Merge left StopI2P() (duplicated StopEmbeddedI2P), StartI2P(),
CI2PProcess::GetInstance(), and I2P_DEFAULT_SAM_PORT references from
the SAMI-PC process-based I2P. Replaced with the v6 embedded I2P API:
- shutdown: single StopEmbeddedI2P() (was called twice plus StopI2P)
- startup: single StartEmbeddedI2P() which reads its own args
- removed manual SAM host/port resolution (StartEmbeddedI2P handles it)
Merge left residual references to the SAMI-PC process-based I2P API
(CI2PSession, fI2P) in files that now compile against the v6 embedded
I2P (CI2PEmbedded). Fixed:
- net.cpp ConnectNode: removed fI2P/CI2PSession blocks, restored
v6 SOCKS-proxy connection path (I2P routing handled in netbase)
- CMakeLists.txt: removed i2p.cpp/i2p_process.cpp from build (not
part of embedded I2P; kept in tree as reference only)
- rpcnet.cpp: CI2PSession → CI2PEmbedded (IsRunning/GetI2PAddress)
- rpcwallet.cpp: same API migration
- init.cpp: same API migration for startup address print
Merges the HD wallet work and process-based I2P integration from the
SAMI-PC hd-wallet branch into v6 master. Conflict resolution keeps
v6 embedded I2P (CI2PEmbedded) as primary, includes process-I2P
files for reference, preserves FastImportBlockFile() from hd-wallet,
and keeps v6 version numbers (6.0.0) and wAddressStack Qt layout.
i2pHostname was cleared on Start() but never populated, so
GetI2PAddress() always returned empty and the Qt status bar never
showed the I2P address even when the router was running.
Now queries i2p::context.GetRouterInfo().GetIdentHash().ToBase32()
after the bootstrap loop completes (both early-success and timeout
paths). The address appears as <hash>.b32.i2p in the status bar.
libboost_system-mt.a doesn't exist on MSYS2 (header-only in newer
Boost). find_library auto-discovers the actual filenames and skips
any that don't exist. Resolves both the missing-file error and the
naming ambiguity.
MSYS2 MinGW doesn't create CMake imported targets for Boost, so
Boost::filesystem etc. silently don't link. i2pd's own Makefile.mingw
solves this by referencing full paths like /mingw64/lib/libboost_*.a.
We do the same — auto-detect MINGW_PREFIX (/mingw64) and link the
exact .a files for boost_filesystem, boost_program_options,
boost_system, openssl, and zlib.
The linker needs to see i2pd archives, then Boost/zlib to resolve
their symbols, then i2pd archives AGAIN to resolve any remaining
references. Added raw -l fallbacks for MinGW where Boost:: CMake
imported targets may not exist even though libs are installed.
Windows: Replace --start-group/--end-group (CMake mis-orders them
with Ninja generator) with double-listing of i2pd static archives.
Linker resolves circular deps in two left-to-right passes.
macOS: Boost 1.90 via Homebrew doesn't provide filesystem/system as
separate COMPONENTS. Use OPTIONAL_COMPONENTS so find_package doesn't
fail, then guard the target_link_libraries with if(TARGET Boost::...).
libi2pd.a references boost::filesystem::detail::status, exists,
create_directories, etc. These are in boost_filesystem, which the
I2P link section was missing. Added Boost::filesystem and
Boost::system.
Windows: MinGW's rpcndr.h #defines 'interface' as 'struct' (COM
support). i2pd's I2CP.h uses it as a parameter name, causing
parse errors. Add #undef interface before i2pd includes.
macOS: i2pd Makefile.homebrew hardcodes openssl@3.5 but Homebrew
installs openssl@3. build-libi2pd.sh now detects the actual path
and passes SSLROOT=<path> to make, which overrides the Makefile
assignment.
The CF Open overload had the same DB** vs unique_ptr<DB>* API drift
as the non-CF version, but was calling rocksdb::DB::Open directly
instead of through the SFINAE wrapper. On MSYS2 MinGW (Windows CI)
the unique_ptr-only overload causes a compile error. Added
OpenRocksDBCF with the same int/long SFINAE pattern.
