btc: arm submitblock RPC backup (ARM B) of the dual-path broadcaster (#744) (#787)

* btc: arm submitblock RPC backup leg (ARM B) of the dual-path broadcaster (#744)

The embedded coin-net P2P relay (submit_block_for_connect -> submit_block_p2p_raw)
is the always-primary daemonless broadcast arm and was already live-wired. The
submitblock RPC backup (ARM B) existed in btc::coin::Node but m_rpc was never
constructed in the run path (init_rpc was dead code that also forced getwork),
so a won block could not reach a locally-run bitcoind -- the #744 gap.

Add an opt-in submitblock backup mirroring the DGB reference (#82):
- btc/coin/rpc_conf.hpp: header-only bitcoin.conf credential parser (twin of
  dgb/coin/rpc_conf.hpp). rpcpassword stays off the process table; --coin-rpc
  carries HOST:PORT only, --coin-rpc-auth points at the conf file.
- btc::coin::Node::arm_submit_rpc(): constructs+connects NodeRPC for submitblock
  ONLY (no getwork side effect), plus has_rpc().
- main_btc: load creds (default ~/.bitcoin/bitcoin.conf), arm when armed()==true,
  otherwise stay UNARMED (daemonless default, byte-identical to before).
- rpc_conf_test.cpp: 5 KATs (armed/unarmed/missing-file/aliases/endpoint-override).

Broadcast-config path only -- no PoW hash, share format, coinbase commitment, or
PPLNS math is touched (consensus-neutral). BTC-fenced; no shared/core edit.
Builds clean (c2pool-btc + btc_share_test); KATs pass.

* btc: harden ARM B submitblock backup — genesis, parser, throw-guard, socket deadline (#744/#787)

Arming ARM B (m_rpc) made four previously-dead defects live on the reward path.
Review (review) findings, all fixed:

B1 (blocker) — NodeRPC::check() probed the LITECOIN genesis hash (copied from the
LTC impl, a #759-class cross-coin drift). On BTC mainnet the is_main_chain &&
!has_block gate always failed -> permanent 15s reconnect loop, ARM B degraded on
the one net where a lost block is real money. New btc/coin/genesis.hpp +
btc_genesis_hash(IS_TESTNET); check() now probes the per-net BTC genesis (mirrors
the DGB reference). genesis_check_test.cpp pins it (regression guard vs the LTC
hash).

B2 (blocker) — unguarded std::stoi in rpc_conf.hpp aborted the node at startup on
a malformed rpcport (e.g. rpcport=abc) in the DEFAULT ~/.bitcoin/bitcoin.conf,
crashing operators who never opted in. New conf_detail::parse_port (digits-only,
range-checked, never throws) -> junk degrades to UNARMED. 3 new KATs.

M1 (major) — a daemon unreachable at submit raised JsonRpcException out of
submit_block_hex; broadcast_block_for_connect had no throw guards (unlike the core
SSOT), so the exception destroyed ARM A's already-succeeded relay -> false 'reached
NEITHER -- lost subsidy' alarm for a block that WAS relayed. Both legs now guarded.
3 new throwing-leg KATs.

M2 (major) — no socket deadline on the beast tcp_stream shared with stratum on one
single-threaded ioc; a hung bitcoind froze the whole node mid-won-block. Added
apply_socket_timeouts() (SO_SND/RCVTIMEO, mirrors DASH #781), armed after each
(re)connect.

Also softened the arm_submit_rpc comment (check() does issue read-only probes).
Broadcast/RPC-transport path only -- no PoW, share, coinbase-commitment, or PPLNS
math touched (consensus-neutral). BTC-fenced. Builds clean (c2pool-btc +
btc_share_test); 20 KATs pass.

