BIP324 connection support #28196

594@@ -595,12 +595,12 @@ def connect_nodes(self, a, b):
595         # * Must have a verack message before anything else
596         self.wait_until(lambda: sum(peer['version'] != 0 for peer in from_connection.getpeerinfo()) == from_num_peers)
597         self.wait_until(lambda: sum(peer['version'] != 0 for peer in to_connection.getpeerinfo()) == to_num_peers)
598-        self.wait_until(lambda: sum(peer['bytesrecv_per_msg'].pop('verack', 0) == 24 for peer in from_connection.getpeerinfo()) == from_num_peers)
599-        self.wait_until(lambda: sum(peer['bytesrecv_per_msg'].pop('verack', 0) == 24 for peer in to_connection.getpeerinfo()) == to_num_peers)
600+        self.wait_until(lambda: sum(peer['bytesrecv_per_msg'].pop('verack', 0) >= 21 for peer in from_connection.getpeerinfo()) == from_num_peers)

1434@@ -1434,6 +1435,20 @@ size_t V2Transport::GetSendMemoryUsage() const noexcept
1435     return sizeof(m_send_buffer) + memusage::DynamicUsage(m_send_buffer);
1436 }
1437 
1438+Span<const std::byte> V2Transport::GetSessionID() const noexcept
1439+{
1440+    if (m_use_v1) return m_v1_fallback.GetSessionID();
1441+    LOCK(m_recv_mutex);
1442+    if (m_recv_state == RecvState::V1) return m_v1_fallback.GetSessionID();

1180+    CNetMessage msg{std::move(ret)};
1181+    msg.m_raw_message_size = m_recv_decode_buffer.size() + BIP324Cipher::EXPANSION;
1182+    if (msg_type) {
1183+        reject_message = false;
1184+        msg.m_type = std::move(*msg_type);
1185+        msg.m_time = time;

1093+                m_recv_state = RecvState::APP_READY;
1094+            }
1095+            break;
1096+        default:
1097+            // Any other state is invalid (this function should not have been called).
1098+            assert(false);

939+    AssertLockNotHeld(m_recv_mutex);
940+    LOCK(m_recv_mutex);
941+    return m_recv_state == RecvState::APP_READY;
942+}
943+
944+void V2Transport::SetReceiveVersion(int nVersionIn) noexcept

1047+{
1048+    AssertLockHeld(m_recv_mutex);
1049+    if (m_recv_buffer.size() == BIP324Cipher::LENGTH_LEN) {
1050+        // Length descriptor received.
1051+        m_recv_len = m_cipher.DecryptLength(MakeByteSpan(m_recv_buffer));
1052+        if (m_recv_len > MAX_SIZE + 13 || m_recv_len > MAX_PROTOCOL_MESSAGE_LENGTH + 13) {

1290+            // Unknown short message id.
1291+            return std::nullopt;
1292+        }
1293+    }
1294+
1295+    if (contents.size() < 13) return std::nullopt; // Long encoding needs at least 13 bytes

1356+    if (short_message_id) {
1357+        contents.resize(1 + msg.data.size());
1358+        contents[0] = *short_message_id;
1359+        std::copy(msg.data.begin(), msg.data.end(), contents.begin() + 1);
1360+    } else {
1361+        contents.resize(13 + msg.data.size());

327@@ -320,7 +328,7 @@ class Transport {
328      * Note that m_type and to_send refer to data that is internal to the transport, and calling
329      * any non-const function on this object may invalidate them.
330      */

472+         * connection aborts. */
473+        GARBAUTH,
474+
475+        /** Version packet.
476+         *
477+         * A packet is received, and decrypted/verified. If that succeeds, its contents is

440+     *  and ignored by receivers. If extensions are defined, they can change what is sent as long
441+     *  as an empty version packet contents is interpreted as no extensions present. */
442+    static constexpr std::array<std::byte, 0> VERSION_CONTENTS = {};
443+
444+    /** State type that defines the contents of the receive buffer. */
445+    enum class RecvState {

