The server isn't running out of memory when the private broadcast
transaction queue is full. Add a new RPC_LIMIT_EXCEEDED code that
can be used whenever a resource is bound and currently at capacity.
Github-Pull: #35678
Rebased-From: 82a02a2a22
Add a belt-and-suspenders feature, limit the amount of
memory and cpu possible when unlucky or simply misconfigured.
The worst case limit is roughly 400kB * 10,000 = 4GB, regardless
of usage pattern.
Before this change, sheer volume of broadcasts, mismatches in
standardness rules, or simply fee mismatches may result in unbounded
growth of memory usage. As the feature may be expanded in
the future, explicit bounds helps reasoning going forward.
Github-Pull: #35406
Rebased-From: 5aea3d0373
In WriteSettings(), verify that writing to the stream and closing it
succeeded before returning true. This prevents RenameOver() from replacing
a valid settings.json with a corrupted or zero-byte file when write limits
or a full disk are encountered.
Additionally, update the ReadSettings() parse failure message to mention
power loss, full disk, or storage error as possible causes.
Fixes#35373
Github-Pull: #35384
Rebased-From: 0654511e1b
Extract the part of `p2p_private_broadcast.py` that fills a given node's
addrman and put it into `test_framework/test_framework.py`.
Github-Pull: #35410
Rebased-From: ab35a028ed
Extract the part of `p2p_private_broadcast.py` that starts
listening on a `P2PConnection` object (or its children classes)
and put it into `test_framework/p2p.py`.
Github-Pull: #35410
Rebased-From: 2333be9cbc
Extract the part of `p2p_private_broadcast.py` that configures and
starts the SOCKS5 server into a reusable function and put it into
`test_framework/socks5.py`.
Use bind port 0 to let the OS pick an available port instead of
hackishly assuming that `p2p_port(N)` is available where N is more
than the number of the nodes the test uses.
Github-Pull: #35410
Rebased-From: 2ffa81fac4
Because the corresponding Taproot fields were added in PSBT in PR 22558, so
these restrictions are no longer necessary.
Github-Pull: #35279
Rebased-From: 81348576cc
send_batch_request() was building raw dicts without a "jsonrpc" version, which made Core to treat them as version 1.0 requests.
This worked in normal mode, but failed with --usecli because TestNodeCLI.batch() expects callables, not dicts.
This commit fixes it by using get_request() which is defined in both AuthServiceProxy and TestNodeCLIAttr.
The assert is changed because by using get_reques() AuthServiceProxy treats it as "jsonrpc" version 2.0 requests, which don't return "error" keys.
Github-Pull: #34991
Rebased-From: 5603ae0ffa
The option is unused since the last removals in:
* 4c40a923f0, and
* 81bf3ebff7
It was brittle and lead to intermittent test issues. Generally, it is
also confusing, because if a test wanted to connect nodes without
checking their connection, it can use `addnode`, like the rpc_setban.py
test.
So fix all issues by removing it.
Github-Pull: #34425
Rebased-From: fae807ed25
This waits for any disconnect (e.g. from a restart of one of the nodes)
to fully happen before the next connect.
Can be reviewed with the git option:
--color-moved=dimmed-zebra
Github-Pull: #34425
Rebased-From: fab2772647
Make the checks stricter and easier to follow:
* Fix a typo.
* After the first ban from node 1 wait until node 0 "sees" the ban.
* Move the restart_node out of the debug log context, to avoid bloat.
* Removed the timeout from the outer/lower exit stack to check "dropped
(banned)\n" on node 1, because the inner/top exit stack waits longer.
* The inner/top exit stack checks for the both disconnections peer=2 and
possibly peer=3 (for v2->v1 retry).
* And finally, add a redundant assert to confirm once more that node 0
is has "seen" the ban.
Github-Pull: #34425
Rebased-From: fa21edddb2
The `Socks5Server` utility handles multiple incoming connections,
which are handled in separate background threads.
The `stop()` method unblocks and waits for the main background thread
cleanly, but it doesn't attempt to wait for any handler threads.
