2016-11-29 06:43:57 +03:00
|
|
|
package main
|
|
|
|
|
|
|
|
import (
|
2017-05-07 14:09:22 +03:00
|
|
|
"bytes"
|
|
|
|
"encoding/binary"
|
|
|
|
"errors"
|
|
|
|
"io"
|
2016-11-29 06:43:57 +03:00
|
|
|
"sync"
|
|
|
|
"sync/atomic"
|
|
|
|
|
2018-03-11 06:00:57 +03:00
|
|
|
"github.com/coreos/bbolt"
|
2016-11-29 06:43:57 +03:00
|
|
|
"github.com/davecgh/go-spew/spew"
|
|
|
|
"github.com/lightningnetwork/lnd/chainntnfs"
|
|
|
|
"github.com/lightningnetwork/lnd/channeldb"
|
2017-05-02 23:04:58 +03:00
|
|
|
"github.com/lightningnetwork/lnd/htlcswitch"
|
2016-11-29 06:43:57 +03:00
|
|
|
"github.com/lightningnetwork/lnd/lnwallet"
|
2017-08-30 05:07:52 +03:00
|
|
|
"github.com/roasbeef/btcd/blockchain"
|
2017-01-06 00:56:27 +03:00
|
|
|
"github.com/roasbeef/btcd/chaincfg/chainhash"
|
2016-11-29 06:43:57 +03:00
|
|
|
"github.com/roasbeef/btcd/txscript"
|
|
|
|
"github.com/roasbeef/btcd/wire"
|
|
|
|
"github.com/roasbeef/btcutil"
|
|
|
|
)
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
var (
|
|
|
|
// retributionBucket stores retribution state on disk between detecting
|
|
|
|
// a contract breach, broadcasting a justice transaction that sweeps the
|
|
|
|
// channel, and finally witnessing the justice transaction confirm on
|
|
|
|
// the blockchain. It is critical that such state is persisted on disk,
|
|
|
|
// so that if our node restarts at any point during the retribution
|
|
|
|
// procedure, we can recover and continue from the persisted state.
|
|
|
|
retributionBucket = []byte("retribution")
|
|
|
|
|
|
|
|
// justiceTxnBucket holds the finalized justice transactions for all
|
|
|
|
// breached contracts. Entries are added to the justice txn bucket just
|
|
|
|
// before broadcasting the sweep txn.
|
|
|
|
justiceTxnBucket = []byte("justice-txn")
|
2018-06-01 17:20:55 +03:00
|
|
|
|
|
|
|
// errBrarShuttingDown is an error returned if the breacharbiter has
|
|
|
|
// been signalled to exit.
|
|
|
|
errBrarShuttingDown = errors.New("breacharbiter shutting down")
|
2017-11-21 10:56:42 +03:00
|
|
|
)
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2018-04-18 14:56:14 +03:00
|
|
|
// ContractBreachEvent is an event the breachArbiter will receive in case a
|
|
|
|
// contract breach is observed on-chain. It contains the necessary information
|
|
|
|
// to handle the breach, and a ProcessACK channel we will use to ACK the event
|
|
|
|
// when we have safely stored all the necessary information.
|
|
|
|
type ContractBreachEvent struct {
|
|
|
|
// ChanPoint is the channel point of the breached channel.
|
|
|
|
ChanPoint wire.OutPoint
|
|
|
|
|
|
|
|
// ProcessACK is an error channel where a nil error should be sent
|
|
|
|
// iff the breach retribution info is safely stored in the retribution
|
|
|
|
// store. In case storing the information to the store fails, a non-nil
|
|
|
|
// error should be sent.
|
|
|
|
ProcessACK chan error
|
|
|
|
|
|
|
|
// BreachRetribution is the information needed to act on this contract
|
|
|
|
// breach.
|
|
|
|
BreachRetribution *lnwallet.BreachRetribution
|
|
|
|
}
|
|
|
|
|
2017-09-01 13:11:14 +03:00
|
|
|
// BreachConfig bundles the required subsystems used by the breach arbiter. An
|
|
|
|
// instance of BreachConfig is passed to newBreachArbiter during instantiation.
|
|
|
|
type BreachConfig struct {
|
2017-09-20 03:30:36 +03:00
|
|
|
// CloseLink allows the breach arbiter to shutdown any channel links for
|
|
|
|
// which it detects a breach, ensuring now further activity will
|
2017-11-21 10:56:42 +03:00
|
|
|
// continue across the link. The method accepts link's channel point and
|
|
|
|
// a close type to be included in the channel close summary.
|
2017-09-20 03:30:36 +03:00
|
|
|
CloseLink func(*wire.OutPoint, htlcswitch.ChannelCloseType)
|
2017-09-01 13:11:14 +03:00
|
|
|
|
|
|
|
// DB provides access to the user's channels, allowing the breach
|
|
|
|
// arbiter to determine the current state of a user's channels, and how
|
|
|
|
// it should respond to channel closure.
|
|
|
|
DB *channeldb.DB
|
|
|
|
|
2017-09-20 03:30:36 +03:00
|
|
|
// Estimator is used by the breach arbiter to determine an appropriate
|
|
|
|
// fee level when generating, signing, and broadcasting sweep
|
|
|
|
// transactions.
|
|
|
|
Estimator lnwallet.FeeEstimator
|
|
|
|
|
|
|
|
// GenSweepScript generates the receiving scripts for swept outputs.
|
|
|
|
GenSweepScript func() ([]byte, error)
|
2017-09-01 13:11:14 +03:00
|
|
|
|
|
|
|
// Notifier provides a publish/subscribe interface for event driven
|
|
|
|
// notifications regarding the confirmation of txids.
|
|
|
|
Notifier chainntnfs.ChainNotifier
|
|
|
|
|
2017-09-20 03:30:36 +03:00
|
|
|
// PublishTransaction facilitates the process of broadcasting a
|
|
|
|
// transaction to the network.
|
|
|
|
PublishTransaction func(*wire.MsgTx) error
|
2017-09-01 13:11:14 +03:00
|
|
|
|
2018-04-18 14:56:14 +03:00
|
|
|
// ContractBreaches is a channel where the breachArbiter will receive
|
|
|
|
// notifications in the event of a contract breach being observed. A
|
|
|
|
// ContractBreachEvent must be ACKed by the breachArbiter, such that
|
|
|
|
// the sending subsystem knows that the event is properly handed off.
|
|
|
|
ContractBreaches <-chan *ContractBreachEvent
|
2018-01-19 01:06:38 +03:00
|
|
|
|
2017-09-20 03:30:36 +03:00
|
|
|
// Signer is used by the breach arbiter to generate sweep transactions,
|
|
|
|
// which move coins from previously open channels back to the user's
|
|
|
|
// wallet.
|
|
|
|
Signer lnwallet.Signer
|
2017-09-01 13:11:14 +03:00
|
|
|
|
|
|
|
// Store is a persistent resource that maintains information regarding
|
|
|
|
// breached channels. This is used in conjunction with DB to recover
|
|
|
|
// from crashes, restarts, or other failures.
|
|
|
|
Store RetributionStore
|
|
|
|
}
|
|
|
|
|
2017-01-13 08:01:50 +03:00
|
|
|
// breachArbiter is a special subsystem which is responsible for watching and
|
2016-11-29 06:43:57 +03:00
|
|
|
// acting on the detection of any attempted uncooperative channel breaches by
|
2017-01-13 08:01:50 +03:00
|
|
|
// channel counterparties. This file essentially acts as deterrence code for
|
2016-11-29 06:43:57 +03:00
|
|
|
// those attempting to launch attacks against the daemon. In practice it's
|
|
|
|
// expected that the logic in this file never gets executed, but it is
|
|
|
|
// important to have it in place just in case we encounter cheating channel
|
2017-01-13 08:01:50 +03:00
|
|
|
// counterparties.
|
|
|
|
// TODO(roasbeef): closures in config for subsystem pointers to decouple?
|
2016-11-29 06:43:57 +03:00
|
|
|
type breachArbiter struct {
|
2018-06-01 01:41:41 +03:00
|
|
|
started uint32 // To be used atomically.
|
|
|
|
stopped uint32 // To be used atomically.
|
2017-11-21 10:56:42 +03:00
|
|
|
|
2017-09-01 13:11:14 +03:00
|
|
|
cfg *BreachConfig
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
quit chan struct{}
|
|
|
|
wg sync.WaitGroup
|
2018-04-18 14:56:14 +03:00
|
|
|
sync.Mutex
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
|
|
|
|
2017-01-13 08:01:50 +03:00
|
|
|
// newBreachArbiter creates a new instance of a breachArbiter initialized with
|
|
|
|
// its dependent objects.
|
2017-09-01 13:11:14 +03:00
|
|
|
func newBreachArbiter(cfg *BreachConfig) *breachArbiter {
|
2016-11-29 06:43:57 +03:00
|
|
|
return &breachArbiter{
|
2018-04-18 14:56:14 +03:00
|
|
|
cfg: cfg,
|
|
|
|
quit: make(chan struct{}),
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Start is an idempotent method that officially starts the breachArbiter along
|
|
|
|
// with all other goroutines it needs to perform its functions.
|
|
|
|
func (b *breachArbiter) Start() error {
|
|
|
|
if !atomic.CompareAndSwapUint32(&b.started, 0, 1) {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-01-31 08:45:02 +03:00
|
|
|
brarLog.Tracef("Starting breach arbiter")
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// Load all retributions currently persisted in the retribution store.