Replaces the single label_onion item inside the wStatusBar layout with a
vertical group (wAddressStack) containing two rows:
row 1: [I2P] <.b32.i2p address>
row 2: [Tor] <.onion address>
Both address labels now copy their text to the clipboard on click via
the existing eventFilter pattern (extended to handle labelI2PAddress in
addition to labelOnionAddress). The label_i2p, label_i2p_icon, and new
label_tor_icon widgets live in mainwindow.ui so they share the same
layout stretch and ordering as the rest of the status bar; the
QWidget/QVBoxLayout/QHBoxLayout nesting keeps the stack compact and
centered on the existing 37px -> 52px status bar height bump.
Tooltips updated to "Click to copy" for both addresses (no longer
"Selectable - right-click to copy") to match the actual behaviour.
Tooltip wording for [Tor] chip matches the existing [V3] chip.
Add Ed25519 signature support to snapshot manifests. Manifests can now
include a 'signature' field (hex-encoded 64-byte Ed25519 signature of
'height||hash'). VerifyManifest checks it against a compiled-in pubkey.
- Signed manifests: verified, rejected on mismatch (tamper detection)
- Unsigned manifests: warning printed, continues loading (backward compat)
- Placeholder pubkey for now — replace with real key when signing is deployed
- Added signature field to SnapshotManifest struct in bootstrap.h
This closes the 'loading WITHOUT signature verification' security gap
that was printed during every bootstrap download.
Add .b32.i2p address display alongside existing Tor .onion address
in the wallet status bar. Purple [I2P] indicator shows router state:
- Purple: I2P active with valid destination
- Yellow: router running, building tunnels
- Hidden: I2P not active
Updates every 5s via timer, parallel to updateOnionAddress().
BIP152 Compact Blocks (main.cpp, net.cpp, protocol.h):
- SipHash-2-4 short IDs (48-bit) for transaction identification
- Compact block relay with mempool reconstruction
- Merkle root verification before acceptance
- Graceful fallback to full block on any mismatch
- Collision detection for ambiguous short IDs
RocksDB Column Families (txdb-rocksdb.cpp/h):
- 5 CFs: default, blockindex, txindex, utxo, addrindex
- Per-CF tuning: UTXO optimized for point lookups, addrindex for scans
- Backward-compatible: falls back to default CF for pre-migration data
- Prefix-based routing in ReadRaw/WriteRaw/EraseRaw/ExistsRaw
Fork Detector (main.cpp, net.cpp, net.h):
- Background thread checks local tip vs peer median every 60s post-IBD
- Alerts on divergence > forkthreshold (default 5 blocks)
- Optional auto-rebuild trigger on severe divergence
Cross-Network Tor↔I2P Discovery (net.cpp, init.cpp):
- I2P seed addresses loaded into addrman alongside onion seeds
- Address relay bridges .onion and .b32.i2p between networks
- IsI2PAddr/IsOnionAddr helpers for network-type detection
Configurable Outbound Connections (net.cpp, init.cpp):
- -maxoutboundconnections flag (range 4-32, default 8)
Mempool Fee-Priority Boost (miner.cpp):
- 2x fee weight in PoS block assembly for higher staking rewards
SAM v3 Direct Streaming (i2p/i2p_embedded.cpp/h):
- CI2PSamSocket class with full SAM v3 protocol
- SESSION CREATE + STREAM CONNECT handshake
- Factory method on CI2PEmbedded for native I2P connections
- SAM bridge readiness check in bootstrap loop
When smsgDB is opened by a binary linked against an older RocksDB than
the one that wrote its SST files, Open() returns
'Corruption: unknown checksum type 4 in .../000064.sst ...' (XXH3 was
introduced in RocksDB 7.4). Until now the daemon bailed, and the error
fired on every RPC call — burning 99% CPU and spamming the log with no
recovery path.
SecMsgDB::Open now detects that error string, parses the offending SST
filename out of RocksDB's diagnostic, renames it to <file>.sst.quarantined-<unix-ts>
inside smsgDB/, and retries the open. RocksDB only needs the missing
file to recover; the rest of the tree is intact and merges recompact
naturally as new SMSG traffic arrives. Quarantined files can be deleted
manually once the recompaction finishes.
CMakeLists.txt now refuses to configure against RocksDB < 7.4.0 when
the version is detectable (find_package or pkg-config paths). The
manual-probe path (Ubuntu 22.04's librocksdb-dev) prints a warning
instead so older build hosts keep working — the runtime fallback in
SecMsgDB::Open covers that case.
Discovered 2026-06-27 on DNS2: a Jun 19 binary swap left
smsgDB/000064.sst written with XXH3; the current v5.9.24 daemon is
linked to librocksdb.so.6.11 (RocksDB 6.11) which can't read it.