Author: frstrtr

src/c2pool/main_btc.cpp

@@ -31,6 +31,7 @@
 #include <impl/btc/coin/transaction.hpp>
 #include <impl/btc/config.hpp>
 #include <impl/btc/config_pool.hpp>
+#include <impl/btc/coin/rpc_conf.hpp>   // bitcoin.conf creds for the submitblock RPC backup (ARM B, #82/#744)
 #include <impl/btc/node.hpp>
 #include <impl/btc/auto_ratchet.hpp>     // AutoRatchet V35->V36 forward-version-voting
 #include <impl/btc/share_check.hpp>      // RefHashParams + compute_ref_hash_for_work
@@ -102,7 +103,13 @@ static void print_usage()
         "  --prefix HEX    c2pool sharechain PREFIX (hex, <=8 bytes), an\n"
         "                  INDEPENDENT per-network constant (no algebraic tie to\n"
         "                  IDENTIFIER). Supply with --network-id to join a custom\n"
-        "                  p2pool chain; omit to use the compiled default prefix.\n";
+        "                  p2pool chain; omit to use the compiled default prefix.\n"
+        "  --coin-rpc H:P  submitblock RPC backup (ARM B) endpoint override.\n"
+        "                  Endpoint only (no secret); creds come from bitcoin.conf.\n"
+        "  --coin-rpc-auth PATH  bitcoin.conf-style file with rpcuser/rpcpassword\n"
+        "                  for the submitblock backup (default ~/.bitcoin/\n"
+        "                  bitcoin.conf; keeps rpcpassword off the process table).\n"
+        "                  Omit both to run daemonless (embedded P2P relay only).\n";
 }
 
 /// BTC wire-protocol magic bytes per network (pchMessageStart).
@@ -133,6 +140,8 @@ int main(int argc, char* argv[])
     uint16_t    sharechain_port = 0;        // 0 = default P2P_PORT (9333); --sharechain-port overrides (opt-in isolation)
     std::string network_id_hex;             // --network-id: c2pool IDENTIFIER override (empty = public net)
     std::string prefix_hex;                 // --prefix: c2pool PREFIX override (empty = compiled default)
+    std::string rpc_endpoint;               // --coin-rpc HOST:PORT: submitblock backup endpoint override (no secret)
+    std::string rpc_conf_path;              // --coin-rpc-auth PATH: bitcoin.conf creds (default ~/.bitcoin/bitcoin.conf)
 
     for (int i = 1; i < argc; ++i)
     {
@@ -221,6 +230,20 @@ int main(int argc, char* argv[])
         {
             prefix_hex = argv[++i];
         }
+        else if (arg == "--coin-rpc" && i + 1 < argc)
+        {
+            // --coin-rpc HOST:PORT — endpoint override for the submitblock RPC
+            // backup (ARM B). Endpoint ONLY (no secret) so it is safe on argv;
+            // rpcuser/rpcpassword come from bitcoin.conf (--coin-rpc-auth).
+            rpc_endpoint = argv[++i];
+        }
+        else if (arg == "--coin-rpc-auth" && i + 1 < argc)
+        {
+            // --coin-rpc-auth PATH — bitcoin.conf-style file carrying
+            // rpcuser/rpcpassword for the submitblock RPC backup. Keeps the
+            // rpcpassword OFF the process table (default ~/.bitcoin/bitcoin.conf).
+            rpc_conf_path = argv[++i];
+        }
         else
         {
             std::cerr << "unknown arg: " << arg << "\n";
@@ -379,6 +402,47 @@ int main(int argc, char* argv[])
 
     btc::coin::Node<btc::Config> coin_node(&ioc, &config);
 