|
2017-07-26 08:57:29 +03:00
|
|
|
breachRetInfos := make(map[wire.OutPoint]retributionInfo)
|
2017-11-21 10:56:42 +03:00
|
|
|
if err := b.cfg.Store.ForAll(func(ret *retributionInfo) error {
|
2017-07-26 08:57:29 +03:00
|
|
|
breachRetInfos[ret.chanPoint] = *ret
|
2017-05-07 14:09:22 +03:00
|
|
|
return nil
|
2017-11-21 10:56:42 +03:00
|
|
|
}); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Load all currently closed channels from disk, we will use the
|
|
|
|
// channels that have been marked fully closed to filter the retribution
|
|
|
|
// information loaded from disk. This is necessary in the event that the
|
|
|
|
// channel was marked fully closed, but was not removed from the
|
|
|
|
// retribution store.
|
|
|
|
closedChans, err := b.cfg.DB.FetchClosedChannels(false)
|
2017-05-07 14:09:22 +03:00
|
|
|
if err != nil {
|
2017-11-21 10:56:42 +03:00
|
|
|
brarLog.Errorf("unable to fetch closing channels: %v", err)
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// Using the set of non-pending, closed channels, reconcile any
|
|
|
|
// discrepancies between the channeldb and the retribution store by
|
|
|
|
// removing any retribution information for which we have already
|
|
|
|
// finished our responsibilities. If the removal is successful, we also
|
|
|
|
// remove the entry from our in-memory map, to avoid any further action
|
|
|
|
// for this channel.
|
2018-05-23 13:11:19 +03:00
|
|
|
// TODO(halseth): no need continue on IsPending once closed channels
|
|
|
|
// actually means close transaction is confirmed.
|
2017-11-21 10:56:42 +03:00
|
|
|
for _, chanSummary := range closedChans {
|
|
|
|
if chanSummary.IsPending {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
chanPoint := &chanSummary.ChanPoint
|
|
|
|
if _, ok := breachRetInfos[*chanPoint]; ok {
|
|
|
|
if err := b.cfg.Store.Remove(chanPoint); err != nil {
|
|
|
|
brarLog.Errorf("unable to remove closed "+
|
|
|
|
"chanid=%v from breach arbiter: %v",
|
|
|
|
chanPoint, err)
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
delete(breachRetInfos, *chanPoint)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// Spawn the exactRetribution tasks to monitor and resolve any breaches
|
|
|
|
// that were loaded from the retribution store.
|
2017-11-21 10:56:42 +03:00
|
|
|
for chanPoint := range breachRetInfos {
|
|
|
|
retInfo := breachRetInfos[chanPoint]
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// Register for a notification when the breach transaction is
|
|
|
|
// confirmed on chain.
|
2017-11-21 10:56:42 +03:00
|
|
|
breachTXID := retInfo.commitHash
|
2017-09-01 13:11:14 +03:00
|
|
|
confChan, err := b.cfg.Notifier.RegisterConfirmationsNtfn(
|
2017-11-21 10:56:42 +03:00
|
|
|
&breachTXID, 1, retInfo.breachHeight)
|
2017-07-26 08:57:29 +03:00
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to register for conf updates "+
|
|
|
|
"for txid: %v, err: %v", breachTXID, err)
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Launch a new goroutine which to finalize the channel
|
|
|
|
// retribution after the breach transaction confirms.
|
|
|
|
b.wg.Add(1)
|
|
|
|
go b.exactRetribution(confChan, &retInfo)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Start watching the remaining active channels!
|
2016-11-29 06:43:57 +03:00
|
|
|
b.wg.Add(1)
|
2018-04-18 14:56:14 +03:00
|
|
|
go b.contractObserver()
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
// Stop is an idempotent method that signals the breachArbiter to execute a
|
|
|
|
// graceful shutdown. This function will block until all goroutines spawned by
|
|
|
|
// the breachArbiter have gracefully exited.
|
|
|
|
func (b *breachArbiter) Stop() error {
|
|
|
|
if !atomic.CompareAndSwapUint32(&b.stopped, 0, 1) {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
brarLog.Infof("Breach arbiter shutting down")
|
|
|
|
|
|
|
|
close(b.quit)
|
|
|
|
b.wg.Wait()
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// IsBreached queries the breach arbiter's retribution store to see if it is
|
|
|
|
// aware of any channel breaches for a particular channel point.
|
|
|
|
func (b *breachArbiter) IsBreached(chanPoint *wire.OutPoint) (bool, error) {
|
|
|
|
return b.cfg.Store.IsBreached(chanPoint)
|
|
|
|
}
|
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
// contractObserver is the primary goroutine for the breachArbiter. This
|
2018-04-18 14:56:14 +03:00
|
|
|
// goroutine is responsible for handling breach events coming from the
|
|
|
|
// contractcourt on the ContractBreaches channel. If a channel breach is
|
|
|
|
// detected, then the contractObserver will execute the retribution logic
|
|
|
|
// required to sweep ALL outputs from a contested channel into the daemon's
|
|
|
|
// wallet.
|
2016-11-29 06:43:57 +03:00
|
|
|
//
|
|
|
|
// NOTE: This MUST be run as a goroutine.
|
2018-04-18 14:56:14 +03:00
|
|
|
func (b *breachArbiter) contractObserver() {
|
2016-11-29 06:43:57 +03:00
|
|
|
defer b.wg.Done()
|
|
|
|
|
2018-04-18 14:56:14 +03:00
|
|
|
brarLog.Infof("Starting contract observer, watching for breaches.")
|
2017-05-11 03:27:05 +03:00
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
for {
|
|
|
|
select {
|
2018-04-18 14:56:14 +03:00
|
|
|
case breachEvent := <-b.cfg.ContractBreaches:
|
|
|
|
// We have been notified about a contract breach!
|
|
|
|
// Handle the handoff, making sure we ACK the event
|
|
|
|
// after we have safely added it to the retribution
|
|
|
|
// store.
|
2018-01-23 04:03:34 +03:00
|
|
|
b.wg.Add(1)
|
2018-04-18 14:56:14 +03:00
|
|
|
go b.handleBreachHandoff(breachEvent)
|
2018-01-23 04:03:34 +03:00
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
case <-b.quit:
|
2018-04-18 14:56:14 +03:00
|
|
|
return
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// convertToSecondLevelRevoke takes a breached output, and a transaction that
|
|
|
|
// spends it to the second level, and mutates the breach output into one that
|
|
|
|
// is able to properly sweep that second level output. We'll use this function
|
|
|
|
// when we go to sweep a breached commitment transaction, but the cheating
|
|
|
|
// party has already attempted to take it to the second level
|
|
|
|
func convertToSecondLevelRevoke(bo *breachedOutput, breachInfo *retributionInfo,
|
|
|
|
spendDetails *chainntnfs.SpendDetail) {
|
|
|
|
|
|
|
|
// In this case, we'll modify the witness type of this output to
|
|
|
|
// actually prepare for a second level revoke.
|
|
|
|
bo.witnessType = lnwallet.HtlcSecondLevelRevoke
|
|
|
|
|
|
|
|
// We'll also redirect the outpoint to this second level output, so the
|
|
|
|
// spending transaction updates it inputs accordingly.
|
|
|
|
spendingTx := spendDetails.SpendingTx
|
|
|
|
oldOp := bo.outpoint
|
|
|
|
bo.outpoint = wire.OutPoint{
|
|
|
|
Hash: spendingTx.TxHash(),
|
|
|
|
Index: 0,
|
|
|
|
}
|
|
|
|
|
|
|
|
// Next, we need to update the amount so we can do fee estimation
|
|
|
|
// properly, and also so we can generate a valid signature as we need
|
|
|
|
// to know the new input value (the second level transactions shaves
|
|
|
|
// off some funds to fees).
|
|
|
|
newAmt := spendingTx.TxOut[0].Value
|
|
|
|
bo.amt = btcutil.Amount(newAmt)
|
|
|
|
bo.signDesc.Output.Value = newAmt
|
|
|
|
|
|
|
|
// Finally, we'll need to adjust the witness program in the
|
|
|
|
// SignDescriptor.
|
|
|
|
bo.signDesc.WitnessScript = bo.secondLevelWitnessScript
|
|
|
|
|
|
|
|
brarLog.Warnf("HTLC(%v) for ChannelPoint(%v) has been spent to the "+
|
|
|
|
"second-level, adjusting -> %v", oldOp, breachInfo.chanPoint,
|
|
|
|
bo.outpoint)
|
|
|
|
}
|
|
|
|
|
2018-06-01 17:20:55 +03:00
|
|
|
// waitForSpendEvent waits for any of the breached outputs to get spent, and
|
|
|
|
// mutates the breachInfo to be able to sweep it. This method should be used
|
|
|
|
// when we fail to publish the justice tx because of a double spend, indicating
|
|
|
|
// that the counter party has taken one of the breached outputs to the second
|
|
|
|
// level. The spendNtfns map is a cache used to store registered spend
|
|
|
|
// subscriptions, in case we must call this method multiple times.
|
|
|
|
func (b *breachArbiter) waitForSpendEvent(breachInfo *retributionInfo,
|
|
|
|
spendNtfns map[wire.OutPoint]*chainntnfs.SpendEvent) error {
|
|
|
|
|
|
|
|
// spend is used to wrap the index of the output that gets spent
|
|
|
|
// together with the spend details.
|
|
|
|
type spend struct {
|
|
|
|
index int
|
|
|
|
detail *chainntnfs.SpendDetail
|
|
|
|
}
|
|
|
|
|
|
|
|
// We create a channel the first goroutine that gets a spend event can
|
|
|
|
// signal. We make it buffered in case multiple spend events come in at
|
|
|
|
// the same time.
|
|
|
|
anySpend := make(chan struct{}, len(breachInfo.breachedOutputs))
|
|
|
|
|
|
|
|
// The allSpends channel will be used to pass spend events from all the
|
|
|
|
// goroutines that detects a spend before they are signalled to exit.
