2016-11-29 06:43:57 +03:00
|
|
|
package main
|
|
|
|
|
|
|
|
import (
|
2017-05-07 14:09:22 +03:00
|
|
|
"bytes"
|
|
|
|
"encoding/binary"
|
|
|
|
"errors"
|
|
|
|
"io"
|
2016-11-29 06:43:57 +03:00
|
|
|
"sync"
|
|
|
|
"sync/atomic"
|
|
|
|
|
2017-05-07 14:09:22 +03:00
|
|
|
"github.com/boltdb/bolt"
|
2016-11-29 06:43:57 +03:00
|
|
|
"github.com/davecgh/go-spew/spew"
|
|
|
|
"github.com/lightningnetwork/lnd/chainntnfs"
|
|
|
|
"github.com/lightningnetwork/lnd/channeldb"
|
2018-01-19 01:06:38 +03:00
|
|
|
"github.com/lightningnetwork/lnd/contractcourt"
|
2017-05-02 23:04:58 +03:00
|
|
|
"github.com/lightningnetwork/lnd/htlcswitch"
|
2016-11-29 06:43:57 +03:00
|
|
|
"github.com/lightningnetwork/lnd/lnwallet"
|
2017-08-30 05:07:52 +03:00
|
|
|
"github.com/roasbeef/btcd/blockchain"
|
2017-01-06 00:56:27 +03:00
|
|
|
"github.com/roasbeef/btcd/chaincfg/chainhash"
|
2016-11-29 06:43:57 +03:00
|
|
|
"github.com/roasbeef/btcd/txscript"
|
|
|
|
"github.com/roasbeef/btcd/wire"
|
|
|
|
"github.com/roasbeef/btcutil"
|
|
|
|
)
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
var (
|
|
|
|
// retributionBucket stores retribution state on disk between detecting
|
|
|
|
// a contract breach, broadcasting a justice transaction that sweeps the
|
|
|
|
// channel, and finally witnessing the justice transaction confirm on
|
|
|
|
// the blockchain. It is critical that such state is persisted on disk,
|
|
|
|
// so that if our node restarts at any point during the retribution
|
|
|
|
// procedure, we can recover and continue from the persisted state.
|
|
|
|
retributionBucket = []byte("retribution")
|
|
|
|
|
|
|
|
// justiceTxnBucket holds the finalized justice transactions for all
|
|
|
|
// breached contracts. Entries are added to the justice txn bucket just
|
|
|
|
// before broadcasting the sweep txn.
|
|
|
|
justiceTxnBucket = []byte("justice-txn")
|
|
|
|
)
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-09-01 13:11:14 +03:00
|
|
|
// BreachConfig bundles the required subsystems used by the breach arbiter. An
|
|
|
|
// instance of BreachConfig is passed to newBreachArbiter during instantiation.
|
|
|
|
type BreachConfig struct {
|
2017-09-20 03:30:36 +03:00
|
|
|
// CloseLink allows the breach arbiter to shutdown any channel links for
|
|
|
|
// which it detects a breach, ensuring now further activity will
|
2017-11-21 10:56:42 +03:00
|
|
|
// continue across the link. The method accepts link's channel point and
|
|
|
|
// a close type to be included in the channel close summary.
|
2017-09-20 03:30:36 +03:00
|
|
|
CloseLink func(*wire.OutPoint, htlcswitch.ChannelCloseType)
|
2017-09-01 13:11:14 +03:00
|
|
|
|
|
|
|
// DB provides access to the user's channels, allowing the breach
|
|
|
|
// arbiter to determine the current state of a user's channels, and how
|
|
|
|
// it should respond to channel closure.
|
|
|
|
DB *channeldb.DB
|
|
|
|
|
2017-09-20 03:30:36 +03:00
|
|
|
// Estimator is used by the breach arbiter to determine an appropriate
|
|
|
|
// fee level when generating, signing, and broadcasting sweep
|
|
|
|
// transactions.
|
|
|
|
Estimator lnwallet.FeeEstimator
|
|
|
|
|
|
|
|
// GenSweepScript generates the receiving scripts for swept outputs.
|
|
|
|
GenSweepScript func() ([]byte, error)
|
2017-09-01 13:11:14 +03:00
|
|
|
|
|
|
|
// Notifier provides a publish/subscribe interface for event driven
|
|
|
|
// notifications regarding the confirmation of txids.
|
|
|
|
Notifier chainntnfs.ChainNotifier
|
|
|
|
|
2017-09-20 03:30:36 +03:00
|
|
|
// PublishTransaction facilitates the process of broadcasting a
|
|
|
|
// transaction to the network.
|
|
|
|
PublishTransaction func(*wire.MsgTx) error
|
2017-09-01 13:11:14 +03:00
|
|
|
|
2018-01-19 01:06:38 +03:00
|
|
|
// SubscribeChannelEvents is a function closure that allows goroutines
|
|
|
|
// within the breachArbiter to be notified of potential on-chain events
|
|
|
|
// related to the channels they're watching.
|
|
|
|
SubscribeChannelEvents func(wire.OutPoint) (*contractcourt.ChainEventSubscription, error)
|
|
|
|
|
2017-09-20 03:30:36 +03:00
|
|
|
// Signer is used by the breach arbiter to generate sweep transactions,
|
|
|
|
// which move coins from previously open channels back to the user's
|
|
|
|
// wallet.
|
|
|
|
Signer lnwallet.Signer
|
2017-09-01 13:11:14 +03:00
|
|
|
|
|
|
|
// Store is a persistent resource that maintains information regarding
|
|
|
|
// breached channels. This is used in conjunction with DB to recover
|
|
|
|
// from crashes, restarts, or other failures.
|
|
|
|
Store RetributionStore
|
|
|
|
}
|
|
|
|
|
2017-01-13 08:01:50 +03:00
|
|
|
// breachArbiter is a special subsystem which is responsible for watching and
|
2016-11-29 06:43:57 +03:00
|
|
|
// acting on the detection of any attempted uncooperative channel breaches by
|
2017-01-13 08:01:50 +03:00
|
|
|
// channel counterparties. This file essentially acts as deterrence code for
|
2016-11-29 06:43:57 +03:00
|
|
|
// those attempting to launch attacks against the daemon. In practice it's
|
|
|
|
// expected that the logic in this file never gets executed, but it is
|
|
|
|
// important to have it in place just in case we encounter cheating channel
|
2017-01-13 08:01:50 +03:00
|
|
|
// counterparties.
|
|
|
|
// TODO(roasbeef): closures in config for subsystem pointers to decouple?
|
2016-11-29 06:43:57 +03:00
|
|
|
type breachArbiter struct {
|
2017-11-21 10:56:42 +03:00
|
|
|
started uint32
|
|
|
|
stopped uint32
|
|
|
|
|
2017-09-01 13:11:14 +03:00
|
|
|
cfg *BreachConfig
|
2016-11-29 06:43:57 +03:00
|
|
|
|
|
|
|
// breachObservers is a map which tracks all the active breach
|
|
|
|
// observers we're currently managing. The key of the map is the
|
|
|
|
// funding outpoint of the channel, and the value is a channel which
|
|
|
|
// will be closed once we detect that the channel has been
|
2017-01-13 08:01:50 +03:00
|
|
|
// cooperatively closed, thereby killing the goroutine and freeing up
|
|
|
|
// resources.
|
2016-11-29 06:43:57 +03:00
|
|
|
breachObservers map[wire.OutPoint]chan struct{}
|
|
|
|
|
|
|
|
// breachedContracts is a channel which is used internally within the
|
|
|
|
// struct to send the necessary information required to punish a
|
2017-01-13 08:01:50 +03:00
|
|
|
// counterparty once a channel breach is detected. Breach observers
|
2016-11-29 06:43:57 +03:00
|
|
|
// use this to communicate with the main contractObserver goroutine.
|
2017-07-26 06:14:03 +03:00
|
|
|
breachedContracts chan *retributionInfo
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2017-01-13 08:01:50 +03:00
|
|
|
// settledContracts is a channel by outside subsystems to notify
|
2016-11-29 06:43:57 +03:00
|
|
|
// the breachArbiter that a channel has peacefully been closed. Once a
|
|
|
|
// channel has been closed the arbiter no longer needs to watch for
|
|
|
|
// breach closes.
|
2018-01-23 04:03:34 +03:00
|
|
|
settledContracts chan wire.OutPoint
|
|
|
|
|
|
|
|
// newContracts is a channel which is used by outside subsystems to
|
|
|
|
// notify the breachArbiter of a new contract (a channel) that should
|
|
|
|
// be watched.
|
|
|
|
newContracts chan wire.OutPoint
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
quit chan struct{}
|
|
|
|
wg sync.WaitGroup
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
|
|
|
|
2017-01-13 08:01:50 +03:00
|
|
|
// newBreachArbiter creates a new instance of a breachArbiter initialized with
|
|
|
|
// its dependent objects.
|
2017-09-01 13:11:14 +03:00
|
|
|
func newBreachArbiter(cfg *BreachConfig) *breachArbiter {
|
2016-11-29 06:43:57 +03:00
|
|
|
return &breachArbiter{
|
2018-01-19 01:06:38 +03:00
|
|
|
cfg: cfg,
|
2016-11-29 06:43:57 +03:00
|
|
|
breachObservers: make(map[wire.OutPoint]chan struct{}),
|
2017-07-26 06:14:03 +03:00
|
|
|
breachedContracts: make(chan *retributionInfo),
|
2018-01-23 04:03:34 +03:00
|
|
|
newContracts: make(chan wire.OutPoint),
|
|
|
|
settledContracts: make(chan wire.OutPoint),
|
2016-11-29 06:43:57 +03:00
|
|
|
quit: make(chan struct{}),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Start is an idempotent method that officially starts the breachArbiter along
|
|
|
|
// with all other goroutines it needs to perform its functions.
