1 files changed, 117 insertions, 33 deletions

diff --git a/src/net.h b/src/net.h
index 8b0245a..0988542 100644
--- a/src/net.h
+++ b/src/net.h
@@ -12,7 +12,13 @@ class CBlockIndex;
 
 
 
-static const unsigned short DEFAULT_PORT = htons(8433);
+// Held in host byte order, unlike the DEFAULT_PORT constant these replace,
+// which was htons(8433). Nothing is lost: net.cpp's GetDefaultPort() applies
+// htons() itself and is what every caller now uses, so the value that reaches
+// a sockaddr is byte-for-byte what it was. Mainnet stays on 8433.
+static const unsigned short MAINNET_PORT = 8433;
+static const unsigned short TESTNET_PORT = 18433;
+static const unsigned int PUBLISH_HOPS = 5;
 enum
 {
     NODE_NETWORK = (1 << 0),
@@ -23,13 +29,24 @@ enum
 
 
 
+// Defined in main.cpp. True while this node is tracking the tip rather than
+// still catching up, measured off the age of our own best block -- see there
+// for why that and not a peer-reported height. Declared here because net.h is
+// parsed before main.h and CNode::AskFor needs it.
+bool IsBlockFetchNearTip();
+
 bool GetMyExternalIP(unsigned int& ipRet);
+bool IsTestNet();
+unsigned short GetDefaultPort();
+void SelectNetworkParams(bool fTestNetIn);
 CNode* ConnectNodeBtf(const string& strBtfAddr);
 CNode* ConnectNodeBtfResolved(const string& strBtfAddr, const string& strMeeting,
-                              const unsigned char enc_pub[32]);
+                              const string& strOnion, const unsigned char enc_pub[32],
+                              const string& strDesc=string());
 void ThreadBtfAccept(void* parg);
 void ThreadBtfConnect(void* parg);
 extern string strBtfConnect;
+extern bool fBtfOnionOnly;
 // Bootstrap seeds added at runtime with /btfseed=ADDRESS:ENCHEX (repeatable).
 // The compiled-in list lives in net.cpp; these are appended to it.
 extern std::vector<std::pair<std::string, std::string> > vBtfExtraSeeds;
@@ -87,30 +104,52 @@ static const int          BTF_RECV_TIMEOUT_SECS    = 30 * 60;
 static const int          BTF_SEND_STALL_SECS      = 10 * 60;
 static const int          BTF_HANDSHAKE_GRACE_SECS = 60;
 
+// How long a requested block gets before it is asked for again, in seconds.
+// Used twice: CNode::AskFor spaces the queued per-announcer block retries this
+// far apart instead of the two minutes transactions get, and the failover
+// sweep in main.cpp re-issues a getdata to a different peer once a sent
+// request has gone unanswered this long. A block body is at most 1 MB and
+// somebody demonstrably has it -- they announced it -- so on this timescale
+// "not here yet" means "not coming from that peer", not "still in transit".
+static const int          BLOCK_FETCH_RETRY_SECS   = 15;
+
 // A serialized object cannot be larger than MAX_SIZE, so no valid network
 // message needs the old 256 MB header allowance. Keep the wire cap aligned with
-// what the deserializer can accept and bound how long one peer may sit on a
-// partial payload after a complete header has arrived.
+// what the deserializer can accept. How long a peer may sit on a partial
+// payload after a complete header has arrived is BTF_MSG_WAIT_MAX_SECS, below.
 static const unsigned int MAX_PROTOCOL_MESSAGE_SIZE = MAX_SIZE;
-static const int          BTF_INCOMPLETE_MESSAGE_TIMEOUT_SECS = 2 * 60;
 
 // Ceiling on simultaneous connections.
 //
-// ThreadSocketHandler watches every peer through one select(), and select()
-// cannot watch more descriptors than FD_SETSIZE. On Windows FD_SET simply
-// stops adding once the set is full -- no error, no log -- so every socket
-// past the limit stays open and is never read again. Nothing capped vNodes,
-// so a node accepted connections it had no way to service, and because new
-// entries go on the end of vNodes it was always the newest connection that
-// starved, including the ones dialed to fix connectivity.
+// ThreadSocketHandler watches every peer in one socket loop. This used to be a
+// select() loop, which made FD_SETSIZE the real limit and silently starved
+// sockets past that bitmap. It is now poll()/WSAPoll(), so the ceiling below is
+// a deliberate resource bound rather than a descriptor-set accident.
 //
 // Measured on two nodes before this ceiling existed: 277 and 90 CNode objects
 // against 93 and 90 live sockets, and a status bar reporting hundreds of
 // peers for a node that was really talking to thirty.
 //
-// 125 is Bitcoin's number and sits far below FD_SETSIZE on both platforms.
+// 125 is Bitcoin's number and remains a conservative public-node default.
 static const unsigned int MAX_CONNECTIONS = 125;
 