|
|
|
|
allSpends := make(chan spend, len(breachInfo.breachedOutputs))
|
|
|
|
|
|
|
|
// exit will be used to signal the goroutines that they can exit.
|
|
|
|
exit := make(chan struct{})
|
|
|
|
var wg sync.WaitGroup
|
|
|
|
|
|
|
|
// We'll now launch a goroutine for each of the HTLC outputs, that will
|
|
|
|
// signal the moment they detect a spend event.
|
|
|
|
for i := 0; i < len(breachInfo.breachedOutputs); i++ {
|
|
|
|
breachedOutput := &breachInfo.breachedOutputs[i]
|
|
|
|
|
|
|
|
// If this isn't an HTLC output, then we can skip it.
|
|
|
|
if breachedOutput.witnessType != lnwallet.HtlcAcceptedRevoke &&
|
|
|
|
breachedOutput.witnessType != lnwallet.HtlcOfferedRevoke {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
brarLog.Debugf("Checking for second-level attempt on HTLC(%v) "+
|
|
|
|
"for ChannelPoint(%v)", breachedOutput.outpoint,
|
|
|
|
breachInfo.chanPoint)
|
|
|
|
|
|
|
|
// If we have already registered for a notification for this
|
|
|
|
// output, we'll reuse it.
|
|
|
|
spendNtfn, ok := spendNtfns[breachedOutput.outpoint]
|
|
|
|
if !ok {
|
|
|
|
var err error
|
|
|
|
spendNtfn, err = b.cfg.Notifier.RegisterSpendNtfn(
|
|
|
|
&breachedOutput.outpoint,
|
|
|
|
breachInfo.breachHeight, true,
|
|
|
|
)
|
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to check for spentness "+
|
|
|
|
"of out_point=%v: %v",
|
|
|
|
breachedOutput.outpoint, err)
|
|
|
|
|
|
|
|
// Registration may have failed if we've been
|
|
|
|
// instructed to shutdown. If so, return here
|
|
|
|
// to avoid entering an infinite loop.
|
|
|
|
select {
|
|
|
|
case <-b.quit:
|
|
|
|
return errBrarShuttingDown
|
|
|
|
default:
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
}
|
|
|
|
spendNtfns[breachedOutput.outpoint] = spendNtfn
|
|
|
|
}
|
|
|
|
|
|
|
|
// Launch a goroutine waiting for a spend event.
|
|
|
|
b.wg.Add(1)
|
|
|
|
wg.Add(1)
|
|
|
|
go func(index int, spendEv *chainntnfs.SpendEvent) {
|
|
|
|
defer b.wg.Done()
|
|
|
|
defer wg.Done()
|
|
|
|
|
|
|
|
select {
|
|
|
|
// The output has been taken to the second level!
|
|
|
|
case sp, ok := <-spendEv.Spend:
|
|
|
|
if !ok {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
brarLog.Debugf("Detected spend of HTLC(%v) "+
|
|
|
|
"for ChannelPoint(%v)",
|
|
|
|
breachedOutput.outpoint,
|
|
|
|
breachInfo.chanPoint)
|
|
|
|
|
|
|
|
// First we send the spend event on the
|
|
|
|
// allSpends channel, such that it can be
|
|
|
|
// handled after all go routines have exited.
|
|
|
|
allSpends <- spend{index, sp}
|
|
|
|
|
|
|
|
// Finally we'll signal the anySpend channel
|
|
|
|
// that a spend was detected, such that the
|
|
|
|
// other goroutines can be shut down.
|
|
|
|
anySpend <- struct{}{}
|
|
|
|
case <-exit:
|
|
|
|
return
|
|
|
|
case <-b.quit:
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}(i, spendNtfn)
|
|
|
|
}
|
|
|
|
|
|
|
|
// We'll wait for any of the outputs to be spent, or that we are
|
|
|
|
// signalled to exit.
|
|
|
|
select {
|
|
|
|
// A goroutine have signalled that a spend occured.
|
|
|
|
case <-anySpend:
|
|
|
|
// Signal for the remaining goroutines to exit.
|
|
|
|
close(exit)
|
|
|
|
wg.Wait()
|
|
|
|
|
|
|
|
// At this point all goroutines that can send on the allSpends
|
|
|
|
// channel have exited. We can therefore safely close the
|
|
|
|
// channel before ranging over its content.
|
|
|
|
close(allSpends)
|
|
|
|
for s := range allSpends {
|
|
|
|
breachedOutput := &breachInfo.breachedOutputs[s.index]
|
|
|
|
brarLog.Debugf("Detected second-level spend on "+
|
|
|
|
"HTLC(%v) for ChannelPoint(%v)",
|
|
|
|
breachedOutput.outpoint, breachInfo.chanPoint)
|
|
|
|
|
|
|
|
delete(spendNtfns, breachedOutput.outpoint)
|
|
|
|
|
|
|
|
// In this case we'll morph our initial revoke spend to
|
|
|
|
// instead point to the second level output, and update
|
|
|
|
// the sign descriptor in the process.
|
|
|
|
convertToSecondLevelRevoke(
|
|
|
|
breachedOutput, breachInfo, s.detail,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
case <-b.quit:
|
|
|
|
return errBrarShuttingDown
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-07-26 06:14:03 +03:00
|
|
|
// exactRetribution is a goroutine which is executed once a contract breach has
|
|
|
|
// been detected by a breachObserver. This function is responsible for
|
|
|
|
// punishing a counterparty for violating the channel contract by sweeping ALL
|
|
|
|
// the lingering funds within the channel into the daemon's wallet.
|
|
|
|
//
|
|
|
|
// NOTE: This MUST be run as a goroutine.
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
func (b *breachArbiter) exactRetribution(confChan *chainntnfs.ConfirmationEvent,
|
2017-07-26 06:14:03 +03:00
|
|
|
breachInfo *retributionInfo) {
|
|
|
|
|
|
|
|
defer b.wg.Done()
|
|
|
|
|
|
|
|
// TODO(roasbeef): state needs to be checkpointed here
|
2017-11-21 10:56:42 +03:00
|
|
|
var breachConfHeight uint32
|
2017-07-26 06:14:03 +03:00
|
|
|
select {
|
2017-11-21 10:56:42 +03:00
|
|
|
case breachConf, ok := <-confChan.Confirmed:
|
2017-07-26 06:14:03 +03:00
|
|
|
// If the second value is !ok, then the channel has been closed
|
|
|
|
// signifying a daemon shutdown, so we exit.
|
|
|
|
if !ok {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
breachConfHeight = breachConf.BlockHeight
|
|
|
|
|
2017-07-26 06:14:03 +03:00
|
|
|
// Otherwise, if this is a real confirmation notification, then
|
|
|
|
// we fall through to complete our duty.
|
|
|
|
case <-b.quit:
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
brarLog.Debugf("Breach transaction %v has been confirmed, sweeping "+
|
|
|
|
"revoked funds", breachInfo.commitHash)
|
|
|
|
|
2018-06-01 17:20:55 +03:00
|
|
|
// We may have to wait for some of the HTLC outputs to be spent to the
|
|
|
|
// second level before broadcasting the justice tx. We'll store the
|
|
|
|
// SpendEvents between each attempt to not re-register uneccessarily.
|
|
|
|
spendNtfns := make(map[wire.OutPoint]*chainntnfs.SpendEvent)
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
finalTx, err := b.cfg.Store.GetFinalizedTxn(&breachInfo.chanPoint)
|
2017-07-26 06:14:03 +03:00
|
|
|
if err != nil {
|
2017-11-21 10:56:42 +03:00
|
|
|
brarLog.Errorf("unable to get finalized txn for"+
|
|
|
|
"chanid=%v: %v", &breachInfo.chanPoint, err)
|
2017-07-26 06:14:03 +03:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// If this retribution has not been finalized before, we will first
|
|
|
|
// construct a sweep transaction and write it to disk. This will allow
|
|
|
|
// the breach arbiter to re-register for notifications for the justice
|
|
|
|
// txid.
|
2018-06-01 17:20:55 +03:00
|
|
|
justiceTxBroadcast:
|
2017-11-21 10:56:42 +03:00
|
|
|
if finalTx == nil {
|
|
|
|
// With the breach transaction confirmed, we now create the
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// justice tx which will claim ALL the funds within the
|
|
|
|
// channel.
|
2017-11-21 10:56:42 +03:00
|
|
|
finalTx, err = b.createJusticeTx(breachInfo)
|
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to create justice tx: %v", err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// Persist our finalized justice transaction before making an
|
|
|
|
// attempt to broadcast.
|
|
|
|
err := b.cfg.Store.Finalize(&breachInfo.chanPoint, finalTx)
|
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to finalize justice tx for "+
|
|
|
|
"chanid=%v: %v", &breachInfo.chanPoint, err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
brarLog.Debugf("Broadcasting justice tx: %v", newLogClosure(func() string {
|
|
|
|
return spew.Sdump(finalTx)
|
|
|
|
}))
|
2017-07-26 06:14:03 +03:00
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// We'll now attempt to broadcast the transaction which finalized the
|
|
|
|
// channel's retribution against the cheating counter party.
|
|
|
|
err = b.cfg.PublishTransaction(finalTx)
|
|
|
|
if err != nil {
|
2018-06-01 17:20:55 +03:00
|
|
|
brarLog.Errorf("unable to broadcast justice tx: %v", err)
|
|
|
|
|
2018-02-14 14:28:19 +03:00
|
|
|
if err == lnwallet.ErrDoubleSpend {
|
2018-06-01 17:20:55 +03:00
|
|
|
// Broadcasting the transaction failed because of a
|
|
|
|
// conflict either in the mempool or in chain. We'll
|
|
|
|
// now create spend subscriptions for all HTLC outputs
|
|
|
|
// on the commitment transaction that could possibly
|
|
|
|
// have been spent, and wait for any of them to
|
|
|
|
// trigger.
|
|
|
|
brarLog.Infof("Waiting for a spend event before " +
|
|
|
|
"attempting to craft new justice tx.")
