Bitcoin Core

util: add _GiB for Gibibyte conversions

Introduce `operator""_GiB`, sharing the overflow-checked conversion logic with the existing `operator""_MiB`.

Use `1_GiB` in a few existing places where it is a drop-in replacement (e.g. `1024_MiB`, `1<<30`) and extend unit tests to cover boundary behavior.

Change CChain::Contains() to take reference

The `CChain::Contains()` method dereferences its input without checking,
potentially resulting in nullptr-dereference if invoked with `nullptr`.
To avoid this possibility, its input is changed to a reference instead.
Call sites are adapted accoringly, extra nullptr-check is added as
needed.

net: cleanup SOCKS5 auth logging

Do not log SOCKS5 auth credentials.

Keep the log entry for the auth path, but omit the
username and password.

No behavior change intended.

tor: torcontrol disconnect on too many lines to avoid OOM

This commit ensures the `TorControlConnection::m_message` buffer doesn't
grow unbounded and exhaust memory, by limiting the number of lines
handled by `TorControlConnection::ProcessBuffer()` to `MAX_LINE_COUNT =
1000`. Now the most memory that can be occupied by `m_message` is on the
order of `MAX_LINE_LENGTH * MAX_LINE_COUNT= 100MB`

Although this is not compliant with the tor control protocol in general,
where commands like `GETINFO ns/all` will likely return thousands of
lines, it is more than sufficient for handling the replies from the
commands that are used by a node:

`AUTHENTICATE`: 1 line:
The server responds with 250 OK on success or 515 Bad
authentication if the authentication cookie is incorrect. Tor closes
the connection on an authentication failure.

https://spec.torproject.org/control-spec/commands.html#authenticate

`GETINFO net/listener/socks`: 2 lines
A quoted, space-separated list of the locations where Tor is
listening...

https://spec.torproject.org/control-spec/commands.html#getinfo

`AUTHCHALLENGE SAFECOOKIE`: 1 line
If the server accepts the command, the server reply format is:

```
"250 AUTHCHALLENGE" SP "SERVERHASH=" ServerHash SP "SERVERNONCE="
ServerNonce CRLF
```

https://spec.torproject.org/control-spec/commands.html#authenticate

`PROTOCOLINFO`: 4-5 lines

The server reply format is:

```
250-PROTOCOLINFO" SP PIVERSION CRLF \*InfoLine "250 OK" CRLF
InfoLine = AuthLine / VersionLine / OtherLine
```

(https://spec.torproject.org/control-spec/commands.html#protocolinfo)

`ADD_ONION`: 2-3 lines for Bitcoin Core's tor control client.

The server reply format is:

```
"250-ServiceID=" ServiceID CRLF
["250-PrivateKey=" KeyType ":" KeyBlob CRLF]
*("250-ClientAuth=" ClientName ":" ClientBlob CRLF)
"250 OK" CRLF
```

...

The server response will only include a private key if the server
was requested to generate a new keypair

...

If client authorization is enabled using the “BasicAuth” flag (which
is v2 only), the service will not be accessible to clients without
valid authorization data (configured with the “HidServAuth” option).
The list of authorized clients is specified with one or more
“ClientAuth” parameters. If “ClientBlob” is not specified for a
client, a new credential will be randomly generated and returned."

https://spec.torproject.org/control-spec/commands.html#add_onion

We don't set the `BasicAuth` flag, so the response will not include any
`ClientAuthLines`.

test: interface_http follow-ups

- Only one node needed for test
- Use ascii encoding instead of utf-8
- Make tests independent of each other
- Expect HTTP error code 413 for too-large request
- Clarify python client race condition in comment

ci: drop -lstdc++ usage in msan fuzz job

wallet, bdbro: Validate btree page levels

BTree pages contain the level in the BTree that the page is supposed to
be at. The root starts at some level between 1 and 255, leaves are
always level 1. Internal pages must be a level that is one less than its
parent. Validating that pages are at their expected level (except for
the root page) enforces that no cycles can occur.

wallet, bdbro: Enforce overflow data lengths

The total length of the data in an overflow record is being given to us.
We should validate that the length is reasonable (fits in the total size
of the file), and to stop reading additional data if the amount of data
read exceeds the stated legnth. This prevents infinite looping behavior.

test: Remove unused create_coinbase imports

scripted-diff: Use new create_block height option

-BEGIN VERIFY SCRIPT-

# Replace single-arg create_coinbase calls ...
# ... followed by ntime arg
sed --in-place --regexp-extended 's/create_block\((.+), create_coinbase\(([^,]+)\), /create_block(\1, height=\2, ntime=/g' $( git grep -l 'create_block(' )
# ... not followed by any other args
sed --in-place --regexp-extended 's/create_block\((.+), create_coinbase\(([^,]+)\)\)/create_block(\1, height=\2)/g' $( git grep -l 'create_block(' )

-END VERIFY SCRIPT-

kernel: build: remove unused serfloat dependency

The serfloat module is only used for fee estimation, which is not
included in the bitcoinkernel library, so the dependency can be removed.

bench: add script verification benchmark for P2TR script-path spends

To reflect the likely most common real-world scenario, a single
OP_CHECKSIG is contained in the Tapscript leaf.