This change stores handler threads and connections, and attempts
to shut them down before `stop()` returns.
Co-authored-by: vasild <vd@FreeBSD.org>
Co-authored-by: w0xlt <94266259+w0xlt@users.noreply.github.com>
Github-Pull: #34863
Rebased-From: 6ac49373aa
Apply the timeout factor inside the add_block function.
Also, force named args for the two expected strings.
Also, add trailing comma for style.
Github-Pull: #35080
Rebased-From: fa02eb87df
The underlying issue was fixed in bitcoin-core/libmultiprocess#268.
Remove the workaround that accepted degraded error messages on Darwin.
Github-Pull: #35014
Rebased-From: b555a0b789
The IPC mining tests (interface_ipc_mining.py) currently use
hardcoded timeouts (e.g., 1000ms, 60000ms) for operations like
waitTipChanged and waiting for block templates. In heavily
loaded CI environments, such as those running sanitizers with
high parallelism, these hardcoded timeouts can be too short,
leading to spurious test failures and brittleness.
This commit multiplies these timeout variables by the test
suite's global `self.options.timeout_factor`. This ensures that
the IPC wait conditions scale appropriately when the test suite
is run with a higher timeout factor, making the tests robust
against slow execution environments.
Addresses CI brittleness observed in bitcoin-core/libmultiprocess#253.
Github-Pull: #34727
Rebased-From: ad75b147b5
Add a test case to interface_ipc_mining.py to verify that the IPC
server correctly handles and reports serialization errors rather than
crashing the node.
This covers the scenario where submitSolution is called with data
that cannot be deserialized, as discussed in #33341
Also introduces the assert_capnp_failed helper in ipc_util.py to
cleanly handle macOS-specific Cap'n Proto exception strings, and
refactors an existing block weight test to use it.
Github-Pull: #34727
Rebased-From: e7a918b69a
The async routines in both interface_ipc.py and interface_ipc_mining.py
contain redundant code to initialize the mining proxy object.
Move the make_mining_ctx helper into test_framework/ipc_util.py and
update both test files to use it. This removes the boilerplate and
prevents code duplication across the IPC test suite.
Github-Pull: #34727
Rebased-From: 63684d6922
This adds a complementary test to interface_ipc_mining.py to ensure
that createNewBlock() wakes up immediately once submitblock advances
the tip, rather than needlessly waiting for the cooldown timer to
expire on its own.
Github-Pull: #34727
Rebased-From: 4ada575d6c
valgrind currently does not work on GCC -O2 compiled executables, which
contain std::optional use, due to an upstream bug. See
https://bugs.kde.org/show_bug.cgi?id=472329
One workaround could be to use -O1. However, that seems brittle, as
variantions of the bug were seen with -O1 as well.
So temporarily use clang in the valgrind CI tasks, because this also
allows to drop a false-positive suppression for:
-DCMAKE_CXX_FLAGS='-Wno-error=array-bounds'
Also, update the comment in contrib/valgrind.supp to mention the
background:
* GCC -O2 wasn't tested with the suppressions file, due to the mentioned
bug.
* Clang-17 (or later) on aarch64 wasn't tested due to bug
https://github.com/bitcoin/bitcoin/issues/29635 and the minimum
supported clang version is clang-17 right now.
* GUI isn't tested, because it requires a debug build, see the prior
commit.
This means the only tested config right now is the one mentioned in the
suppression file.
Github-Pull: #34589
Rebased-From: fa70b9ebaa
This allows to run the test under valgrind:
./bld-cmake/test/functional/feature_dbcrash.py --timeout-factor=10 --valgrind
For testing, the same test can be run multiple times in parallel:
./bld-cmake/test/functional/test_runner.py -j 10 $( printf 'feature_dbcrash.py %.0s' {1..10} ) --timeout-factor=10 --valgrind
(Running the test under valgrind may take several hours!)
I found that before this commit, 9 out of the 10 runs failed via:
```
...
