btcd

Merge pull request #2580 from Roasbeef/version-bump-v0.26.2

build: bump version to v0.26.2-beta

build: bump version to v0.26.2-beta

In this commit, we move btcd past the v0.26.1 release candidate and set
the development version to v0.26.2-beta. This keeps the daemon and RPC
server version on the next patch series as work resumes on master.

build: bump version to v0.26.1-beta.rc1

In this commit, we bump btcd from v0.26.0-beta to
v0.26.1-beta.rc1 for the next release candidate. This puts the version
reported by the daemon and RPC server in sync with the release series
prepared by this PR.

version: preserve semantic version separators

In this commit, we include periods in the alphabet accepted by
normalizeVerString. SemVer uses periods to separate pre-release identifiers,
but the old filter silently collapsed beta.rc1 into betarc1.

We add a focused test for the dotted RC suffix before using it for the next
release candidate.

build: pin tagged submodules and remove local replacements

In this commit, we pin btcutil and wire to their freshly tagged v2.0.1
releases. We also remove the root module's remaining local replace
directives now that all three in-tree modules have published versions.

This makes local builds and downstream module consumers resolve the same
btcutil, v2transport, and wire code. The regenerated checksums cover each
published module.

build: bump v2transport to v1.1.0

In this commit, we bump the root module requirement to the freshly tagged
v2transport v1.1.0 release. This exposes the responder handshake admission
APIs added in #2576 when btcd is built as a downstream module, where the
repository-local replace directive does not apply.

rpcclient: wrap DisableAuth tests to 80 columns

In this commit, we wrap the new DisableAuth regression tests to the
btcd 80-column formatting convention. We also split the nested handler
setup and assertions into logical stanzas so the tests match the
surrounding style.

rpcclient: harden DisableAuth transport tests

In this commit, we make the DisableAuth tests observe successful
requests instead of inferring them from an empty header. This closes a
false-positive path where credential lookup could fail before the
request reached the server.

We also cover the WebSocket handshake, cookie bypass, and
caller-provided headers across enabled and disabled auth. The public
comment now makes clear that DisableAuth only suppresses
rpcclient-generated Basic auth.

rpcclient: make HTTP Basic Auth optional via DisableAuth

Add a DisableAuth field to ConnConfig that, when set to true, skips
setting the Authorization header on RPC requests.

This enables connecting to third-party RPC providers (e.g. Alchemy,
GetBlock) that authenticate via API key in the URL path and reject
requests containing an Authorization header with 401 errors.

Previously, getAuth() unconditionally set BasicAuth or attempted
cookie auth, leaving no way to disable authentication entirely.

Fixes #2505

rpcclient: add tests for DisableAuth header behavior

Add table-driven tests that verify:
- Authorization header is omitted when DisableAuth is true
- Authorization header is present when DisableAuth is false
- Default (zero value) behavior includes Authorization header

Suggested by @TechLateef in #2514.

integration: stabilize pre-verack disconnect cycles

In this commit, we make the pre-verack lifecycle test count only peers that
btcd has admitted and processed through version exchange.

The source handshake limit can close a rapid follow-up socket while the
previous disconnect is still unwinding. This made the client-side version
write fail with EPIPE before the intended lifecycle path ran. We now wait for
a version response from btcd, retry rejected attempts under a deadline, and
still disconnect without sending verack.

This preserves all 50 peerDone without peerAdd cycles while removing the
scheduler-dependent admission race from the test.

config: reject non-positive maxpeers

In this commit, we reject maxpeers values that cannot represent a usable
peer budget.

A zero value reached connmgr as TargetOutbound=0, where zero means to use
the default target of eight. The server then rejected every completed
peer and immediately created a replacement request. Rejecting the value
during configuration avoids that outbound reconnect loop.

server+connmgr: make outbound startup deterministic

In this commit, we define TargetOutbound as the number of automatic
connections and treat explicit Connect requests as additional peers.

Permanent requests could previously consume connection IDs before Start
sampled the shared counter. The resulting automatic count depended on
goroutine scheduling, while the listener reserved the worst-case total.
We now start the configured automatic count directly and cap it by the
peer budget left after permanent peers.

The composition test covers permanent requests on both sides of Start and
pins the same automatic+permanent total for either ordering.

integration: synchronize p2p lifecycle stress batches

In this commit, we make each stress wave establish its full set of peers
before disconnecting them together. A ping/pong barrier proves the server
processed each verack, while RPC connection-count barriers prove
registration and removal completed before the next wave starts.

We bound concurrent handshakes from the shared source, drain every worker on
failure, and wait for server-side cleanup. This keeps the test compatible
with the admission limits it exercises and makes a passing run evidence of
the intended NewPeer/DonePeer ordering.

v2transport: restore responder handshake progress

In this commit, we send the responder key as soon as the initiator diverges
from the v1 prefix. This avoids the BIP324 deadlock where both sides can wait
for the other to write before the initiator has sent its complete 64-byte
key.

