Chunked transfer trailers are just headers that are included
at the end of the request. We can parse and validate them with code
we already use to read headers. In a future commit we will also
be able to use one MAX_HEADERS_SIZE limit to cover both sections.
Even though we parse and validate, we ignore these data.
fad9ab714b test: Append print_suppressions=0 to LSAN_OPTIONS, and suppress bitcoin-qt (MarcoFalke)
Pull request description:
(see commit msg for rationale and background).
To test, one should be able to use the cmake options such as `-DCMAKE_C_COMPILER='clang' -DCMAKE_CXX_COMPILER='clang++' --preset=dev-mode -DBUILD_GUI=ON -DSANITIZERS=address` on e.g. Fedora. Then see that the current suppressions file is insufficient, and also confirm that `print_suppressions=0` is required.
ACKs for top commit:
fanquake:
ACK fad9ab714b
Tree-SHA512: 1830b4aeb072fa18b76522a124a268073675da14255e469a6d86ee5de52cd08d5613d0c3bd8a66465b0c4636345c9e967923cd1fb516906a58b614fe0e700033
75f5851927 doc: add release note for REST cache-control headers (w0xlt)
bbe21ac29f doc: document REST cache-control defaults (w0xlt)
862a179556 http: add no-store to dispatcher-generated error responses (w0xlt)
acf45c44c0 rest: add Cache-Control headers to REST responses (w0xlt)
Pull request description:
This PR adds explicit Cache-Control headers to REST responses.
The policy is:
- Immutable data gets: `Cache-Control: public, immutable, max-age=86400`
- Mutable, node-local, and error responses get: `Cache-Control: no-store`
Important details:
- `/block` and `/block/notxdetails` bin/hex, `/blockpart`, `/blockfilter`, `/spenttxouts`, and `/deploymentinfo/<blockhash>.json` are treated as immutable.
- `/block` and `/block/notxdetails` JSON, all `/tx` formats, `/headers`, `/blockfilterheaders`, `/blockhashbyheight`, `/chaininfo`, `/mempool`, `/getutxos`, and `/deploymentinfo.json` are no-store.
- REST errors and HTTP dispatcher-generated errors are no-store.
- Unmatched `/rest` 404s also return no-store, including paths like `/rest/tx`, `/rest/does-not-exist`, and `/rest?x=1`.
Tests were added in `interface_rest.py` to cover successful responses, behavior across a newly mined block, REST errors, and unmatched REST 404s.
Docs were added to `REST-interface.md`, including guidance for overriding the defaults in a reverse proxy or CDN.
Closes#33809
ACKs for top commit:
stickies-v:
re-ACK 75f5851927
pinheadmz:
ACK 75f5851927
sedited:
ACK 75f5851927
Tree-SHA512: 292ccd06ddfc9272c17fa720ce1ea8bb05462337af6460488f70003d3daf31fcf262e68c264522a911bba65ae2b25fc88a1fd422e5664583daf64070231cb062
it adds a unit test verifying that clients not permitted by
`-rpcallowip` are rejected immediately after `accept()`, before any of
their request bytes are read from the socket.
Co-authored-by: w0xlt <94266259+w0xlt@users.noreply.github.com>
Co-authored-by: pinheadmz <pinheadmz@pm.me>
db74d3390a doc: clarify test placement guidance (Lőrinc)
Pull request description:
**Problem:** `doc/developer-notes.md` does not explain where test coverage belongs in a commit stack, especially when existing behavior is uncovered or a refactor depends on uncovered behavior.
This has led to review questions about whether tests should record current behavior before a change or be added with the final behavior, for example in [#35251](https://github.com/bitcoin/bitcoin/pull/35251#discussion_r3217842286) and [#31212](https://github.com/bitcoin/bitcoin/pull/31212#discussion_r1854105033).
**Fix:** Add a `General Testing` section under the development guidelines explaining when to use automated tests or a manual testing guide and when behavior-preserving work is easy to validate without new tests.
Add a `Commit Structure for Tests` subsection distinguishing existing coverage, simple uncovered changes, non-trivial changes to uncovered behavior, and non-trivial refactors whose preserved behavior is not covered.
Replace the blanket `CONTRIBUTING.md` rule with a link to the detailed guidance.