TestFramework (INFO): Iteration 36, generating 2500 transactions [11, 5, 6]
TestFramework (ERROR): Unexpected exception
Traceback (most recent call last):
File "/b-c/test/functional/test_framework/test_framework.py", line 142, in main
self.run_test()
~~~~~~~~~~~~~^^
File "/b-c/bld-cmake/test/functional/feature_dbcrash.py", line 262, in run_test
self.sync_node3blocks(block_hashes)
~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^
File "/b-c/bld-cmake/test/functional/feature_dbcrash.py", line 151, in sync_node3blocks
nodei_utxo_hash = self.restart_node(i, block_hash)
File "/b-c/bld-cmake/test/functional/feature_dbcrash.py", line 102, in restart_node
raise AssertionError(f"Unable to successfully restart node {node_index} in allotted time")
AssertionError: Unable to successfully restart node 0 in allotted time
```
With this commit, all 10 runs passed.
Github-Pull: #34589
Rebased-From: fadb77169b
This should fix https://github.com/bitcoin/bitcoin/issues/34367
I am not familiar with Windows sockets thread-safety, but creating the
event loop on the main thread, and running it in the network thread
could lead to a fast abort in Python on Windows (without any stderr):
```
77/276 - wallet_txn_clone.py failed, Duration: 1 s
stdout:
2025-12-10T08:04:27.500134Z TestFramework (INFO): PRNG seed is: 4018092284830106117
stderr:
Combine the logs and print the last 99999999 lines ...
============
Combined log for D:\a\_temp/test_runner_₿_🏃_20251210_075632/wallet_txn_clone_196:
============
test 2025-12-10T08:04:27.500134Z TestFramework (INFO): PRNG seed is: 4018092284830106117
test 2025-12-10T08:04:27.500433Z TestFramework (DEBUG): Setting up network thread
```
Also, I couldn't find any docs that require the loop must be created on
the thread that runs them:
* https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.new_event_loop
* https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.run_forever
However, the patch seems trivial to review, harmless, and easy to
revert, so it may be a good try to fix the intermittent Windows Python
crash.
Github-Pull: #34820
Rebased-From: fa050da980
we don't need to send GETADDR for initial self announcement
anymore + can construct addr_receivers using
AddrReceiver(send_getaddr=False).
however we would need to send an empty ADDR message to each
of the addr_receivers to initialise addr relay for inbound
connections. so current code is simpler and we can just
clarify the comment.
Github-Pull: #34750
Rebased-From: 57bfa864fe
since we're bumping mocktime more than CHAIN_SYNC_TIMEOUT = 20 * 60,
it's possible for disconnections like this to happen in the test:
$ test/functional/p2p_addr_relay.py --randomseed=7758649581790797022
...
TestFramework (INFO): Check that we answer getaddr messages only once per connection
TestFramework.p2p (WARNING): Connection lost to 127.0.0.1:58829 due to [Errno 54] Connection reset by peer
...
Github-Pull: #34750
Rebased-From: 7ee8c0abc6
the test silently passes on master because SetupAddressRelay
isn't called by default for inbound connections.
Github-Pull: #34750
Rebased-From: ecb5ce6e76
fa0587a306 test: Remove fixed TODO in address_to_scriptpubkey (MarcoFalke)
Pull request description:
After commit d178082996 added the bech32 format, the TODO about adding other formats can be removed.
ACKs for top commit:
sedited:
ACK fa0587a306
rkrux:
crACK fa0587a306
musaHaruna:
ACK [fa0587a](fa0587a306)
Tree-SHA512: 49a8a514bed11e945bd8f9b13b84ae14b4dbc8a7ebb7224b1746776d9dbf68abc3b53d67f1b7fff83bc4360b15324fb96611550f4aca808b16beb03bcbfd0a55
89386e700e kernel: Use fs:: namespace and unicode path in kernel tests (sedited)
Pull request description:
Add support for unicode characters in paths to the kernel tests by using our fs:: wrappers for std::filesystem calls and adding the windows application manifest to the binary. This exercises their handling through the kernel API.