439+    /** Contents of the version packet to send. BIP324 stipulates this is supposed to be empty,
440+     *  and ignored by receivers. If extensions are defined, they can change what is sent as long
441+     *  as an empty version packet contents is interpreted as no extensions present. */
442+    static constexpr std::array<std::byte, 0> VERSION_CONTENTS = {};
443+
444+    /** State type that defines the contents of the receive buffer. */

1002+    AssertLockNotHeld(m_send_mutex);
1003+    // We still have to determine if this is a v1 or v2 connection. The bytes being received could
1004+    // be the beginning of either a v1 packet (network magic + "version\x00"), or of a v2 public key.
1005+    assert(m_recv_buffer.size() <= m_v1_prefix.size());
1006+    if (!std::equal(m_recv_buffer.begin(), m_recv_buffer.end(), m_v1_prefix.begin())) {
1007+        // Mismatch with v1 prefix, so we can assume a v2 connection.

1009+        // Transition the sender to KEY state (if not already).
1010+        LOCK(m_send_mutex);
1011+        assert(m_send_state == SendState::KEY_MAYBE_V1 || m_send_state == SendState::KEY);
1012+        m_send_state = SendState::KEY;
1013+    } else if (m_recv_buffer.size() == m_v1_prefix.size()) {
1014+        // Full match with the v2 prefix, so fall back to v1 behavior.

438+    /** Contents of the version packet to send. BIP324 stipulates this is supposed to be empty,
439+     *  and ignored by receivers. If extensions are defined, they can change what is sent as long
440+     *  as an empty version packet contents is interpreted as no extensions present. */
441+    static constexpr std::array<std::byte, 0> VERSION_CONTENTS = {};
442+
443+    /** State type that defines the contents of the receive buffer. */

966+        // These three states all involve decoding a packet. Process the length descriptor first,
967+        // followed by the ciphertext.
968+        if (m_recv_buffer.size() < BIP324Cipher::LENGTH_LEN) {
969+            return BIP324Cipher::LENGTH_LEN - m_recv_buffer.size();
970+        } else {
971+            return BIP324Cipher::EXPANSION + m_recv_len - m_recv_buffer.size();

1066+            return false;
1067+        }
1068+        // Feed the last 4 bytes of the Poly1305 authentication tag (and its timing) into our RNG.
1069+        RandAddEvent(ReadLE32(m_recv_buffer.data() + m_recv_buffer.size() - 4));
1070+
1071+        // At this point we have a valid packed decrypted into m_recv_decode_buffer. Depending on

1077+            m_recv_state = RecvState::VERSION;
1078+            m_recv_garbage = {};
1079+            break;
1080+        case RecvState::VERSION:
1081+            if (!ignore) {
1082+                // Version message received; transition to application phase. The contents is

431+     *  as an empty version packet contents is interpreted as no extensions present. */
432+    static constexpr std::array<std::byte, 0> VERSION_CONTENTS = {};
433+
434+    /** State type that defines the current contents of the receive buffer and/or how the next
435+     *  received bytes added to it will be interpreted. */
436+    enum class RecvState {

298@@ -300,7 +299,8 @@ class Transport {
299      *  - Span<const uint8_t> to_send: span of bytes to be sent over the wire (possibly empty).
300      *  - bool more: whether there will be more bytes to be sent after the ones in to_send are
301      *    all sent (as signaled by MarkBytesSent()).
302-     *  - const std::string& m_type: message type on behalf of which this is being sent.
303+     *  - const std::string& m_type: message type on behalf of which this is being sent
304+     *    ("" for bytes that are not on behalf of any message).