|
|
|
|
func (b *breachArbiter) Start() error {
|
|
|
|
if !atomic.CompareAndSwapUint32(&b.started, 0, 1) {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-01-31 08:45:02 +03:00
|
|
|
brarLog.Tracef("Starting breach arbiter")
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// Load all retributions currently persisted in the retribution store.
|
2017-07-26 08:57:29 +03:00
|
|
|
breachRetInfos := make(map[wire.OutPoint]retributionInfo)
|
2017-11-21 10:56:42 +03:00
|
|
|
if err := b.cfg.Store.ForAll(func(ret *retributionInfo) error {
|
2017-07-26 08:57:29 +03:00
|
|
|
breachRetInfos[ret.chanPoint] = *ret
|
2017-05-07 14:09:22 +03:00
|
|
|
return nil
|
2017-11-21 10:56:42 +03:00
|
|
|
}); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Load all currently closed channels from disk, we will use the
|
|
|
|
// channels that have been marked fully closed to filter the retribution
|
|
|
|
// information loaded from disk. This is necessary in the event that the
|
|
|
|
// channel was marked fully closed, but was not removed from the
|
|
|
|
// retribution store.
|
|
|
|
closedChans, err := b.cfg.DB.FetchClosedChannels(false)
|
2017-05-07 14:09:22 +03:00
|
|
|
if err != nil {
|
2017-11-21 10:56:42 +03:00
|
|
|
brarLog.Errorf("unable to fetch closing channels: %v", err)
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// Using the set of non-pending, closed channels, reconcile any
|
|
|
|
// discrepancies between the channeldb and the retribution store by
|
|
|
|
// removing any retribution information for which we have already
|
|
|
|
// finished our responsibilities. If the removal is successful, we also
|
|
|
|
// remove the entry from our in-memory map, to avoid any further action
|
|
|
|
// for this channel.
|
|
|
|
for _, chanSummary := range closedChans {
|
|
|
|
if chanSummary.IsPending {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
chanPoint := &chanSummary.ChanPoint
|
|
|
|
if _, ok := breachRetInfos[*chanPoint]; ok {
|
|
|
|
if err := b.cfg.Store.Remove(chanPoint); err != nil {
|
|
|
|
brarLog.Errorf("unable to remove closed "+
|
|
|
|
"chanid=%v from breach arbiter: %v",
|
|
|
|
chanPoint, err)
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
delete(breachRetInfos, *chanPoint)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-05-07 14:09:22 +03:00
|
|
|
// We need to query that database state for all currently active
|
2017-11-21 10:56:42 +03:00
|
|
|
// channels, these channels will represent a super set of all channels
|
|
|
|
// that may be assigned a go routine to monitor for channel breaches.
|
2017-09-01 13:11:14 +03:00
|
|
|
activeChannels, err := b.cfg.DB.FetchAllChannels()
|
2017-01-15 05:03:45 +03:00
|
|
|
if err != nil && err != channeldb.ErrNoActiveChannels {
|
2017-05-05 02:08:56 +03:00
|
|
|
brarLog.Errorf("unable to fetch active channels: %v", err)
|
2017-01-15 05:03:45 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
nActive := len(activeChannels)
|
|
|
|
if nActive > 0 {
|
2017-01-15 05:03:45 +03:00
|
|
|
brarLog.Infof("Retrieved %v channels from database, watching "+
|
2017-08-15 01:14:43 +03:00
|
|
|
"with vigilance!", nActive)
|
2017-01-15 05:03:45 +03:00
|
|
|
}
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// Here we will determine a set of channels that will need to be managed
|
2017-11-21 10:56:42 +03:00
|
|
|
// by the contractObserver. This should comprise all active channels
|
|
|
|
// that have not been breached. If the channel point has an entry in the
|
|
|
|
// retribution store, we skip it to avoid creating a breach observer.
|
|
|
|
// Resolving breached channels will be handled later by spawning an
|
|
|
|
// exactRetribution task for each.
|
2018-01-19 01:06:38 +03:00
|
|
|
channelsToWatch := make([]*contractcourt.ChainEventSubscription, 0, nActive)
|
2017-07-26 08:57:29 +03:00
|
|
|
for _, chanState := range activeChannels {
|
2017-11-21 10:56:42 +03:00
|
|
|
// If this channel was previously breached, we skip it here to
|
|
|
|
// avoid creating a breach observer, as we can go straight to
|
|
|
|
// the task of exacting retribution.
|
2018-01-19 01:06:38 +03:00
|
|
|
chanPoint := chanState.FundingOutpoint
|
|
|
|
if _, ok := breachRetInfos[chanPoint]; ok {
|
2017-11-21 10:56:42 +03:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
2018-01-19 01:06:38 +03:00
|
|
|
// For each active channels, we'll request a chain event
|
|
|
|
// subscription form the system that's overseeing the channel.
|
|
|
|
chainEvents, err := b.cfg.SubscribeChannelEvents(chanPoint)
|
2017-01-15 05:03:45 +03:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2018-01-19 01:06:38 +03:00
|
|
|
// Finally, add this channel event stream to breach arbiter's
|
|
|
|
// list of channels to watch.
|
|
|
|
channelsToWatch = append(channelsToWatch, chainEvents)
|
2017-07-26 08:57:29 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// Spawn the exactRetribution tasks to monitor and resolve any breaches
|
|
|
|
// that were loaded from the retribution store.
|
2017-11-21 10:56:42 +03:00
|
|
|
for chanPoint := range breachRetInfos {
|
|
|
|
retInfo := breachRetInfos[chanPoint]
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// Register for a notification when the breach transaction is
|
|
|
|
// confirmed on chain.
|
2017-11-21 10:56:42 +03:00
|
|
|
breachTXID := retInfo.commitHash
|
2017-09-01 13:11:14 +03:00
|
|
|
confChan, err := b.cfg.Notifier.RegisterConfirmationsNtfn(
|
2017-11-21 10:56:42 +03:00
|
|
|
&breachTXID, 1, retInfo.breachHeight)
|
2017-07-26 08:57:29 +03:00
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to register for conf updates "+
|
|
|
|
"for txid: %v, err: %v", breachTXID, err)
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Launch a new goroutine which to finalize the channel
|
|
|
|
// retribution after the breach transaction confirms.
|
|
|
|
b.wg.Add(1)
|
|
|
|
go b.exactRetribution(confChan, &retInfo)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Start watching the remaining active channels!
|
2016-11-29 06:43:57 +03:00
|
|
|
b.wg.Add(1)
|
2017-01-15 05:03:45 +03:00
|
|
|
go b.contractObserver(channelsToWatch)
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
// Stop is an idempotent method that signals the breachArbiter to execute a
|
|
|
|
// graceful shutdown. This function will block until all goroutines spawned by
|
|
|
|
// the breachArbiter have gracefully exited.
|
|
|
|
func (b *breachArbiter) Stop() error {
|
|
|
|
if !atomic.CompareAndSwapUint32(&b.stopped, 0, 1) {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
brarLog.Infof("Breach arbiter shutting down")
|
|
|
|
|
|
|
|
close(b.quit)
|
|
|
|
b.wg.Wait()
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// IsBreached queries the breach arbiter's retribution store to see if it is
|
|
|
|
// aware of any channel breaches for a particular channel point.
|
|
|
|
func (b *breachArbiter) IsBreached(chanPoint *wire.OutPoint) (bool, error) {
|
|
|
|
return b.cfg.Store.IsBreached(chanPoint)
|
|
|
|
}
|
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
// contractObserver is the primary goroutine for the breachArbiter. This
|
|
|
|
// goroutine is responsible for managing goroutines that watch for breaches for
|
|
|
|
// all current active and newly created channels. If a channel breach is
|
|
|
|
// detected by a spawned child goroutine, then the contractObserver will
|
|
|
|
// execute the retribution logic required to sweep ALL outputs from a contested
|
|
|
|
// channel into the daemon's wallet.
|
|
|
|
//
|
|
|
|
// NOTE: This MUST be run as a goroutine.
|
2018-01-19 01:06:38 +03:00
|
|
|
func (b *breachArbiter) contractObserver(channelEvents []*contractcourt.ChainEventSubscription) {
|
2017-07-26 08:57:29 +03:00
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
defer b.wg.Done()
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
brarLog.Infof("Starting contract observer with %v active channels",
|
2018-01-19 01:06:38 +03:00
|
|
|
len(channelEvents))
|
2017-11-21 10:56:42 +03:00
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
// For each active channel found within the database, we launch a
|
|
|
|
// detected breachObserver goroutine for that channel and also track
|
|
|
|
// the new goroutine within the breachObservers map so we can cancel it
|
|
|
|
// later if necessary.
|
2018-01-19 01:06:38 +03:00
|
|
|
for _, channelEvent := range channelEvents {
|
2016-11-29 06:43:57 +03:00
|
|
|
settleSignal := make(chan struct{})
|
2018-01-19 01:06:38 +03:00
|
|
|
chanPoint := channelEvent.ChanPoint
|
|
|
|
b.breachObservers[chanPoint] = settleSignal
|
2018-01-17 06:57:04 +03:00
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
b.wg.Add(1)
|
2018-01-19 01:06:38 +03:00
|
|
|
go b.breachObserver(channelEvent, settleSignal)
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
|
|
|
|
2017-05-11 03:27:05 +03:00
|
|
|
// TODO(roasbeef): need to ensure currentHeight passed in doesn't
|
|
|
|
// result in lost notification
|
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
out:
|
|
|
|
for {
|
|
|
|
select {
|
|
|
|
case breachInfo := <-b.breachedContracts:
|
|
|
|
// A new channel contract has just been breached! We
|
|
|
|
// first register for a notification to be dispatched
|
|
|
|
// once the breach transaction (the revoked commitment
|
|
|
|
// transaction) has been confirmed in the chain to
|
|
|
|
// ensure we're not dealing with a moving target.