ACKs for top commit:
hebasto:
ACK 89386e700e.
w0xlt:
ACK 89386e700e
Tree-SHA512: 7b541f482d84a66c89eec63aea0e7f7626bbbd62082ad7a7fb2c7a517296c291a6ff301c628e5e9e1d7b850ead89005141481a2bfd06d8a9081622e32f7340cc
5b2c3960b9 test: clean up tx resurrection (re-org) test in feature_block.py (Sebastian Falbesoner)
Pull request description:
The following comment about ECDSA signatures created with the test framework not passing mempool policy has been obsolete for a long time (at least since 2019, see PR #15826):
8c07800b19/test/functional/feature_block.py (L1167-L1172)
so remove it. While at it, change the resurrected txs to be indeed standard valid, so the `acceptnonstdtxn=1` parameter can also be removed from the functional test.
Kudos to stratospher, who (IIRC) mentioned this outdated comment a while ago.
ACKs for top commit:
sedited:
ACK 5b2c3960b9
Bortlesboat:
Tested ACK 5b2c3960b9. Ran feature_block.py locally, passes. Nice cleanup — removing `-acceptnonstdtxn=1` by making the resurrection txs standard (P2PK) is the right approach. The old unsigned OP_TRUE workaround comment explains why this was needed, glad to see it gone.
stratospher:
ACK 5b2c3960. nice!
Tree-SHA512: 94517e432647a8e8db51fad90a26493c57ce9dfd924b17ce909ea40d50bc6279d974c6d2046b34f5f92b481ca5e0abdedaf412ce41b4cb904605c140a8dba583
20ae9b98ea Extend functional test for setBlockIndexCandidates UB (marcofleon)
854a6d5a9a validation: fix UB in LoadChainTip (marcofleon)
9249e6089e validation: remove LoadChainTip call from ActivateSnapshot (marcofleon)
Pull request description:
Addresses https://github.com/bitcoin/bitcoin/issues/34503. See this issue for more details as well.
Fixes a bug where, under certain conditions, `setBlockIndexCandidates` had blocks in it that were worse than the tip. The block index candidate set uses `nSequenceId` as a sort key, so modifying this field while blocks are in the set results in undefined behavior. This PR populates `setBlockIndexCandidates` after the `nSequenceId` modifications, avoiding the UB.
ACKs for top commit:
achow101:
ACK 20ae9b98ea
sedited:
Re-ACK 20ae9b98ea
sipa:
Code review ACK 20ae9b98ea
Tree-SHA512: 121c170bb70fb6365089d578db63c811e7926e129d7206e569947f7a1f6c5ddc8d5f4937b80f1ba1b7d7daa42789b143ca5b56f154b7ab968a1cd55f925f378d
97e7e79435 test: Enable `system_tests/run_command` "stdin" test on Windows (Hennadii Stepanov)
a4324ce095 test: Remove `system_tests/run_command` runtime dependencies (Hennadii Stepanov)
Pull request description:
`system_tests` currently rely on `cat`, `echo`, `false` and `sh` being available in `PATH` at runtime.
This PR:
1. Removes these dependencies.
2. Reduces the number of platform-specific code paths.
The change is primarily motivated by my work on maintaining the [`bitcoin-core`](https://packages.guix.gnu.org/packages/bitcoin-core) package in Guix. It enables the removal of the existing `bash` and `coreutils` native inputs, which in turn makes it possible to drop the implicit dependency on `qtbase@5` (see https://codeberg.org/guix/guix/pulls/4386#issuecomment-8613333).
ACKs for top commit:
maflcko:
re-ACK 97e7e79435👓
janb84:
ACK 97e7e79435
sedited:
ACK 97e7e79435
Tree-SHA512: 1375c676f85c75d571df1ddfc3a4405767dbf0ed7bfea2927c93ec01b29f9f7ae3383e546d2658f595e8ffafa9ab20bba6fcc628a9f5ebdb288bbef03b645fb6
cbdb891de2 test: Wait for txospender index to be synced in rpc_gettxspendingprevout (Ava Chow)
2db5c049bb test: Sync mempools after tx creation in rpc_gettxspendingprevout (Ava Chow)
Pull request description:
On slower runs, the txospender index may not be synced yet when the tests of its behavior begin, causing intermittent failures. Wait for them to be synced before starting the tests.