+    // ── #82/#744 submitblock RPC BACKUP arm (ARM B of the dual-path
+    // broadcaster) ── The embedded coin-net P2P relay (submit_block_for_connect
+    // -> submit_block_p2p_raw) is the always-primary daemonless path; this arms
+    // the OPT-IN submitblock backup so a won block ALSO reaches a locally-run
+    // bitcoind if the operator provisions one. Creds come from bitcoin.conf
+    // (default ~/.bitcoin/bitcoin.conf, overridable with --coin-rpc-auth PATH)
+    // so the rpcpassword NEVER touches argv; --coin-rpc HOST:PORT overrides only
+    // the endpoint. No creds => arm stays UNARMED (has_rpc()==false) and
+    // submit_block_hex returns false LOUDLY -- byte-identical to the daemonless
+    // default. Mirrors main_dgb's NodeRPC arming (the #82 reference).
+    {
+        btc::coin::RpcConf rpc_conf;
+        std::string conf_path = rpc_conf_path;
+        if (conf_path.empty()) {
+            const char* home = std::getenv("HOME");
+            conf_path = std::string(home ? home : ".") + "/.bitcoin/bitcoin.conf";
+        }
+        if (btc::coin::load_rpc_conf(conf_path, rpc_conf)) {
+            if (rpc_conf.port == 0) {
+                // Bitcoin Core RPC defaults: mainnet 8332, testnet3 18332,
+                // testnet4 48332, regtest 18443.
+                rpc_conf.port = regtest ? 18443
+                              : (testnet4 ? 48332
+                                          : (testnet ? 18332 : 8332));
+            }
+            btc::coin::apply_endpoint_override(rpc_endpoint, rpc_conf);
+        } else {
+            // No conf creds; --coin-rpc alone still lets an operator point the
+            // endpoint, but without user/pass the arm cannot fire.
+            btc::coin::apply_endpoint_override(rpc_endpoint, rpc_conf);
+        }
+        if (rpc_conf.armed()) {
+            coin_node.arm_submit_rpc(NetService(rpc_conf.host, rpc_conf.port),
+                                     rpc_conf.userpass());
+        } else {
+            LOG_INFO << "[BTC] submitblock RPC backup UNARMED "
+                        "(no bitcoin.conf creds; embedded P2P relay is the only "
+                        "broadcast arm)";
+        }
+    }
+
     // Constants for getheaders driver: protocol version sent in the message
     // (matches what we advertised in version handshake — see B1 coin/p2p_node.hpp).
     constexpr uint32_t BTC_PROTOCOL_VERSION = 70016;

src/impl/btc/coin/block_broadcast.hpp

@@ -52,8 +52,19 @@ inline bool broadcast_block_for_connect(
     const std::function<bool()>& relay_p2p,
     const std::function<bool()>& submit_rpc)
 {
-    bool relayed   = relay_p2p  ? relay_p2p()  : false;  // best-effort fast propagation
-    bool connected = submit_rpc ? submit_rpc() : false;  // ALWAYS - connect-authoritative
+    // BOTH legs guarded (mirrors core::broadcast_block_with_fallback): a throwing
+    // sink must NEVER unwind out of the won-block path and destroy the OTHER
+    // leg's result. In particular a throwing submit_rpc -- e.g. a daemon
+    // unreachable at submit time raises JsonRpcException out of submit_block_hex
+    // -- must NOT erase an already-succeeded P2P relay, else the caller falsely
+    // reports "reached NEITHER -- lost subsidy" for a block that WAS relayed to
+    // peers. This hole was newly reachable once ARM B (m_rpc) was armed (#744 M1).
+    bool relayed = false;
+    try { relayed = relay_p2p ? relay_p2p() : false; }      // best-effort fast propagation
+    catch (...) { relayed = false; }
+    bool connected = false;
+    try { connected = submit_rpc ? submit_rpc() : false; }  // ALWAYS - connect-authoritative
+    catch (...) { connected = false; }
     return relayed || connected;
 }
 