|
|
|
|
breachTXID := &breachInfo.commitHash
|
2017-09-01 13:11:14 +03:00
|
|
|
cfChan, err := b.cfg.Notifier.RegisterConfirmationsNtfn(
|
2017-11-21 10:56:42 +03:00
|
|
|
breachTXID, 1, breachInfo.breachHeight)
|
2016-11-29 06:43:57 +03:00
|
|
|
if err != nil {
|
2017-07-26 08:57:29 +03:00
|
|
|
brarLog.Errorf("unable to register for conf "+
|
|
|
|
"updates for txid: %v, err: %v",
|
|
|
|
breachTXID, err)
|
2016-11-29 06:43:57 +03:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
brarLog.Warnf("A channel has been breached with "+
|
|
|
|
"txid: %v. Waiting for confirmation, then "+
|
|
|
|
"justice will be served!", breachTXID)
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// With the retribution state persisted, channel close
|
|
|
|
// persisted, and notification registered, we launch a
|
|
|
|
// new goroutine which will finalize the channel
|
|
|
|
// retribution after the breach transaction has been
|
|
|
|
// confirmed.
|
2016-11-29 06:43:57 +03:00
|
|
|
b.wg.Add(1)
|
2017-09-01 13:11:14 +03:00
|
|
|
go b.exactRetribution(cfChan, breachInfo)
|
2016-11-29 06:43:57 +03:00
|
|
|
|
|
|
|
delete(b.breachObservers, breachInfo.chanPoint)
|
2017-07-26 08:57:29 +03:00
|
|
|
|
2018-01-23 04:03:34 +03:00
|
|
|
case chanPoint := <-b.newContracts:
|
|
|
|
// A new channel has just been opened within the
|
|
|
|
// daemon, so we launch a new breachObserver to handle
|
|
|
|
// the detection of attempted contract breaches.
|
|
|
|
settleSignal := make(chan struct{})
|
|
|
|
|
|
|
|
// If the contract is already being watched, then an
|
|
|
|
// additional send indicates we have a stale version of
|
|
|
|
// the contract. So we'll cancel active watcher
|
|
|
|
// goroutine to create a new instance with the latest
|
|
|
|
// contract reference.
|
|
|
|
if oldSignal, ok := b.breachObservers[chanPoint]; ok {
|
|
|
|
brarLog.Infof("ChannelPoint(%v) is now live, "+
|
|
|
|
"abandoning state contract for live "+
|
|
|
|
"version", chanPoint)
|
|
|
|
close(oldSignal)
|
|
|
|
}
|
|
|
|
|
|
|
|
b.breachObservers[chanPoint] = settleSignal
|
|
|
|
|
|
|
|
brarLog.Debugf("New contract detected, launching " +
|
|
|
|
"breachObserver")
|
|
|
|
|
|
|
|
chainEvents, err := b.cfg.SubscribeChannelEvents(chanPoint)
|
|
|
|
if err != nil {
|
|
|
|
// TODO(roasbeef); panic?
|
|
|
|
brarLog.Errorf("unable to register for event "+
|
|
|
|
"sub for chan_point=%v: %v", chanPoint, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
b.wg.Add(1)
|
|
|
|
go b.breachObserver(chainEvents, settleSignal)
|
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
case chanPoint := <-b.settledContracts:
|
|
|
|
// A new channel has been closed either unilaterally or
|
|
|
|
// cooperatively, as a result we no longer need a
|
|
|
|
// breachObserver detected to the channel.
|
2018-01-23 04:03:34 +03:00
|
|
|
killSignal, ok := b.breachObservers[chanPoint]
|
2016-11-29 06:43:57 +03:00
|
|
|
if !ok {
|
2016-11-29 07:07:58 +03:00
|
|
|
brarLog.Errorf("Unable to find contract: %v",
|
|
|
|
chanPoint)
|
|
|
|
continue
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
brarLog.Debugf("ChannelPoint(%v) has been settled, "+
|
|
|
|
"cancelling breachObserver", chanPoint)
|
|
|
|
|
|
|
|
// If we had a breachObserver active, then we signal it
|
|
|
|
// for exit and also delete its state from our tracking
|
|
|
|
// map.
|
|
|
|
close(killSignal)
|
2018-01-23 04:03:34 +03:00
|
|
|
delete(b.breachObservers, chanPoint)
|
2016-11-29 06:43:57 +03:00
|
|
|
case <-b.quit:
|
|
|
|
break out
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// convertToSecondLevelRevoke takes a breached output, and a transaction that
|
|
|
|
// spends it to the second level, and mutates the breach output into one that
|
|
|
|
// is able to properly sweep that second level output. We'll use this function
|
|
|
|
// when we go to sweep a breached commitment transaction, but the cheating
|
|
|
|
// party has already attempted to take it to the second level
|
|
|
|
func convertToSecondLevelRevoke(bo *breachedOutput, breachInfo *retributionInfo,
|
|
|
|
spendDetails *chainntnfs.SpendDetail) {
|
|
|
|
|
|
|
|
// In this case, we'll modify the witness type of this output to
|
|
|
|
// actually prepare for a second level revoke.
|
|
|
|
bo.witnessType = lnwallet.HtlcSecondLevelRevoke
|
|
|
|
|
|
|
|
// We'll also redirect the outpoint to this second level output, so the
|
|
|
|
// spending transaction updates it inputs accordingly.
|
|
|
|
spendingTx := spendDetails.SpendingTx
|
|
|
|
oldOp := bo.outpoint
|
|
|
|
bo.outpoint = wire.OutPoint{
|
|
|
|
Hash: spendingTx.TxHash(),
|
|
|
|
Index: 0,
|
|
|
|
}
|
|
|
|
|
|
|
|
// Next, we need to update the amount so we can do fee estimation
|
|
|
|
// properly, and also so we can generate a valid signature as we need
|
|
|
|
// to know the new input value (the second level transactions shaves
|
|
|
|
// off some funds to fees).
|
|
|
|
newAmt := spendingTx.TxOut[0].Value
|
|
|
|
bo.amt = btcutil.Amount(newAmt)
|
|
|
|
bo.signDesc.Output.Value = newAmt
|
|
|
|
|
|
|
|
// Finally, we'll need to adjust the witness program in the
|
|
|
|
// SignDescriptor.
|
|
|
|
bo.signDesc.WitnessScript = bo.secondLevelWitnessScript
|
|
|
|
|
|
|
|
brarLog.Warnf("HTLC(%v) for ChannelPoint(%v) has been spent to the "+
|
|
|
|
"second-level, adjusting -> %v", oldOp, breachInfo.chanPoint,
|
|
|
|
bo.outpoint)
|
|
|
|
}
|
|
|
|
|
2017-07-26 06:14:03 +03:00
|
|
|
// exactRetribution is a goroutine which is executed once a contract breach has
|
|
|
|
// been detected by a breachObserver. This function is responsible for
|
|
|
|
// punishing a counterparty for violating the channel contract by sweeping ALL
|
|
|
|
// the lingering funds within the channel into the daemon's wallet.
|
|
|
|
//
|
|
|
|
// NOTE: This MUST be run as a goroutine.
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
func (b *breachArbiter) exactRetribution(confChan *chainntnfs.ConfirmationEvent,
|
2017-07-26 06:14:03 +03:00
|
|
|
breachInfo *retributionInfo) {
|
|
|
|
|
|
|
|
defer b.wg.Done()
|
|
|
|
|
|
|
|
// TODO(roasbeef): state needs to be checkpointed here
|
2017-11-21 10:56:42 +03:00
|
|
|
var breachConfHeight uint32
|
2017-07-26 06:14:03 +03:00
|
|
|
select {
|
2017-11-21 10:56:42 +03:00
|
|
|
case breachConf, ok := <-confChan.Confirmed:
|
2017-07-26 06:14:03 +03:00
|
|
|
// If the second value is !ok, then the channel has been closed
|
|
|
|
// signifying a daemon shutdown, so we exit.
|
|
|
|
if !ok {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
breachConfHeight = breachConf.BlockHeight
|
|
|
|
|
2017-07-26 06:14:03 +03:00
|
|
|
// Otherwise, if this is a real confirmation notification, then
|
|
|
|
// we fall through to complete our duty.
|
|
|
|
case <-b.quit:
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
brarLog.Debugf("Breach transaction %v has been confirmed, sweeping "+
|
|
|
|
"revoked funds", breachInfo.commitHash)
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
finalTx, err := b.cfg.Store.GetFinalizedTxn(&breachInfo.chanPoint)
|
2017-07-26 06:14:03 +03:00
|
|
|
if err != nil {
|
2017-11-21 10:56:42 +03:00
|
|
|
brarLog.Errorf("unable to get finalized txn for"+
|
|
|
|
"chanid=%v: %v", &breachInfo.chanPoint, err)
|
2017-07-26 06:14:03 +03:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// If this retribution has not been finalized before, we will first
|
|
|
|
// construct a sweep transaction and write it to disk. This will allow
|
|
|
|
// the breach arbiter to re-register for notifications for the justice
|
|
|
|
// txid.