423+class V2Transport final : public Transport
424+{
425+public:
426+    static constexpr uint32_t MAX_GARBAGE_LEN = 4095;
427+
428+private:

551+    std::array<uint8_t, 12> m_v1_prefix = {0, 0, 0, 0, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x00};
552+
553+    /** Lock for receiver-side fields. */
554+    mutable Mutex m_recv_mutex;
555+    /** In {GARBAUTH, VERSION, APP}, the decrypted packet length, if
556+     *  m_recv_buffer.size() >= BIP324::LENGTH_LEN). Unspecified otherwise. */

560+    /** During GARBAUTH, the garbage received during GARB_GARBTERM. */
561+    std::vector<uint8_t> m_recv_garbage GUARDED_BY(m_recv_mutex);
562+    /** Buffer to put decrypted contents in, for converting to CNetMessage. */
563+    std::vector<uint8_t> m_recv_decode_buffer GUARDED_BY(m_recv_mutex);
564+    /** Deserialization type. */
565+    int m_recv_type GUARDED_BY(m_recv_mutex);

595+public:
596+
597+    /** Construct a V2 transport with securely generated random keys. */
598+    V2Transport(NodeId nodeid, bool initiating, int type_in, int version_in) noexcept;
599+    /** Construct a V2 transport with specified keys and garbage (test use only). */
600+    V2Transport(NodeId nodeid, bool initiating, int type_in, int version_in, const CKey& key, Span<const std::byte> ent32, Span<const uint8_t> garbage) noexcept;

1029+        return m_v1_prefix.size() - m_recv_buffer.size();
1030+    case RecvState::KEY:
1031+        // As long as we have not received the other side's public key, don't receive more than
1032+        // that (64 bytes), as garbage follows, and locating the garbage terminator requires the
1033+        // key exchange first.
1034+        return EllSwiftPubKey::size() - m_recv_buffer.size();

567+    int m_recv_version GUARDED_BY(m_recv_mutex);
568+    /** Current receiver state. */
569+    RecvState m_recv_state GUARDED_BY(m_recv_mutex);
570+
571+    /** Lock for sending-side fields. */
572+    mutable Mutex m_send_mutex;

1101+
1102+        // Initialize the ciphers.
1103+        std::array<std::byte, EllSwiftPubKey::size()> ellswift_data;
1104+        std::copy(m_recv_buffer.begin(), m_recv_buffer.end(), UCharCast(ellswift_data.data()));
1105+        LOCK(m_send_mutex);
1106+        m_cipher.Initialize(EllSwiftPubKey{ellswift_data}, m_initiating);

1104+        std::copy(m_recv_buffer.begin(), m_recv_buffer.end(), UCharCast(ellswift_data.data()));
1105+        LOCK(m_send_mutex);
1106+        m_cipher.Initialize(EllSwiftPubKey{ellswift_data}, m_initiating);
1107+
1108+        // Switch receiver state to GARB_GARBTERM.
1109+        m_recv_state = RecvState::GARB_GARBTERM;

1144+            // Garbage terminator received. Switch to receiving garbage authentication packet.
1145+            m_recv_garbage = std::move(m_recv_buffer);
1146+            m_recv_garbage.resize(m_recv_garbage.size() - BIP324Cipher::GARBAGE_TERMINATOR_LEN);
1147+            m_recv_buffer.clear();
1148+            m_recv_state = RecvState::GARBAUTH;
1149+        } else if (m_recv_buffer.size() == MAX_GARBAGE_LEN + BIP324Cipher::GARBAGE_TERMINATOR_LEN) {

1143+        if (MakeByteSpan(m_recv_buffer).last(BIP324Cipher::GARBAGE_TERMINATOR_LEN) == m_cipher.GetReceiveGarbageTerminator()) {
1144+            // Garbage terminator received. Switch to receiving garbage authentication packet.
1145+            m_recv_garbage = std::move(m_recv_buffer);
1146+            m_recv_garbage.resize(m_recv_garbage.size() - BIP324Cipher::GARBAGE_TERMINATOR_LEN);
1147+            m_recv_buffer.clear();
1148+            m_recv_state = RecvState::GARBAUTH;

