From 41b2ba748531605a1afd84fdb967330c0efc529f Mon Sep 17 00:00:00 2001 From: Bitflash Date: Wed, 29 Jul 2026 14:11:58 -0300 Subject: net: exchange signed .btf descriptors between peers (#32) Discovery has depended entirely on the Nostr relays. Two connected nodes never told each other who else existed, so a relay outage left a running network unable to grow, and a node that found one stale peer had no way to learn there was anything better. The old `addr` gossip went out with the IRC seed. Peers now trade signed descriptors over a new "btfpeers" message: our own first, then peers that actually answered us. The receiver checks each Schnorr signature against the key the `.btf` address decodes to, so the sender is trusted for nothing -- forging an entry needs somebody else's secret key. That leaves flooding with self-generated keys, which the per-message caps and the "peers that answered" ordering are there to blunt. Unknown commands are ignored (main.cpp), so nodes without this just drop the message; nothing here is a protocol break. The cache from the peer-cache change now keeps each peer's descriptor verbatim alongside the parsed fields, because that signature is what makes a peer relayable. Entries without one -- resolved through Nostr, or written before this -- stay dialable, just not passed on. A dial never clears a descriptor already on file. --- src/net.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'src/net.h') diff --git a/src/net.h b/src/net.h index f028c3b..7d70721 100644 --- a/src/net.h +++ b/src/net.h @@ -29,6 +29,21 @@ CNode* ConnectNodeBtfResolved(const string& strBtfAddr, const string& strMeeting void ThreadBtfAccept(void* parg); void ThreadBtfConnect(void* parg); extern string strBtfConnect; + +// --- .btf peer exchange --------------------------------------------------- +// Peers gossip signed descriptors so discovery survives a relay outage. Both +// caps apply to a single "btfpeers" message; the generic header limit is 256 MB, +// which is no protection at all for something a stranger can send unprompted. +static const unsigned int MAX_PEX_DESCRIPTORS = 20; +static const unsigned int MAX_PEX_DESCRIPTOR_BYTES = 1024; +// Ignore a peer's exchange more often than this. One announcement per side per +// connection is the intended traffic; anything faster is someone else's idea. +static const int64 PEX_MIN_INTERVAL = 60; + +// Descriptors to hand a peer: ours first, then peers that answered us. +void BtfPexCollect(std::vector& vDescOut); +// Verify descriptors a peer sent and remember the good ones. Returns how many. +int BtfPexAccept(const std::vector& vDesc); void AbandonRequests(void (*fn)(void*, CDataStream&), void* param1); bool AnySubscribed(unsigned int nChannel); void ThreadBitcoinMiner(void* parg); @@ -467,6 +482,9 @@ public: // publish and subscription vector vfSubscribe; + // Last "btfpeers" we accepted from this node, to rate-limit the exchange. + int64 nLastPexRecv; + CNode(SOCKET hSocketIn, CAddress addrIn, bool fInboundIn=false) { @@ -483,6 +501,7 @@ public: fDisconnect = false; nRefCount = 0; nReleaseTime = 0; + nLastPexRecv = 0; vfSubscribe.assign(256, false); // Push a version message -- cgit v1.2.3