READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server440 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

10,257 bytes · SHA-256 419a2ebb22d7b9ef… · View upstream ↗

1// Copyright (c) The Bitcoin Core developers
2// Distributed under the MIT software license, see the accompanying
3// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5#include <banman.h>
6#include <net.h>
7#include <net_processing.h>
8#include <protocol.h>
9#include <sync.h>
10#include <test/fuzz/FuzzedDataProvider.h>
11#include <test/fuzz/fuzz.h>
12#include <test/fuzz/util.h>
13#include <test/fuzz/util/net.h>
14#include <test/util/net.h>
15#include <test/util/setup_common.h>
16#include <test/util/time.h>
17#include <test/util/validation.h>
18#include <util/time.h>
19#include <validationinterface.h>
20
21#include <array>
22#include <ios>
23#include <memory>
24#include <vector>
25
26namespace {
27TestingSetup* g_setup;
28
29void initialize()
30{
31    static const auto testing_setup = MakeNoLogFileContext<TestingSetup>(
32        /*chain_type=*/ChainType::REGTEST);
33    g_setup = testing_setup.get();
34}
35
36// Inbound message types with private broadcast specific handling.
37// Used as the guided path in the CallOneOf() below.
38constexpr std::array INBOUND_MSG_TYPES{
39    NetMsgType::VERSION,
40    NetMsgType::VERACK,
41    NetMsgType::GETDATA,
42    NetMsgType::PONG,
43};
44} // namespace
45
46FUZZ_TARGET(p2p_private_broadcast, .init = ::initialize)
47{
48    SeedRandomStateForTest(SeedRand::ZEROS);
49    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
50
51    auto& node{g_setup->m_node};
52    auto& connman{static_cast<ConnmanTestMsg&>(*node.connman)};
53    connman.Reset();
54    auto& chainman{static_cast<TestChainstateManager&>(*node.chainman)};
55
56    FakeNodeClock clock_ctx{1610000000s}; // 2021-01-07, arbitrary
57    FakeSteadyClock steady_clock;
58    chainman.ResetIbd();
59    // Sometimes leave IBD: incoming TX processing (the broadcast-abort path)
60    // returns early during IBD.
61    if (fuzzed_data_provider.ConsumeBool()) chainman.JumpOutOfIbd();
62
63    // Reset, so that dangling pointers can be detected by sanitizers.
64    node.banman.reset();
65    node.addrman.reset();
66    node.peerman.reset();
67    node.addrman = std::make_unique<AddrMan>(
68        *node.netgroupman, /*deterministic=*/true, /*consistency_check_ratio=*/0);
69    node.peerman = PeerManager::make(connman, *node.addrman,
70                                     /*banman=*/nullptr, chainman,
71                                     *node.mempool, *node.warnings,
72                                     PeerManager::Options{
73                                         .reconcile_txs = true,
74                                         .deterministic_rng = true,
75                                     });
76    connman.SetMsgProc(node.peerman.get());
77    connman.SetAddrman(*node.addrman);
78
79    // Seed with 0-3 transactions to test multiple pending broadcasts; zero exercises
80    // the connected-in-vain disconnect in PushPrivateBroadcastTx().
81    const int num_txs{fuzzed_data_provider.ConsumeIntegralInRange(0, 3)};
82    std::vector<CTransactionRef> seeded_txs;
83    for (int i = 0; i < num_txs; ++i) {
84        auto tx{MakeTransactionRef(ConsumeTransaction(fuzzed_data_provider, /*prevout_txids=*/std::nullopt))};
85        (void)node.peerman->InitiateTxBroadcastPrivate(tx);
86        seeded_txs.push_back(tx);
87    }
88
89    LOCK(NetEventsInterface::g_msgproc_mutex);
90
91    static NodeId node_id{0};
92    // Create at least one PRIVATE_BROADCAST peer, optionally add others of random types.