1162+    if (m_recv_buffer.size() == BIP324Cipher::LENGTH_LEN) {
1163+        // Length descriptor received.
1164+        m_recv_len = m_cipher.DecryptLength(MakeByteSpan(m_recv_buffer));
1165+        if (m_recv_len > MAX_SIZE + 1 + CMessageHeader::COMMAND_SIZE ||
1166+            m_recv_len > MAX_PROTOCOL_MESSAGE_LENGTH + 1 + CMessageHeader::COMMAND_SIZE) {
1167+            LogPrint(BCLog::NET, "V2 transport error: packet too large (%u bytes), peer=%d\n", m_recv_len, m_nodeid);

1165+        if (m_recv_len > MAX_SIZE + 1 + CMessageHeader::COMMAND_SIZE ||
1166+            m_recv_len > MAX_PROTOCOL_MESSAGE_LENGTH + 1 + CMessageHeader::COMMAND_SIZE) {
1167+            LogPrint(BCLog::NET, "V2 transport error: packet too large (%u bytes), peer=%d\n", m_recv_len, m_nodeid);
1168+            return false;
1169+        }
1170+    } else if (m_recv_buffer.size() > BIP324Cipher::LENGTH_LEN && m_recv_buffer.size() == m_recv_len + BIP324Cipher::EXPANSION) {

1373+    } else {
1374+        // Initialize with zeroes, and then write the message type string starting at offset 0.
1375+        // This means contents[0] and the unused positions in contents[1..13] remain 0x00.
1376+        contents.resize(1 + CMessageHeader::COMMAND_SIZE + msg.data.size(), 0);
1377+        std::copy(msg.m_type.begin(), msg.m_type.end(), reinterpret_cast<char*>(contents.data() + 1));
1378+        std::copy(msg.data.begin(), msg.data.end(), contents.begin() + 1 + CMessageHeader::COMMAND_SIZE);

539@@ -538,6 +540,9 @@ class V2Transport final : public Transport
540     const bool m_initiating;
541     /** NodeId (for debug logging). */
542     const NodeId m_nodeid;
543+    /** Whether the send/receive states are V1. This is an optimization allowing fallback to
544+     *  (typically) work without the m_cs_send or m_cs_recv locks. */

539@@ -538,6 +540,9 @@ class V2Transport final : public Transport
540     const bool m_initiating;
541     /** NodeId (for debug logging). */
542     const NodeId m_nodeid;
543+    /** Whether the send/receive states are V1. This is an optimization allowing fallback to
544+     *  (typically) work without the m_cs_send or m_cs_recv locks. */
545+    std::atomic<bool> m_use_v1{false};

568+    /** NodeId (for debug logging). */
569+    const NodeId m_nodeid;
570+    /** Encapsulate a V1Transport to fall back to. */
571+    V1Transport m_v1_fallback;
572+    /** V1 prefix to look for (4-byte network magic + "version\x00"; magic will be filled in). */
573+    std::array<uint8_t, 12> m_v1_prefix = {0, 0, 0, 0, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x00};

1140+    AssertLockNotHeld(m_send_mutex);
1141+    Assume(m_recv_state == RecvState::KEY_MAYBE_V1);
1142+    // We still have to determine if this is a v1 or v2 connection. The bytes being received could
1143+    // be the beginning of either a v1 packet (network magic + "version\x00"), or of a v2 public key.
1144+    assert(m_recv_buffer.size() <= m_v1_prefix.size());
1145+    if (!std::equal(m_recv_buffer.begin(), m_recv_buffer.end(), m_v1_prefix.begin())) {

1046+
1047+void V2Transport::SetSendState(SendState send_state) noexcept
1048+{
1049+    AssertLockHeld(m_send_mutex);
1050+    // No-op if no change is desired.
1051+    if (send_state == m_send_state) return;

1147+        SetReceiveState(RecvState::KEY); // Convert to KEY state, leaving received bytes around.
1148+        // Transition the sender to KEY_GARB state (if not already).
1149+        LOCK(m_send_mutex);
1150+        SetSendState(SendState::KEY_GARB);
1151+    } else if (m_recv_buffer.size() == m_v1_prefix.size()) {
1152+        // Full match with the v2 prefix, so fall back to v1 behavior.

