net: exchange signed .btf descriptors between peers (#32)

Discovery has depended entirely on the Nostr relays. Two connected nodes never
told each other who else existed, so a relay outage left a running network
unable to grow, and a node that found one stale peer had no way to learn there
was anything better. The old `addr` gossip went out with the IRC seed.

Peers now trade signed descriptors over a new "btfpeers" message: our own
first, then peers that actually answered us. The receiver checks each Schnorr
signature against the key the `.btf` address decodes to, so the sender is
trusted for nothing -- forging an entry needs somebody else's secret key. That
leaves flooding with self-generated keys, which the per-message caps and the
"peers that answered" ordering are there to blunt.

Unknown commands are ignored (main.cpp), so nodes without this just drop the
message; nothing here is a protocol break.

The cache from the peer-cache change now keeps each peer's descriptor verbatim
alongside the parsed fields, because that signature is what makes a peer
relayable. Entries without one -- resolved through Nostr, or written before
this -- stay dialable, just not passed on. A dial never clears a descriptor
already on file.

1 files changed, 19 insertions, 0 deletions

diff --git a/src/net.h b/src/net.h
index f028c3b..7d70721 100644
--- a/src/net.h
+++ b/src/net.h
@@ -29,6 +29,21 @@ CNode* ConnectNodeBtfResolved(const string& strBtfAddr, const string& strMeeting
 void ThreadBtfAccept(void* parg);
 void ThreadBtfConnect(void* parg);
 extern string strBtfConnect;
+
+// --- .btf peer exchange ---------------------------------------------------
+// Peers gossip signed descriptors so discovery survives a relay outage. Both
+// caps apply to a single "btfpeers" message; the generic header limit is 256 MB,
+// which is no protection at all for something a stranger can send unprompted.
+static const unsigned int MAX_PEX_DESCRIPTORS      = 20;
+static const unsigned int MAX_PEX_DESCRIPTOR_BYTES = 1024;
+// Ignore a peer's exchange more often than this. One announcement per side per
+// connection is the intended traffic; anything faster is someone else's idea.
+static const int64        PEX_MIN_INTERVAL         = 60;
+
+// Descriptors to hand a peer: ours first, then peers that answered us.
+void BtfPexCollect(std::vector<std::string>& vDescOut);
+// Verify descriptors a peer sent and remember the good ones. Returns how many.
+int  BtfPexAccept(const std::vector<std::string>& vDesc);
 void AbandonRequests(void (*fn)(void*, CDataStream&), void* param1);
 bool AnySubscribed(unsigned int nChannel);
 void ThreadBitcoinMiner(void* parg);
@@ -467,6 +482,9 @@ public:
     // publish and subscription
     vector<char> vfSubscribe;
 
+    // Last "btfpeers" we accepted from this node, to rate-limit the exchange.
+    int64 nLastPexRecv;
+
 
     CNode(SOCKET hSocketIn, CAddress addrIn, bool fInboundIn=false)
     {
@@ -483,6 +501,7 @@ public:
         fDisconnect = false;
         nRefCount = 0;
         nReleaseTime = 0;
+        nLastPexRecv = 0;
         vfSubscribe.assign(256, false);
 
         // Push a version message