
TestSyncStateMachine checked that handleHeadersMsg advanced
lastProgressTime by comparing it against the timestamp written by
startSync. Those two writes can happen within the same clock tick, so
the handler can update the field while time.After still reports false.
Reset lastProgressTime to the zero value before delivering headers and
assert that the handler writes a non-zero value. This keeps the test
focused on the behavior under test without depending on adjacent
time.Now calls producing distinct timestamps.
wire.ReadTxOut returns PkScript slices backed by its internal 4 MiB
script slab. PSBT inputs keep parsed WitnessUtxo values, so small
scripts could otherwise keep the whole slab live.
Copy the script before storing the TxOut and assert the parsed witness
script has compact capacity.