1152+        // Full match with the v2 prefix, so fall back to v1 behavior.
1153+        LOCK(m_send_mutex);
1154+        Span<const uint8_t> feedback{m_recv_buffer};
1155+        bool ret = m_v1_fallback.ReceivedBytes(feedback); // Feed already received bytes to v1 transport.
1156+        assert(feedback.empty());
1157+        assert(ret);

343+    key_data.resize(32);
344+    CKey key;
345+    key.Set(key_data.begin(), key_data.end(), true);
346+    if (!key.IsValid()) return {};
347+    // Construct garbage
348+    size_t garb_len = provider.ConsumeIntegralInRange<size_t>(0, 4095);

359+    // Retrieve entropy
360+    auto ent = provider.ConsumeBytes<std::byte>(32);
361+    ent.resize(32);
362+    // Use as entropy SHA256(ent || garbage). This prevents a situation where the fuzzer manages to
363+    // include the garbage terminator (which is a function of both ellswift keys) in the garbage.
364+    // This is entremely unlikely (~2^-116) with random keys/garbage, but the fuzzer can choose

1321+        } else if (m_recv_state == RecvState::GARBAUTH || m_recv_state == RecvState::VERSION ||
1322+            m_recv_state == RecvState::APP) {
1323+            // During states where a packet is being received, as much as is expected but never
1324+            // more than MAX_RESERVE_AHEAD bytes in addition to what is received so far.
1325+            size_t alloc_add = std::min(max_read, msg_bytes.size() + MAX_RESERVE_AHEAD);
1326+            m_recv_buffer.reserve(m_recv_buffer.size() + alloc_add);

1277+    /** Schedule an encrypted packet with specified message type and payload to be sent to
1278+     *  transport (only after ReceiveKey). */
1279+    void SendMessage(std::string mtype, Span<const uint8_t> payload)
1280+    {
1281+        // Construct contents consisting of 0x00 + 12-byte message type + payload.
1282+        std::vector<uint8_t> contents(13 + payload.size());

1321+        tester.SendVersion();
1322+        ret = tester.Interact();
1323+        BOOST_CHECK(ret && ret->empty());
1324+        tester.ReceiveGarbage();
1325+        tester.ReceiveVersion();
1326+        auto msg_data_1 = g_insecure_rand_ctx.randbytes<uint8_t>(InsecureRandRange(100000));

582+
583+public:
584+    static constexpr uint32_t MAX_GARBAGE_LEN = 4095;
585+
586+    /** Construct a V2 transport with securely generated random keys. */
587+    V2Transport(NodeId nodeid, bool initiating, int type_in, int version_in) noexcept;

418@@ -417,6 +419,187 @@ class V1Transport final : public Transport
419     size_t GetSendMemoryUsage() const noexcept override EXCLUSIVE_LOCKS_REQUIRED(!m_send_mutex);
420 };
421 
422+class V2Transport final : public Transport
423+{
424+private:
425+    /** Contents of the version packet to send. BIP324 stipulates this is supposed to be empty,

502+        /** Public key.
503+         *
504+         * This is the initial state. The public key is sent out. When the receiver
505+         * receives the other side's public key and transitions to GARB_GARBTERM, the sender state
506+         * becomes KEY_GARBTERM_GARBAUTH_VERSION. The key is left in the send buffer when this
507+         * happens, because it may not have been fully sent out yet. */

1041+    Assume(m_recv_state == RecvState::KEY);
1042+    if (m_recv_buffer.size() == EllSwiftPubKey::size()) {
1043+        // Other side's key has been fully received.
1044+
1045+        // Initialize the ciphers.
1046+        EllSwiftPubKey ellswift(MakeByteSpan(m_recv_buffer).first(EllSwiftPubKey::size()));