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
finalTx = nil
|
2018-02-08 04:42:36 +03:00
|
|
|
|
2018-06-01 17:20:55 +03:00
|
|
|
err := b.waitForSpendEvent(breachInfo, spendNtfns)
|
|
|
|
if err != nil {
|
|
|
|
if err != errBrarShuttingDown {
|
|
|
|
brarLog.Errorf("error waiting for "+
|
|
|
|
"spend event: %v", err)
|
|
|
|
}
|
2018-02-08 04:42:36 +03:00
|
|
|
return
|
|
|
|
}
|
2018-06-01 17:20:55 +03:00
|
|
|
|
|
|
|
brarLog.Infof("Attempting another justice tx broadcast")
|
|
|
|
goto justiceTxBroadcast
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
}
|
2017-07-26 06:14:03 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// As a conclusionary step, we register for a notification to be
|
|
|
|
// dispatched once the justice tx is confirmed. After confirmation we
|
|
|
|
// notify the caller that initiated the retribution workflow that the
|
|
|
|
// deed has been done.
|
2017-11-21 10:56:42 +03:00
|
|
|
justiceTXID := finalTx.TxHash()
|
2017-09-01 13:11:14 +03:00
|
|
|
confChan, err = b.cfg.Notifier.RegisterConfirmationsNtfn(
|
2017-11-21 10:56:42 +03:00
|
|
|
&justiceTXID, 1, breachConfHeight)
|
2017-07-26 06:14:03 +03:00
|
|
|
if err != nil {
|
2018-06-01 17:20:55 +03:00
|
|
|
brarLog.Errorf("unable to register for conf for txid(%v): %v",
|
|
|
|
justiceTXID, err)
|
2017-07-26 06:14:03 +03:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
select {
|
|
|
|
case _, ok := <-confChan.Confirmed:
|
|
|
|
if !ok {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// Compute both the total value of funds being swept and the
|
|
|
|
// amount of funds that were revoked from the counter party.
|
|
|
|
var totalFunds, revokedFunds btcutil.Amount
|
|
|
|
for _, input := range breachInfo.breachedOutputs {
|
|
|
|
totalFunds += input.Amount()
|
|
|
|
|
|
|
|
// If the output being revoked is the remote commitment
|
|
|
|
// output or an offered HTLC output, it's amount
|
|
|
|
// contributes to the value of funds being revoked from
|
|
|
|
// the counter party.
|
|
|
|
switch input.WitnessType() {
|
|
|
|
case lnwallet.CommitmentRevoke:
|
|
|
|
revokedFunds += input.Amount()
|
|
|
|
case lnwallet.HtlcOfferedRevoke:
|
|
|
|
revokedFunds += input.Amount()
|
|
|
|
default:
|
|
|
|
}
|
|
|
|
}
|
2017-07-26 06:14:03 +03:00
|
|
|
|
|
|
|
brarLog.Infof("Justice for ChannelPoint(%v) has "+
|
|
|
|
"been served, %v revoked funds (%v total) "+
|
|
|
|
"have been claimed", breachInfo.chanPoint,
|
|
|
|
revokedFunds, totalFunds)
|
|
|
|
|
|
|
|
// With the channel closed, mark it in the database as such.
|
2017-09-01 13:11:14 +03:00
|
|
|
err := b.cfg.DB.MarkChanFullyClosed(&breachInfo.chanPoint)
|
2017-07-26 06:14:03 +03:00
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to mark chan as closed: %v", err)
|
2017-11-21 10:56:42 +03:00
|
|
|
return
|
2017-07-26 06:14:03 +03:00
|
|
|
}
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// Justice has been carried out; we can safely delete the
|
|
|
|
// retribution info from the database.
|
2017-09-01 13:11:14 +03:00
|
|
|
err = b.cfg.Store.Remove(&breachInfo.chanPoint)
|
2017-07-26 06:14:03 +03:00
|
|
|
if err != nil {
|
2017-07-26 08:57:29 +03:00
|
|
|
brarLog.Errorf("unable to remove retribution "+
|
|
|
|
"from the db: %v", err)
|
2017-07-26 06:14:03 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// TODO(roasbeef): add peer to blacklist?
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// TODO(roasbeef): close other active channels with offending
|
|
|
|
// peer
|
2017-07-26 06:14:03 +03:00
|
|
|
|
|
|
|
return
|
|
|
|
case <-b.quit:
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-04-18 14:56:14 +03:00
|
|
|
// handleBreachHandoff handles a new breach event, by writing it to disk, then
|
|
|
|
// notifies the breachArbiter contract observer goroutine that a channel's
|
|
|
|
// contract has been breached by the prior counterparty. Once notified the
|
|
|
|
// breachArbiter will attempt to sweep ALL funds within the channel using the
|
|
|
|
// information provided within the BreachRetribution generated due to the
|
|
|
|
// breach of channel contract. The funds will be swept only after the breaching
|
|
|
|
// transaction receives a necessary number of confirmations.
|
|
|
|
//
|
|
|
|
// NOTE: This MUST be run as a goroutine.
|
|
|
|
func (b *breachArbiter) handleBreachHandoff(breachEvent *ContractBreachEvent) {
|
|
|
|
defer b.wg.Done()
|
2018-01-20 04:25:06 +03:00
|
|
|
|
2018-04-18 14:56:14 +03:00
|
|
|
chanPoint := breachEvent.ChanPoint
|
|
|
|
brarLog.Debugf("Handling breach handoff for ChannelPoint(%v)",
|
|
|
|
chanPoint)
|
2018-01-20 04:25:06 +03:00
|
|
|
|
2018-04-18 14:56:14 +03:00
|
|
|
// A read from this channel indicates that a channel breach has been
|
|
|
|
// detected! So we notify the main coordination goroutine with the
|
|
|
|
// information needed to bring the counterparty to justice.
|
|
|
|
breachInfo := breachEvent.BreachRetribution
|
|
|
|
brarLog.Warnf("REVOKED STATE #%v FOR ChannelPoint(%v) "+
|
|
|
|
"broadcast, REMOTE PEER IS DOING SOMETHING "+
|
|
|
|
"SKETCHY!!!", breachInfo.RevokedStateNum,
|
|
|
|
chanPoint)
|
2018-01-20 04:25:06 +03:00
|
|
|
|
2018-04-18 14:56:14 +03:00
|
|
|
// Immediately notify the HTLC switch that this link has been
|
|
|
|
// breached in order to ensure any incoming or outgoing
|
|
|
|
// multi-hop HTLCs aren't sent over this link, nor any other
|
|
|
|
// links associated with this peer.
|
|
|
|
b.cfg.CloseLink(&chanPoint, htlcswitch.CloseBreach)
|
2017-07-26 08:57:29 +03:00
|
|
|
|
2018-04-18 14:56:14 +03:00
|
|
|
// TODO(roasbeef): need to handle case of remote broadcast
|
|
|
|
// mid-local initiated state-transition, possible
|
|
|
|
// false-positive?
|
2017-05-05 02:08:56 +03:00
|
|
|
|
2018-04-18 14:56:14 +03:00
|
|
|
// Acquire the mutex to ensure consistency between the call to
|
|
|
|
// IsBreached and Add below.
|
|
|
|
b.Lock()
|
2017-11-23 22:41:42 +03:00
|
|
|
|
2018-04-18 14:56:14 +03:00
|
|
|
// We first check if this breach info is already added to the
|
|
|
|
// retribution store.
|
|
|
|
breached, err := b.cfg.Store.IsBreached(&chanPoint)
|
|
|
|
if err != nil {
|
|
|
|
b.Unlock()
|
|
|
|
brarLog.Errorf("unable to check breach info in DB: %v", err)
|
2017-07-26 08:57:29 +03:00
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
select {
|
2018-04-18 14:56:14 +03:00
|
|
|
case breachEvent.ProcessACK <- err:
|
2017-11-21 10:56:42 +03:00
|
|
|
case <-b.quit:
|
2017-07-26 08:57:29 +03:00
|
|
|
}
|
2018-04-18 14:56:14 +03:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// If this channel is already marked as breached in the retribution
|
|
|
|
// store, we already have handled the handoff for this breach. In this
|
|
|
|
// case we can safely ACK the handoff, and return.
|
|
|
|
if breached {
|
|
|
|
b.Unlock()
|
2017-07-26 08:57:29 +03:00
|
|
|
|
|
|
|
select {
|
2018-04-18 14:56:14 +03:00
|
|
|
case breachEvent.ProcessACK <- nil:
|
2017-07-26 08:57:29 +03:00
|
|
|
case <-b.quit:
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
2018-04-18 14:56:14 +03:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// Using the breach information provided by the wallet and the
|
|
|
|
// channel snapshot, construct the retribution information that
|
|
|
|
// will be persisted to disk.
|
|
|
|
retInfo := newRetributionInfo(&chanPoint, breachInfo)
|
|
|
|
|
|
|
|
// Persist the pending retribution state to disk.
|
|
|
|
err = b.cfg.Store.Add(retInfo)
|
|
|
|
b.Unlock()
|
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to persist retribution "+
|
|
|
|
"info to db: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Now that the breach has been persisted, try to send an
|
|
|
|
// acknowledgment back to the close observer with the error. If
|
|
|
|
// the ack is successful, the close observer will mark the
|
|
|
|
// channel as pending-closed in the channeldb.
|
|
|
|
select {
|
|
|
|
case breachEvent.ProcessACK <- err:
|
|
|
|
// Bail if we failed to persist retribution info.