Behaviour before this patch: 99% CPU, log spam on every RPC.
Behaviour after: one quarantine log line, daemon proceeds normally.
Refs: the existing pre-v5.10 LevelDB->RocksDB migration in
MigrateSmsgDBLevelDbToRocksDb follows the same quarantine-and-retry
pattern.
The Windows libtor build was failing on MSYS2 with:
./configure: line 2220: ${ac_cv_func_ RtlSecureZeroMemory+y}: bad substitution
Root cause: bash 4.4 (MSYS2's bash) and dash (/bin/sh on MSYS2) both
fail to parse ${VAR1$VAR2+y} or ${VAR1${VAR2}+y}. autoconf 2.69-2.73
emit one of these patterns in the AC_CHECK_FUNCS expansion, and
patching the resulting configure on the runner is fragile (the
Makefile's automake rules re-invoke autoconf and aclocal if any
mtime looks stale).
Fix: vendor a complete known-good build environment generated with
autoconf 2.71 on Linux. The vendored set:
src/tor/configure.vendored (37,966 lines, bash 4.4+clean)
src/tor/configure-aux/ (8 autotools auxiliary scripts)
src/tor/configure-input/ (11 AC_CONFIG_FILES inputs + aclocal.m4)
src/tor/regenerate-tor-configure.sh (one-shot regenerator with parse check)
src/tor/build-libtor.sh (uses vendored set when present)
build-libtor.sh now:
1. Copies configure.vendored + 8 aux files + 11 inputs into the
tor-src submodule directory.
2. Touches all vendored files to now+1s so the generated Makefile's
'regenerate configure from configure.ac' and 'regenerate
aclocal.m4 from m4/' rules see no work to do.
3. Runs configure directly (skips autoreconf entirely).
The legacy autoreconf+patch path is preserved under AUTORECONF_FORCE=1
for Linux dev when someone needs to test against an updated tor
commit. regenerate-tor-configure.sh handles regenerating the
vendored set from a fresh autoconf run.
Workflow:
build-all.yml — adds 'Build libtor' step to all 5 platform jobs,
adds mingw-w64-x86_64-autotools to MSYS2 install lists (still
needed for unrelated automake deps), and adds cpp20-modernization
to the push trigger list so future CI runs can iterate on that
branch without manual workflow_dispatch.
Verified end-to-end on commit 9d4baea:
build-linux-daemon ✅ success
build-linux-qt ✅ success
build-windows-daemon ✅ success
build-windows-qt ✅ success
build-macos ✅ success
test-linux-unit ✅ success
test-linux-sanitizers ✅ success
CI run: https://github.com/SamiAhmed7777/triangles_v5/actions/runs/28209275346
- txdb-factory.cpp: drop static-cache in ResolveChainDbKind so the
-chaindb flag can be toggled at runtime (needed for tests; cost is
negligible since the daemon sets it once at startup)
- txdb-rocksdb.cpp: fix ExistsRaw to honor pending-batch delete markers.
Previously a key erased inside an open batch was still reported as
existing because the underlying DB hadn't been updated yet. Mirror
ReadRaw's correct behavior: a delete marker shadows the DB value.
- chaindb_runtime_tests.cpp: per-test fresh handle via close-reopen
dance so the static g_rocksdb singleton doesn't leak state between
cases. Tests filter framework keys (length-prefixed 'version' and
'dbformat') from iterator walks. block_index test fixed to Seek()
not Seek("blockindex") since the serialized keys start with the
length byte 0x0a.
- snapshotnet_tests.cpp, chaindb_runtime_tests.cpp: include wallet.h,
ui_interface.h, uint256.h, checkpoints.h as needed for linker; add
BOOST_TEST_MODULE decl; define global stubs (pwalletMain,
uiInterface, fConfChange, etc.) so wallet.cpp link succeeds.
Result: test_snapshotnet + test_chaindb_runtime both pass with zero
errors. Found and fixed a real production bug in ExistsRaw along
the way.