While touching this benchmark, also set the operation unit to "script"
and do some minor refactorings to deduplicate code and improve readability.

Co-authored-by: David Gumberg <davidzgumberg@gmail.com>
Co-authored-by: Lőrinc <pap.lorinc@gmail.com>

contrib: Fix NameError in signet miner gbt()

The logging.warning call referenced `bci["bestblockhash"]`, a variable
from the calling scope `do_generate()` that is not available inside the
`Generate.gbt()` method. This would crash with a NameError when
getblocktemplate returned a template based on an unexpected previous
block.

Use the `bestblockhash` parameter that was already being passed in and
used correctly in the comparison on the line above.

The bug was introduced in 7b31332370 when the gbt logic was extracted
into its own method — the if-condition was updated but the logging
call was not.

opt: Skip UTXOs with worse waste, same eff_value

When two successive UTXOs differ in waste but match in effective value,
we can skip the second if the first is not selected, because all input
sets we can generate by swapping out a less wasteful UTXOs with a more
wastefull UTXO of matching effective value would be strictly worse.

Also expand documentation of Branch and Bound.

opt: Skip evaluation of equivalent input sets

When two successive UTXOs match in effective value and weight, we can
skip the second if the prior is not selected: adding it would create an
equivalent input set to a previously evaluated.

E.g. if we have three UTXOs with effective values {5, 3, 3} of the same
weight each, we want to evaluate
{5, _, _}, {5, 3, _}, {5, 3, 3}, {_, 3, _}, {_, 3, 3},
but skip {5, _, 3}, and {_, _, 3}, because the first 3 is not selected,
and we therefore do not need to evaluate the second 3 at the same
position in the input set.

If we reach the end of the branch, we must SHIFT the previously selected
UTXO group instead.

coinselection: Track effective_value lookahead

Introduces a dedicated data structure to track the total
effective_value available in the remaining UTXOs at each index of the
UTXO pool. In contrast to the original approach in BnB, this allows us
to immediately jump to a lower index instead of visiting every UTXO to
add back their eff_value to the lookahead.

coinselection: BnB skip exploring high waste

At high feerates adding more inputs will increase the waste score. If
the current waste is already higher than the best selection’s we cannot
improve upon the best selection. All solutions that include the current
selection with more additional inputs must be worse than the best
selection so far: SHIFT

This optimization only works at high feerates, because at low feerates,
adding more inputs decreases waste, so this condition would exit
prematurely. We would never attempt input sets with higher weight than
the prior best selection, even though we would prefer those at low
feerates.

coinselection: Track whether BnB completed

BnB may not be able to exhaustively search all potentially interesting
combinations for large UTXO pools, so we keep track of whether the
search was terminated by the iteration limit.

coinselection: rewrite BnB in CoinGrinder-style

In the original implementation of BnB, the state of the search is
backtracked by explicitly walking back to the omission branch and then
testing again. This retests an equivalent candidate set as before, e.g.,
after backtracking from {ABC}, it would evaluate {AB_}, before trying
{AB_D}, but {AB_} is equivalent to {AB} which was tested before.

CoinGrinder tracks the state of the search instead by remembering which
UTXO was last added and explicitly shifting from that UTXO directly to
the next, so after {ABC}, it will immediately move on to {AB_D}. We
replicate this approach here.

The description of the two optimizations is removed from the
documentation as they will only be implented in a later commit.

coinselection: Track BnB iteration count in result

The expected iteration count demonstrates how the following improvements
reduce iterations will help catch any regressions in the future.

coinselection: Tiebreak SRD eviction by weight

When UTXOs tie in effective value, prefer keeping the lower weight UTXO.