|
|
|
|
if err != nil {
|
|
|
|
return
|
|
|
|
}
|
2017-05-05 02:07:25 +03:00
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
case <-b.quit:
|
|
|
|
return
|
|
|
|
}
|
2018-04-18 14:56:14 +03:00
|
|
|
|
|
|
|
// Now that a new channel contract has been added to the retribution
|
|
|
|
// store, we first register for a notification to be dispatched once
|
|
|
|
// the breach transaction (the revoked commitment transaction) has been
|
|
|
|
// confirmed in the chain to ensure we're not dealing with a moving
|
|
|
|
// target.
|
|
|
|
breachTXID := &retInfo.commitHash
|
|
|
|
cfChan, err := b.cfg.Notifier.RegisterConfirmationsNtfn(breachTXID, 1,
|
|
|
|
retInfo.breachHeight)
|
|
|
|
if err != nil {
|
|
|
|
brarLog.Errorf("unable to register for conf updates for "+
|
|
|
|
"txid: %v, err: %v", breachTXID, err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
brarLog.Warnf("A channel has been breached with txid: %v. Waiting "+
|
|
|
|
"for confirmation, then justice will be served!", breachTXID)
|
|
|
|
|
|
|
|
// With the retribution state persisted, channel close persisted, and
|
|
|
|
// notification registered, we launch a new goroutine which will
|
|
|
|
// finalize the channel retribution after the breach transaction has
|
|
|
|
// been confirmed.
|
|
|
|
b.wg.Add(1)
|
|
|
|
go b.exactRetribution(cfChan, retInfo)
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// SpendableOutput an interface which can be used by the breach arbiter to
|
|
|
|
// construct a transaction spending from outputs we control.
|
|
|
|
type SpendableOutput interface {
|
|
|
|
// Amount returns the number of satoshis contained within the output.
|
|
|
|
Amount() btcutil.Amount
|
|
|
|
|
|
|
|
// Outpoint returns the reference to the output being spent, used to
|
|
|
|
// construct the corresponding transaction input.
|
|
|
|
OutPoint() *wire.OutPoint
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// WitnessType returns an enum specifying the type of witness that must
|
|
|
|
// be generated in order to spend this output.
|
|
|
|
WitnessType() lnwallet.WitnessType
|
|
|
|
|
|
|
|
// SignDesc returns a reference to a spendable output's sign descriptor,
|
|
|
|
// which is used during signing to compute a valid witness that spends
|
|
|
|
// this output.
|
|
|
|
SignDesc() *lnwallet.SignDescriptor
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// BuildWitness returns a valid witness allowing this output to be
|
|
|
|
// spent, the witness should be attached to the transaction at the
|
|
|
|
// location determined by the given `txinIdx`.
|
2017-09-20 03:30:36 +03:00
|
|
|
BuildWitness(signer lnwallet.Signer, txn *wire.MsgTx,
|
2017-08-22 02:56:58 +03:00
|
|
|
hashCache *txscript.TxSigHashes,
|
|
|
|
txinIdx int) ([][]byte, error)
|
|
|
|
}
|
|
|
|
|
2017-07-26 06:14:03 +03:00
|
|
|
// breachedOutput contains all the information needed to sweep a breached
|
|
|
|
// output. A breached output is an output that we are now entitled to due to a
|
|
|
|
// revoked commitment transaction being broadcast.
|
|
|
|
type breachedOutput struct {
|
2017-08-22 02:56:58 +03:00
|
|
|
amt btcutil.Amount
|
|
|
|
outpoint wire.OutPoint
|
|
|
|
witnessType lnwallet.WitnessType
|
2017-09-01 13:11:14 +03:00
|
|
|
signDesc lnwallet.SignDescriptor
|
2017-05-07 14:09:22 +03:00
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
secondLevelWitnessScript []byte
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
witnessFunc lnwallet.WitnessGenerator
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// makeBreachedOutput assembles a new breachedOutput that can be used by the
|
2017-08-30 05:07:52 +03:00
|
|
|
// breach arbiter to construct a justice or sweep transaction.
|
2017-09-19 02:32:20 +03:00
|
|
|
func makeBreachedOutput(outpoint *wire.OutPoint,
|
2017-08-22 02:56:58 +03:00
|
|
|
witnessType lnwallet.WitnessType,
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
secondLevelScript []byte,
|
2017-09-19 02:32:20 +03:00
|
|
|
signDescriptor *lnwallet.SignDescriptor) breachedOutput {
|
2017-08-22 02:56:58 +03:00
|
|
|
|
|
|
|
amount := signDescriptor.Output.Value
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
return breachedOutput{
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
amt: btcutil.Amount(amount),
|
|
|
|
outpoint: *outpoint,
|
|
|
|
secondLevelWitnessScript: secondLevelScript,
|
|
|
|
witnessType: witnessType,
|
|
|
|
signDesc: *signDescriptor,
|
2017-08-22 02:56:58 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Amount returns the number of satoshis contained in the breached output.
|
|
|
|
func (bo *breachedOutput) Amount() btcutil.Amount {
|
|
|
|
return bo.amt
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// OutPoint returns the breached output's identifier that is to be included as a
|
2017-08-22 02:56:58 +03:00
|
|
|
// transaction input.
|
|
|
|
func (bo *breachedOutput) OutPoint() *wire.OutPoint {
|
|
|
|
return &bo.outpoint
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// WitnessType returns the type of witness that must be generated to spend the
|
|
|
|
// breached output.
|
|
|
|
func (bo *breachedOutput) WitnessType() lnwallet.WitnessType {
|
|
|
|
return bo.witnessType
|
|
|
|
}
|
|
|
|
|
|
|
|
// SignDesc returns the breached output's SignDescriptor, which is used during
|
|
|
|
// signing to compute the witness.
|
|
|
|
func (bo *breachedOutput) SignDesc() *lnwallet.SignDescriptor {
|
|
|
|
return &bo.signDesc
|
|
|
|
}
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// BuildWitness computes a valid witness that allows us to spend from the
|
|
|
|
// breached output. It does so by first generating and memoizing the witness
|
|
|
|
// generation function, which parameterized primarily by the witness type and
|
|
|
|
// sign descriptor. The method then returns the witness computed by invoking
|
|
|
|
// this function on the first and subsequent calls.
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
func (bo *breachedOutput) BuildWitness(signer lnwallet.Signer, txn *wire.MsgTx,
|
|
|
|
hashCache *txscript.TxSigHashes, txinIdx int) ([][]byte, error) {
|
|
|
|
|
|
|
|
// First, we ensure that the witness generation function has been
|
|
|
|
// initialized for this breached output.
|
|
|
|
bo.witnessFunc = bo.witnessType.GenWitnessFunc(
|
|
|
|
signer, bo.SignDesc(),
|
|
|
|
)
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Now that we have ensured that the witness generation function has
|
|
|
|
// been initialized, we can proceed to execute it and generate the
|
|
|
|
// witness for this particular breached output.
|
|
|
|
return bo.witnessFunc(txn, hashCache, txinIdx)
|
2017-07-26 06:14:03 +03:00
|
|
|
}
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Add compile-time constraint ensuring breachedOutput implements
|
|
|
|
// SpendableOutput.
|
|
|
|
var _ SpendableOutput = (*breachedOutput)(nil)
|
|
|
|
|
2017-07-26 06:14:03 +03:00
|
|
|
// retributionInfo encapsulates all the data needed to sweep all the contested
|
|
|
|
// funds within a channel whose contract has been breached by the prior
|
|
|
|
// counterparty. This struct is used to create the justice transaction which
|
|
|
|
// spends all outputs of the commitment transaction into an output controlled
|
|
|
|
// by the wallet.
|
|
|
|
type retributionInfo struct {
|
2017-11-21 10:56:42 +03:00
|
|
|
commitHash chainhash.Hash
|
|
|
|
chanPoint wire.OutPoint
|
|
|
|
chainHash chainhash.Hash
|
|
|
|
breachHeight uint32
|
2017-07-26 08:57:29 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
breachedOutputs []breachedOutput
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// newRetributionInfo constructs a retributionInfo containing all the
|
|
|
|
// information required by the breach arbiter to recover funds from breached
|
|
|
|
// channels. The information is primarily populated using the BreachRetribution
|
|
|
|
// delivered by the wallet when it detects a channel breach.
|
|
|
|
func newRetributionInfo(chanPoint *wire.OutPoint,
|
2017-11-21 10:56:42 +03:00
|
|
|
breachInfo *lnwallet.BreachRetribution) *retributionInfo {
|
2017-08-22 02:56:58 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// Determine the number of second layer HTLCs we will attempt to sweep.
|
|
|
|
nHtlcs := len(breachInfo.HtlcRetributions)
|
|
|
|
|
|
|
|
// Initialize a slice to hold the outputs we will attempt to sweep. The
|
|
|
|
// maximum capacity of the slice is set to 2+nHtlcs to handle the case
|
|
|
|
// where the local, remote, and all HTLCs are not dust outputs. All
|
|
|
|
// HTLC outputs provided by the wallet are guaranteed to be non-dust,
|
|
|
|
// though the commitment outputs are conditionally added depending on
|
|
|
|
// the nil-ness of their sign descriptors.
|
|
|
|
breachedOutputs := make([]breachedOutput, 0, nHtlcs+2)
|
|
|
|
|
|
|
|
// First, record the breach information for the local channel point if
|
|
|
|
// it is not considered dust, which is signaled by a non-nil sign
|
|
|
|
// descriptor. Here we use CommitmentNoDelay since this output belongs
|
|
|
|
// to us and has no time-based constraints on spending.
|
|
|
|
if breachInfo.LocalOutputSignDesc != nil {
|
|
|
|
localOutput := makeBreachedOutput(
|
|
|
|
&breachInfo.LocalOutpoint,
|
|
|
|
lnwallet.CommitmentNoDelay,
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// No second level script as this is a commitment
|
|
|
|
// output.