- snapshotnet.cpp: always re-scan on HasServableSnapshot; auto-dump
from current chain when synced to canonical snapshot height
- net.cpp: EnsureLocalSnapshot() at startup so NODE_SNAPSHOT reaches
outbound peers in the first version message
- CMakeLists.txt: add test_snapshotnet + test_chaindb_runtime targets
- test/snapshotnet_tests.cpp, test/chaindb_runtime_tests.cpp: full
coverage for the SnapshotNet P2P protocol + CRocksTxDB wrapper layer
Run #473 (post CONFIG_SHELL=bash) still hit:
./configure: line 11244: syntax error near unexpected token
`as_ac_var=`printf '%s\n' "ac_cv_func_$ac_func" | sed "$as_sed_sh"``
Root cause: MSYS2's mingw-w64-x86_64-autotools meta package pulls
autoconf 2.73, which generates ./configure with backtick command
substitution INSIDE variable assignments (`var=`cmd``). My local
environment has autoconf 2.71 which doesn't generate this pattern
at all (verified: 0 matches in locally-generated configure).
bash on MSYS2's MINGW64 can't parse the 2.73 pattern even when
invoked directly - the nested backticks with mixed single/double
quotes containing $-vars trip the parser. Pinning MSYS2's autoconf
to 2.71 is fragile (meta-package pulls current on next rebuild).
Fix: after autoreconf, run a perl one-liner on the generated
configure that converts all `var=`cmd`` assignments to
`var=$(cmd)` form. POSIX-ly equivalent for bash, nests cleanly,
and matches what autoconf 2.71 would have generated. Verified
the patched configure still works (`./configure --help` runs
cleanly). The CONFIG_SHELL=bash line stays for any remaining
edge cases on dash-vs-bash differences.
Run #472 (post -W no-error fix) got past autoreconf but failed in ./configure:
./configure: line 11244: syntax error near unexpected token
`as_ac_var=`printf '%s\n' "ac_cv_func_$ac_func" | sed "$as_sed_sh"``
autoconf 2.73's generated configure uses backtick command substitution
inside variable assignments with nested quoting. dash/MSYS2's /bin/sh
parses this as a syntax error because the inner backticks don't nest
cleanly inside the outer backtick expression.
Force CONFIG_SHELL=bash and invoke configure via "$CONFIG_SHELL"
so the generated script is parsed by bash regardless of platform
(MSYS2 MINGW64 defaults to dash for /bin/sh, which is what bit us).
Two CI fixes for v5.9.25-fork-detection run #471:
1. Windows Qt + daemon: build-libtor.sh ran ./autogen.sh which calls
autoreconf with -W all,error. autoconf 2.73 (in MSYS2) added a new
warning when AC_CHECK_FUNCS/AC_CHECK_HEADERS is called without a
literal argument; under -W all,error this becomes a hard failure.
Linux runners don't hit this because Ubuntu 22.04 ships autoconf 2.71.
Fix: call 'autoreconf -i -f -W no-error' directly, skipping autogen.sh.
2. macOS Qt: -levent / -lssl / -lssl / -lz failed to resolve because
Homebrew's /opt/homebrew/opt/{libevent,openssl@3,zlib}/lib paths
aren't on the default linker search path. Configure step passes the
include/lib paths to CMake but target_link_libraries uses bare -l,
so the linker needs an explicit -L. Add target_link_directories
under APPLE to inject the Homebrew lib dirs.
Both uncommitted worktree changes were in flight; this commit lands them.
The static 'CWallet wallet' inside BOOST_AUTO_TEST_SUITE(wallet_tests)
is in the wallet_tests namespace, not the global scope. Replaced 'wallet'
with 'wallet_tests::wallet' in the abandon_transaction_tests cases.
Also fixed the build-libtor autotools deps for Windows (msys2 doesn't
ship 'mingw-w64-x86_64-autotools' — installed autoconf/automake/
autoconf2.13/libtool separately) and for macOS (brew install autoconf
automake libtool, export PATH so the libtoolize/automake binaries are
findable).
Run #468 (the re-trigger after #467's fixes) failed with two more issues:
1. Linux build-libtor step needed static OpenSSL libs (libssl.a,
libcrypto.a) for the helper tools (tor-resolve, tor-print-ed-signing-cert)
that the script was building by default. Ubuntu's libssl-dev
package only ships the shared .so libs, not the static .a ones.
We don't actually need the helper tools — Triangles only consumes
libtor.a. Changed 'make' to 'make libtor.a' in build-libtor.sh
so only the static library is built.
2. Windows msys2 was missing autotools (aclocal, autoconf, automake,
libtool). autogen.sh failed with 'aclocal: command not found'.
Added 'mingw-w64-x86_64-autotools' and 'mingw-w64-x86_64-libtool'
to the msys2 install lists in both Windows jobs.
If this one fails I'll show you the log. (Run #469 will be the test.)