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
secondLevelCheck:
|
2017-11-21 10:56:42 +03:00
|
|
|
if finalTx == nil {
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// Before we create the justice tx, we need to check to see if
|
|
|
|
// any of the active HTLC's on the commitment transactions has
|
|
|
|
// been spent. In this case, we'll need to go to the second
|
|
|
|
// level to sweep them before the remote party can.
|
|
|
|
for i := 0; i < len(breachInfo.breachedOutputs); i++ {
|
|
|
|
breachedOutput := &breachInfo.breachedOutputs[i]
|
|
|
|
|
|
|
|
// If this isn't an HTLC output, then we can skip it.
|
|
|
|
if breachedOutput.witnessType != lnwallet.HtlcAcceptedRevoke &&
|
|
|
|
breachedOutput.witnessType != lnwallet.HtlcOfferedRevoke {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
brarLog.Debugf("Checking for second-level attempt on "+
|
|
|
|
"HTLC(%v) for ChannelPoint(%v)",
|
|
|
|
breachedOutput.outpoint, breachInfo.chanPoint)
|
|
|
|
|
|
|
|
// Now that we have an HTLC output, we'll quickly check
|
|
|
|
// to see if it has been spent or not.
|
|
|
|
spendNtfn, err := b.cfg.Notifier.RegisterSpendNtfn(
|
|
|
|
&breachedOutput.outpoint, breachInfo.breachHeight,
|
|
|
|
)
|
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to check for spentness "+
|
|
|
|
"of out_point=%v: %v",
|
|
|
|
breachedOutput.outpoint, err)
|
2018-02-08 04:42:36 +03:00
|
|
|
|
|
|
|
// Registration may have failed if we've been
|
|
|
|
// instructed to shutdown. If so, return here to
|
|
|
|
// avoid entering an infinite loop.
|
|
|
|
select {
|
|
|
|
case <-b.quit:
|
|
|
|
return
|
|
|
|
default:
|
|
|
|
continue
|
|
|
|
}
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
select {
|
|
|
|
// The output has been taken to the second level!
|
|
|
|
case spendDetails, ok := <-spendNtfn.Spend:
|
|
|
|
if !ok {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// In this case we'll morph our initial revoke
|
|
|
|
// spend to instead point to the second level
|
|
|
|
// output, and update the sign descriptor in
|
|
|
|
// the process.
|
|
|
|
convertToSecondLevelRevoke(
|
|
|
|
breachedOutput, breachInfo, spendDetails,
|
|
|
|
)
|
|
|
|
|
|
|
|
// It hasn't been spent so we'll continue.
|
|
|
|
default:
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// With the breach transaction confirmed, we now create the
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// justice tx which will claim ALL the funds within the
|
|
|
|
// channel.
|
2017-11-21 10:56:42 +03:00
|
|
|
finalTx, err = b.createJusticeTx(breachInfo)
|
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to create justice tx: %v", err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// Persist our finalized justice transaction before making an
|
|
|
|
// attempt to broadcast.
|
|
|
|
err := b.cfg.Store.Finalize(&breachInfo.chanPoint, finalTx)
|
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to finalize justice tx for "+
|
|
|
|
"chanid=%v: %v", &breachInfo.chanPoint, err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
brarLog.Debugf("Broadcasting justice tx: %v", newLogClosure(func() string {
|
|
|
|
return spew.Sdump(finalTx)
|
|
|
|
}))
|
2017-07-26 06:14:03 +03:00
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// We'll now attempt to broadcast the transaction which finalized the
|
|
|
|
// channel's retribution against the cheating counter party.
|
|
|
|
err = b.cfg.PublishTransaction(finalTx)
|
|
|
|
if err != nil {
|
2017-07-26 06:14:03 +03:00
|
|
|
brarLog.Errorf("unable to broadcast "+
|
|
|
|
"justice tx: %v", err)
|
2018-02-14 14:28:19 +03:00
|
|
|
if err == lnwallet.ErrDoubleSpend {
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
brarLog.Infof("Attempting to transfer HTLC revocations " +
|
|
|
|
"to the second level")
|
|
|
|
finalTx = nil
|
2018-02-08 04:42:36 +03:00
|
|
|
|
|
|
|
// Txn publication may fail if we're shutting down.
|
|
|
|
// If so, return to avoid entering an infinite loop.
|
|
|
|
select {
|
|
|
|
case <-b.quit:
|
|
|
|
return
|
|
|
|
default:
|
|
|
|
goto secondLevelCheck
|
|
|
|
}
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
}
|
2017-07-26 06:14:03 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// As a conclusionary step, we register for a notification to be
|
|
|
|
// dispatched once the justice tx is confirmed. After confirmation we
|
|
|
|
// notify the caller that initiated the retribution workflow that the
|
|
|
|
// deed has been done.
|
2017-11-21 10:56:42 +03:00
|
|
|
justiceTXID := finalTx.TxHash()
|
2017-09-01 13:11:14 +03:00
|
|
|
confChan, err = b.cfg.Notifier.RegisterConfirmationsNtfn(
|
2017-11-21 10:56:42 +03:00
|
|
|
&justiceTXID, 1, breachConfHeight)
|
2017-07-26 06:14:03 +03:00
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to register for conf for txid: %v",
|
|
|
|
justiceTXID)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
select {
|
|
|
|
case _, ok := <-confChan.Confirmed:
|
|
|
|
if !ok {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// Compute both the total value of funds being swept and the
|
|
|
|
// amount of funds that were revoked from the counter party.
|
|
|
|
var totalFunds, revokedFunds btcutil.Amount
|
|
|
|
for _, input := range breachInfo.breachedOutputs {
|
|
|
|
totalFunds += input.Amount()
|
|
|
|
|
|
|
|
// If the output being revoked is the remote commitment
|
|
|
|
// output or an offered HTLC output, it's amount
|
|
|
|
// contributes to the value of funds being revoked from
|
|
|
|
// the counter party.
|
|
|
|
switch input.WitnessType() {
|
|
|
|
case lnwallet.CommitmentRevoke:
|
|
|
|
revokedFunds += input.Amount()
|
|
|
|
case lnwallet.HtlcOfferedRevoke:
|
|
|
|
revokedFunds += input.Amount()
|
|
|
|
default:
|
|
|
|
}
|
|
|
|
}
|
2017-07-26 06:14:03 +03:00
|
|
|
|
|
|
|
brarLog.Infof("Justice for ChannelPoint(%v) has "+
|
|
|
|
"been served, %v revoked funds (%v total) "+
|
|
|
|
"have been claimed", breachInfo.chanPoint,
|
|
|
|
revokedFunds, totalFunds)
|
|
|
|
|
|
|
|
// With the channel closed, mark it in the database as such.
|
2017-09-01 13:11:14 +03:00
|
|
|
err := b.cfg.DB.MarkChanFullyClosed(&breachInfo.chanPoint)
|
2017-07-26 06:14:03 +03:00
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to mark chan as closed: %v", err)
|
2017-11-21 10:56:42 +03:00
|
|
|
return
|
2017-07-26 06:14:03 +03:00
|
|
|
}
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// Justice has been carried out; we can safely delete the
|
|
|
|
// retribution info from the database.
|
2017-09-01 13:11:14 +03:00
|
|
|
err = b.cfg.Store.Remove(&breachInfo.chanPoint)
|
2017-07-26 06:14:03 +03:00
|
|
|
if err != nil {
|
2017-07-26 08:57:29 +03:00
|
|
|
brarLog.Errorf("unable to remove retribution "+
|
|
|
|
"from the db: %v", err)
|
2017-07-26 06:14:03 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// TODO(roasbeef): add peer to blacklist?
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// TODO(roasbeef): close other active channels with offending
|
|
|
|
// peer
|
2017-07-26 06:14:03 +03:00
|
|
|
|
|
|
|
return
|
|
|
|
case <-b.quit:
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
// breachObserver notifies the breachArbiter contract observer goroutine that a
|
2017-01-13 08:01:50 +03:00
|
|
|
// channel's contract has been breached by the prior counterparty. Once
|
2016-11-29 06:43:57 +03:00
|
|
|
// notified the breachArbiter will attempt to sweep ALL funds within the
|
|
|
|
// channel using the information provided within the BreachRetribution
|
|
|
|
// generated due to the breach of channel contract. The funds will be swept
|
|
|
|
// only after the breaching transaction receives a necessary number of
|
|
|
|
// confirmations.
|
2018-01-19 01:06:38 +03:00
|
|
|
func (b *breachArbiter) breachObserver(
|
|
|
|
chainEvents *contractcourt.ChainEventSubscription,
|
2016-11-29 06:43:57 +03:00
|
|
|
settleSignal chan struct{}) {
|
|
|
|
|
2018-01-19 01:06:38 +03:00
|
|
|
defer func() {
|
|
|
|
b.wg.Done()
|
|
|
|
chainEvents.Cancel()
|
|
|
|
}()
|
|
|
|
|
|
|
|
chanPoint := chainEvents.ChanPoint
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
brarLog.Debugf("Breach observer for ChannelPoint(%v) started ",
|
2017-08-15 01:14:43 +03:00
|
|
|
chanPoint)
|
2016-11-29 06:43:57 +03:00
|
|
|
|
|
|
|
select {
|
|
|
|
// A read from this channel indicates that the contract has been
|
|
|
|
// settled cooperatively so we exit as our duties are no longer needed.
|
|
|
|
case <-settleSignal:
|
|
|
|
return
|
|
|
|
|
2018-01-20 04:25:06 +03:00
|
|
|
// The channel has been closed cooperatively, so we're done here.
|
|
|
|
case <-chainEvents.CooperativeClosure:
|
|
|
|
// Launch a goroutine to cancel out this contract within the
|
|
|
|
// breachArbiter's main goroutine.
|
|
|
|
b.wg.Add(1)
|
|
|
|
go func() {
|
|
|
|
defer b.wg.Done()
|
|
|
|
|
|
|
|
select {
|
2018-01-23 04:03:34 +03:00
|
|
|
case b.settledContracts <- chanPoint:
|
2018-01-20 04:25:06 +03:00
|
|
|
case <-b.quit:
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
|
|
|
|
b.cfg.CloseLink(&chanPoint, htlcswitch.CloseBreach)
|
|
|
|
|
2017-05-05 02:08:56 +03:00
|
|
|
// The channel has been closed by a normal means: force closing with
|
|
|
|
// the latest commitment transaction.
|
2018-01-19 01:06:38 +03:00
|
|
|
case <-chainEvents.UnilateralClosure:
|
2017-05-05 02:08:56 +03:00
|
|
|
// Launch a goroutine to cancel out this contract within the
|
|
|
|
// breachArbiter's main goroutine.