+// Cap inbound connections from any single address. Without it one source can
+// hold every slot up to MAX_CONNECTIONS -- exactly what happened to the
+// rendezvous relays, where a single IP parked hundreds of connections and
+// starved real peers. A legitimate peer, even a relay talking to a relay,
+// needs only a handful; 32 leaves generous room while denying any one address
+// more than a quarter of the table. The firewall connlimit on the relays does
+// the same thing a layer lower; this makes every build carry the defense.
+//
+// Loopback (127.0.0.0/8) is exempt in the accept path. A managed-Tor node
+// receives every inbound onion peer over its local hidden-service listener, so
+// they all appear as 127.0.0.1 -- capping loopback would cap onion peers as a
+// group, which is exactly wrong for a network moving toward onion-only. The
+// global MAX_CONNECTIONS still bounds the total; a per-onion-identity limit,
+// applied once identity is known after accept(), is the right future tool for
+// onion floods.
+static const unsigned int MAX_CONNECTIONS_PER_IP = 32;
+
 // A node marked for disconnect is normally held until its buffers drain, so
 // a last message still goes out. But vSend cannot drain through a socket
 // whose far end is gone, and that made such a node immortal: it stayed in
@@ -176,7 +215,7 @@ static const int          BTF_BEHIND_WARN_INTERVAL_SECS = 5 * 60;
 //
 // These counters exist so it can. Cheap to keep, and they name the failures
 // that actually happened rather than the ones that sound impressive.
-extern int   nPeersWatched;        // peers in the last select() set
+extern int   nPeersWatched;        // peers in the last poll() set
 extern int64 nBlocksReceived;      // blocks handed to ProcessBlock
 extern int64 nBlocksWithoutParent; // ...of those, how many arrived orphaned
 
@@ -236,15 +275,17 @@ void CheckForShutdown(int n);
 // The message start string is designed to be unlikely to occur in normal data.
 // The characters are rarely used upper ascii, not valid as UTF-8, and produce
 // a large 4-byte int at any alignment.
-// Magic bytes unique to the Bitflash network (0xbf = "BF"). Second byte bumped
-// to 0x20 for the 2026 stable relaunch so the old test chain can't interfere.
-static const char pchMessageStart[4] = { 0xbf, 0x20, 0x5c, 0xfd };
+// Magic bytes unique to the selected Bitflash network. Mainnet uses 0xbf =
+// "BF"; testnet swaps the whole sequence so a test node cannot handshake with
+// mainnet before consensus-level testnet activation exists.
+extern char pchMessageStart[4];
 
 class CMessageHeader
 {
 public:
     enum { COMMAND_SIZE=12 };
-    char pchMessageStart[sizeof(::pchMessageStart)];
+    enum { MESSAGE_START_SIZE=4 };
+    char pchMessageStart[MESSAGE_START_SIZE];
     char pchCommand[COMMAND_SIZE];
     unsigned int nMessageSize;
 
@@ -335,7 +376,7 @@ public:
         nServices = 0;
         memcpy(pchReserved, pchIPv4, sizeof(pchReserved));
         ip = 0;
-        port = DEFAULT_PORT;
+        port = GetDefaultPort();
         nTime = GetAdjustedTime();
         nLastFailed = 0;
     }
@@ -365,7 +406,7 @@ public:
         nServices = nServicesIn;
         memcpy(pchReserved, pchIPv4, sizeof(pchReserved));
         ip = 0;
-        port = DEFAULT_PORT;
+        port = GetDefaultPort();
         nTime = GetAdjustedTime();
         nLastFailed = 0;
 
@@ -656,9 +697,6 @@ public:
     int64 nLastSend;
     int64 nLastRecv;
     int64 nLastSendEmpty;
-    int64 nIncompleteMessageStart;
-    unsigned int nIncompleteMessageSize;
-    string strIncompleteMessageCommand;
     string strBtfAddr;
     string strBtfMeeting;
 
@@ -699,11 +737,13 @@ public:
         nLastSend = 0;
         nLastRecv = 0;
         nLastSendEmpty = GetTime();
-        nIncompleteMessageStart = 0;
-        nIncompleteMessageSize = 0;
-        strIncompleteMessageCommand.clear();
         strBtfAddr.clear();
         strBtfMeeting.clear();
+        // Not waiting on anything yet. Left indeterminate, the first partial
+        // message this peer sends is measured against whatever was in this
+        // memory, and ProcessMessages drops it as unreadable on first contact.
+        nMsgWaitSince = 0;
+        nMsgWaitSize = 0;
         nStartingHeight = -1;
 
         // Push a version message
@@ -798,13 +838,51 @@ public:
         static int64 nLastTime;
         nLastTime = nNow = max(nNow, ++nLastTime);
 