src/impl/btc/coin/genesis.hpp

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+#pragma once
+
+// ---------------------------------------------------------------------------
+// btc::coin genesis-hash SSOT for NodeRPC::check().
+//
+// check() probes getblockheader(<genesis>) to confirm the external daemon is a
+// real bitcoind on the SELECTED network (a wrong-coin / wrong-net daemon does
+// not answer for this hash). Historically check() hard-coded the *Litecoin*
+// genesis (copied verbatim from the LTC impl and never corrected), so on BTC
+// MAINNET the `is_main_chain && !has_block` gate always failed -> a permanent
+// 15s reconnect loop and a degraded ARM B on the one network where a lost block
+// is real money (#744/#787 B1, a #759-class cross-coin copy-paste drift).
+//
+// Per-net values sourced from bitcoin/src/kernel/chainparams.cpp and mirrored in
+// header_chain.hpp. Kept as a per-coin ISOLATION primitive (bucket-1): pinned
+// here so a standalone TU can guard against drift WITHOUT linking the beast
+// transport, exactly as dgb/coin/rpc_request.hpp does for DGB.
+// ---------------------------------------------------------------------------
+
+namespace btc
+{
+namespace coin
+{
+
+inline constexpr const char* BTC_GENESIS_MAIN =
+    "000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f";
+// testnet3 genesis. NodeRPC carries a single testnet bool; the check() gate only
+// bites on `is_main_chain` (mainnet), so testnet3/testnet4/regtest all bypass it
+// regardless (is_main_chain==false) -- the testnet value is the correct probe
+// for a standard testnet3 daemon and harmless for the other test nets.
+inline constexpr const char* BTC_GENESIS_TEST =
+    "000000000933ea01ad0ee984209779baaec3ced90fa3f408719526f8d77f4943";
+
+// The genesis hash NodeRPC::check() probes for the selected network.
+inline const char* btc_genesis_hash(bool testnet)
+{
+    return testnet ? BTC_GENESIS_TEST : BTC_GENESIS_MAIN;
+}
+
+} // namespace coin
+} // namespace btc

src/impl/btc/coin/node.hpp

@@ -101,6 +101,29 @@ class Node : public btc::interfaces::Node
             m_p2p->enable_mempool_request();
     }
 
+    /// Arm the submitblock RPC BACKUP leg (ARM B of the dual-path broadcaster)
+    /// WITHOUT the getwork side effect init_rpc() carries. connect() runs the
+    /// read-only liveness/softfork probe check() (getblockheader + getblockchaininfo
+    /// + getnetworkinfo, results discarded by c2pool's own template path) but
+    /// never getwork, so an external bitcoind we drive purely for submitblock
+    /// arms cleanly and the embedded/daemonless template path is unperturbed.
+    /// OPT-IN: main_btc calls
+    /// this only when bitcoin.conf creds resolve (rpcpassword stays off the
+    /// process table); otherwise m_rpc stays null, has_rpc()==false, and
+    /// submit_block_hex returns false LOUDLY -- byte-identical to the daemonless
+    /// default. Mirrors main_dgb's NodeRPC arming (the #82 reference). The
+    /// embedded P2P relay (ARM A) remains the always-primary daemonless path.
+    void arm_submit_rpc(const NetService& addr, const std::string& userpass)
+    {
+        m_rpc = std::make_unique<NodeRPC>(m_context, this, m_config->coin()->m_testnet);
+        m_rpc->connect(addr, userpass);
+        LOG_INFO << "[BTC] submitblock RPC backup ARMED: NodeRPC -> "
+                 << addr.to_string() << " (creds from bitcoin.conf)";
+    }
+
+    /// True once arm_submit_rpc has bound the submitblock backup leg.
+    bool has_rpc() const { return m_rpc != nullptr; }
+
     /// Submit a block via P2P directly (faster propagation than RPC).
     void submit_block_p2p(BlockType& block)
     {

src/impl/btc/coin/rpc.cpp

@@ -1,8 +1,14 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 #include "rpc.hpp"
 
+#ifndef _WIN32
+#include <sys/socket.h>          // setsockopt SO_SND/RCVTIMEO (Send() deadline, #744/#787 M2)
+#include <sys/time.h>            // struct timeval
+#endif
+
 #include <impl/btc/config_pool.hpp>
 #include <impl/btc/coin/softfork_check.hpp>
+#include <impl/btc/coin/genesis.hpp>       // btc_genesis_hash — per-net check() probe (#744/#787 B1)
 