|
2017-07-26 08:57:29 +03:00
|
|
|
b.wg.Add(1)
|
2017-05-05 02:08:56 +03:00
|
|
|
go func() {
|
2017-07-26 08:57:29 +03:00
|
|
|
defer b.wg.Done()
|
|
|
|
|
|
|
|
select {
|
2018-01-23 04:03:34 +03:00
|
|
|
case b.settledContracts <- chanPoint:
|
2017-07-26 08:57:29 +03:00
|
|
|
case <-b.quit:
|
|
|
|
}
|
2017-05-05 02:08:56 +03:00
|
|
|
}()
|
|
|
|
|
2018-01-19 01:06:38 +03:00
|
|
|
b.cfg.CloseLink(&chanPoint, htlcswitch.CloseBreach)
|
2017-11-23 22:41:42 +03:00
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
// A read from this channel indicates that a channel breach has been
|
|
|
|
// detected! So we notify the main coordination goroutine with the
|
2017-01-13 08:01:50 +03:00
|
|
|
// information needed to bring the counterparty to justice.
|
2018-01-19 01:06:38 +03:00
|
|
|
case breachInfo := <-chainEvents.ContractBreach:
|
2016-11-29 06:43:57 +03:00
|
|
|
brarLog.Warnf("REVOKED STATE #%v FOR ChannelPoint(%v) "+
|
|
|
|
"broadcast, REMOTE PEER IS DOING SOMETHING "+
|
|
|
|
"SKETCHY!!!", breachInfo.RevokedStateNum,
|
|
|
|
chanPoint)
|
|
|
|
|
|
|
|
// Immediately notify the HTLC switch that this link has been
|
|
|
|
// breached in order to ensure any incoming or outgoing
|
2017-01-13 08:01:50 +03:00
|
|
|
// multi-hop HTLCs aren't sent over this link, nor any other
|
2016-11-29 06:43:57 +03:00
|
|
|
// links associated with this peer.
|
2018-01-19 01:06:38 +03:00
|
|
|
b.cfg.CloseLink(&chanPoint, htlcswitch.CloseBreach)
|
2016-11-29 06:43:57 +03:00
|
|
|
|
|
|
|
// TODO(roasbeef): need to handle case of remote broadcast
|
2017-07-26 08:57:29 +03:00
|
|
|
// mid-local initiated state-transition, possible
|
|
|
|
// false-positive?
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Using the breach information provided by the wallet and the
|
|
|
|
// channel snapshot, construct the retribution information that
|
|
|
|
// will be persisted to disk.
|
2018-01-19 01:06:38 +03:00
|
|
|
retInfo := newRetributionInfo(&chanPoint, breachInfo)
|
2017-07-26 08:57:29 +03:00
|
|
|
|
|
|
|
// Persist the pending retribution state to disk.
|
2017-11-21 10:56:42 +03:00
|
|
|
err := b.cfg.Store.Add(retInfo)
|
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to persist retribution "+
|
|
|
|
"info to db: %v", err)
|
2017-07-26 08:57:29 +03:00
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// Now that the breach has been persisted, try to send an
|
|
|
|
// acknowledgment back to the close observer with the error. If
|
|
|
|
// the ack is successful, the close observer will mark the
|
|
|
|
// channel as pending-closed in the channeldb.
|
|
|
|
select {
|
2018-01-23 04:03:34 +03:00
|
|
|
case chainEvents.ProcessACK <- err:
|
2017-11-21 10:56:42 +03:00
|
|
|
// Bail if we failed to persist retribution info.
|
|
|
|
if err != nil {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
case <-b.quit:
|
|
|
|
return
|
2017-07-26 08:57:29 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// Finally, we send the retribution information into the
|
|
|
|
// breachArbiter event loop to deal swift justice.
|
|
|
|
select {
|
|
|
|
case b.breachedContracts <- retInfo:
|
|
|
|
case <-b.quit:
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
2017-05-05 02:07:25 +03:00
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
case <-b.quit:
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// SpendableOutput an interface which can be used by the breach arbiter to
|
|
|
|
// construct a transaction spending from outputs we control.
|
|
|
|
type SpendableOutput interface {
|
|
|
|
// Amount returns the number of satoshis contained within the output.
|
|
|
|
Amount() btcutil.Amount
|
|
|
|
|
|
|
|
// Outpoint returns the reference to the output being spent, used to
|
|
|
|
// construct the corresponding transaction input.
|
|
|
|
OutPoint() *wire.OutPoint
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// WitnessType returns an enum specifying the type of witness that must
|
|
|
|
// be generated in order to spend this output.
|
|
|
|
WitnessType() lnwallet.WitnessType
|
|
|
|
|
|
|
|
// SignDesc returns a reference to a spendable output's sign descriptor,
|
|
|
|
// which is used during signing to compute a valid witness that spends
|
|
|
|
// this output.
|
|
|
|
SignDesc() *lnwallet.SignDescriptor
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// BuildWitness returns a valid witness allowing this output to be
|
|
|
|
// spent, the witness should be attached to the transaction at the
|
|
|
|
// location determined by the given `txinIdx`.
|
2017-09-20 03:30:36 +03:00
|
|
|
BuildWitness(signer lnwallet.Signer, txn *wire.MsgTx,
|
2017-08-22 02:56:58 +03:00
|
|
|
hashCache *txscript.TxSigHashes,
|
|
|
|
txinIdx int) ([][]byte, error)
|
|
|
|
}
|
|
|
|
|
2017-07-26 06:14:03 +03:00
|
|
|
// breachedOutput contains all the information needed to sweep a breached
|
|
|
|
// output. A breached output is an output that we are now entitled to due to a
|
|
|
|
// revoked commitment transaction being broadcast.
|
|
|
|
type breachedOutput struct {
|
2017-08-22 02:56:58 +03:00
|
|
|
amt btcutil.Amount
|
|
|
|
outpoint wire.OutPoint
|
|
|
|
witnessType lnwallet.WitnessType
|
2017-09-01 13:11:14 +03:00
|
|
|
signDesc lnwallet.SignDescriptor
|
2017-05-07 14:09:22 +03:00
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
secondLevelWitnessScript []byte
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
witnessFunc lnwallet.WitnessGenerator
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// makeBreachedOutput assembles a new breachedOutput that can be used by the
|
2017-08-30 05:07:52 +03:00
|
|
|
// breach arbiter to construct a justice or sweep transaction.
|
2017-09-19 02:32:20 +03:00
|
|
|
func makeBreachedOutput(outpoint *wire.OutPoint,
|
2017-08-22 02:56:58 +03:00
|
|
|
witnessType lnwallet.WitnessType,
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
secondLevelScript []byte,
|
2017-09-19 02:32:20 +03:00
|
|
|
signDescriptor *lnwallet.SignDescriptor) breachedOutput {
|
2017-08-22 02:56:58 +03:00
|
|
|
|
|
|
|
amount := signDescriptor.Output.Value
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
return breachedOutput{
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
amt: btcutil.Amount(amount),
|
|
|
|
outpoint: *outpoint,
|
|
|
|
secondLevelWitnessScript: secondLevelScript,
|
|
|
|
witnessType: witnessType,
|
|
|
|
signDesc: *signDescriptor,
|
2017-08-22 02:56:58 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Amount returns the number of satoshis contained in the breached output.
|
|
|
|
func (bo *breachedOutput) Amount() btcutil.Amount {
|
|
|
|
return bo.amt
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// OutPoint returns the breached output's identifier that is to be included as a
|
2017-08-22 02:56:58 +03:00
|
|
|
// transaction input.
|
|
|
|
func (bo *breachedOutput) OutPoint() *wire.OutPoint {
|
|
|
|
return &bo.outpoint
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// WitnessType returns the type of witness that must be generated to spend the
|
|
|
|
// breached output.
|
|
|
|
func (bo *breachedOutput) WitnessType() lnwallet.WitnessType {
|
|
|
|
return bo.witnessType
|
|
|
|
}
|
|
|
|
|
|
|
|
// SignDesc returns the breached output's SignDescriptor, which is used during
|
|
|
|
// signing to compute the witness.
|
|
|
|
func (bo *breachedOutput) SignDesc() *lnwallet.SignDescriptor {
|
|
|
|
return &bo.signDesc
|
|
|
|
}
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// BuildWitness computes a valid witness that allows us to spend from the
|
|
|
|
// breached output. It does so by first generating and memoizing the witness
|
|
|
|
// generation function, which parameterized primarily by the witness type and
|
|
|
|
// sign descriptor. The method then returns the witness computed by invoking
|
|
|
|
// this function on the first and subsequent calls.
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
func (bo *breachedOutput) BuildWitness(signer lnwallet.Signer, txn *wire.MsgTx,
|
|
|
|
hashCache *txscript.TxSigHashes, txinIdx int) ([][]byte, error) {
|
|
|
|
|
|
|
|
// First, we ensure that the witness generation function has been
|
|
|
|
// initialized for this breached output.
|
|
|
|
bo.witnessFunc = bo.witnessType.GenWitnessFunc(
|
|
|
|
signer, bo.SignDesc(),
|
|
|
|
)
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Now that we have ensured that the witness generation function has
|
|
|
|
// been initialized, we can proceed to execute it and generate the
|
|
|
|
// witness for this particular breached output.
|
|
|
|
return bo.witnessFunc(txn, hashCache, txinIdx)
|
2017-07-26 06:14:03 +03:00
|
|
|
}
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Add compile-time constraint ensuring breachedOutput implements
|
|
|
|
// SpendableOutput.
|
|
|
|
var _ SpendableOutput = (*breachedOutput)(nil)
|
|
|
|
|
2017-07-26 06:14:03 +03:00
|
|
|
// retributionInfo encapsulates all the data needed to sweep all the contested
|
|
|
|
// funds within a channel whose contract has been breached by the prior
|
|
|
|
// counterparty. This struct is used to create the justice transaction which
|
|
|
|
// spends all outputs of the commitment transaction into an output controlled
|
|
|
|
// by the wallet.