93    std::vector<CNode*> peers;
94
95    CNode* pb_node = new CNode(
96        /*id=*/node_id++,
97        /*sock=*/std::make_shared<FuzzedSock>(fuzzed_data_provider, steady_clock),
98        /*addrIn=*/ConsumeAddress(fuzzed_data_provider),
99        /*nKeyedNetGroupIn=*/0,
100        /*nLocalHostNonceIn=*/0,
101        /*addrBindIn=*/CService{},
102        /*addrNameIn=*/"",
103        /*conn_type_in=*/ConnectionType::PRIVATE_BROADCAST,
104        /*inbound_onion=*/false,
105        /*network_key=*/0);
106
107    peers.push_back(pb_node);
108    connman.AddTestNode(*pb_node);
109    // Capture outbound messages to verify if well formed (and to learn the PING
110    // nonce), before SocketSendData drains vSendMsg.
111    connman.SetCaptureMessages(true);
112    const auto CaptureMessageOrig = CaptureMessage;
113    const CAddress pb_addr = pb_node->addr;
114    std::optional<uint64_t> pb_ping_nonce;
115    CaptureMessage = [&](const CAddress& addr, const std::string& msg_type,
116                         std::span<const unsigned char> data, bool is_incoming) {
117        if (is_incoming || addr != pb_addr) return;
118        if (msg_type == NetMsgType::PING) {
119            Assert(data.size() == sizeof(uint64_t));
120            uint64_t nonce;
121            SpanReader{data} >> nonce;
122            pb_ping_nonce = nonce;
123            return;
124        }
125        if (msg_type == NetMsgType::VERSION) {
126            SpanReader ds{data};
127            int32_t version;
128            uint64_t my_services, your_services, my_services_dup, nonce;
129            int64_t my_time;
130            CService your_addr, my_addr;
131            std::string user_agent;
132            int32_t height;
133            bool relay;
134            ds >> version >> my_services >> my_time >>
135                your_services >> CNetAddr::V1(your_addr) >>
136                my_services_dup >> CNetAddr::V1(my_addr) >>
137                nonce >> user_agent >> height >> relay;
138            Assert(version == WTXID_RELAY_VERSION);
139            Assert(my_services == NODE_NONE && my_services_dup == NODE_NONE);
140            Assert(my_time == 0);
141            Assert(your_services == NODE_NONE);
142            Assert(your_addr == CService{});
143            Assert(user_agent == "/pynode:0.0.1/");
144            Assert(height == 0);
145            Assert(!relay);
146            return;
147        }
148        if (msg_type != NetMsgType::INV) return;
149        SpanReader ds{data};
150        std::vector<CInv> invs;
151        ds >> invs;
152        Assert(invs.size() == 1);
153        Assert(invs[0].IsMsgTx());
154    };
155
156    // Complete handshake so PushPrivateBroadcastTx runs.
157    connman.Handshake(
158        /*node=*/*pb_node,
159        /*successfully_connected=*/true,
160        /*remote_services=*/ServiceFlags(NODE_NETWORK | NODE_WITNESS),
161        /*local_services=*/NODE_NONE,
162        /*version=*/PROTOCOL_VERSION,
163        /*relay_txs=*/true);
164
165    // Optionally add extra peers of random connection types.
166    const int extra_peers{fuzzed_data_provider.ConsumeIntegralInRange(0, 2)};
167    for (int i = 0; i < extra_peers; ++i) {
168        auto extra_peer{ConsumeNodeAsUniquePtr(fuzzed_data_provider, steady_clock, node_id++)};
169        // An address collision would match the capture hook's filter and fail
170        // its assertions on this peer's (legitimate) other-typed messages.
171        if (extra_peer->addr == pb_addr) continue;
172        peers.push_back(extra_peer.release());
173        connman.AddTestNode(*peers.back());
174        node.peerman->InitializeNode(
