net: bound connected-peer resources

changelog.d/parent-same-peer-wtxid.md

@@ -0,0 +1,6 @@
+Fixed
+
+- **A txid parent is requested after the same peer's wtxid window ends.**
+  Expiry matched the first announcement for that peer. When that row was
+  the waiting txid parent, the in-flight wtxid window stayed indexed and
+  no getdata followed.

changelog.d/peer-resources.md

@@ -0,0 +1,19 @@
+Security
+
+- Cap the parent-request tracker per peer and process-wide. A full
+  process-wide table skips the new announcement and does not disconnect
+  the peer. Only a peer at its own cap is disconnected. A wtxid
+  announcement is re-requested as a wtxid and does not change another
+  peer's txid parent. While that request is in flight, the same hash is
+  not asked again as a txid.
+- Charge outbound getdata and tx announcements against the per-peer send
+  budget, and stop serving blocks once that budget is already over.
+- The per-peer rate window keeps the previous second so a boundary does
+  not grant a second full budget.
+- Count v2 decoy packets and unknown message types in the per-peer rate
+  window on tip-follow and IBD. One decoy that does not fit adds the
+  rate-limit score. The peer is disconnected at the same threshold as
+  other frames.
+- Batch mempool transaction announcements into one inv per thousand,
+  still charged against the per-peer send budget.
+- Findings write-ups: 053, 054, 055, 056, 057, 058, 059.

crates/rbitcoin-net/src/codec.rs

@@ -22,6 +22,10 @@ pub const MAX_PROTOCOL_MESSAGE_LENGTH: usize = 4_000_000;
 /// Bitcoin Core `MAX_INV_SZ` — max inventory items in inv/getdata/notfound.
 pub const MAX_INV_SIZE: usize = 50_000;
 
+/// Tx announcements per `inv`. Separate from [`MAX_INV_SIZE`]: one message
+/// stays at a thousand even though the wire cap is fifty thousand.
+pub const TX_INV_BATCH: usize = 1_000;
+
 /// Bitcoin Core `MAX_HEADERS_RESULTS` — max headers in a `headers` message.
 pub const MAX_HEADERS_RESULTS: usize = 2_000;