|
|
|
|
nil,
|
2017-09-19 02:32:20 +03:00
|
|
|
breachInfo.LocalOutputSignDesc)
|
|
|
|
|
|
|
|
breachedOutputs = append(breachedOutputs, localOutput)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Second, record the same information regarding the remote outpoint,
|
|
|
|
// again if it is not dust, which belongs to the party who tried to
|
|
|
|
// steal our money! Here we set witnessType of the breachedOutput to
|
2017-08-22 02:56:58 +03:00
|
|
|
// CommitmentRevoke, since we will be using a revoke key, withdrawing
|
|
|
|
// the funds from the commitment transaction immediately.
|
2017-09-19 02:32:20 +03:00
|
|
|
if breachInfo.RemoteOutputSignDesc != nil {
|
|
|
|
remoteOutput := makeBreachedOutput(
|
|
|
|
&breachInfo.RemoteOutpoint,
|
|
|
|
lnwallet.CommitmentRevoke,
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// No second level script as this is a commitment
|
|
|
|
// output.
|
|
|
|
nil,
|
2017-09-19 02:32:20 +03:00
|
|
|
breachInfo.RemoteOutputSignDesc)
|
2017-08-22 02:56:58 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
breachedOutputs = append(breachedOutputs, remoteOutput)
|
|
|
|
}
|
2017-08-22 02:56:58 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// Lastly, for each of the breached HTLC outputs, record each as a
|
|
|
|
// breached output with the appropriate witness type based on its
|
|
|
|
// directionality. All HTLC outputs provided by the wallet are assumed
|
|
|
|
// to be non-dust.
|
2017-08-22 02:56:58 +03:00
|
|
|
for i, breachedHtlc := range breachInfo.HtlcRetributions {
|
2017-09-01 13:11:14 +03:00
|
|
|
// Using the breachedHtlc's incoming flag, determine the
|
|
|
|
// appropriate witness type that needs to be generated in order
|
|
|
|
// to sweep the HTLC output.
|
|
|
|
var htlcWitnessType lnwallet.WitnessType
|
|
|
|
if breachedHtlc.IsIncoming {
|
|
|
|
htlcWitnessType = lnwallet.HtlcAcceptedRevoke
|
|
|
|
} else {
|
|
|
|
htlcWitnessType = lnwallet.HtlcOfferedRevoke
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
htlcOutput := makeBreachedOutput(
|
|
|
|
&breachInfo.HtlcRetributions[i].OutPoint,
|
|
|
|
htlcWitnessType,
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
breachInfo.HtlcRetributions[i].SecondLevelWitnessScript,
|
2017-09-01 13:11:14 +03:00
|
|
|
&breachInfo.HtlcRetributions[i].SignDesc)
|
2017-09-19 02:32:20 +03:00
|
|
|
|
|
|
|
breachedOutputs = append(breachedOutputs, htlcOutput)
|
2017-08-22 02:56:58 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
return &retributionInfo{
|
2017-09-19 02:32:20 +03:00
|
|
|
commitHash: breachInfo.BreachTransaction.TxHash(),
|
2017-11-21 10:56:42 +03:00
|
|
|
chainHash: breachInfo.ChainHash,
|
2017-09-19 02:32:20 +03:00
|
|
|
chanPoint: *chanPoint,
|
|
|
|
breachedOutputs: breachedOutputs,
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
breachHeight: breachInfo.BreachHeight,
|
2017-08-22 02:56:58 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-11-29 06:43:57 +03:00
|
|
|
// createJusticeTx creates a transaction which exacts "justice" by sweeping ALL
|
|
|
|
// the funds within the channel which we are now entitled to due to a breach of
|
2017-01-13 08:01:50 +03:00
|
|
|
// the channel's contract by the counterparty. This function returns a *fully*
|
2016-11-29 06:43:57 +03:00
|
|
|
// signed transaction with the witness for each input fully in place.
|
2017-07-26 08:57:29 +03:00
|
|
|
func (b *breachArbiter) createJusticeTx(
|
|
|
|
r *retributionInfo) (*wire.MsgTx, error) {
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// We will assemble the breached outputs into a slice of spendable
|
|
|
|
// outputs, while simultaneously computing the estimated weight of the
|
|
|
|
// transaction.
|
|
|
|
var (
|
|
|
|
spendableOutputs []SpendableOutput
|
2017-09-26 06:13:53 +03:00
|
|
|
weightEstimate lnwallet.TxWeightEstimator
|
2017-09-19 02:32:20 +03:00
|
|
|
)
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// Allocate enough space to potentially hold each of the breached
|
|
|
|
// outputs in the retribution info.
|
|
|
|
spendableOutputs = make([]SpendableOutput, 0, len(r.breachedOutputs))
|
|
|
|
|
|
|
|
// The justice transaction we construct will be a segwit transaction
|
|
|
|
// that pays to a p2wkh output. Components such as the version,
|
2017-09-26 06:13:53 +03:00
|
|
|
// nLockTime, and output are already included in the TxWeightEstimator.
|
|
|
|
weightEstimate.AddP2WKHOutput()
|
2017-09-01 13:11:14 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
// Next, we iterate over the breached outputs contained in the
|
|
|
|
// retribution info. For each, we switch over the witness type such
|
|
|
|
// that we contribute the appropriate weight for each input and witness,
|
|
|
|
// finally adding to our list of spendable outputs.
|
|
|
|
for i := range r.breachedOutputs {
|
|
|
|
// Grab locally scoped reference to breached output.
|
|
|
|
input := &r.breachedOutputs[i]
|
|
|
|
|
|
|
|
// First, select the appropriate estimated witness weight for
|
|
|
|
// the give witness type of this breached output. If the witness
|
|
|
|
// type is unrecognized, we will omit it from the transaction.
|
2017-09-26 06:13:53 +03:00
|
|
|
var witnessWeight int
|
2017-09-19 02:32:20 +03:00
|
|
|
switch input.WitnessType() {
|
|
|
|
case lnwallet.CommitmentNoDelay:
|
2018-01-23 04:05:09 +03:00
|
|
|
witnessWeight = lnwallet.P2WKHWitnessSize
|
2017-09-19 02:32:20 +03:00
|
|
|
|
|
|
|
case lnwallet.CommitmentRevoke:
|
2018-01-23 04:05:09 +03:00
|
|
|
witnessWeight = lnwallet.ToLocalPenaltyWitnessSize
|
2017-09-19 02:32:20 +03:00
|
|
|
|
2017-09-01 13:11:14 +03:00
|
|
|
case lnwallet.HtlcOfferedRevoke:
|
2017-09-19 02:32:20 +03:00
|
|
|
witnessWeight = lnwallet.OfferedHtlcPenaltyWitnessSize
|
|
|
|
|
2017-09-01 13:11:14 +03:00
|
|
|
case lnwallet.HtlcAcceptedRevoke:
|
2017-09-19 02:32:20 +03:00
|
|
|
witnessWeight = lnwallet.AcceptedHtlcPenaltyWitnessSize
|
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
case lnwallet.HtlcSecondLevelRevoke:
|
|
|
|
witnessWeight = lnwallet.SecondLevelHtlcPenaltyWitnessSize
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
default:
|
|
|
|
brarLog.Warnf("breached output in retribution info "+
|
|
|
|
"contains unexpected witness type: %v",
|
|
|
|
input.WitnessType())
|
|
|
|
continue
|
2017-09-01 13:11:14 +03:00
|
|
|
}
|
2017-09-26 06:13:53 +03:00
|
|
|
weightEstimate.AddWitnessInput(witnessWeight)
|
2017-09-19 02:32:20 +03:00
|
|
|
|
|
|
|
// Finally, append this input to our list of spendable outputs.
|
|
|
|
spendableOutputs = append(spendableOutputs, input)
|
2017-09-01 13:11:14 +03:00
|
|
|
}
|
2016-11-29 06:43:57 +03:00
|
|
|
|
2018-02-13 17:06:41 +03:00
|
|
|
txVSize := int64(weightEstimate.VSize())
|
|
|
|
return b.sweepSpendableOutputsTxn(txVSize, spendableOutputs...)
|
2016-11-29 06:43:57 +03:00
|
|
|
}
|
2017-07-31 03:45:39 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// sweepSpendableOutputsTxn creates a signed transaction from a sequence of
|
|
|
|
// spendable outputs by sweeping the funds into a single p2wkh output.
|
2018-02-13 17:06:41 +03:00
|
|
|
func (b *breachArbiter) sweepSpendableOutputsTxn(txVSize int64,
|
2017-08-22 02:56:58 +03:00
|
|
|
inputs ...SpendableOutput) (*wire.MsgTx, error) {
|
|
|
|
|
|
|
|
// First, we obtain a new public key script from the wallet which we'll
|
|
|
|
// sweep the funds to.
|
|
|
|
// TODO(roasbeef): possibly create many outputs to minimize change in
|
|
|
|
// the future?
|
2017-09-01 13:11:14 +03:00
|
|
|
pkScript, err := b.cfg.GenSweepScript()
|
2017-07-31 03:45:39 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Compute the total amount contained in the inputs.
|
|
|
|
var totalAmt btcutil.Amount
|
|
|
|
for _, input := range inputs {
|
|
|
|
totalAmt += input.Amount()
|
2017-07-31 03:45:39 +03:00
|
|
|
}
|
|
|
|
|
2017-11-23 22:41:20 +03:00
|
|
|
// We'll actually attempt to target inclusion within the next two
|
|
|
|
// blocks as we'd like to sweep these funds back into our wallet ASAP.