The tests also query mempool txs from other nodes, make sure mempools are synced before doing so.
The first commit with the following diff reproduces #34735:
```
diff --git a/src/index/txospenderindex.cpp b/src/index/txospenderindex.cpp
index d451bb1e0a4..e786f05a98c 100644
--- a/src/index/txospenderindex.cpp
+++ b/src/index/txospenderindex.cpp
@@ -129,6 +129,7 @@ static std::vector<std::pair<COutPoint, CDiskTxPos>> BuildSpenderPositions(const
bool TxoSpenderIndex::CustomAppend(const interfaces::BlockInfo& block)
{
+ UninterruptibleSleep(100ms);
WriteSpenderInfos(BuildSpenderPositions(block));
return true;
}
```
Fixes#34735
ACKs for top commit:
furszy:
ACK cbdb891de2
andrewtoth:
ACK cbdb891de2
sedited:
ACK cbdb891de2
rkrux:
crACK cbdb891de2
Tree-SHA512: ba1ab6216ac3b647a5f9e20f4899e51e643bf20829e698aa63c127c88ed4e33afa222bebeae1210fc869c46288e99c0b344330197913e244ffe1a6aca943568d
15c4889497 index: document TxoSpenderIndex::FindSpender (furszy)
f8b9595aaa test: Add missing txospenderindex coverage in feature_init (Fabian Jahr)
a1074d852a index, rpc, test: Misc formatting fixes (Fabian Jahr)
Pull request description:
This addresses my own comments in the last review of #24539: https://github.com/bitcoin/bitcoin/pull/24539#pullrequestreview-3829110465
The first commit fixes three small formatting errors.
The second commit adds some missing coverage in `feature_init` and refactors the code a bit as well so these misses don't happen so easily in the future.
The third commit is by furzy:
> TxoSpenderIndex::FindSpender returns an Expected<optional<TxoSpender>> but
the two levels of the return type were undocumented, making it unclear what a returned
nullopt means. So added doc clarifying each return case.
ACKs for top commit:
furszy:
ACK 15c4889497
sedited:
ACK 15c4889497
rkrux:
crACK 15c4889497
Tree-SHA512: 2e0f060a54b558d2967ebae0835cf81bd86c2d8d983d670a48d1bee7d347f186623e75db7ae311ca1566807f715c1b3fa67cf734c9467d35e13b84d082f28253
5c005363a8 test: improve `wallet_backup` test (rkrux)
04d9515748 test: improve `wallet_assumeutxo` func test (rkrux)
Pull request description:
Relates to #34354
While the actual fix of the issue is in another PR, this one improves the
affected tests by trying to reduce the chain notifications that
need to be processed while simulating erroneous wallet restoration
scenarios.
ACKs for top commit:
maflcko:
lgtm ACK 5c005363a8
furszy:
ACK 5c005363a8
w0xlt:
ACK 5c005363a8
brunoerg:
code review ACK 5c005363a8
Tree-SHA512: 176e3ea8275c7aa082af695f5b76d82c079ff9a7178855b4ce95504edb8ce89b59a772e2d38dd43e997a5bea3d64be700b74cfec7bbc6992538f837877ab7222
Fix the from-disk subtest to use a separate node so it builds on a
clean genesis block, rather than the leftover chain from the
in-memory subtest.
Change from a two-way to a three-way block race. The UB in the old
LoadChainTip (mutating nSequenceId, a sort key, while the block is
in setBlockIndexCandidates) corrupts the internal tree structure,
resulting in a failed erase that leaves stale blocks in the set
alongside the tip. With only two competing blocks, this is caught
by libstdc++ but not by libc++. A three-way split triggers the bug
on both implementations.