175            *peers.back(),
176            static_cast<ServiceFlags>(fuzzed_data_provider.ConsumeIntegral<uint64_t>()));
177    }
178
179    LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 100)
180    {
181        // Pick any random peer to test interleaved message handling.
182        CNode& p2p_node = *PickValue(fuzzed_data_provider, peers);
183        if (p2p_node.fDisconnect) continue;
184
185        clock_ctx += ConsumeDuration<std::chrono::seconds>(fuzzed_data_provider, 0s, 600s);
186
187        std::optional<CSerializedNetMsg> net_msg;
188        CallOneOf(
189            fuzzed_data_provider,
190            [&] {
191                net_msg.emplace();
192                net_msg->m_type = std::string{PickValue(fuzzed_data_provider, INBOUND_MSG_TYPES)};
193            },
194            [&] {
195                net_msg.emplace();
196                net_msg->m_type = fuzzed_data_provider.ConsumeRandomLengthString(CMessageHeader::MESSAGE_TYPE_SIZE);
197            },
198            [&] {
199                (void)node.peerman->InitiateTxBroadcastPrivate(
200                    MakeTransactionRef(ConsumeTransaction(fuzzed_data_provider, /*prevout_txids=*/std::nullopt)));
201            },
202            [&] {
203                // Construct a valid GETDATA for a seeded tx to exercise the TX send path.
204                if (p2p_node.IsPrivateBroadcastConn() &&
205                    p2p_node.fSuccessfullyConnected &&
206                    !seeded_txs.empty()) {
207                    const auto& tx{PickValue(fuzzed_data_provider, seeded_txs)};
208                    net_msg.emplace(NetMsg::Make(
209                        NetMsgType::GETDATA,
210                        std::vector<CInv>{{MSG_TX, tx->GetHash().ToUint256()}}));
211                }
212            },
213            [&] {
214                // Confirm reception of the pushed TX with a PONG matching the captured PING nonce.
215                if (&p2p_node == pb_node && pb_ping_nonce) {
216                    net_msg.emplace(NetMsg::Make(NetMsgType::PONG, *pb_ping_nonce));
217                }
218            },
219            [&] {
220                // Echo a seeded tx back from a non-private-broadcast peer to exercise
221                // the received-from-network broadcast-abort path.
222                if (!p2p_node.IsPrivateBroadcastConn() &&
223                    p2p_node.fSuccessfullyConnected &&
224                    !seeded_txs.empty()) {
225                    const auto& tx{PickValue(fuzzed_data_provider, seeded_txs)};
226                    net_msg.emplace(NetMsg::Make(NetMsgType::TX, TX_WITH_WITNESS(*tx)));
227                }
228            });
229
230        if (net_msg) {
231            if (net_msg->data.empty()) {
232                net_msg->data = ConsumeRandomLengthByteVector(fuzzed_data_provider, MAX_PROTOCOL_MESSAGE_LENGTH);
233            }
234            connman.FlushSendBuffer(p2p_node);
235
236            // ConsumeTransaction() can produce messages larger than the
237            // maximum payload accepted by the P2P transport.
238            if (net_msg->data.size() > MAX_PROTOCOL_MESSAGE_LENGTH) continue;
239
240            (void)connman.ReceiveMsgFrom(p2p_node, std::move(*net_msg));
241
242            bool more_work{true};
243            while (more_work) {
244                p2p_node.fPauseSend = false;
245                try {
246                    more_work = connman.ProcessMessagesOnce(p2p_node);
247                } catch (const std::ios_base::failure&) {
248                }
249                node.peerman->SendMessages(p2p_node);
250            }