|
2018-02-13 17:06:41 +03:00
|
|
|
feePerVSize, err := b.cfg.Estimator.EstimateFeePerVSize(2)
|
2017-11-23 22:41:20 +03:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2018-02-13 17:06:41 +03:00
|
|
|
txFee := feePerVSize.FeeForVSize(txVSize)
|
2017-08-22 02:56:58 +03:00
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
// TODO(roasbeef): already start to siphon their funds into fees
|
2017-08-22 02:56:58 +03:00
|
|
|
sweepAmt := int64(totalAmt - txFee)
|
|
|
|
|
|
|
|
// With the fee calculated, we can now create the transaction using the
|
|
|
|
// information gathered above and the provided retribution information.
|
2017-09-01 13:11:14 +03:00
|
|
|
txn := wire.NewMsgTx(2)
|
2017-08-22 02:56:58 +03:00
|
|
|
|
|
|
|
// We begin by adding the output to which our funds will be deposited.
|
|
|
|
txn.AddTxOut(&wire.TxOut{
|
|
|
|
PkScript: pkScript,
|
|
|
|
Value: sweepAmt,
|
2017-07-31 03:45:39 +03:00
|
|
|
})
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Next, we add all of the spendable outputs as inputs to the
|
|
|
|
// transaction.
|
|
|
|
for _, input := range inputs {
|
|
|
|
txn.AddTxIn(&wire.TxIn{
|
|
|
|
PreviousOutPoint: *input.OutPoint(),
|
|
|
|
})
|
2017-07-31 03:45:39 +03:00
|
|
|
}
|
|
|
|
|
2017-08-30 05:07:52 +03:00
|
|
|
// Before signing the transaction, check to ensure that it meets some
|
|
|
|
// basic validity requirements.
|
|
|
|
btx := btcutil.NewTx(txn)
|
|
|
|
if err := blockchain.CheckTransactionSanity(btx); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Create a sighash cache to improve the performance of hashing and
|
|
|
|
// signing SigHashAll inputs.
|
|
|
|
hashCache := txscript.NewTxSigHashes(txn)
|
|
|
|
|
|
|
|
// Create a closure that encapsulates the process of initializing a
|
|
|
|
// particular output's witness generation function, computing the
|
|
|
|
// witness, and attaching it to the transaction. This function accepts
|
|
|
|
// an integer index representing the intended txin index, and the
|
|
|
|
// breached output from which it will spend.
|
|
|
|
addWitness := func(idx int, so SpendableOutput) error {
|
|
|
|
// First, we construct a valid witness for this outpoint and
|
|
|
|
// transaction using the SpendableOutput's witness generation
|
|
|
|
// function.
|
2017-09-20 03:30:36 +03:00
|
|
|
witness, err := so.BuildWitness(b.cfg.Signer, txn, hashCache,
|
|
|
|
idx)
|
2017-08-22 02:56:58 +03:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2017-07-31 03:45:39 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Then, we add the witness to the transaction at the
|
|
|
|
// appropriate txin index.
|
|
|
|
txn.TxIn[idx].Witness = witness
|
2017-07-31 03:45:39 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
return nil
|
|
|
|
}
|
2017-07-31 03:45:39 +03:00
|
|
|
|
2017-08-22 02:56:58 +03:00
|
|
|
// Finally, generate a witness for each output and attach it to the
|
|
|
|
// transaction.
|
|
|
|
for i, input := range inputs {
|
|
|
|
if err := addWitness(i, input); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return txn, nil
|
2017-07-31 03:45:39 +03:00
|
|
|
}
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// RetributionStore provides an interface for managing a persistent map from
|
|
|
|
// wire.OutPoint -> retributionInfo. Upon learning of a breach, a BreachArbiter
|
|
|
|
// should record the retributionInfo for the breached channel, which serves a
|
|
|
|
// checkpoint in the event that retribution needs to be resumed after failure.
|
|
|
|
// A RetributionStore provides an interface for managing the persisted set, as
|
|
|
|
// well as mapping user defined functions over the entire on-disk contents.
|
|
|
|
//
|
|
|
|
// Calls to RetributionStore may occur concurrently. A concrete instance of
|
|
|
|
// RetributionStore should use appropriate synchronization primitives, or
|
|
|
|
// be otherwise safe for concurrent access.
|
|
|
|
type RetributionStore interface {
|
|
|
|
// Add persists the retributionInfo to disk, using the information's
|
|
|
|
// chanPoint as the key. This method should overwrite any existing
|
2017-12-18 05:40:05 +03:00
|
|
|
// entries found under the same key, and an error should be raised if
|
2017-07-26 08:57:29 +03:00
|
|
|
// the addition fails.
|
|
|
|
Add(retInfo *retributionInfo) error
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// IsBreached queries the retribution store to see if the breach arbiter
|
|
|
|
// is aware of any breaches for the provided channel point.
|
|
|
|
IsBreached(chanPoint *wire.OutPoint) (bool, error)
|
|
|
|
|
|
|
|
// Finalize persists the finalized justice transaction for a particular
|
|
|
|
// channel.
|
|
|
|
Finalize(chanPoint *wire.OutPoint, finalTx *wire.MsgTx) error
|
|
|
|
|
|
|
|
// GetFinalizedTxn loads the finalized justice transaction, if any, from
|
|
|
|
// the retribution store. The finalized transaction will be nil if
|
|
|
|
// Finalize has not yet been called for this channel point.
|
|
|
|
GetFinalizedTxn(chanPoint *wire.OutPoint) (*wire.MsgTx, error)
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// Remove deletes the retributionInfo from disk, if any exists, under
|
|
|
|
// the given key. An error should be re raised if the removal fails.
|
|
|
|
Remove(key *wire.OutPoint) error
|
|
|
|
|
|
|
|
// ForAll iterates over the existing on-disk contents and applies a
|
|
|
|
// chosen, read-only callback to each. This method should ensure that it
|
|
|
|
// immediately propagate any errors generated by the callback.
|
|
|
|
ForAll(cb func(*retributionInfo) error) error
|
2017-05-07 14:09:22 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// retributionStore handles persistence of retribution states to disk and is
|
|
|
|
// backed by a boltdb bucket. The primary responsibility of the retribution
|
|
|
|
// store is to ensure that we can recover from a restart in the middle of a
|
|
|
|
// breached contract retribution.
|
|
|
|
type retributionStore struct {
|
|
|
|
db *channeldb.DB
|
|
|
|
}
|
|
|
|
|
|
|
|
// newRetributionStore creates a new instance of a retributionStore.
|
|
|
|
func newRetributionStore(db *channeldb.DB) *retributionStore {
|
|
|
|
return &retributionStore{
|
|
|
|
db: db,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Add adds a retribution state to the retributionStore, which is then persisted
|
|
|
|
// to disk.
|
2017-07-26 06:14:03 +03:00
|
|
|
func (rs *retributionStore) Add(ret *retributionInfo) error {
|
2017-05-07 14:09:22 +03:00
|
|
|
return rs.db.Update(func(tx *bolt.Tx) error {
|
2017-07-26 08:57:29 +03:00
|
|
|
// If this is our first contract breach, the retributionBucket
|
|
|
|
// won't exist, in which case, we just create a new bucket.
|
2017-05-07 14:09:22 +03:00
|
|
|
retBucket, err := tx.CreateBucketIfNotExists(retributionBucket)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
var outBuf bytes.Buffer
|
2017-07-26 06:39:59 +03:00
|
|
|
if err := writeOutpoint(&outBuf, &ret.chanPoint); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
var retBuf bytes.Buffer
|
|
|
|
if err := ret.Encode(&retBuf); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-08-15 01:14:43 +03:00
|
|
|
return retBucket.Put(outBuf.Bytes(), retBuf.Bytes())
|
2017-05-07 14:09:22 +03:00
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// Finalize writes a signed justice transaction to the retribution store. This
|
|
|
|
// is done before publishing the transaction, so that we can recover the txid on
|
|
|
|
// startup and re-register for confirmation notifications.
|
|
|
|
func (rs *retributionStore) Finalize(chanPoint *wire.OutPoint,
|
|
|
|
finalTx *wire.MsgTx) error {
|
|
|
|
return rs.db.Update(func(tx *bolt.Tx) error {
|
|
|
|
justiceBkt, err := tx.CreateBucketIfNotExists(justiceTxnBucket)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
var chanBuf bytes.Buffer
|
|
|
|
if err := writeOutpoint(&chanBuf, chanPoint); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
var txBuf bytes.Buffer
|
|
|
|
if err := finalTx.Serialize(&txBuf); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return justiceBkt.Put(chanBuf.Bytes(), txBuf.Bytes())
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetFinalizedTxn loads the finalized justice transaction for the provided
|
|
|
|
// channel point. The finalized transaction will be nil if Finalize has yet to
|
|
|
|
// be called for this channel point.
|
|
|
|
func (rs *retributionStore) GetFinalizedTxn(
|
|
|
|
chanPoint *wire.OutPoint) (*wire.MsgTx, error) {
|
|
|
|
|
|
|
|
var finalTxBytes []byte
|
|
|
|
if err := rs.db.View(func(tx *bolt.Tx) error {
|
|
|
|
justiceBkt := tx.Bucket(justiceTxnBucket)
|
|
|
|
if justiceBkt == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
var chanBuf bytes.Buffer
|
|
|
|
if err := writeOutpoint(&chanBuf, chanPoint); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
finalTxBytes = justiceBkt.Get(chanBuf.Bytes())
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if finalTxBytes == nil {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
finalTx := &wire.MsgTx{}
|
|
|
|
err := finalTx.Deserialize(bytes.NewReader(finalTxBytes))
|
|
|
|
|
|
|
|
return finalTx, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsBreached queries the retribution store to discern if this channel was
|
|
|
|
// previously breached. This is used when connecting to a peer to determine if
|
|
|
|
// it is safe to add a link to the htlcswitch, as we should never add a channel
|
|
|
|
// that has already been breached.