To trigger CheckBlockIndex (where the crashing assertion is), replace
the restart loop with sending a new block after a single restart.
faa68ed4bd test: Fix intermittent issue in wallet_assumeutxo.py (MarcoFalke)
Pull request description:
The test has many issues:
* It fails intermittently, due to the use of `-stopatheight` (https://github.com/bitcoin/bitcoin/issues/34710)
* Using `-stopatheight` is expensive, because it requires two restarts, making the test slow
* The overwritten `def setup_network` does not store the extra args via the `add_nodes` call, so if code is added in the future to restart a node, it may not pick up its global extra args.
Fix all issues by:
* Adding and using a fast `dumb_sync_blocks` util helper to achieve what `-stopatheight` doesn't achieve
* Calling `self.add_nodes(self.num_nodes, self.extra_args)` in the overridden `setup_network`
Can be tested via this diff:
```diff
diff --git a/src/node/kernel_notifications.cpp b/src/node/kernel_notifications.cpp
index ab0e5ccb69..49384c10b8 100644
--- a/src/node/kernel_notifications.cpp
+++ b/src/node/kernel_notifications.cpp
@@ -61,2 +61,3 @@ kernel::InterruptResult KernelNotifications::blockTip(SynchronizationState state
if (m_stop_at_height && index.nHeight >= m_stop_at_height) {
+ LogInfo("Send shutdown signal after reaching stop height");
if (!m_shutdown_request()) {
diff --git a/src/util/tokenpipe.cpp b/src/util/tokenpipe.cpp
index c982fa6fc4..a5565ebd36 100644
--- a/src/util/tokenpipe.cpp
+++ b/src/util/tokenpipe.cpp
@@ -4,2 +4,3 @@
#include <util/tokenpipe.h>
+#include <util/time.h>
@@ -60,2 +61,3 @@ int TokenPipeEnd::TokenRead()
ssize_t result = read(m_fd, &token, 1);
+ UninterruptibleSleep(500ms);
if (result < 0) {
```
On master: The test fails
On this pull: The test passes
Fixes https://github.com/bitcoin/bitcoin/issues/34710
ACKs for top commit:
kevkevinpal:
ACK [faa68ed](faa68ed4bd)
achow101:
ACK faa68ed4bd
w0xlt:
ACK faa68ed4bd
Tree-SHA512: 6fcd52b6f6a5fa5a5e41e7b3cf5c733af62af9c60271e7d22c266aca90f2af67f91ffe80a3ed8b8d1a91d001700870f493207998bac988c4e3671a3a0dba7ba7
f51665bee7 psbt: validate pubkeys in MuSig2 pubnonce/partial sig deserialization (tboy1337)
Pull request description:
The previous fix for invalid MuSig2 pubkeys (bitcoin/bitcoin#34010) only
addressed the PSBT_IN_MUSIG2_PARTICIPANT_PUBKEYS field. However, the
PSBT_IN_MUSIG2_PUB_NONCE and PSBT_IN_MUSIG2_PARTIAL_SIG fields also
deserialize pubkeys without validation, which could lead to crashes when
invalid pubkeys are processed.
This commit adds validation to the DeserializeMuSig2ParticipantDataIdentifier
function to ensure all pubkeys in MuSig2 pubnonce and partial signature
fields are fully valid elliptic curve points.
The fix:
- Validates both aggregate and participant pubkeys in MuSig2 pubnonce and
partial signature deserialization
- Throws std::ios_base::failure with descriptive error messages for invalid
pubkeys
- Prevents potential crashes from invalid elliptic curve points
- Maintains backward compatibility for valid PSBTs
This completes the fix for issues [#33999](https://github.com/bitcoin/bitcoin/issues/33999) and [#34201](https://github.com/bitcoin/bitcoin/issues/34201).
ACKs for top commit:
rkrux:
lgtm ACK f51665bee7
w0xlt:
ACK f51665bee7
darosior:
utACK f51665bee7
Tree-SHA512: 8454d77a05aa003a3121b0a5975e8a000125ee0d62343bfa625a75db113358ba7a210ae0376ca1666957b7de7005e06e5a54c95170430ee5e9e1416719b8af53
Add support for unicode characters in paths to the kernel tests by using
our fs:: wrappers for std::filesystem calls and adding the windows
application manifest to the binary. This exercises their handling
through the kernel API.