-        // Each retry is 2 minutes after the last
-        nRequestTime = max(nRequestTime + 2 * 60 * 1000000, nNow);
+        // Each retry is 2 minutes after the last -- and because nRequestTime
+        // is shared across peers, the same spacing is what strings requests
+        // for one inv across its announcers. For transactions that is pacing;
+        // for a new block it was the stall of issue #33: nine peers announce
+        // the block, the first one asked does not serve it, and the ninth
+        // candidate is not even asked until sixteen minutes in, with the pool
+        // mining on the stale tip the whole time.
+        //
+        // Blocks retry on the fetch timescale, but only while we are at the
+        // tip. That is where the stall costs something -- the pool keeps
+        // handing out jobs against a dead tip -- and it is also where the
+        // spacing is nearly free: one block is in flight, and its body has
+        // almost always arrived before the second announcer's turn comes
+        // round, so AlreadyHave drops the duplicate before a getdata is sent.
+        //
+        // While catching up neither half holds. A peer working through a
+        // 500-deep queue can be minutes away from block N without anything
+        // being wrong, so at 15s the second announcer is asked at +15s, the
+        // third at +30s, and the bulk download arrives once per announcer --
+        // up to eight times over. Nothing caps that: the eight-entry cap is on
+        // mapBlockFetch, which is a different mechanism from this spacing.
+        // Two minutes is the right number there, and it is what this line did
+        // before. Failover at the tip does not depend on this being 15s in any
+        // case: mapBlockFetch re-issues a stalled getdata to the next peer on
+        // its own timer, which is what actually fixes #33.
+        bool fFast = (inv.type == MSG_BLOCK && IsBlockFetchNearTip());
+        int64 nRetryUsecs = (fFast ? BLOCK_FETCH_RETRY_SECS : 2 * 60) * 1000000LL;
+        nRequestTime = max(nRequestTime + nRetryUsecs, nNow);
         mapAskFor.insert(make_pair(nRequestTime, inv));
     }
 
 
 
+    // "sending: tx (N bytes)" alone was ~71% of a 13-hour production
+    // debug.log (issue #35), so tx sends are demoted to the /debugrelay-gated
+    // "relay" category; every other command's send trace stays on "net".
+    // The line is emitted in pieces across BeginMessage/EndMessage/
+    // AbortMessage, so all three must agree on the category or orphaned
+    // "(N bytes)" fragments would leak into a plain -debug log.
+    // Valid only mid-message (nPushPos != -1).
+    const char* SendLogCategory() const
+    {
+        return strcmp(GetMessageCommand(), "tx") == 0 ? "relay" : "net";
+    }
+
     void BeginMessage(const char* pszCommand)
     {
         EnterCriticalSection(&cs_vSend);
@@ -812,17 +890,19 @@ public:
             AbortMessage();
         nPushPos = vSend.size();
         vSend << CMessageHeader(pszCommand, 0);
-        if (LogAcceptsCategory("net")) printf("sending: %-12s ", pszCommand);
+        if (LogAcceptsCategory(SendLogCategory())) printf("sending: %-12s ", pszCommand);
     }
 
     void AbortMessage()
     {
         if (nPushPos == -1)
             return;
+        // Capture before nPushPos is cleared; GetMessageCommand() needs it.
+        const char* pszCategory = SendLogCategory();
         vSend.resize(nPushPos);
         nPushPos = -1;
         LeaveCriticalSection(&cs_vSend);
-        if (LogAcceptsCategory("net")) printf("(aborted)\n");
+        if (LogAcceptsCategory(pszCategory)) printf("(aborted)\n");
     }
 
     void EndMessage()
@@ -830,7 +910,11 @@ public:
         extern int nDropMessagesTest;
         if (nDropMessagesTest > 0 && GetRand(nDropMessagesTest) == 0)
         {
-            if (LogAcceptsCategory("net")) printf("dropmessages DROPPING SEND MESSAGE\n");
+            // Same category as the "sending: " this line interrupts, so a tx
+            // does not announce its own drop under "net" having been gated
+            // off under "relay". nPushPos can be -1 here, and then
+            // GetMessageCommand() returns "" and this is "net" as before.
+            if (LogAcceptsCategory(SendLogCategory())) printf("dropmessages DROPPING SEND MESSAGE\n");
             AbortMessage();
             return;
         }
@@ -842,10 +926,10 @@ public:
         unsigned int nSize = vSend.size() - nPushPos - sizeof(CMessageHeader);
         memcpy((char*)&vSend[nPushPos] + offsetof(CMessageHeader, nMessageSize), &nSize, sizeof(nSize));
 
-        if (LogAcceptsCategory("net")) printf("(%d bytes)  ", nSize);
+        if (LogAcceptsCategory(SendLogCategory())) printf("(%d bytes)  ", nSize);
         //for (int i = nPushPos+sizeof(CMessageHeader); i < min(vSend.size(), nPushPos+sizeof(CMessageHeader)+20U); i++)
         //    printf("%02x ", vSend[i] & 0xff);
-        if (LogAcceptsCategory("net")) printf("\n");
+        if (LogAcceptsCategory(SendLogCategory())) printf("\n");
 
         nPushPos = -1;
         LeaveCriticalSection(&cs_vSend);