src/wallet/receive.cpp

src/wallet/coinselection.cpp

src/consensus/validation.h

src/primitives/transaction.cpp

src/script/descriptor.cpp

src/bitcoin-cli.cpp

src/rpc/blockchain.cpp

src/rpc/rawtransaction.cpp

src/init.cpp

src/crypto/sha256.cpp

src/consensus/merkle.h

src/consensus/tx_check.h

src/consensus/tx_verify.h

src/policy/feerate.h

src/policy/feerate.cpp

src/primitives/transaction_identifier.h

src/chainparamsbase.h

src/chainparamsbase.cpp

src/util/moneystr.cpp

src/crypto/ripemd160.h

src/crypto/sha1.h

src/crypto/sha512.h

src/crypto/hmac_sha256.h

src/crypto/hmac_sha512.h

src/crypto/hmac_sha256.cpp

src/crypto/hmac_sha512.cpp

src/crypto/hkdf_sha256_32.h

src/crypto/hkdf_sha256_32.cpp

src/support/cleanse.h

src/support/cleanse.cpp

src/crypto/siphash.cpp

src/crypto/muhash.h

src/crypto/chacha20.h

src/crypto/poly1305.h

src/crypto/chacha20poly1305.h

src/crypto/chacha20poly1305.cpp

src/util/chaintype.cpp

src/util/obfuscation.h

src/util/byte_units.h

src/util/overflow.h

src/blockencodings.cpp

src/net_permissions.cpp

src/policy/packages.cpp

src/policy/rbf.cpp

src/policy/truc_policy.cpp

src/policy/ephemeral_policy.cpp

src/policy/settings.cpp

src/policy/policy.cpp

src/node/transaction.cpp

src/node/coin.cpp

src/rpc/client.cpp

src/rpc/external_signer.cpp

src/rpc/request.cpp

src/rpc/server_util.cpp

src/rpc/fees.cpp

src/rpc/output_script.cpp

src/rpc/rawtransaction_util.cpp

src/rpc/rawtransaction_util.h

src/rpc/register.h

src/rpc/request.h

src/rpc/server_util.h

src/rpc/protocol.h

src/rpc/server.h

src/rpc/signmessage.cpp

src/rpc/txoutproof.cpp

src/rpc/util.cpp

src/rpc/util.h

src/wallet/rpc/addresses.cpp

src/wallet/rpc/backup.cpp

src/wallet/rpc/coins.cpp

src/wallet/rpc/encrypt.cpp

src/wallet/rpc/signmessage.cpp

src/wallet/rpc/util.cpp

src/wallet/rpc/util.h

src/wallet/coincontrol.cpp

src/wallet/coincontrol.h

src/wallet/context.cpp

src/wallet/context.h

src/wallet/crypter.cpp

src/wallet/crypter.h

src/wallet/db.cpp

src/wallet/export.cpp

src/wallet/external_signer_scriptpubkeyman.cpp

src/wallet/rpc/spend.cpp

src/wallet/rpc/transactions.cpp

src/wallet/rpc/wallet.cpp

src/wallet/feebumper.cpp

src/wallet/feebumper.h

src/index/base.h

src/index/base.cpp

src/index/txindex.h

src/index/txindex.cpp

src/index/txindex_key.h

src/index/txospenderindex.h

src/index/txospenderindex.cpp

src/index/blockfilterindex.h

src/index/blockfilterindex.cpp

src/index/coinstatsindex.h

src/index/coinstatsindex.cpp

src/index/db_key.h

src/index/disktxpos.h

src/kernel/chain.cpp

src/kernel/chain.h

src/kernel/checks.cpp

src/kernel/checks.h

src/kernel/context.cpp

src/kernel/context.h

src/kernel/cs_main.cpp

src/kernel/cs_main.h

src/kernel/disconnected_transactions.cpp

src/kernel/disconnected_transactions.h

src/kernel/mempool_removal_reason.cpp

src/kernel/mempool_removal_reason.h

src/kernel/coinstats.cpp

src/kernel/coinstats.h

src/kernel/chainparams.cpp

src/kernel/chainparams.h

src/wallet/sqlite.cpp

src/wallet/sqlite.h

src/wallet/transaction.cpp

src/wallet/transaction.h

src/wallet/dump.cpp

src/wallet/dump.h

src/wallet/init.cpp

src/wallet/walletutil.cpp

src/wallet/walletutil.h

src/wallet/wallettool.cpp

src/wallet/wallettool.h

src/wallet/export.h

src/wallet/migrate.cpp

src/wallet/migrate.h

src/wallet/db.h

src/wallet/walletdb.cpp

src/wallet/interfaces.cpp

src/wallet/scriptpubkeyman.cpp

src/wallet/scriptpubkeyman.h

src/kernel/bitcoinkernel.cpp

src/kernel/bitcoinkernel.h

src/kernel/bitcoinkernel_wrapper.h

src/node/chainstate.cpp

src/node/chainstate.h

src/node/blockstorage.cpp

src/node/blockstorage.h

src/node/mempool_persist.cpp

src/node/mempool_persist.h

src/node/utxo_snapshot.cpp

src/node/utxo_snapshot.h

src/node/kernel_notifications.cpp

src/node/kernel_notifications.h

src/node/blockmanager_args.cpp

src/kernel/blockmanager_opts.h

src/util/expected.cpp

src/policy/settings.h

src/util/types.h