 #include <core/log.hpp>
 #include <core/hash.hpp>
@@ -65,6 +71,11 @@ void NodeRPC::connect(NetService address, std::string userpass)
                         LOG_ERROR << "CoindRPC error when try connect: [" << ec.message() << "].";
                     } else
                     {
+                        // #744/#787 M2: arm the Send() socket deadline on the
+                        // freshly-connected socket BEFORE check() issues any
+                        // blocking RPC, so a daemon that connects but never
+                        // responds cannot wedge the ioc here either.
+                        apply_socket_timeouts();
                         try
                         {
                             if (check())
@@ -128,9 +139,38 @@ void NodeRPC::sync_reconnect()
 		LOG_WARNING << "CoindRPC sync_reconnect connect failed: " << ec.message();
 		return;
 	}
+	apply_socket_timeouts();   // #744/#787 M2: re-arm the Send() deadline on the fresh socket
 	LOG_INFO << "CoindRPC reconnected (sync)";
 }
 
+void NodeRPC::apply_socket_timeouts()
+{
+	// Force the socket back to BLOCKING mode, then set kernel send/receive
+	// timeouts. async_connect leaves asio's non_blocking flag set; under it a
+	// synchronous recv returns EAGAIN immediately and SO_RCVTIMEO is a no-op. In
+	// blocking mode the sync http::write/http::read inside Send() do true
+	// blocking send()/recv() which the kernel bounds by SO_SND/RCVTIMEO, so a
+	// wedged bitcoind returns an error after RPC_IO_TIMEOUT_SECONDS instead of
+	// hanging the whole ioc. (beast tcp_stream::expires_after governs only ASYNC
+	// ops; Send() drives the sync path, so the socket-option deadline is the
+	// correct lever -- same reasoning as the DASH #781 impl.) POSIX-only; on
+	// Windows this is a no-op (pre-PR behaviour: no deadline). #744/#787 M2.
+#ifndef _WIN32
+	if (!m_stream.socket().is_open())
+		return;
+	boost::system::error_code ec;
+	m_stream.socket().non_blocking(false, ec);   // guarantee SO_*TIMEO applies
+	if (ec)
+		LOG_WARNING << "CoindRPC: could not set blocking mode: " << ec.message();
+	struct timeval tv;
+	tv.tv_sec  = RPC_IO_TIMEOUT_SECONDS;
+	tv.tv_usec = 0;
+	const int fd = m_stream.socket().native_handle();
+	::setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
+	::setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
+#endif
+}
+
 std::string NodeRPC::Send(const std::string &request)
 {
 	// Retry once after synchronous reconnect on write/read failure
@@ -195,7 +235,9 @@ nlohmann::json NodeRPC::CallAPIMethod(const std::string& method, const jsonrpccx
 
 bool NodeRPC::check()
 {
-	bool has_block = check_blockheader(uint256S("12a765e31ffd4059bada1e25190f6e98c99d9714d334efa41a195a7e7e04bfe2"));
+	// #744/#787 B1: probe the per-net BTC genesis (was the LITECOIN genesis,
+	// copied from the LTC impl -- broke the mainnet handshake gate below).
+	bool has_block = check_blockheader(uint256S(btc_genesis_hash(IS_TESTNET)));
 	bool is_main_chain = getblockchaininfo()["chain"].get<std::string>() == "main";
 	nlohmann::json blockchaininfo;
 

src/impl/btc/coin/rpc.hpp

@@ -49,6 +49,15 @@ class NodeRPC : public jsonrpccxx::IClientConnector
     bool m_connected = false;
     std::unique_ptr<core::Timer> m_reconnect_timer;
 
+    // #744/#787 M2: a hung bitcoind (accepts TCP, never responds) must not freeze
+    // the whole single-threaded ioc (stratum + sharechain P2P + header sync all
+    // run on it) mid-won-block. apply_socket_timeouts() forces the socket to
+    // blocking mode and sets kernel SO_SND/RCVTIMEO so Send()'s sync write/read
+    // return an error after RPC_IO_TIMEOUT_SECONDS instead of hanging forever.
+    // Mirrors the DASH #781 pattern. Called after each (re)connect.
+    static constexpr int RPC_IO_TIMEOUT_SECONDS = 30;
+    void apply_socket_timeouts();
+
     std::string Send(const std::string &request) override;
     nlohmann::json CallAPIMethod(const std::string& method, const jsonrpccxx::positional_parameter& params = {});