|
|
|
|
type retributionInfo struct {
|
2017-11-21 10:56:42 +03:00
|
|
|
commitHash chainhash.Hash
|
|
|
|
chanPoint wire.OutPoint
|
|
|
|
chainHash chainhash.Hash
|
|
|
|
breachHeight uint32
|
2017-07-26 08:57:29 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
breachedOutputs []breachedOutput
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// newRetributionInfo constructs a retributionInfo containing all the
|
|
|
|
// information required by the breach arbiter to recover funds from breached
|
|
|
|
// channels. The information is primarily populated using the BreachRetribution
|
|
|
|
// delivered by the wallet when it detects a channel breach.
|
|
|
|
func newRetributionInfo(chanPoint *wire.OutPoint,
|
2017-11-21 10:56:42 +03:00
|
|
|
breachInfo *lnwallet.BreachRetribution) *retributionInfo {
|
2017-08-22 02:56:58 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// Determine the number of second layer HTLCs we will attempt to sweep.
|
|
|
|
nHtlcs := len(breachInfo.HtlcRetributions)
|
|
|
|
|
|
|
|
// Initialize a slice to hold the outputs we will attempt to sweep. The
|
|
|
|
// maximum capacity of the slice is set to 2+nHtlcs to handle the case
|
|
|
|
// where the local, remote, and all HTLCs are not dust outputs. All
|
|
|
|
// HTLC outputs provided by the wallet are guaranteed to be non-dust,
|
|
|
|
// though the commitment outputs are conditionally added depending on
|
|
|
|
// the nil-ness of their sign descriptors.
|
|
|
|
breachedOutputs := make([]breachedOutput, 0, nHtlcs+2)
|
|
|
|
|
|
|
|
// First, record the breach information for the local channel point if
|
|
|
|
// it is not considered dust, which is signaled by a non-nil sign
|
|
|
|
// descriptor. Here we use CommitmentNoDelay since this output belongs
|
|
|
|
// to us and has no time-based constraints on spending.
|
|
|
|
if breachInfo.LocalOutputSignDesc != nil {
|
|
|
|
localOutput := makeBreachedOutput(
|
|
|
|
&breachInfo.LocalOutpoint,
|
|
|
|
lnwallet.CommitmentNoDelay,
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// No second level script as this is a commitment
|
|
|
|
// output.
|
|
|
|
nil,
|
2017-09-19 02:32:20 +03:00
|
|
|
breachInfo.LocalOutputSignDesc)
|
|
|
|
|
|
|
|
breachedOutputs = append(breachedOutputs, localOutput)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Second, record the same information regarding the remote outpoint,
|
|
|
|
// again if it is not dust, which belongs to the party who tried to
|
|
|
|
// steal our money! Here we set witnessType of the breachedOutput to
|
2017-08-22 02:56:58 +03:00
|
|
|
// CommitmentRevoke, since we will be using a revoke key, withdrawing
|
|
|
|
// the funds from the commitment transaction immediately.
|
2017-09-19 02:32:20 +03:00
|
|
|
if breachInfo.RemoteOutputSignDesc != nil {
|
|
|
|
remoteOutput := makeBreachedOutput(
|
|
|
|
&breachInfo.RemoteOutpoint,
|
|
|
|
lnwallet.CommitmentRevoke,
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// No second level script as this is a commitment
|
|
|
|
// output.
|
|
|
|
nil,
|
2017-09-19 02:32:20 +03:00
|
|
|
breachInfo.RemoteOutputSignDesc)
|
2017-08-22 02:56:58 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
breachedOutputs = append(breachedOutputs, remoteOutput)
|
|
|
|
}
|
2017-08-22 02:56:58 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// Lastly, for each of the breached HTLC outputs, record each as a
|
|
|
|
// breached output with the appropriate witness type based on its
|
|
|
|
// directionality. All HTLC outputs provided by the wallet are assumed
|
|
|
|
// to be non-dust.
|
2017-08-22 02:56:58 +03:00
|
|
|
for i, breachedHtlc := range breachInfo.HtlcRetributions {
|
2017-09-01 13:11:14 +03:00
|
|
|
// Using the breachedHtlc's incoming flag, determine the
|
|
|
|
// appropriate witness type that needs to be generated in order
|
|
|
|
// to sweep the HTLC output.
|
|
|
|
var htlcWitnessType lnwallet.WitnessType
|
|
|
|
if breachedHtlc.IsIncoming {
|
|
|
|
htlcWitnessType = lnwallet.HtlcAcceptedRevoke
|
|
|
|
} else {
|
|
|
|
htlcWitnessType = lnwallet.HtlcOfferedRevoke
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
htlcOutput := makeBreachedOutput(
|
|
|
|
&breachInfo.HtlcRetributions[i].OutPoint,
|
|
|
|
htlcWitnessType,
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
breachInfo.HtlcRetributions[i].SecondLevelWitnessScript,
|
2017-09-01 13:11:14 +03:00
|
|
|
&breachInfo.HtlcRetributions[i].SignDesc)
|
2017-09-19 02:32:20 +03:00
|
|
|
|
|
|
|
breachedOutputs = append(breachedOutputs, htlcOutput)
|
2017-08-22 02:56:58 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
return &retributionInfo{
|
2017-09-19 02:32:20 +03:00
|
|
|
commitHash: breachInfo.BreachTransaction.TxHash(),
|
2017-11-21 10:56:42 +03:00
|
|
|
chainHash: breachInfo.ChainHash,
|
2017-09-19 02:32:20 +03:00
|
|
|
chanPoint: *chanPoint,
|
|
|
|
breachedOutputs: breachedOutputs,
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
breachHeight: breachInfo.BreachHeight,
|
2017-08-22 02:56:58 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
// createJusticeTx creates a transaction which exacts "justice" by sweeping ALL
|
|
|
|
// the funds within the channel which we are now entitled to due to a breach of
|
2017-01-13 08:01:50 +03:00
|
|
|
// the channel's contract by the counterparty. This function returns a *fully*
|
2016-11-29 06:43:57 +03:00
|
|
|
// signed transaction with the witness for each input fully in place.
|
2017-07-26 08:57:29 +03:00
|
|
|
func (b *breachArbiter) createJusticeTx(
|
|
|
|
r *retributionInfo) (*wire.MsgTx, error) {
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// We will assemble the breached outputs into a slice of spendable
|
|
|
|
// outputs, while simultaneously computing the estimated weight of the
|
|
|
|
// transaction.
|
|
|
|
var (
|
|
|
|
spendableOutputs []SpendableOutput
|
2017-09-26 06:13:53 +03:00
|
|
|
weightEstimate lnwallet.TxWeightEstimator
|
2017-09-19 02:32:20 +03:00
|
|
|
)
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// Allocate enough space to potentially hold each of the breached
|
|
|
|
// outputs in the retribution info.
|
|
|
|
spendableOutputs = make([]SpendableOutput, 0, len(r.breachedOutputs))
|
|
|
|
|
|
|
|
// The justice transaction we construct will be a segwit transaction
|
|
|
|
// that pays to a p2wkh output. Components such as the version,
|
2017-09-26 06:13:53 +03:00
|
|
|
// nLockTime, and output are already included in the TxWeightEstimator.
|
|
|
|
weightEstimate.AddP2WKHOutput()
|
2017-09-01 13:11:14 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// Next, we iterate over the breached outputs contained in the
|
|
|
|
// retribution info. For each, we switch over the witness type such
|
|
|
|
// that we contribute the appropriate weight for each input and witness,
|
|
|
|
// finally adding to our list of spendable outputs.
|
|
|
|
for i := range r.breachedOutputs {
|
|
|
|
// Grab locally scoped reference to breached output.
|
|
|
|
input := &r.breachedOutputs[i]
|
|
|
|
|
|
|
|
// First, select the appropriate estimated witness weight for
|
|
|
|
// the give witness type of this breached output. If the witness
|
|
|
|
// type is unrecognized, we will omit it from the transaction.
|
2017-09-26 06:13:53 +03:00
|
|
|
var witnessWeight int
|
2017-09-19 02:32:20 +03:00
|
|
|
switch input.WitnessType() {
|
|
|
|
case lnwallet.CommitmentNoDelay:
|
2018-01-23 04:05:09 +03:00
|
|
|
witnessWeight = lnwallet.P2WKHWitnessSize
|
2017-09-19 02:32:20 +03:00
|
|
|
|
|
|
|
case lnwallet.CommitmentRevoke:
|
2018-01-23 04:05:09 +03:00
|
|
|
witnessWeight = lnwallet.ToLocalPenaltyWitnessSize
|
2017-09-19 02:32:20 +03:00
|
|
|
|
2017-09-01 13:11:14 +03:00
|
|
|
case lnwallet.HtlcOfferedRevoke:
|
2017-09-19 02:32:20 +03:00
|
|
|
witnessWeight = lnwallet.OfferedHtlcPenaltyWitnessSize
|
|
|
|
|
2017-09-01 13:11:14 +03:00
|
|
|
case lnwallet.HtlcAcceptedRevoke:
|
2017-09-19 02:32:20 +03:00
|
|
|
witnessWeight = lnwallet.AcceptedHtlcPenaltyWitnessSize
|
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
case lnwallet.HtlcSecondLevelRevoke:
|
|
|
|
witnessWeight = lnwallet.SecondLevelHtlcPenaltyWitnessSize
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
default:
|
|
|
|
brarLog.Warnf("breached output in retribution info "+
|
|
|
|
"contains unexpected witness type: %v",
|
|
|
|
input.WitnessType())
|
|
|
|
continue
|
2017-09-01 13:11:14 +03:00
|
|
|
}
|
2017-09-26 06:13:53 +03:00
|
|
|
weightEstimate.AddWitnessInput(witnessWeight)
|
2017-09-19 02:32:20 +03:00
|
|
|
|
|
|
|
// Finally, append this input to our list of spendable outputs.
|
|
|
|
spendableOutputs = append(spendableOutputs, input)
|
2017-09-01 13:11:14 +03:00
|
|
|
}
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2018-02-13 17:06:41 +03:00
|
|
|
txVSize := int64(weightEstimate.VSize())
|
|
|
|
return b.sweepSpendableOutputsTxn(txVSize, spendableOutputs...)