ACKs for top commit:
maflcko:
lgtm ACK db74d3390a
pablomartin4btc:
ACK db74d3390a
LarryRuane:
ACK db74d3390a
w0xlt:
ACK db74d3390a
sedited:
ACK db74d3390a
Tree-SHA512: a8f3629b9bd59d20b1bc597d1b43fbb1d3cca9f500a8d79a7b62b417cd6b91c7b92cf6e32946171c76eb54e882a58eac94045753d8bb5899acdb48a7d1ccb2bd
The print_suppressions=0 is required to avoid a CI failure when the
suppressions were used. E.g:
```
$ LSAN_OPTIONS="suppressions=$(pwd)/test/sanitizer_suppressions/lsan:print_suppressions=1" ./bld-cmake/test/functional/interface_gui.py
2026-08-08T10:53:45.864160Z TestFramework (INFO): PRNG seed is: 8358096631255493262
2026-08-08T10:53:45.914748Z TestFramework (INFO): Initializing test directory /tmp/bitcoin_func_test_5zx5343v
2026-08-08T10:53:47.029997Z TestFramework (INFO): Test that bitcoin-gui starts up and can be stopped via RPC
2026-08-08T10:53:47.431761Z TestFramework (ERROR): Unexpected exception:
File "./test/functional/test_framework/test_node.py", line 534, in is_node_stopped
raise AssertionError("Unexpected stderr {} != {}".format(stderr, expected_stderr))
AssertionError: Unexpected stderr -----------------------------------------------------
Suppressions used:
count bytes template
2 181 bitcoin-qt
----------------------------------------------------- !=
```
The general suppression of the qt executables is required to avoid CI
failures for i386 builds. E.g:
```
test 2026-08-05T08:54:08.370427Z TestFramework (ERROR): Unexpected exception:
Traceback (most recent call last):
File "/ci_container_base/ci/scratch_ ₿🧪_/build-i686-pc-linux-gnu/test/functional/interface_gui.py", line 34, in run_test
self.stop_node(0)
~~~~~~~~~~~~~~^^^
File "/ci_container_base/test/functional/test_framework/test_node.py", line 525, in is_node_stopped
assert return_code in expected_ret_code, self._node_msg(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError: [node 0] Node returned unexpected exit code (1) vs ((0,)) when stopping
node0 stderr =================================================================
==73449==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 386 byte(s) in 17 object(s) allocated from:
#0 0x5df28a2d in malloc (/ci_container_base/ci/scratch_ ₿🧪_/build-i686-pc-linux-gnu/bin/bitcoin-qt+0x1d0da2d) (BuildId: 496a5df531df278fe395724ae917f266331b3f81)
#1 0xee03c1d1 (<unknown module>)
Indirect leak of 12 byte(s) in 1 object(s) allocated from:
#0 0x5df28a2d in malloc (/ci_container_base/ci/scratch_ ₿🧪_/build-i686-pc-linux-gnu/bin/bitcoin-qt+0x1d0da2d) (BuildId: 496a5df531df278fe395724ae917f266331b3f81)
#1 0xee03c1d1 (<unknown module>)
SUMMARY: AddressSanitizer: 398 byte(s) leaked in 18 allocation(s).
```
77440814bf fuzz: reset SOCKS5 interrupt between inputs (Hao Xu)
Pull request description:
Reset `g_socks5_interrupt` before each `socks5` fuzz input.
`CThreadInterrupt` remains interrupted until explicitly reset. Previously,
inputs executed after the first input setting the interrupt flag inherited its
state. As corpus inputs are shuffled between all-input coverage runs, the
number of affected inputs and the resulting coverage counts could differ.
Tested with the complete 91-input `socks5` corpus. The all-input deterministic
coverage check passes.
ACKs for top commit:
nervana21:
tACK 77440814bf
maflcko:
lgtm ACK 77440814bf
sedited:
ACK 77440814bf
Tree-SHA512: d1b2b33661f9796628fd7eb1f4ddb212b07110ebbfa7516e305f8aa21bde7898b4bf8fc6f6570df22f8cf6380f1287cb9b6135683ad49b2bdbe83ad9a1af23b9
`SignMuSig2()` derives MuSig2 aggregate keys from metadata supplied by a PSBT.
A hardened child cannot be publicly derived, and a path that produces another key does not identify the aggregate being signed.
Check each child index as `uint32_t` immediately before deriving that child, preserving the hardened bit without an implementation-defined conversion to `int`.
Return failure if a child index is hardened, and skip a path if it derives to a different key so another aggregate can still be tried.
The descriptor parser enforces the same requirement for MuSig2 aggregate derivations.