|
|
|
|
func (rs *retributionStore) IsBreached(chanPoint *wire.OutPoint) (bool, error) {
|
|
|
|
var found bool
|
|
|
|
err := rs.db.View(func(tx *bolt.Tx) error {
|
|
|
|
retBucket := tx.Bucket(retributionBucket)
|
|
|
|
if retBucket == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
var chanBuf bytes.Buffer
|
|
|
|
if err := writeOutpoint(&chanBuf, chanPoint); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
retInfo := retBucket.Get(chanBuf.Bytes())
|
|
|
|
if retInfo != nil {
|
|
|
|
found = true
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
})
|
|
|
|
|
|
|
|
return found, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Remove removes a retribution state and finalized justice transaction by
|
|
|
|
// channel point from the retribution store.
|
|
|
|
func (rs *retributionStore) Remove(chanPoint *wire.OutPoint) error {
|
2017-05-07 14:09:22 +03:00
|
|
|
return rs.db.Update(func(tx *bolt.Tx) error {
|
|
|
|
retBucket := tx.Bucket(retributionBucket)
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// We return an error if the bucket is not already created,
|
|
|
|
// since normal operation of the breach arbiter should never try
|
|
|
|
// to remove a finalized retribution state that is not already
|
|
|
|
// stored in the db.
|
2017-05-07 14:09:22 +03:00
|
|
|
if retBucket == nil {
|
2017-07-26 08:57:29 +03:00
|
|
|
return errors.New("unable to remove retribution " +
|
2017-11-21 10:56:42 +03:00
|
|
|
"because the retribution bucket doesn't exist.")
|
2017-05-07 14:09:22 +03:00
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
// Serialize the channel point we are intending to remove.
|
|
|
|
var chanBuf bytes.Buffer
|
|
|
|
if err := writeOutpoint(&chanBuf, chanPoint); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
2017-11-21 10:56:42 +03:00
|
|
|
chanBytes := chanBuf.Bytes()
|
|
|
|
|
|
|
|
// Remove the persisted retribution info and finalized justice
|
|
|
|
// transaction.
|
|
|
|
if err := retBucket.Delete(chanBytes); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// If we have not finalized this channel breach, we can exit
|
|
|
|
// early.
|
|
|
|
justiceBkt := tx.Bucket(justiceTxnBucket)
|
|
|
|
if justiceBkt == nil {
|
|
|
|
return nil
|
|
|
|
}
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
return justiceBkt.Delete(chanBytes)
|
2017-05-07 14:09:22 +03:00
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
// ForAll iterates through all stored retributions and executes the passed
|
|
|
|
// callback function on each retribution.
|
2017-07-26 06:14:03 +03:00
|
|
|
func (rs *retributionStore) ForAll(cb func(*retributionInfo) error) error {
|
2017-05-07 14:09:22 +03:00
|
|
|
return rs.db.View(func(tx *bolt.Tx) error {
|
2017-07-26 08:57:29 +03:00
|
|
|
// If the bucket does not exist, then there are no pending
|
|
|
|
// retributions.
|
2017-05-07 14:09:22 +03:00
|
|
|
retBucket := tx.Bucket(retributionBucket)
|
|
|
|
if retBucket == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-07-26 08:57:29 +03:00
|
|
|
// Otherwise, we fetch each serialized retribution info,
|
|
|
|
// deserialize it, and execute the passed in callback function
|
|
|
|
// on it.
|
2017-11-21 10:56:42 +03:00
|
|
|
return retBucket.ForEach(func(_, retBytes []byte) error {
|
2017-07-26 06:14:03 +03:00
|
|
|
ret := &retributionInfo{}
|
2017-11-21 10:56:42 +03:00
|
|
|
err := ret.Decode(bytes.NewBuffer(retBytes))
|
|
|
|
if err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return cb(ret)
|
|
|
|
})
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
// Encode serializes the retribution into the passed byte stream.
|
2017-07-26 06:14:03 +03:00
|
|
|
func (ret *retributionInfo) Encode(w io.Writer) error {
|
2017-11-21 10:56:42 +03:00
|
|
|
var scratch [4]byte
|
2017-07-26 08:57:29 +03:00
|
|
|
|
2017-05-07 14:09:22 +03:00
|
|
|
if _, err := w.Write(ret.commitHash[:]); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-07-26 06:39:59 +03:00
|
|
|
if err := writeOutpoint(w, &ret.chanPoint); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-11-11 02:23:02 +03:00
|
|
|
if _, err := w.Write(ret.chainHash[:]); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
binary.BigEndian.PutUint32(scratch[:], ret.breachHeight)
|
|
|
|
if _, err := w.Write(scratch[:]); err != nil {
|
2017-07-26 08:57:29 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
nOutputs := len(ret.breachedOutputs)
|
|
|
|
if err := wire.WriteVarInt(w, 0, uint64(nOutputs)); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
for _, output := range ret.breachedOutputs {
|
|
|
|
if err := output.Encode(w); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Dencode deserializes a retribution from the passed byte stream.
|
2017-07-26 06:14:03 +03:00
|
|
|
func (ret *retributionInfo) Decode(r io.Reader) error {
|
2017-11-21 10:56:42 +03:00
|
|
|
var scratch [32]byte
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
if _, err := io.ReadFull(r, scratch[:]); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
2017-11-21 10:56:42 +03:00
|
|
|
hash, err := chainhash.NewHash(scratch[:])
|
2017-05-07 14:09:22 +03:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
ret.commitHash = *hash
|
|
|
|
|
2017-07-26 06:39:59 +03:00
|
|
|
if err := readOutpoint(r, &ret.chanPoint); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
if _, err := io.ReadFull(r, scratch[:]); err != nil {
|
2017-11-11 02:23:02 +03:00
|
|
|
return err
|
|
|
|
}
|
2017-11-21 10:56:42 +03:00
|
|
|
chainHash, err := chainhash.NewHash(scratch[:])
|
2017-11-11 02:23:02 +03:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
ret.chainHash = *chainHash
|
|
|
|
|
2017-11-21 10:56:42 +03:00
|
|
|
if _, err := io.ReadFull(r, scratch[:4]); err != nil {
|
2017-07-26 08:57:29 +03:00
|
|
|
return err
|
|
|
|
}
|
2017-11-21 10:56:42 +03:00
|
|
|
ret.breachHeight = binary.BigEndian.Uint32(scratch[:4])
|
2017-07-26 08:57:29 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
nOutputsU64, err := wire.ReadVarInt(r, 0)
|
2017-05-07 14:09:22 +03:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2017-09-19 02:32:20 +03:00
|
|
|
nOutputs := int(nOutputsU64)
|
2017-05-07 14:09:22 +03:00
|
|
|
|
2017-09-19 02:32:20 +03:00
|
|
|
ret.breachedOutputs = make([]breachedOutput, nOutputs)
|
|
|
|
for i := range ret.breachedOutputs {
|
|
|
|
if err := ret.breachedOutputs[i].Decode(r); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Encode serializes a breachedOutput into the passed byte stream.
|
|
|
|
func (bo *breachedOutput) Encode(w io.Writer) error {
|
|
|
|
var scratch [8]byte
|
|
|
|
|
|
|
|
binary.BigEndian.PutUint64(scratch[:8], uint64(bo.amt))
|
|
|
|
if _, err := w.Write(scratch[:8]); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-07-26 06:39:59 +03:00
|
|
|
if err := writeOutpoint(w, &bo.outpoint); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
err := lnwallet.WriteSignDescriptor(w, &bo.signDesc)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
err = wire.WriteVarBytes(w, 0, bo.secondLevelWitnessScript)
|
|
|
|
if err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
binary.BigEndian.PutUint16(scratch[:2], uint16(bo.witnessType))
|
|
|
|
if _, err := w.Write(scratch[:2]); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Decode deserializes a breachedOutput from the passed byte stream.
|
|
|
|
func (bo *breachedOutput) Decode(r io.Reader) error {
|
|
|
|
var scratch [8]byte
|
|
|
|
|
|
|
|
if _, err := io.ReadFull(r, scratch[:8]); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
bo.amt = btcutil.Amount(binary.BigEndian.Uint64(scratch[:8]))
|
|
|
|
|
2017-07-26 06:39:59 +03:00
|
|
|
if err := readOutpoint(r, &bo.outpoint); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-09-01 13:11:14 +03:00
|
|
|
if err := lnwallet.ReadSignDescriptor(r, &bo.signDesc); err != nil {
|
2017-05-07 14:09:22 +03:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
wScript, err := wire.ReadVarBytes(r, 0, 1000, "witness script")
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
bo.secondLevelWitnessScript = wScript
|
|
|
|
|
2017-05-07 14:09:22 +03:00
|
|
|
if _, err := io.ReadFull(r, scratch[:2]); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2017-07-26 08:57:29 +03:00
|
|
|
bo.witnessType = lnwallet.WitnessType(
|
breacharbiter: properly account for second-level spends during breach remedy
In this commit, we address an un accounted for case during the breach
remedy process. If the remote node actually went directly to the second
layer during a channel breach attempt, then we wouldn’t properly be
able to sweep with out justice transaction, as some HTLC inputs may
actually be spent at that point.
In order to address this case, we’ll now catch the transaction
rejection, then check to see which input was spent, promote that to a
second level spend, and repeat as necessary. At the end of this loop,
any inputs which have been spent to the second level will have had the
prevouts and witnesses updated.
In order to perform this transition, we now also store the second level
witness script in the database. This allow us to modify the sign desc
with the proper input value, as well as witness script.
2018-01-23 04:11:02 +03:00
|
|
|
binary.BigEndian.Uint16(scratch[:2]),
|
|
|
|
)
|
2017-05-07 14:09:22 +03:00
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|