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
2017-07-31 03:45:39 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// sweepSpendableOutputsTxn creates a signed transaction from a sequence of
|
|
|
|
// spendable outputs by sweeping the funds into a single p2wkh output.
|
2018-02-13 17:06:41 +03:00
|
|
|
func (b *breachArbiter) sweepSpendableOutputsTxn(txVSize int64,
|
2017-08-22 02:56:58 +03:00
|
|
|
inputs ...SpendableOutput) (*wire.MsgTx, error) {
|
|
|
|
|
|
|
|
// First, we obtain a new public key script from the wallet which we'll
|
|
|
|
// sweep the funds to.
|
|
|
|
// TODO(roasbeef): possibly create many outputs to minimize change in
|
|
|
|
// the future?
|
2017-09-01 13:11:14 +03:00
|
|
|
pkScript, err := b.cfg.GenSweepScript()
|
2017-07-31 03:45:39 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Compute the total amount contained in the inputs.
|
|
|
|
var totalAmt btcutil.Amount
|
|
|
|
for _, input := range inputs {
|
|
|
|
totalAmt += input.Amount()
|
2017-07-31 03:45:39 +03:00
|
|
|
}
|
|
|
|
|
2017-11-23 22:41:20 +03:00
|
|
|
// We'll actually attempt to target inclusion within the next two
|
|
|
|
// blocks as we'd like to sweep these funds back into our wallet ASAP.
|
2018-02-13 17:06:41 +03:00
|
|
|
feePerVSize, err := b.cfg.Estimator.EstimateFeePerVSize(2)
|
2017-11-23 22:41:20 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2018-02-13 17:06:41 +03:00
|
|
|
txFee := feePerVSize.FeeForVSize(txVSize)
|
2017-08-22 02:56:58 +03:00
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// TODO(roasbeef): already start to siphon their funds into fees
|
2017-08-22 02:56:58 +03:00
|
|
|
sweepAmt := int64(totalAmt - txFee)
|
|
|
|
|
|
|
|
// With the fee calculated, we can now create the transaction using the
|
|
|
|
// information gathered above and the provided retribution information.
|
2017-09-01 13:11:14 +03:00
|
|
|
txn := wire.NewMsgTx(2)
|
2017-08-22 02:56:58 +03:00
|
|
|
|
|
|
|
// We begin by adding the output to which our funds will be deposited.
|
|
|
|
txn.AddTxOut(&wire.TxOut{
|
|
|
|
PkScript: pkScript,
|
|
|
|
Value: sweepAmt,
|
2017-07-31 03:45:39 +03:00
|
|
|
})
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Next, we add all of the spendable outputs as inputs to the
|
|
|
|
// transaction.
|
|
|
|
for _, input := range inputs {
|
|
|
|
txn.AddTxIn(&wire.TxIn{
|
|
|
|
PreviousOutPoint: *input.OutPoint(),
|
|
|
|
})
|
2017-07-31 03:45:39 +03:00
|
|
|
}
|
|
|
|
|
2017-08-30 05:07:52 +03:00
|
|
|
// Before signing the transaction, check to ensure that it meets some
|
|
|
|
// basic validity requirements.
|
|
|
|
btx := btcutil.NewTx(txn)
|
|
|
|
if err := blockchain.CheckTransactionSanity(btx); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Create a sighash cache to improve the performance of hashing and
|
|
|
|
// signing SigHashAll inputs.
|
|
|
|
hashCache := txscript.NewTxSigHashes(txn)
|
|
|
|
|
|
|
|
// Create a closure that encapsulates the process of initializing a
|
|
|
|
// particular output's witness generation function, computing the
|
|
|
|
// witness, and attaching it to the transaction. This function accepts
|
|
|
|
// an integer index representing the intended txin index, and the
|
|
|
|
// breached output from which it will spend.
|
|
|
|
addWitness := func(idx int, so SpendableOutput) error {
|
|
|
|
// First, we construct a valid witness for this outpoint and
|
|
|
|
// transaction using the SpendableOutput's witness generation
|
|
|
|
// function.
|
2017-09-20 03:30:36 +03:00
|
|
|
witness, err := so.BuildWitness(b.cfg.Signer, txn, hashCache,
|
|
|
|
idx)
|
2017-08-22 02:56:58 +03:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2017-07-31 03:45:39 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Then, we add the witness to the transaction at the
|
|
|
|
// appropriate txin index.
|
|
|
|
txn.TxIn[idx].Witness = witness
|
2017-07-31 03:45:39 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
return nil
|
|
|
|
}
|
2017-07-31 03:45:39 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Finally, generate a witness for each output and attach it to the
|
|
|
|
// transaction.
|
|
|
|
for i, input := range inputs {
|
|
|
|
if err := addWitness(i, input); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return txn, nil
|
2017-07-31 03:45:39 +03:00
|
|
|
}
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// RetributionStore provides an interface for managing a persistent map from
|
|
|
|
// wire.OutPoint -> retributionInfo. Upon learning of a breach, a BreachArbiter
|
|
|
|
// should record the retributionInfo for the breached channel, which serves a
|
|
|
|
// checkpoint in the event that retribution needs to be resumed after failure.
|
|
|
|
// A RetributionStore provides an interface for managing the persisted set, as
|
|
|
|
// well as mapping user defined functions over the entire on-disk contents.
|
|
|
|
//
|
|
|
|
// Calls to RetributionStore may occur concurrently. A concrete instance of
|
|
|
|
// RetributionStore should use appropriate synchronization primitives, or
|
|
|
|
// be otherwise safe for concurrent access.
|
|
|
|
type RetributionStore interface {
|
|
|
|
// Add persists the retributionInfo to disk, using the information's
|
|
|
|
// chanPoint as the key. This method should overwrite any existing
|
2017-12-18 05:40:05 +03:00
|
|
|
// entries found under the same key, and an error should be raised if
|
2017-07-26 08:57:29 +03:00
|
|
|
// the addition fails.
|
|
|
|
Add(retInfo *retributionInfo) error
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// IsBreached queries the retribution store to see if the breach arbiter
|
|
|
|
// is aware of any breaches for the provided channel point.
|
|
|
|
IsBreached(chanPoint *wire.OutPoint) (bool, error)
|
|
|
|
|
|
|
|
// Finalize persists the finalized justice transaction for a particular
|
|
|
|
// channel.
|
|
|
|
Finalize(chanPoint *wire.OutPoint, finalTx *wire.MsgTx) error
|
|
|
|
|
|
|
|
// GetFinalizedTxn loads the finalized justice transaction, if any, from
|
|
|
|
// the retribution store. The finalized transaction will be nil if
|
|
|
|
// Finalize has not yet been called for this channel point.
|
|
|
|
GetFinalizedTxn(chanPoint *wire.OutPoint) (*wire.MsgTx, error)
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// Remove deletes the retributionInfo from disk, if any exists, under
|
|
|
|
// the given key. An error should be re raised if the removal fails.
|
|
|
|
Remove(key *wire.OutPoint) error
|
|
|
|
|
|
|
|
// ForAll iterates over the existing on-disk contents and applies a
|
|
|
|
// chosen, read-only callback to each. This method should ensure that it
|
|
|
|
// immediately propagate any errors generated by the callback.
|
|
|
|
ForAll(cb func(*retributionInfo) error) error
|
2017-05-07 14:09:22 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// retributionStore handles persistence of retribution states to disk and is
|
|
|
|
// backed by a boltdb bucket. The primary responsibility of the retribution
|
|
|
|
// store is to ensure that we can recover from a restart in the middle of a
|
|
|
|
// breached contract retribution.
|
|
|
|
type retributionStore struct {
|
|
|
|
db *channeldb.DB
|
|
|
|
}
|
|
|
|
|
|
|
|
// newRetributionStore creates a new instance of a retributionStore.
|
|
|
|
func newRetributionStore(db *channeldb.DB) *retributionStore {
|
|
|
|
return &retributionStore{
|
|
|
|
db: db,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Add adds a retribution state to the retributionStore, which is then persisted
|
|
|
|
// to disk.
|
2017-07-26 06:14:03 +03:00
|
|
|
func (rs *retributionStore) Add(ret *retributionInfo) error {
|
2017-05-07 14:09:22 +03:00
|
|
|
return rs.db.Update(func(tx *bolt.Tx) error {
|
2017-07-26 08:57:29 +03:00
|
|
|
// If this is our first contract breach, the retributionBucket
|
|
|
|
// won't exist, in which case, we just create a new bucket.
|
2017-05-07 14:09:22 +03:00
|
|
|
retBucket, err := tx.CreateBucketIfNotExists(retributionBucket)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
var outBuf bytes.Buffer
|
2017-07-26 06:39:59 +03:00
|
|
|
if err := writeOutpoint(&outBuf, &ret.chanPoint); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
var retBuf bytes.Buffer
|
|
|
|
if err := ret.Encode(&retBuf); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-08-15 01:14:43 +03:00
|
|
|
return retBucket.Put(outBuf.Bytes(), retBuf.Bytes())
|
2017-05-07 14:09:22 +03:00
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// Finalize writes a signed justice transaction to the retribution store. This
|
|
|
|
// is done before publishing the transaction, so that we can recover the txid on
|
|
|
|
// startup and re-register for confirmation notifications.
|
|
|
|
func (rs *retributionStore) Finalize(chanPoint *wire.OutPoint,
|
|
|
|
finalTx *wire.MsgTx) error {
|
|
|
|
return rs.db.Update(func(tx *bolt.Tx) error {
|
|
|
|
justiceBkt, err := tx.CreateBucketIfNotExists(justiceTxnBucket)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
var chanBuf bytes.Buffer
|
|
|
|
if err := writeOutpoint(&chanBuf, chanPoint); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
var txBuf bytes.Buffer
|
|
|
|
if err := finalTx.Serialize(&txBuf); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return justiceBkt.Put(chanBuf.Bytes(), txBuf.Bytes())
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetFinalizedTxn loads the finalized justice transaction for the provided
|
|
|
|
// channel point. The finalized transaction will be nil if Finalize has yet to
|
|
|
|
// be called for this channel point.