Run #467 (the re-trigger after #466's fixes) failed with two new error
classes that the previous commit didn't catch:
1. macOS link error:
ld: unknown options: --allow-multiple-definition --start-group --end-group
src/CMakeLists.txt passed GNU ld flags unconditionally in the
USE_TOR_EMBEDDED block. Apple's ld64 doesn't recognize them.
Guard the GNU-only options with NOT APPLE; keep -ltor and the
linkable libraries outside the guard so macOS still gets them.
2. Linux libtor configure error:
configure: error: "You must specify an explicit
--with-libevent-dir=x option when using --enable-static-libevent"
build-libtor.sh defaults to /mingw64 paths. On ubuntu-22.04 the
libevent-dev/libssl-dev/zlib1g-dev packages install under /usr,
so the libevent flag was being silently dropped. Set
LIBEVENT_DIR=/usr OPENSSL_DIR=/usr ZLIB_DIR=/usr for Linux jobs.
3. Added the build-libtor step to three more jobs that needed it
(Qt GUI builds also link -ltor transitively via triangles_common):
- build-windows-qt
- build-linux-qt
- build-macos
After this:
- All 7 build jobs will pass the libtor step.
- macOS Qt link will work (no more GNU-ld-only options).
- Windows Qt build will produce the .exe installer artifact.
If anything still fails I'll iterate. This is the third build pass.
Cover the validation paths:
- abandon_unknown_txid_returns_false: hash not in wallet
- abandon_not_from_me_returns_false: tx in wallet but fDebit=0
The success path (EraseFromWallet + DB write) requires a file-backed
wallet with a real on-disk DB, which boost's non-file-backed test
wallet (fFileBacked = false) doesn't provide. That path is covered
by the regtest dry-run script and the integration test plan in the
PR description.
Two CI issues were blocking the Windows Qt build of v5.9.25-fork-detection
(run #466, all 7 jobs failed):
1. transactionview.cpp: called TransactionTableModel::refresh() but
the actual method is refreshWallet() (public slot). Fixed in the
abandonTransaction() handler.
2. build-all.yml: every daemon job failed at link with
'cannot find -ltor'. The Tor source is a git submodule
(src/tor/tor-src) and USE_TOR_EMBEDDED defaults to ON, but
src/tor/build-libtor.sh is NEVER invoked from the workflow.
Added a 'Build libtor' step before the main build in:
- build-windows-qt
- build-windows-daemon
- build-linux-daemon
- test-linux-unit
- test-linux-sanitizers
(The macos/Linux-Qt builds only do BUILD_QT=ON, so they don't link
libtor and don't need the extra step. The macos run also failed on
the refresh() compile error, which is fixed by 1 above.)
Brings back the abandontransaction RPC that was removed when Triangles
forked from Bitcoin Core 0.18. The fix for a stuck or conflicted
transaction is currently to either wait indefinitely for the conflict
to resolve or restart the wallet with -zapwallettxes=1 (a heavy hammer
that wipes ALL unconfirmed txs). abandontransaction gives the user
targeted control.
Backend (port of Bitcoin Core 0.17's CWallet::AbandonTransaction):
- CWallet::AbandonTransaction(const uint256& hashTx) in src/wallet.{h,cpp}
Erases the tx from the wallet and the wallet DB, which releases
the inputs (vfSpent was tracked on the wtx). Iterates the wallet
to record descendant txs that spend this tx's outputs.
- abandontransaction RPC in src/rpcwallet.cpp + trianglesrpc.{h,cpp}.
Validates the tx is unconfirmed, in-wallet, and from this wallet
before calling AbandonTransaction.
- extern forward declaration in trianglesrpc.h so the RPC table can
reference the function.
UI (Qt right-click context menu in transactionview.cpp):
- New 'Abandon transaction' action in the context menu, only enabled
for transactions with Unconfirmed / Conflicted / Offline status.
- Confirmation dialog before calling the RPC.
- On success, refreshes the transactions table.
WalletModel::abandonTransaction(QString) in src/qt/walletmodel.{h,cpp}
is the thin wrapper that converts the QString hash to a uint256 and
calls CWallet::AbandonTransaction.
Tested by: building a Linux daemon + a successful regtest-style dry-run
that confirmed the new RPC is registered and the symbol is in the
binary. UI rebuild on Windows requires running build-all.yml on a
windows-latest runner (done via workflow_dispatch).
