Randomize secp contexts for marginally better sidechannel resistance
[rust-lightning] / lightning / src / chain / channelmonitor.rs
index 83b57c8e566fa859ba0967df3ed3d644d8b0fbbc..a830c8216a6a4e8fe0e631763380ea12b05836ee 100644 (file)
@@ -22,7 +22,7 @@
 //!
 //! [`chain::Watch`]: ../trait.Watch.html
 
-use bitcoin::blockdata::block::BlockHeader;
+use bitcoin::blockdata::block::{Block, BlockHeader};
 use bitcoin::blockdata::transaction::{TxOut,Transaction};
 use bitcoin::blockdata::transaction::OutPoint as BitcoinOutPoint;
 use bitcoin::blockdata::script::{Script, Builder};
@@ -41,14 +41,16 @@ use ln::chan_utils;
 use ln::chan_utils::{CounterpartyCommitmentSecrets, HTLCOutputInCommitment, HTLCType, ChannelTransactionParameters, HolderCommitmentTransaction};
 use ln::channelmanager::{HTLCSource, PaymentPreimage, PaymentHash};
 use ln::onchaintx::{OnchainTxHandler, InputDescriptors};
+use chain;
 use chain::chaininterface::{BroadcasterInterface, FeeEstimator};
 use chain::transaction::{OutPoint, TransactionData};
-use chain::keysinterface::{SpendableOutputDescriptor, StaticPaymentOutputDescriptor, DelayedPaymentOutputDescriptor, ChannelKeys, KeysInterface};
+use chain::keysinterface::{SpendableOutputDescriptor, StaticPaymentOutputDescriptor, DelayedPaymentOutputDescriptor, Sign, KeysInterface};
 use util::logger::Logger;
 use util::ser::{Readable, ReadableArgs, MaybeReadable, Writer, Writeable, U48};
 use util::byte_utils;
 use util::events::Event;
 
+use std::cell::RefCell;
 use std::collections::{HashMap, HashSet, hash_map};
 use std::{cmp, mem};
 use std::ops::Deref;
@@ -623,7 +625,7 @@ impl Readable for ChannelMonitorUpdateStep {
 /// the "reorg path" (ie disconnecting blocks until you find a common ancestor from both the
 /// returned block hash and the the current chain and then reconnecting blocks to get to the
 /// best chain) upon deserializing the object!
-pub struct ChannelMonitor<ChanSigner: ChannelKeys> {
+pub struct ChannelMonitor<Signer: Sign> {
        latest_update_id: u64,
        commitment_transaction_number_obscure_factor: u64,
 
@@ -691,9 +693,9 @@ pub struct ChannelMonitor<ChanSigner: ChannelKeys> {
        outputs_to_watch: HashMap<Txid, Vec<(u32, Script)>>,
 
        #[cfg(test)]
-       pub onchain_tx_handler: OnchainTxHandler<ChanSigner>,
+       pub onchain_tx_handler: OnchainTxHandler<Signer>,
        #[cfg(not(test))]
-       onchain_tx_handler: OnchainTxHandler<ChanSigner>,
+       onchain_tx_handler: OnchainTxHandler<Signer>,
 
        // This is set when the Channel[Manager] generated a ChannelMonitorUpdate which indicated the
        // channel has been force-closed. After this is set, no further holder commitment transaction
@@ -721,7 +723,7 @@ pub struct ChannelMonitor<ChanSigner: ChannelKeys> {
 #[cfg(any(test, feature = "fuzztarget", feature = "_test_utils"))]
 /// Used only in testing and fuzztarget to check serialization roundtrips don't change the
 /// underlying object
-impl<ChanSigner: ChannelKeys> PartialEq for ChannelMonitor<ChanSigner> {
+impl<Signer: Sign> PartialEq for ChannelMonitor<Signer> {
        fn eq(&self, other: &Self) -> bool {
                if self.latest_update_id != other.latest_update_id ||
                        self.commitment_transaction_number_obscure_factor != other.commitment_transaction_number_obscure_factor ||
@@ -761,7 +763,7 @@ impl<ChanSigner: ChannelKeys> PartialEq for ChannelMonitor<ChanSigner> {
        }
 }
 
-impl<ChanSigner: ChannelKeys> Writeable for ChannelMonitor<ChanSigner> {
+impl<Signer: Sign> Writeable for ChannelMonitor<Signer> {
        fn write<W: Writer>(&self, writer: &mut W) -> Result<(), Error> {
                //TODO: We still write out all the serialization here manually instead of using the fancy
                //serialization framework we have, we should migrate things over to it.
@@ -948,13 +950,13 @@ impl<ChanSigner: ChannelKeys> Writeable for ChannelMonitor<ChanSigner> {
        }
 }
 