Co-authored-by: Anthropic Security <security-cvd@anthropic.com>
Co-authored-by: Evan Sultanik <evan.sultanik@trailofbits.com>
Co-authored-by: Ava Chow <github@achow101.com>
Exercise `analyzepsbt` and `finalizepsbt` with mismatched and hardened MuSig2 aggregate derivation paths, restarting the node after each abort so the current behavior remains executable.
a3ebf8ab60 rpc: fix mempool entry vsize docs (Musa Haruna)
Pull request description:
Follow-up to [#32800](https://github.com/bitcoin/bitcoin/pull/32800#discussion_r3672286132).
This fixes the RPC help text for `MempoolEntryDescription()`. These docs are used by mempool-entry RPCs such as `getmempoolentry`, verbose `getrawmempool`, `getmempoolancestors`, and `getmempooldescendants`.
The vsize fields in those results describe transactions already in the mempool, so they are always returned and there is no `allowed` field. This removes the incorrect optional markers and the `testmempoolaccept`-specific “only present when allowed is true” wording.
No behavior change.
ACKs for top commit:
sedited:
ACK a3ebf8ab60
Tree-SHA512: 60574d120d8b85944cde00ebb151c0e847c25000d5ea822ee4d624c723626a1c4db187fa8d09f2fe4405cccb58492c8ac7f754f3176f5adf85008dfb4dd96f14
f32685315c doc: Install `pkgconf` to find `capnproto` on NetBSD (Hennadii Stepanov)
5964c7229f doc: Switch `pkg-config` package to modern `pkgconf` on NetBSD (Hennadii Stepanov)
9b85c9814d doc: Drop GCC upgrade instructions for NetBSD (Hennadii Stepanov)
Pull request description:
This PR updates the "NetBSD Build Guide" following the latest release 11.0. See commit messages for more details.
ACKs for top commit:
fanquake:
ACK f32685315c
Tree-SHA512: 1138038715957951d79c838a1f06dfe5d641684901f451a0937a5df16c03c01f76443cc4761b6258cb93dc4ba496fe99129deb45dd9ea3d3a56c9762813a3d76
222855ed11 doc: mention -DWITH_ZMQ=ON in macOS build guide (cyb3ralbert)
Pull request description:
`doc/build-osx.md` currently says:
> Support for ZMQ notifications requires the following dependency.
The `zeromq` dependency is covered, but the `-DWITH_ZMQ=ON` CMake option is not
mentioned anywhere in that section. `WITH_ZMQ` defaults to `OFF`, so following the
guide as written results in a build with ZMQ disabled, even though the user completed
the ZMQ section. I verified this at the configure step on macOS: with `zeromq`
installed and no flag, CMake reports `ZeroMQ ... OFF`; with `-DWITH_ZMQ=ON` it
reports `ON`.
The same wording was added to the BSD build guides in #35283, but `doc/build-osx.md`
was not included.
Docs-only change. No tests run.
ACKs for top commit:
hebasto:
ACK 222855ed11.
Tree-SHA512: b7e7114e18ef10216780f6b549516c79bff67d7a909c5167f9c48cc8d2ef0b10f1524c7656452308914e5cd86425588f9f2dac07d4eeb2fe1e624f5478453d73
6b6d77cc84 windows: remove deprecated codecvt via UTF-8 narrow APIs (kevkevinpal)
Pull request description:
Since #32380 the Windows process code page is UTF-8, so narrow
APIs accept UTF-8 directly. Drop wstring_convert/codecvt and the
related wide process calls (`_wsystem`, `_wexecvp`, `CreateProcessW`)
in favor of `::system`, `_execvp`, and `CreateProcess`.
This should be fine to remove since Bitcoin Core is now on C++20
ACKs for top commit:
hebasto:
re-ACK 6b6d77cc84, only rebased since my [recent](https://github.com/bitcoin/bitcoin/pull/35704#pullrequestreview-4845891494) review.
hodlinator:
ACK 6b6d77cc84
Tree-SHA512: dd8039e4d2ccf5d04e52d845ceed2b9ce6b2c53ee23680e502eae6b4f07228e42ae602ca5079c42615ec7be61741fd77781e61567adcc6f03e960ce5b55b1d9a
Run `dumpbin.exe /imports` on the cross-built `bitcoind.exe` in the
"Windows, test cross-built" jobs to list the imported DLLs and to
ensure the executable is linked against the expected C runtime.