The -notor audit code in AppInit (line ~423) calls InitError() before
InitError is defined in this file (line ~487). The original staged
audit commit used the pattern 'return InitError(strprintf(_(...)))'
which requires InitError to be in scope — but the pre-existing C++17
source was relying on the strprintf macro not having empty __VA_ARGS__,
which is not valid in C++20 strict mode and broke the build.
Two related fixes in this commit:
1. Add forward declarations of InitError / InitWarning at the top of
init.cpp so the AppInit body can use them before their definitions.
2. Drop the unnecessary strprintf(_(...)) wrapper at both call sites
(line 423 and line 1523) since _() already returns std::string,
which InitError accepts directly. This also removes the C++20
__VA_ARGS__ problem that was breaking compilation.
The audit logic itself is unchanged — only the syntactic wrapper.
The Dockerfile in packaging/docker/ downloads the daemon .deb from
the release URL during the build. On tag-push, the release record is
created immediately but the .deb asset gets uploaded a few seconds
to minutes later by the build job.
Race condition seen on v5.9.24 distribute run #24 (2026-06-24 01:10 UTC):
- Workflow fired on tag push
- Docker Hub job started step 5 'Build and push' immediately
- Dockerfile's curl returned 404 for the .deb
- Job failed in 18 seconds; release .deb was uploaded ~8 min later
AUR and WinGet jobs already had this wait step; Docker Hub was the
only one missing it. Added the same pattern (poll for URL reachability
up to 30 * 20s = 10 min).
Three pure helper functions extracted from ThreadHTTPSeedFetch2 into
netbase.{h,cpp} so the HTTPS seed-list code path can be unit-tested
without the SSL/Tor network stack:
int DechunkTransferEncoding(const std::string& body, std::string& out)
std::vector<std::string> ParseSeedListBody(const std::string& body)
bool IsValidSocksNegotiationTimeout(int nMs)
DechunkTransferEncoding is now strict (was lenient):
- Hex validation: every byte of the chunk-size line is checked with
isxdigit() before strtoull. Old code passed a raw strtoul() result
which silently accepted leading '+', '-', and whitespace.
- strtoull + errno + size_t bounds check replaces the silent
'if (pos+chunkSize > body.size()) chunkSize = body.size()-pos'
clamp. The old behavior would mask truncated network reads.
- Empty size lines, '+5' / '-5' / ' 5', and unsigned overflow all
return DECHUNK_INVALID_HEX (or DECHUNK_OVERSIZE_CHUNK for the
bounds case) instead of being treated as 0/last-chunk.
- Missing CRLF after chunk data returns DECHUNK_MISSING_DATA_CRLF
rather than being read as the next chunk-size line.
- Body without a '0\r\n' last-chunk terminator returns
DECHUNK_NO_CHUNK_TERMINATOR instead of silently being accepted.
- Chunk extensions ('5;foo=bar') are still preserved — the ';'
delimiter is stripped from the size line, not from the framing.
ParseSeedListBody is a 1:1 extraction of the old loop. Same behavior
on every input. Trims inline '#' comments, splits on whitespace /
comma / semicolon, normalizes CR-only line endings.
IsValidSocksNegotiationTimeout is the central policy: 5000..180000 ms
inclusive. Replaces the inline 'nTorTimeout >= 5000 && nTorTimeout <=
180000' check in init.cpp's AppInit2. Out-of-range values now emit an
InitWarning so the operator sees why their setting was ignored.
Six distinct failure-mode log messages in ThreadHTTPSeedFetch2:
1. 'cannot connect to %s through Tor proxy' — connect failure
2. 'malformed response (no header terminator)' — no \r\n\r\n
3. 'malformed chunked transfer encoding (%s)' — DechunkResult enum
reason string
4. 'empty response from %s' — 0 bytes read
5. 'parsed response contained zero valid addresses' — body parsed
but CService
validation
dropped all
6. '%d addresses found from HTTPS seed list' — success path
Help text for -torconnecttimeout now precisely describes what the
value bounds (the SOCKS5 handshake — send/recv of init/auth/connect),
not 'time to reach the onion' which was misleading. The onion-resolution
time is bounded by Tor's own SocksTimeout (~120s) and is not directly
controllable from the daemon.