Co-authored-by: Yancy <github@yancy.lol>

Squashed 'src/secp256k1/' changes from 57315a6985..7262adb4b4

7262adb4b4 Merge bitcoin-core/secp256k1#1841: gha: Bump deprecated GHA workflow dependencies
c5cd9d6d9a gha: Bump deprecated GHA workflow dependencies
95b702de34 Merge bitcoin-core/secp256k1#1839: ecdsa: VERIFY_CHECK result of _fe_set_b32_limit
634215f3fc Merge bitcoin-core/secp256k1#1837: tests: Fix function pointer initialization C89 error in ellswift tests
43fca0ff55 ecdsa: VERIFY_CHECK result of _fe_set_b32_limit
b84635ed3b tests: Fix C89 function pointer initialization in ellswift tests
ffc25a2731 Merge bitcoin-core/secp256k1#1834: ecmult: Document and test ng=NULL in ecmult
3a403639dc eckey: Call ecmult with NULL instead of zero scalar
7e68c0c88b ecmult: Document and test ng=NULL in ecmult
1aafe15139 Merge bitcoin-core/secp256k1#1777: Make SHA256 compression runtime pluggable
b9cb1cbfd7 Merge bitcoin-core/secp256k1#1824: util: introduce and use `ARRAY_SIZE` macro
4d92a083bc sha256: speed up writes using multi-block compression
0753f8b909 Add API to override SHA256 compression at runtime
fdb6a91a5e Introduce hash context to support pluggable SHA256 compression
c0a2aba088 Merge bitcoin-core/secp256k1#1811: bench: Update help functions in bench and bench_internal
10f546a2c0 Merge bitcoin-core/secp256k1#1832: testrand: Remove testrand_finish
8d0eda07e9 testrand: Remove testrand_finish
95e6815843 Merge bitcoin-core/secp256k1#1825: hash: remove redundant `secp256k1_sha256_initialize` in tagged hash midstate functions
f48b1bfa5d hash: add midstate initializer and use it for tagged hashes
3019186a6d Merge bitcoin-core/secp256k1#1829: ci: Fix leftover use of old ECMULTGENPRECISION
79e9f25237 ci: Fix leftover use of old ECMULTGENPRECISION
dfe042feb2 Merge bitcoin-core/secp256k1#1828: Revert "ci, docker: Fix LLVM repository signature failure"
76e92cfeea Revert "ci, docker: Fix LLVM repository signature failure"
ac561601b8 Merge bitcoin-core/secp256k1#1760: cmake: Add dynamic test discovery to improve parallelism
c7a7f732bd Merge bitcoin-core/secp256k1#1821: ellswift: fix overflow flag handling in secp256k1_ellswift_xdh
921b9711ea util: introduce and use `ARRAY_SIZE` macro
b99a94c382 Add tests for bad scalar inputs in ellswift XDH
307b49f1b9 ellswift: fix overflow flag handling in secp256k1_ellswift_xdh
322d0a4358 Merge bitcoin-core/secp256k1#1823: ci: Load Docker image by ID from builder step
ed02466d3f ci: Load Docker image by ID from builder step
c49c9be504 bench: Update help functions in bench and bench_internal
1d146ac3ed Merge bitcoin-core/secp256k1#1819: tests: Improve secp256k1_scalar_check_overflow tests (Issue #1812)
f47bbc07f0 test: add unit tests for secp256k1_scalar_check_overflow
d071aa56d5 Merge bitcoin-core/secp256k1#1815: refactor: remove unnecessary `malloc` result casts
99ab4a105e Merge bitcoin-core/secp256k1#1817: ci: Disable Docker build summary generation
c5da3bde9c Merge bitcoin-core/secp256k1#1818: ci: Enforce base-10 evaluation
97de5120cf Merge bitcoin-core/secp256k1#1804: test: show both CMake and Autotools usage for ctime_tests
4fb7ccf5d4 ci: Enforce base-10 evaluation
3ae72e7867 ci: Disable Docker build summary generation
97b3c47849 refactor: remove unnecessary `malloc` result casts
1bc74a22f8 test: show both Autotools and CMake usage for ctime_tests
8354618e02 cmake: Set `LABELS` property for tests
29f26ec3cf cmake: Integrate DiscoverTests and normalize test names
f95b263f23 cmake: Add DiscoverTests module
4ac651144b cmake, refactor: Deduplicate test-related code

git-subtree-dir: src/secp256k1
git-subtree-split: 7262adb4b40074201fb30847035a82b8d742f350

coins: add explicit `CoinsViewEmpty` noop backend

Introduce `CoinsViewEmpty` as an explicit no-op `CCoinsView` implementation, and define its singleton accessor out of line in `coins.cpp` to avoid `-Wunique-object-duplication` in shared-library builds.`
Use it at call sites that intentionally want a no-op backend instead of constructing anonymous placeholder views.

`CCoinsViewTest` and `CoinsViewBottom` now inherit defaults from `CoinsViewEmpty` (e.g. the unused `EstimateSize()`, which now returns 0).

Co-authored-by: Ryan Ofsky <ryan@ofsky.org>

fuzz: keep backend assertions aligned to active backend

`TestCoinsView` switches the `CCoinsViewCache` backend during fuzzing and then queries the backend for cross-checks.
Pass the backend as a `CCoinsView*` (to make it relocatable) and retarget it when toggling between the original backend and a local empty `CCoinsView` so assertions always refer to the active backend. This will be switched to a singleton in the next commit.

Note that the previous slice-assignment (`backend_coins_view = CCoinsView{}`) was a silent noop for the db target, it only copied base-class members (none) without changing the vtable, so the backend was never actually switched.
The pointer approach makes the switch real for both targets, which revealed that when restoring the original backend after the empty one, the cache must be reset first to avoid carrying FRESH flags that were valid relative to the empty backend but invalid relative to the original (which may already contain those coins).

Co-authored-by: Anthony Towns <aj@erisian.com.au>
Co-authored-by: Andrew Toth <andrewstoth@gmail.com>
Co-authored-by: Ryan Ofsky <ryan@ofsky.org>
Co-authored-by: marcofleon <marleo23@proton.me>

refactor: normalize CCoinsView whitespace and signatures

Let's get these out of the way to simplify riskier followup commits