Regression test for #16159: an address labeled via setlabel by a
wallet that doesn't own it is assigned a "send" purpose and must not
appear in listreceivedbyaddress/listreceivedbylabel results, even
with include_empty=true.
Co-authored-by: Andreas Kouloumos <kouloumosa@gmail.com>
listreceivedbyaddress/listreceivedbylabel with include_empty=true
walked the full address book and returned every entry with no
matching mapTally record, including addresses with a "send" purpose
(foreign addresses labeled via setlabel, the GUI, or
addmultisigaddress) that the wallet never received funds to and does
not own.
Filter these out via IsMine() rather than the address book's
"purpose" field, since purpose is set inconsistently across several
code paths and IsMine() is the same check mapTally itself is already
built from.
Fixes#16159.
Co-authored-by: Brandon Odiwuor <brandon.odiwuor@gmail.com>
Use derivehdkey instead of extracting each participant xpub (and
derivation info) from the listdescriptors output.
Additionally use the new <0;1> descriptor syntax.
Finally this commits adds a few debug log lines, and expand the
explanation for why we use m/44h/1h/0h.
Add an UnusedKey filter to GetHDPubKeys() so the new RPC can prefer
unused(KEY) descriptors before falling back to active descriptors.
Co-authored-by: w0xlt <94266259+w0xlt@users.noreply.github.com>
Reconstruct a descriptor's extended private key from its xpub by looking
up the corresponding private key. This is the extended-key analog of
GetKey() and is used by the derivehdkey RPC in the following commit.
GetHDPubKeys() centralizes the descriptor xpub lookup used by gethdkeys and
createwalletdescriptor, and by the derivehdkey RPC added in a later commit.
The HDKeyFilter argument serves gethdkeys' active_only mode (Active vs All)
and createwalletdescriptor's active descriptor selection.
No behavior change, except the dynamic_cast now uses Assert() instead of
gethdkeys' CHECK_NONFATAL, since it is not a recoverable input.
ParseHDKeypath() parsed each path element with ToIntegral<uint32_t>, so
a bare decimal >= 2^31 (e.g. "m/2147483648" == 0x80000000) was silently
treated as "m/0h".
This commit rejects such overflow instead.
ParseHDKeypath() lives in util/bip32, so its unit test belongs in
bip32_tests rather than psbt_wallet_tests. Pure move, no changes to the
test itself; subsequent commits extend it in its new home.
b9d573e4a9 fees: Return false for incompatible fee estimates (Hao Xu)
Pull request description:
policy_estimator_io deliberately reuses a CBlockPolicyEstimator because
constructing one for every fuzz input severely reduces throughput.
However, Read() returns true for an incompatible old fee estimates file
without replacing the estimator state. The target then calls Write()
with state loaded by a previous input, making coverage depend on corpus
order.
Return false for incompatible files so the target skips Write() when no
state was loaded. This keeps the estimator reuse optimization instead of
resetting the expensive object before every fuzz input.
For the in-tree production caller, incompatible files remain non-fatal
and the estimator still starts from its default state. Read() now
reports failure, so startup emits one additional non-fatal warning.
Node startup and estimator state are unchanged, as is RPC behavior.
ACKs for top commit:
maflcko:
review ACK b9d573e4a9📩
sedited:
ACK b9d573e4a9
Tree-SHA512: d6ec5986122716ad2c6fb5305626aec71b4b416242791547a12f86fb210d768c87fcb9615fd50259908656766bbe085d55ae90e1d72eaee24d438eecfd9c6dd4
87b080fe2b fuzz: reset the reused mempool in process_message(s) (Hao Xu)
d522fd3196 fuzz: prepare deterministic mempool rebuilds (Hao Xu)
b11456386b fuzz: let the test input toggle IBD in the p2p fuzz targets (Hao Xu)
2a29cee684 test: add helper to reset chainman and mempool (Hao Xu)
2a4ef42d34 fuzz: share a single FakeNodeClock in the chainman-resetting fuzz targets (Hao Xu)
Pull request description:
## Problem
`process_message` and `process_messages` keep the node in IBD (`ResetIbd()`) and
mine their coinbases with the default bare-`OP_TRUE` output script. As a result
`net_processing` returns early at the `IsInitialBlockDownload()` check and never
reaches the transaction-handling path; and even if it did, a tx spending a
bare-`OP_TRUE` coinbase is rejected as `NONSTANDARD` by
`ValidateInputsStandardness`. The reused mempool therefore always stays empty and
that path is never exercised.