-impl<ChanSigner: ChannelKeys> ChannelMonitor<ChanSigner> {
-       pub(crate) fn new(keys: ChanSigner, shutdown_pubkey: &PublicKey,
+impl<Signer: Sign> ChannelMonitor<Signer> {
+       pub(crate) fn new(secp_ctx: Secp256k1<secp256k1::All>, keys: Signer, shutdown_pubkey: &PublicKey,
                          on_counterparty_tx_csv: u16, destination_script: &Script, funding_info: (OutPoint, Script),
                          channel_parameters: &ChannelTransactionParameters,
                          funding_redeemscript: Script, channel_value_satoshis: u64,
                          commitment_transaction_number_obscure_factor: u64,
-                         initial_holder_commitment_tx: HolderCommitmentTransaction) -> ChannelMonitor<ChanSigner> {
+                         initial_holder_commitment_tx: HolderCommitmentTransaction) -> ChannelMonitor<Signer> {
 
                assert!(commitment_transaction_number_obscure_factor <= (1 << 48));
                let our_channel_close_key_hash = WPubkeyHash::hash(&shutdown_pubkey.serialize());
@@ -970,8 +972,6 @@ impl<ChanSigner: ChannelKeys> ChannelMonitor<ChanSigner> {
                let channel_keys_id = keys.channel_keys_id();
                let holder_revocation_basepoint = keys.pubkeys().revocation_basepoint;
 
-               let secp_ctx = Secp256k1::new();
-
                // block for Rust 1.34 compat
                let (holder_commitment_tx, current_holder_commitment_number) = {
                        let trusted_tx = initial_holder_commitment_tx.trust();
@@ -992,7 +992,8 @@ impl<ChanSigner: ChannelKeys> ChannelMonitor<ChanSigner> {
                };
 
                let onchain_tx_handler =
-                       OnchainTxHandler::new(destination_script.clone(), keys, channel_parameters.clone(), initial_holder_commitment_tx);
+                       OnchainTxHandler::new(destination_script.clone(), keys,
+                       channel_parameters.clone(), initial_holder_commitment_tx, secp_ctx.clone());
 
                let mut outputs_to_watch = HashMap::new();
                outputs_to_watch.insert(funding_info.0.txid, vec![(funding_info.0.index as u32, funding_info.1.clone())]);
@@ -2253,7 +2254,7 @@ impl<ChanSigner: ChannelKeys> ChannelMonitor<ChanSigner> {
 /// transaction and losing money. This is a risk because previous channel states
 /// are toxic, so it's important that whatever channel state is persisted is
 /// kept up-to-date.
-pub trait Persist<Keys: ChannelKeys>: Send + Sync {
+pub trait Persist<ChannelSigner: Sign>: Send + Sync {
        /// Persist a new channel's data. The data can be stored any way you want, but
        /// the identifier provided by Rust-Lightning is the channel's outpoint (and
        /// it is up to you to maintain a correct mapping between the outpoint and the
@@ -2265,7 +2266,7 @@ pub trait Persist<Keys: ChannelKeys>: Send + Sync {
        ///
        /// [`ChannelMonitor::serialize_for_disk`]: struct.ChannelMonitor.html#method.serialize_for_disk
        /// [`ChannelMonitorUpdateErr`]: enum.ChannelMonitorUpdateErr.html
-       fn persist_new_channel(&self, id: OutPoint, data: &ChannelMonitor<Keys>) -> Result<(), ChannelMonitorUpdateErr>;
+       fn persist_new_channel(&self, id: OutPoint, data: &ChannelMonitor<ChannelSigner>) -> Result<(), ChannelMonitorUpdateErr>;
 
        /// Update one channel's data. The provided `ChannelMonitor` has already
        /// applied the given update.
@@ -2294,13 +2295,29 @@ pub trait Persist<Keys: ChannelKeys>: Send + Sync {
        /// [`ChannelMonitor::serialize_for_disk`]: struct.ChannelMonitor.html#method.serialize_for_disk
        /// [`ChannelMonitorUpdate::write`]: struct.ChannelMonitorUpdate.html#method.write
        /// [`ChannelMonitorUpdateErr`]: enum.ChannelMonitorUpdateErr.html
-       fn update_persisted_channel(&self, id: OutPoint, update: &ChannelMonitorUpdate, data: &ChannelMonitor<Keys>) -> Result<(), ChannelMonitorUpdateErr>;
+       fn update_persisted_channel(&self, id: OutPoint, update: &ChannelMonitorUpdate, data: &ChannelMonitor<ChannelSigner>) -> Result<(), ChannelMonitorUpdateErr>;
+}
+
+impl<Signer: Sign, T: Deref, F: Deref, L: Deref> chain::Listen for (RefCell<ChannelMonitor<Signer>>, T, F, L)
+where
+       T::Target: BroadcasterInterface,
+       F::Target: FeeEstimator,
+       L::Target: Logger,
+{
+       fn block_connected(&self, block: &Block, height: u32) {
+               let txdata: Vec<_> = block.txdata.iter().enumerate().collect();
+               self.0.borrow_mut().block_connected(&block.header, &txdata, height, &*self.1, &*self.2, &*self.3);
+       }
+
+       fn block_disconnected(&self, header: &BlockHeader, height: u32) {
+               self.0.borrow_mut().block_disconnected(header, height, &*self.1, &*self.2, &*self.3);
+       }
 }
 
 const MAX_ALLOC_SIZE: usize = 64*1024;
 