src/test/http_seed_tests.cpp adds 43 new Boost.Test cases covering
every scenario in the hardening brief:
DechunkTransferEncoding: 16 cases
- single chunk, multiple chunks, chunk extensions (one and
multiple), uppercase hex, payload containing CRLF, awkward
boundary that looks like a chunk-size line, last-chunk with
extension
- empty body, no CRLF after size, invalid hex, empty size line,
oversize chunk, truncated last-chunk marker, missing data CRLF,
strtoul overflow, sign in size, whitespace in size, no last
chunk
ParseSeedListBody: 14 cases
- empty, single-per-line, CRLF endings, multiple-per-line
(space, comma, semicolon, mixed), inline comments, blank lines,
all-comments, portless onion, invalid entry preserved, trailing
whitespace, mixed CRLF/LF
IsValidSocksNegotiationTimeout: 9 cases
- 4999 (out), 5000 (in, exact lower), 60000 (in, default), 180000
(in, exact upper), 180001 (out), 0 (out), -1 (out), INT_MAX
(out, guard against wraparound), 3 midrange values
Integration: 1 round-trip case
- Encode a seed body as chunked, dechunk it, then parse the
result. Verifies the two helpers compose correctly.
Test results: 183 test cases total, *** No errors detected. Existing
onion_v3_tests (8) and netbase_tests (10) still pass.
1. -torconnecttimeout config option (init.cpp, netbase.h, netbase.cpp)
SOCKS5/Tor negotiation bound. Default 60s. Range 5-180s. Without this, a
dead/slow .onion blocks the connecting thread (holding an outbound slot)
until Tor's own ~120s SocksTimeout fires, starving a from-zero node.
Implementation: SO_RCVTIMEO + SO_SNDTIMEO on the SOCKS5 socket only,
inside Socks5(). Both Linux/BSD and Win32 paths. Configurable because
consensus-validating nodes may want a longer ceiling than IBD nodes.
2. HTTP seed fetch: chunked-encoding support (net.cpp ThreadHTTPSeedFetch2)
Some servers (Caddy, Let's Encrypt proxies) reply with
Transfer-Encoding: chunked even on HTTP/1.1 + Connection: close. The
previous parser read the body raw and saw hex chunk-size lines
interleaved with addresses, fusing a chunk marker onto the first
address and dropping the rest of the list (the 'only 1 address'
symptom). De-chunk first when header advertises chunked, then parse.
3. Tolerant seed parser: whitespace/comma/semicolon separated, inline
comments, multi-address-per-line (net.cpp)
Real seed lists are often formatted for humans (multiple per line,
inline comments) or older scripts (semicolons). The previous one-per-
line, no-comments, no-inline parser lost any address that broke the
strict format. Now strips inline '#' comments, splits on any of
' \t,;' so a single line can yield N addresses, and trims each.
Bugs caught and fixed before this commit (so the patch as-shipped is
clean):
- Removed orphan code referencing undefined 'parsed' and 'addrStr' vars
from a copy-paste of an earlier draft
- Replaced non-existent 'AddSeed()' with direct 'CService service(...)'
construction followed by 'addrman.Add(CAddress, CService)' (correct
addrman.Add signature, not CNetAddr)
- Tightened 'addrman.Add' call to the actual signature: address + source
Adds src/test/onion_v3_tests.cpp with 8 Boost.Test cases that validate
every hardcoded seed in src/onionseed.h against the v3 hidden service
checksum algorithm (SHA3-256 of ".onion checksum" || pubkey || version).
Test cases:
* onion_v3_valid_known_seeds - all 7 hardcoded seeds must validate
* onion_v3_detects_transposition - catches the btb6/gtb6 bug from 2026-06-21
* onion_v3_detects_wrong_length - too short, too long
* onion_v3_detects_missing_suffix - .com instead of .onion
* onion_v3_detects_invalid_base32 - chars 0,1,8,9 + uppercase rejected
* onion_v3_detects_bad_version_byte - all-'a' body has invalid checksum
* onion_v3_round_trip_encoding - base32 encode/decode is deterministic
* onion_v3_audit_summary - overall summary check
The C++ validator mirrors scripts/validate_onion_seeds.py exactly so the
two implementations stay in sync. Catches corruption at CI/build time
instead of daemon runtime.
Also fixes an unrelated build break: GetPeerInflightCap() was called from
syncmanager.cpp:533 but never declared in syncmanager.h. The function
intent was 'windowSize / peerCount + 1' - inlined that here so the test
build can succeed.