We split key generation and key agreement into separate admission leases,
and release each lease before the intervening network I/O. The regression
test stops after the first mismatch, requires the responder to make
progress, then completes key agreement and verifies the resulting packet
ciphers interoperate.

server+inbound: correct inbound admission accounting

In this commit, we keep loopback and whitelisted peers inside the ordinary
pending-handshake and V2 source budgets, while preserving their existing
no-ban behavior.

We also derive the listener reservation from the configured peer mode.
Connect-only and simnet nodes now reserve just their permanent peers, while
automatic mode accounts for both its target and addpeers without exceeding
MaxPeers.

Finally, a bound V2 handshake consumes its rate budgets once, but reacquires
the concurrency slot for each CPU-bound responder phase. This keeps rate
limiting scoped to the handshake while bounding both expensive phases.

psbt: decode base64 packets incrementally

In this commit, we decode base64 PSBT packets as a stream instead of
reading the full encoded input into memory first.

The previous aggregate bound reused wire.MaxMessagePayload, even though
BIP-174 doesn't bind PSBT packet size to the P2P message limit. This made
the base64 path reject packets that the raw path accepted. We now feed
decoded bytes through the same per-field parser used for raw packets,
while retaining strict base64 and trailing-data checks.

We also add a regression test with nine individually valid 4,000,000-byte
unknown values to pin raw and base64 parsing to the same behavior.

address: reject v2-v16 segwit addresses encoded with bech32

BIP-350 requires that segregated witness outputs of version 1 through 16
use the bech32m checksum, while only version 0 uses bech32. decodeSegWitAddress
only special-cased versions 0 and 1, so a witness program with version 2-16
encoded using the legacy bech32 checksum decoded successfully, in violation of
the spec and contrary to the BIP-350 reference decoder (which rejects any
non-zero witness version that is not bech32m).

Generalize the version 1 check to cover all versions >= 1, matching the
reference decode() function. Add the relevant BIP-350 INVALID_ADDRESS vectors
(v2 and v16 encoded with bech32) as a regression test; they decoded
successfully before this change and are now rejected.

Signed-off-by: Lrifton92 <Lrifton92@users.noreply.github.com>

blockchain/indexers: propagate index drop errors

In this commit, we propagate errors returned while cataloging index
buckets, matching the bucket deletion path fixed by the preceding commit.

We also add fault-injected regression coverage for both paths so neither
error can silently report a successful index drop.

blockchain/indexers: fix dropped error

psbt: reject nil taproot pointer fields

In this commit, we extend taproot PSBT serialization and finalization to reject nil script spend signatures, leaf scripts, and BIP32 derivations before any sort or dereference. We return wrapped ErrInvalidPsbtFormat errors so callers can identify malformed packet state without parsing strings.

We also make FindLeafScript reject nil inputs and leaf entries. This keeps both the direct finalizer and MaybeFinalize paths from panicking on malformed in-memory packets.

multi: parse own-DB blocks leniently in getblock and indexer init

In this commit, we extend the lenient database block parser to the remaining call sites that re-read blocks from the node's own database.

The getblock RPC now copies FetchBlock bytes before its read transaction ends, since database buffers are not valid outside that lifetime. We then strip any legacy trailing data and serve the exact block serialization at every verbosity level. A regression database invalidates its buffer as View returns, pinning the required copy.

The index manager uses the same parser while rolling an index tip back to the main chain. We also place DBBlockFromBytes before its first caller and log legacy trailing data at debug level, since a frequently fetched dirty block should not flood operator logs.

peer: close late connections after disconnect

In this commit, we serialize connection association with peer
disconnection. Previously, Disconnect could run before
AssociateConnection, close quit without a socket, and leave a later
connection published with no remaining path that could close it.

We now close connections handed to a peer that is already disconnecting,
and publish the connected flag only after the socket and connection time
are initialized. The tests pin both call orderings and race the
transitions to verify the socket closes exactly once.

server: centralize inbound handshake admission

In this commit, we introduce a server-wide admission policy for
incomplete inbound handshakes and the CPU-bound portion of v2 responder
setup. Source accounting uses normalized IPv4 and IPv6 prefixes, while
global, per-source, and concurrent v2 budgets remain independent and
bounded.

Peer construction passes the policy through a small interface only for
inbound v2 responders. Handshake slots release on verack or disconnect,
and the connection manager reserves MaxPeers capacity for automatic
outbound peers.

v2transport: refactor responder setup

In this commit, we split the responder handshake into transport
classification, key setup, and wire completion phases. This lets callers
install a narrow admission interface after the full v2 candidate is
available, while preserving NewPeer compatibility and the existing
transcript.

We also propagate handshake write failures, reject short writes, and
cover v1 fallback, incomplete candidates, admission lifetime, and
end-to-end v2 interoperability.