net: do not consume a header until the body is there, and cap what one can claim

Upstream #109's message-stall rework, hand-merged so it keeps the progress
timing this tree already had.

The old path consumed the header, found the payload short, inserted the header
back at the front of vRecv, then Sleep(100) inside the shared message thread.
A peer that announces a large payload and drips bytes made every pass pay an
O(n) insert and a 100 ms stall -- one peer slowing the thread that serves all
of them. Now the header is read from a copy and only skipped once the whole
body has arrived, so there is nothing to put back and nothing to sleep for.

Kept OURS, not upstream's, on the timeout: upstream restarts its clock only
when the (size, command) pair changes, which drops a peer sending one big
message slowly but honestly. This times the STALL -- the clock restarts on any
progress -- which is the distinction that matters on a slow link.

Also from #109: a header could announce 256 MB while serialize.h refuses
anything over MAX_SIZE (32 MB), so the check admitted an allocation the parser
would reject anyway and burned a peer slot for two minutes doing it.
MAX_PROTOCOL_MESSAGE_SIZE ties the two together. 8x less a peer can make us
hold, and this node takes public Stratum.

And #103's other half: ~CNode closed its socket with a raw closesocket(),
invisible to the accounting, and left hSocket set afterwards -- which is how a
descriptor number that now belongs to somebody else gets closed a second time.

(cherry picked from commit 2f25e2e07985e9bc732cadfbb3c9ac233895a814)

1 files changed, 15 insertions, 0 deletions

diff --git a/src/net.h b/src/net.h
index 440550c..0317676 100644
--- a/src/net.h
+++ b/src/net.h
@@ -146,6 +146,16 @@ static const int64        BTF_NO_PEER_HEIGHT_MAX_SECS = 20 * 60;
 // minutes is far beyond that, and well inside BTF_RECV_TIMEOUT_SECS.
 static const int64        BTF_MSG_WAIT_MAX_SECS = 2 * 60;
 
+// Largest payload a peer may announce in a message header: MAX_PROTOCOL_MESSAGE_SIZE
+// is defined further up this file. This tree reached the same cap by the same
+// reasoning as upstream #109 -- a 256 MB allowance is eight times what the
+// deserializer will accept (serialize.h throws above MAX_SIZE), so the header
+// check admitted an allocation the parser would only reject later, after
+// BTF_MSG_WAIT_MAX_SECS of a stalled peer slot -- so only the note survives.
+//
+// Both definitions were textually clean and 59 lines apart, so the replay onto
+// upstream merged them without a conflict and only the compiler objected.
+
 // Send a ping after this long with nothing to say, so a peer running the
 // inactivity check above does not mistake a quiet node for a dead one. Must
 // stay well under BTF_RECV_TIMEOUT_SECS.
@@ -741,6 +751,11 @@ public:
     {
         if (hSocket != INVALID_SOCKET)
         {
+            // Route through BtfCloseSocket so the accounting sees this close.
+            // A raw closesocket() here was invisible to sockcount, which is
+            // why the leak numbers never added up, and leaving the descriptor
+            // set afterwards is how a number that now belongs to somebody else
+            // gets closed a second time. (#103)
             BtfCloseSocket(hSocket);
             hSocket = INVALID_SOCKET;
         }