-impl<'a, ChanSigner: ChannelKeys, K: KeysInterface<ChanKeySigner = ChanSigner>> ReadableArgs<&'a K>
-               for (BlockHash, ChannelMonitor<ChanSigner>) {
+impl<'a, Signer: Sign, K: KeysInterface<Signer = Signer>> ReadableArgs<&'a K>
+               for (BlockHash, ChannelMonitor<Signer>) {
        fn read<R: ::std::io::Read>(reader: &mut R, keys_manager: &'a K) -> Result<Self, DecodeError> {
                macro_rules! unwrap_obj {
                        ($key: expr) => {
@@ -2540,6 +2557,9 @@ impl<'a, ChanSigner: ChannelKeys, K: KeysInterface<ChanKeySigner = ChanSigner>>
                let lockdown_from_offchain = Readable::read(reader)?;
                let holder_tx_signed = Readable::read(reader)?;
 
+               let mut secp_ctx = Secp256k1::new();
+               secp_ctx.seeded_randomize(&keys_manager.get_secure_random_bytes());
+
                Ok((last_block_hash.clone(), ChannelMonitor {
                        latest_update_id,
                        commitment_transaction_number_obscure_factor,
@@ -2585,7 +2605,7 @@ impl<'a, ChanSigner: ChannelKeys, K: KeysInterface<ChanKeySigner = ChanSigner>>
                        holder_tx_signed,
 
                        last_block_hash,
-                       secp_ctx: Secp256k1::new(),
+                       secp_ctx,
                }))
        }
 }
@@ -2612,7 +2632,7 @@ mod tests {
        use bitcoin::secp256k1::key::{SecretKey,PublicKey};
        use bitcoin::secp256k1::Secp256k1;
        use std::sync::{Arc, Mutex};
-       use chain::keysinterface::InMemoryChannelKeys;
+       use chain::keysinterface::InMemorySigner;
 
        #[test]
        fn test_prune_preimages() {
@@ -2668,7 +2688,7 @@ mod tests {
                        }
                }
 
-               let keys = InMemoryChannelKeys::new(
+               let keys = InMemorySigner::new(
                        &secp_ctx,
                        SecretKey::from_slice(&[41; 32]).unwrap(),
                        SecretKey::from_slice(&[41; 32]).unwrap(),
@@ -2700,7 +2720,7 @@ mod tests {
                };
                // Prune with one old state and a holder commitment tx holding a few overlaps with the
                // old state.
-               let mut monitor = ChannelMonitor::new(keys,
+               let mut monitor = ChannelMonitor::new(Secp256k1::new(), keys,
                                                      &PublicKey::from_secret_key(&secp_ctx, &SecretKey::from_slice(&[42; 32]).unwrap()), 0, &Script::new(),
                                                      (OutPoint { txid: Txid::from_slice(&[43; 32]).unwrap(), index: 0 }, Script::new()),
                                                      &channel_parameters,
@@ -2818,7 +2838,7 @@ mod tests {
                                sign_input!(sighash_parts, idx, 0, inp, sum_actual_sigs);
                        }
                }
-               assert_eq!(base_weight + OnchainTxHandler::<InMemoryChannelKeys>::get_witnesses_weight(&inputs_des[..]),  claim_tx.get_weight() + /* max_length_sig */ (73 * inputs_des.len() - sum_actual_sigs));
+               assert_eq!(base_weight + OnchainTxHandler::<InMemorySigner>::get_witnesses_weight(&inputs_des[..]),  claim_tx.get_weight() + /* max_length_sig */ (73 * inputs_des.len() - sum_actual_sigs));
 
                // Claim tx with 1 offered HTLCs, 3 received HTLCs
                claim_tx.input.clear();
@@ -2842,7 +2862,7 @@ mod tests {
                                sign_input!(sighash_parts, idx, 0, inp, sum_actual_sigs);
                        }
                }
-               assert_eq!(base_weight + OnchainTxHandler::<InMemoryChannelKeys>::get_witnesses_weight(&inputs_des[..]),  claim_tx.get_weight() + /* max_length_sig */ (73 * inputs_des.len() - sum_actual_sigs));
+               assert_eq!(base_weight + OnchainTxHandler::<InMemorySigner>::get_witnesses_weight(&inputs_des[..]),  claim_tx.get_weight() + /* max_length_sig */ (73 * inputs_des.len() - sum_actual_sigs));
 
                // Justice tx with 1 revoked HTLC-Success tx output
                claim_tx.input.clear();
@@ -2864,7 +2884,7 @@ mod tests {
                                sign_input!(sighash_parts, idx, 0, inp, sum_actual_sigs);
                        }
                }
-               assert_eq!(base_weight + OnchainTxHandler::<InMemoryChannelKeys>::get_witnesses_weight(&inputs_des[..]), claim_tx.get_weight() + /* max_length_isg */ (73 * inputs_des.len() - sum_actual_sigs));
+               assert_eq!(base_weight + OnchainTxHandler::<InMemorySigner>::get_witnesses_weight(&inputs_des[..]), claim_tx.get_weight() + /* max_length_isg */ (73 * inputs_des.len() - sum_actual_sigs));
        }
 
        // Further testing is done in the ChannelManager integration tests.