src/kernel/messagestartchars.h

src/kernel/warning.h

src/util/exception.h

src/common/license_info.h

src/node/coins_view_args.h

src/node/database_args.h

src/util/batchpriority.h

src/util/ui_change_type.h

src/node/coins_view_args.cpp

src/node/peerman_args.h

src/util/serfloat.h

src/node/blockmanager_args.h

src/node/database_args.cpp

src/util/overloaded.h

src/interfaces/types.h

src/node/chainstatemanager_args.h

src/node/minisketchwrapper.h

src/util/macros.h

src/util/syserror.h

src/common/run_command.h

src/util/bytevectorhash.cpp

src/node/mempool_persist_args.cpp

src/util/exec.h

src/util/rbf.h

src/crypto/hex_base.h

src/node/mempool_persist_args.h

src/interfaces/echo.h

src/util/any.h

src/util/batchpriority.cpp

src/util/threadnames.h

src/node/coin.h

src/node/mempool_args.h

src/util/asmap.h

src/util/bytevectorhash.h

src/node/context.cpp

src/util/insert.h

src/util/readwritefile.h

src/node/peerman_args.cpp

src/node/interface_ui.cpp

src/interfaces/handler.h

src/node/mining_args.h

src/util/hasher.cpp

src/common/init.h

src/kernel/mempool_limits.h

src/common/system.h

src/crypto/sha3.h

src/util/threadinterrupt.cpp

src/node/protocol_version.h

src/util/exception.cpp

src/common/messages.h

src/node/connection_types.cpp

src/util/bip32.h

src/common/license_info.cpp

src/util/stdmutex.h

src/common/run_command.cpp

src/util/check.cpp

src/util/golombrice.h

src/node/types.h

src/node/timeoffsets.h

src/util/readwritefile.cpp

src/util/fastrange.h

src/util/signalinterrupt.h

src/util/task_runner.h

src/util/syserror.cpp

src/common/interfaces.cpp

src/common/types.h

src/util/threadinterrupt.h

src/kernel/chainstatemanager_opts.h

src/node/psbt.h

src/policy/ephemeral_policy.h

src/util/trace.h

src/common/url.cpp

src/kernel/mempool_options.h

src/util/serfloat.cpp

src/kernel/notifications_interface.h

src/node/timeoffsets.cpp

src/node/warnings.cpp

src/util/hash_type.h

src/crypto/hex_base.cpp

src/node/eviction.h

src/util/tokenbucket.h

src/crypto/aes.h

src/common/pcp.h

src/util/feefrac.cpp

src/node/transaction.h

src/util/threadnames.cpp

src/common/signmessage.h

src/util/exec.cpp

src/util/signalinterrupt.cpp

src/clientversion.cpp

src/common/signmessage.cpp

src/compat/assumptions.h

src/compat/byteswap.h

src/deploymentinfo.cpp

src/deploymentinfo.h

src/deploymentstatus.cpp

src/deploymentstatus.h

src/dummywallet.cpp

src/external_signer.h

src/init/bitcoin-gui.cpp

src/init/bitcoin-node.cpp

src/init/bitcoin-qt.cpp

src/init/bitcoin-wallet.cpp

src/init/bitcoind.cpp

src/init/common.h

src/interfaces/init.h

src/interfaces/ipc.h

src/key_io.h

src/logging/categories.h

src/logging/timer.h

src/mapport.h

src/musig.h

src/net_permissions.h

src/netgroup.h

src/netmessagemaker.h

src/node/chainstatemanager_args.cpp

src/node/connection_types.h

src/node/context.h

src/node/interface_ui.h

src/node/mempool_args.cpp

src/node/mining_args.cpp

src/node/minisketchwrapper.cpp

src/node/txreconciliation.h

src/policy/fees/estimator_args.cpp

src/policy/fees/estimator_args.h

src/policy/fees/estimator_man.cpp

src/policy/fees/estimator_man.h

src/policy/packages.h

src/policy/rbf.h

src/policy/truc_policy.h

src/pow.h

src/primitives/block.cpp

src/randomenv.h

src/rest.h

src/script/keyorigin.h

src/script/parsing.cpp

src/script/parsing.h

src/script/script_error.h

src/script/sigcache.cpp

src/script/sigcache.h

src/script/solver.h

src/script/verify_flags.h

src/semaphore_grant.h

src/signet.h

src/span.h

src/support/allocators/secure.h

src/support/allocators/zeroafterfree.h

src/util/tokenpipe.cpp

src/util/translation.h

src/util/vector.h

src/versionbits.h

src/versionbits_impl.h

src/wallet/external_signer_scriptpubkeyman.h

src/wallet/fees.h

src/wallet/load.h

src/wallet/receive.h

src/wallet/rpc/wallet.h

src/wallet/types.h

src/walletinitinterface.h

src/zmq/zmqabstractnotifier.cpp

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.