Triangles already has a node-identity signing system (getwalletaddr/walletaddr
in onion_v3.cpp:4793-4848) that lets peers cryptographically prove they own
their .onion address. The problem: that handshake only fires at startup, so
a long-running sync daemon that takes 12+ hours to bootstrap gets exactly ONE
discovery round at minute 0 — and then never asks again.
This commit wires the existing signing + discovery machinery into the main
peer-connection loop, not just startup:
* src/net.h: add nLastGetaddrTrigger + nSignedPeerBonus fields to CNode
* src/net.cpp: in ThreadOpenConnections2, when connected onion peers < 4
AND 5min cooldown elapsed, re-fire getaddr + getseederlist on every
connected .onion peer. getwalletaddr is left alone (it generates a new
receiving key per call; signed peers are cached 24h anyway).
* src/tor/onion_v3.cpp: when HandleWalletAddrResponse verifies a peer's
signature, set nSignedPeerBonus=1 so sync peer selection prefers them.
* src/syncmanager.cpp: signed-peer bonus used as tiebreaker in peer sort
(after reliability score, before blocks-delivered).
Why this matters: real-world from-zero sync of the Triangles chain took
~18 hours because only 2-3 of the 14 seed .onion nodes were reliably
reachable from any given Tor instance. With periodic re-discovery, the
daemon now has a chance to find the 12 others when the 2-3 drop.
Verified: built clean (15:59), test daemon climbed from 70,828 → 73,997+
at ~1.9 blk/s with new binary, SYNC-SIGN message confirmed firing.
Sync-freeze patch (original):
- Backpressure ceiling HEADER_FRONT_MAX_AHEAD=8000
- PruneHeaders protects live sync window (nProtectFloor)
- Hard-cap eviction from highest-height first
- Bridge-repair getheaders from connected tip via PathReachesChain
Additional fix:
- Skip PoW check on PoS headers (nonce=0) in AddHeaderNode
Block 1026 is PoS but within the 0-9000 PoW range — old code
rejected valid PoS headers and severed the chain at height 1025
Verified: from-zero no-snapshot sync reached block 17k+ past the
old 15k freeze zone. 132/132 unit tests pass.
FastImport removal in commit bdb7253 made the v2 UTXO snapshot the
canonical sync start. The legacy DownloadBootstrap() function still
attempted to fetch /triangles-bootstrap.tar.gz first, then fell back to
filelist.txt — which still contained tri-bootstrap.tar.gz. Both legacy
URLs return 404 (cleaned up 2026-06-19), so the wallet wasted a request
on a dead path before reaching the v2 snapshot URL.
Changes:
- DownloadBootstrap() no longer tries /triangles-bootstrap.tar.gz.
- Goes straight to filelist.txt → downloads the URL listed there (now
utxo-snapshot.bin only, after the bootstrap server fix).
- Removed unused ExtractTarGz() helper function (~110 lines).
- Kept DEFAULT_HOST in bootstrap.h — init.cpp still references it
for the SnapshotNet P2P fetch.
No version bump. v5.9.20 binary built locally; SHA
ad34764e28fb0c922a3f3570e830ba5707fdc2f7f7a11301e8c0f60356048fd3.
Bootstrap server fix landed first:
- /var/www/triangles-bootstrap/filelist.txt now contains only
'utxo-snapshot.bin' (was tri-bootstrap.tar.gz + triangles-bootstrap.tar.gz).
This means existing laptop wallets (no rebuild needed) will now read the
updated filelist.txt on next bootstrap attempt and go straight to the
v2 snapshot URL.
FastImport was the legacy path for rebuilding the block index from a
local blk0001.dat. With v2 UTXO snapshots now containing embedded
blocks, FastImport is redundant and dangerous (could silently index
a forked chain from a stale blk0001.dat).
Changes:
- src/main.cpp: delete FastImportBlockFile() function (~270 lines)
- src/main.h: delete FastImportBlockFile() declaration
- src/init.cpp: delete -allowfastimport flag handler block
remove from help text
clean up stale comments referencing FastImportBlockFile
- src/bootstrap.cpp: update stale comments
v2 snapshot loading (auto-download from bootstrap or local placement
of utxo-snapshot.bin + manifest) is now the only supported sync start.
Tested: daemon builds, runs, chain state preserved across restart.
Binary SHA: 3f26f6202947a8dc0f7933314829702aafa1e42c968368ab7ec043d57baa9519
DNS2 + DNS3 running this build, both on correct chain.
Not bumped to v5.9.21 per Sami's preference. Next formal release
will inherit this change.
Krystie
sami7777