|
|
|
|
func (rs *retributionStore) GetFinalizedTxn(
|
|
|
|
chanPoint *wire.OutPoint) (*wire.MsgTx, error) {
|
|
|
|
|
|
|
|
var finalTxBytes []byte
|
|
|
|
if err := rs.db.View(func(tx *bolt.Tx) error {
|
|
|
|
justiceBkt := tx.Bucket(justiceTxnBucket)
|
|
|
|
if justiceBkt == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
var chanBuf bytes.Buffer
|
|
|
|
if err := writeOutpoint(&chanBuf, chanPoint); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
finalTxBytes = justiceBkt.Get(chanBuf.Bytes())
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if finalTxBytes == nil {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
finalTx := &wire.MsgTx{}
|
|
|
|
err := finalTx.Deserialize(bytes.NewReader(finalTxBytes))
|
|
|
|
|
|
|
|
return finalTx, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsBreached queries the retribution store to discern if this channel was
|
|
|
|
// previously breached. This is used when connecting to a peer to determine if
|
|
|
|
// it is safe to add a link to the htlcswitch, as we should never add a channel
|
|
|
|
// that has already been breached.
|
|
|
|
func (rs *retributionStore) IsBreached(chanPoint *wire.OutPoint) (bool, error) {
|
|
|
|
var found bool
|
|
|
|
err := rs.db.View(func(tx *bolt.Tx) error {
|
|
|
|
retBucket := tx.Bucket(retributionBucket)
|
|
|
|
if retBucket == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
var chanBuf bytes.Buffer
|
|
|
|
if err := writeOutpoint(&chanBuf, chanPoint); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
retInfo := retBucket.Get(chanBuf.Bytes())
|
|
|
|
if retInfo != nil {
|
|
|
|
found = true
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
})
|
|
|
|
|
|
|
|
return found, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Remove removes a retribution state and finalized justice transaction by
|
|
|
|
// channel point from the retribution store.
|
|
|
|
func (rs *retributionStore) Remove(chanPoint *wire.OutPoint) error {
|
2017-05-07 14:09:22 +03:00
|
|
|
return rs.db.Update(func(tx *bolt.Tx) error {
|
|
|
|
retBucket := tx.Bucket(retributionBucket)
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// We return an error if the bucket is not already created,
|
|
|
|
// since normal operation of the breach arbiter should never try
|
|
|
|
// to remove a finalized retribution state that is not already
|
|
|
|
// stored in the db.
|
2017-05-07 14:09:22 +03:00
|
|
|
if retBucket == nil {
|
2017-07-26 08:57:29 +03:00
|
|
|
return errors.New("unable to remove retribution " +
|
2017-11-21 10:56:42 +03:00
|
|
|
"because the retribution bucket doesn't exist.")
|
2017-05-07 14:09:22 +03:00
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// Serialize the channel point we are intending to remove.
|
|
|
|
var chanBuf bytes.Buffer
|
|
|
|
if err := writeOutpoint(&chanBuf, chanPoint); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
2017-11-21 10:56:42 +03:00
|
|
|
chanBytes := chanBuf.Bytes()
|
|
|
|
|
|
|
|
// Remove the persisted retribution info and finalized justice
|
|
|
|
// transaction.
|
|
|
|
if err := retBucket.Delete(chanBytes); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// If we have not finalized this channel breach, we can exit
|
|
|
|
// early.
|
|
|
|
justiceBkt := tx.Bucket(justiceTxnBucket)
|
|
|
|
if justiceBkt == nil {
|
|
|
|
return nil
|
|
|
|
}
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
return justiceBkt.Delete(chanBytes)
|
2017-05-07 14:09:22 +03:00
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
// ForAll iterates through all stored retributions and executes the passed
|
|
|
|
// callback function on each retribution.
|
2017-07-26 06:14:03 +03:00
|
|
|
func (rs *retributionStore) ForAll(cb func(*retributionInfo) error) error {
|
2017-05-07 14:09:22 +03:00
|
|
|
return rs.db.View(func(tx *bolt.Tx) error {
|
2017-07-26 08:57:29 +03:00
|
|
|
// If the bucket does not exist, then there are no pending
|
|
|
|
// retributions.
|
2017-05-07 14:09:22 +03:00
|
|
|
retBucket := tx.Bucket(retributionBucket)
|
|
|
|
if retBucket == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// Otherwise, we fetch each serialized retribution info,
|
|
|
|
// deserialize it, and execute the passed in callback function
|
|
|
|
// on it.
|
2017-11-21 10:56:42 +03:00
|
|
|
return retBucket.ForEach(func(_, retBytes []byte) error {
|
2017-07-26 06:14:03 +03:00
|
|
|
ret := &retributionInfo{}
|
2017-11-21 10:56:42 +03:00
|
|
|
err := ret.Decode(bytes.NewBuffer(retBytes))
|
|
|
|
if err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return cb(ret)
|
|
|
|
})
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
// Encode serializes the retribution into the passed byte stream.
|
2017-07-26 06:14:03 +03:00
|
|
|
func (ret *retributionInfo) Encode(w io.Writer) error {
|
2017-11-21 10:56:42 +03:00
|
|
|
var scratch [4]byte
|
2017-07-26 08:57:29 +03:00
|
|
|
|
2017-05-07 14:09:22 +03:00
|
|
|
if _, err := w.Write(ret.commitHash[:]); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-07-26 06:39:59 +03:00
|
|
|
if err := writeOutpoint(w, &ret.chanPoint); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-11-11 02:23:02 +03:00
|
|
|
if _, err := w.Write(ret.chainHash[:]); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
binary.BigEndian.PutUint32(scratch[:], ret.breachHeight)
|
|
|
|
if _, err := w.Write(scratch[:]); err != nil {
|
2017-07-26 08:57:29 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
nOutputs := len(ret.breachedOutputs)
|
|
|
|
if err := wire.WriteVarInt(w, 0, uint64(nOutputs)); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
for _, output := range ret.breachedOutputs {
|
|
|
|
if err := output.Encode(w); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Dencode deserializes a retribution from the passed byte stream.
|
2017-07-26 06:14:03 +03:00
|
|
|
func (ret *retributionInfo) Decode(r io.Reader) error {
|
2017-11-21 10:56:42 +03:00
|
|
|
var scratch [32]byte
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
if _, err := io.ReadFull(r, scratch[:]); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
2017-11-21 10:56:42 +03:00
|
|
|
hash, err := chainhash.NewHash(scratch[:])
|
2017-05-07 14:09:22 +03:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
ret.commitHash = *hash
|
|
|
|
|
2017-07-26 06:39:59 +03:00
|
|
|
if err := readOutpoint(r, &ret.chanPoint); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
if _, err := io.ReadFull(r, scratch[:]); err != nil {
|
2017-11-11 02:23:02 +03:00
|
|
|
return err
|
|
|
|
}
|
2017-11-21 10:56:42 +03:00
|
|
|
chainHash, err := chainhash.NewHash(scratch[:])
|
2017-11-11 02:23:02 +03:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
ret.chainHash = *chainHash
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
if _, err := io.ReadFull(r, scratch[:4]); err != nil {
|
2017-07-26 08:57:29 +03:00
|
|
|
return err
|
|
|
|
}
|
2017-11-21 10:56:42 +03:00
|
|
|
ret.breachHeight = binary.BigEndian.Uint32(scratch[:4])
|
2017-07-26 08:57:29 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
nOutputsU64, err := wire.ReadVarInt(r, 0)
|
2017-05-07 14:09:22 +03:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2017-09-19 02:32:20 +03:00
|
|
|
nOutputs := int(nOutputsU64)
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
ret.breachedOutputs = make([]breachedOutput, nOutputs)
|
|
|
|
for i := range ret.breachedOutputs {
|
|
|
|
if err := ret.breachedOutputs[i].Decode(r); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Encode serializes a breachedOutput into the passed byte stream.
|
|
|
|
func (bo *breachedOutput) Encode(w io.Writer) error {
|
|
|
|
var scratch [8]byte
|
|
|
|
|
|
|
|
binary.BigEndian.PutUint64(scratch[:8], uint64(bo.amt))
|
|
|
|
if _, err := w.Write(scratch[:8]); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-07-26 06:39:59 +03:00
|
|
|
if err := writeOutpoint(w, &bo.outpoint); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
err := lnwallet.WriteSignDescriptor(w, &bo.signDesc)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
err = wire.WriteVarBytes(w, 0, bo.secondLevelWitnessScript)
|
|
|
|
if err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
binary.BigEndian.PutUint16(scratch[:2], uint16(bo.witnessType))
|
|
|
|
if _, err := w.Write(scratch[:2]); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Decode deserializes a breachedOutput from the passed byte stream.
|
|
|
|
func (bo *breachedOutput) Decode(r io.Reader) error {
|
|
|
|
var scratch [8]byte
|
|
|
|
|
|
|
|
if _, err := io.ReadFull(r, scratch[:8]); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
bo.amt = btcutil.Amount(binary.BigEndian.Uint64(scratch[:8]))
|
|
|
|
|
2017-07-26 06:39:59 +03:00
|
|
|
if err := readOutpoint(r, &bo.outpoint); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-09-01 13:11:14 +03:00
|
|
|
if err := lnwallet.ReadSignDescriptor(r, &bo.signDesc); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
wScript, err := wire.ReadVarBytes(r, 0, 1000, "witness script")
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
bo.secondLevelWitnessScript = wScript
|
|
|
|
|
2017-05-07 14:09:22 +03:00
|
|
|
if _, err := io.ReadFull(r, scratch[:2]); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2017-07-26 08:57:29 +03:00
|
|
|
bo.witnessType = lnwallet.WitnessType(
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
binary.BigEndian.Uint16(scratch[:2]),
|
|
|
|
)
|
2017-05-07 14:09:22 +03:00
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|