1131+        if (!ret) {
1132+            LogPrint(BCLog::NET, "V2 transport error: packet decryption failure (%u bytes), peer=%d\n", m_recv_len, m_nodeid);
1133+            return false;
1134+        }
1135+        // Feed the last 4 bytes of the Poly1305 authentication tag (and its timing) into our RNG.
1136+        RandAddEvent(ReadLE32(m_recv_buffer.data() + m_recv_buffer.size() - 4));

1244+    Assume(m_recv_state == RecvState::APP_READY);
1245+    Span<const uint8_t> contents{m_recv_decode_buffer};
1246+    auto msg_type = GetMessageType(contents);
1247+    CDataStream ret(m_recv_type, m_recv_version);
1248+    CNetMessage msg{std::move(ret)};
1249+    msg.m_raw_message_size = m_recv_decode_buffer.size() + BIP324Cipher::EXPANSION;

418@@ -417,6 +419,194 @@ class V1Transport final : public Transport
419     size_t GetSendMemoryUsage() const noexcept override EXCLUSIVE_LOCKS_REQUIRED(!m_send_mutex);
420 };
421 
422+class V2Transport final : public Transport
423+{
424+private:
425+    /** Contents of the version packet to send. BIP324 that senders should leave this empty, and

969+{
970+    AssertLockHeld(m_send_mutex);
971+    // No-op if no change is desired.
972+    if (send_state == m_send_state) return;
973+    // Enforce allowed state transitions.
974+    switch (send_state) {

319-     * to what is being returned.
320+     * @param[in] have_next_message controls whether the "more" return value indicates more bytes
321+     *            to be sent before (have_next_message=false) or after (have_next_message=true) a
322+     *            potential SetMessageToSend immediately afterwards. It is set by the caller when
323+     *            they know they have another message ready to send. The have_next_message
324+     *            argument only affects this "more" return value and nothing else.

3012@@ -3006,7 +3013,7 @@ void CConnman::PushMessage(CNode* pnode, CSerializedNetMsg&& msg)
3013     size_t nBytesSent = 0;
3014     {
3015         LOCK(pnode->cs_vSend);
3016-        const auto& [to_send, _more, _msg_type] = pnode->m_transport->GetBytesToSend();
3017+        const auto& [to_send, more, _msg_type] = pnode->m_transport->GetBytesToSend(true);

3026+        // If there was nothing to send before, and there is now (predicted by the "more" value
3027+        // returned by the GetBytesToSend call above), attempt "optimistic write":
3028         // because the poll/select loop may pause for SELECT_TIMEOUT_MILLISECONDS before actually
3029         // doing a send, try sending from the calling thread if the queue was empty before.
3030-        if (queue_was_empty) {
3031+        if (queue_was_empty && more) {

1332-            const auto& [to_send, _more, _msg_type] = pnode->m_transport->GetBytesToSend();
1333-            select_send = !to_send.empty() || !pnode->vSendMsg.empty();
1334+            // once a potential message from vSendMsg is handed to the transport. GetBytesToSend
1335+            // determines both of these in a single call.
1336+            const auto& [to_send, more, _msg_type] = pnode->m_transport->GetBytesToSend(!pnode->vSendMsg.empty());
1337+            select_send = !to_send.empty() || more;

1014+/** A class for scenario-based tests of V2Transport
1015+ *
1016+ * Each V2TransportTester encapsulates a V2Transport (the one being tested), and can be told to
1017+ * interact with it. To do so, it also encapsulates a BIP324Cipher to act as the other side. A
1018+ * second V2Transport is not used, as doing so would not permit scenarios that involve sending
1019+ * invalid data, or ones scenarios using BIP324 features that are not implemented on the sending

1033+
1034+void V2Transport::ProcessReceivedKey() noexcept
1035+{
1036+    AssertLockHeld(m_recv_mutex);
1037+    AssertLockNotHeld(m_send_mutex);
1038+    Assume(m_recv_state == RecvState::KEY);

1035+{
1036+    AssertLockHeld(m_recv_mutex);
1037+    AssertLockNotHeld(m_send_mutex);
1038+    Assume(m_recv_state == RecvState::KEY);
1039+    if (m_recv_buffer.size() == EllSwiftPubKey::size()) {
1040+        // Other side's key has been fully received.