## Changes
Both targets now get the same treatment:
1. **Toggle IBD from the test input** — a `bool` decides whether to also
`JumpOutOfIbd()`, exercising both the IBD and non-IBD paths. In
`process_message` it is consumed last, so existing corpus entries read `false`
and are unchanged. In `process_messages` the messages run in a loop, so the
bool must be consumed *first* (see the corpus note below).
2. **Use a spendable `P2WSH_OP_TRUE` coinbase** — both anyone-can-spend (an
`OP_TRUE` witness, no signature) and a standard witness output, so a fuzz-built
tx spending a mature coinbase can actually be accepted into the mempool.
3. **Reset the rng before rebuilding (preparation)** — rebuilding the chainman
(and, in the next commit, the mempool) consumes the global PRNG. Reset it with
`MakeRandDeterministicDANGEROUS()` first so the rebuild is deterministic across
iterations. Mirrors the `cmpctblock` harness.
4. **Reset the reused mempool** — now that the mempool can become non-empty,
rebuild it together with the chainman in `ResetChainmanAndMempool()` when the
block index grew or the mempool changed. A dirty mempool is detected by its
sequence number rather than its size, since a tx can be added and removed
within one iteration (leaving the size unchanged).
## Corpus note
~~In `process_messages` the IBD bool is consumed before the message loop (first
integral read), which shifts the `FuzzedDataProvider` layout. Existing
`process_messages` corpus entries can be migrated by appending a single `0x00`
byte at the end (read as `false`, keeping the IBD path); every other consumed
value stays the same. This is a qa-assets change accompanying this PR.~~
This note no longer applies because the IBD toggle is now consumed inside the
message loop. Appending a single `0x00` byte would not reliably target that bool
or preserve the rest of the input layout.
The accompanying `qa-assets` update should migrate or regenerate the affected
`process_messages` corpus entries for the current layout.
ACKs for top commit:
Crypt-iQ:
crACK 87b080fe2b
maflcko:
review ACK 87b080fe2b🏁
frankomosh:
Review ACK 87b080fe2b
Tree-SHA512: e557b2ca3329767a45fe8315c63df9c3191a3a46a17c5e75ea3e4ad0c25e0e500a687fa650297a386b0a2ebb95503d069089ca5ae3d0a34caab98367aeb28683
fae7ba9aba ci: Fix $BASE_ROOT_DIR installation (MarcoFalke)
Pull request description:
In the ci system, `BASE_ROOT_DIR` has a default value that can be changed. This has problems:
* The docs do not mention that changing the value requires re-building the image, as the value is embedded.
* Many places hard-code the default value, which is confusing and brittle.
Fix all issues by adding docs and replacing the hard-coded default values with `$BASE_ROOT_DIR`.
ACKs for top commit:
willcl-ark:
ACK fae7ba9aba
Tree-SHA512: 6bdfc7acf46962f83664b9a4996b65bddad2f3046c19654a83b89c63a7ac8ac3ab3396f03240d42b091f3eda00b9da50bb49a2d19ded37b0de840a20a7c7e1d9
fa2e76d397 bench: Add base_blob compare bench via uint256 (MarcoFalke)
fa588e9e0f refactor: Mark assertion_fail as [[noreturn]] (MarcoFalke)
faec059dfe refactor: Add uint256::operator<=>() (MarcoFalke)
fa6df14c23 refactor: uint256::operator==() = default (MarcoFalke)
Pull request description:
Some refactors with rationale:
* Default the `uint256` base blob equals operator, because this is standard C++20 practise.
* Add the `uint256` base blob `<=>` operator, because this is standard C++20 practise. Also, `transaction_identifier` already offers such an operator. This allows to remove the non-standard `Compare()` function.
* Add a `[[noreturn]]` to the assertion failure helper that does not return. This is standard C++11 practise.
ACKs for top commit:
optout21:
ACK fa2e76d397
Sjors:
ACK fa2e76d397
purpleKarrot:
ACK fa2e76d397
hebasto:
re-ACK fa2e76d397.
w0xlt:
ACK fa2e76d397 as a simplification/refactor, not as a performance optimization.
Tree-SHA512: 2e64e09fabe71d84c05ed943664417dd1bc1cf6fe6bf31006a58dd9180c458f69915ba7770501537678f1ad51cce16018f79bdf6780e072b73b692ea44b60185