918+    m_recv_state{RecvState::KEY},
919+    m_send_state{SendState::KEY}
920+{
921+    // Initialize the send buffer with ellswift pubkey.
922+    m_send_buffer.resize(EllSwiftPubKey::size());
923+    std::copy(std::begin(m_cipher.GetOurPubKey()), std::end(m_cipher.GetOurPubKey()), MakeWritableByteSpan(m_send_buffer).begin());

1045+        m_cipher.Initialize(ellswift, m_initiating);
1046+
1047+        // Switch receiver state to GARB_GARBTERM.
1048+        SetReceiveState(RecvState::GARB_GARBTERM);
1049+        m_recv_buffer.clear();
1050+

1085+            m_recv_buffer.clear();
1086+            SetReceiveState(RecvState::GARBAUTH);
1087+        } else if (m_recv_buffer.size() == MAX_GARBAGE_LEN + BIP324Cipher::GARBAGE_TERMINATOR_LEN) {
1088+            // We've reached the maximum length for garbage + garbage terminator, and the
1089+            // terminator still does not match. Abort.
1090+            LogPrint(BCLog::NET, "V2 transport error: missing garbage terminator, peer=%d\n", m_nodeid);

1100+    Assume(m_recv_state == RecvState::GARBAUTH || m_recv_state == RecvState::VERSION ||
1101+           m_recv_state == RecvState::APP);
1102+
1103+    // The maximum permitted contents length for a packet.
1104+    static constexpr size_t MAX_CONTENTS_LEN =
1105+        1 + CMessageHeader::COMMAND_SIZE + // The maximum length for encoding the message type.

1011+        return 1;
1012+    case RecvState::GARBAUTH:
1013+    case RecvState::VERSION:
1014+    case RecvState::APP:
1015+        // These three states all involve decoding a packet. Process the length descriptor first,
1016+        // followed by the ciphertext.

1143+            break;
1144+        case RecvState::VERSION:
1145+            if (!ignore) {
1146+                // Version message received; transition to application phase. The contents is
1147+                // ignored, but can be used for future extensions.
1148+                SetReceiveState(RecvState::APP);

3029+        // If there was nothing to send before, and there is now (predicted by the "more" value
3030+        // returned by the GetBytesToSend call above), attempt "optimistic write":
3031         // because the poll/select loop may pause for SELECT_TIMEOUT_MILLISECONDS before actually
3032         // doing a send, try sending from the calling thread if the queue was empty before.
3033-        if (queue_was_empty) {
3034+        if (queue_was_empty && more) {

1085+            // terminator still does not match. Abort.
1086+            LogPrint(BCLog::NET, "V2 transport error: missing garbage terminator, peer=%d\n", m_nodeid);
1087+            return false;
1088+        }
1089+    }
1090+    return true;

1106+        m_recv_len = m_cipher.DecryptLength(MakeByteSpan(m_recv_buffer));
1107+        if (m_recv_len > MAX_CONTENTS_LEN) {
1108+            LogPrint(BCLog::NET, "V2 transport error: packet too large (%u bytes), peer=%d\n", m_recv_len, m_nodeid);
1109+            return false;
1110+        }
1111+    } else if (m_recv_buffer.size() > BIP324Cipher::LENGTH_LEN && m_recv_buffer.size() == m_recv_len + BIP324Cipher::EXPANSION) {

450+         * becomes GARB_GARBTERM. */
451+        KEY,
452+
453+        /** Garbage and garbage terminator.
454+         *
455+         * Whenever a byte is received, the last 16 bytes are compared with the expected garbage