Randomize secp contexts for marginally better sidechannel resistance
[rust-lightning] / lightning / src / chain / channelmonitor.rs
index b46a2df13eea8d8c462e1df72dd6dca9fac2b45f..a830c8216a6a4e8fe0e631763380ea12b05836ee 100644 (file)
@@ -22,7 +22,7 @@
 //!
 //! [`chain::Watch`]: ../trait.Watch.html
 
-use bitcoin::blockdata::block::BlockHeader;
+use bitcoin::blockdata::block::{Block, BlockHeader};
 use bitcoin::blockdata::transaction::{TxOut,Transaction};
 use bitcoin::blockdata::transaction::OutPoint as BitcoinOutPoint;
 use bitcoin::blockdata::script::{Script, Builder};
@@ -41,14 +41,16 @@ use ln::chan_utils;
 use ln::chan_utils::{CounterpartyCommitmentSecrets, HTLCOutputInCommitment, HTLCType, ChannelTransactionParameters, HolderCommitmentTransaction};
 use ln::channelmanager::{HTLCSource, PaymentPreimage, PaymentHash};
 use ln::onchaintx::{OnchainTxHandler, InputDescriptors};
+use chain;
 use chain::chaininterface::{BroadcasterInterface, FeeEstimator};
 use chain::transaction::{OutPoint, TransactionData};
-use chain::keysinterface::{SpendableOutputDescriptor, ChannelKeys, KeysInterface};
+use chain::keysinterface::{SpendableOutputDescriptor, StaticPaymentOutputDescriptor, DelayedPaymentOutputDescriptor, Sign, KeysInterface};
 use util::logger::Logger;
 use util::ser::{Readable, ReadableArgs, MaybeReadable, Writer, Writeable, U48};
 use util::byte_utils;
 use util::events::Event;
 
+use std::cell::RefCell;
 use std::collections::{HashMap, HashSet, hash_map};
 use std::{cmp, mem};
 use std::ops::Deref;
@@ -174,7 +176,7 @@ pub enum ChannelMonitorUpdateErr {
 /// means you tried to update a monitor for a different channel or the ChannelMonitorUpdate was
 /// corrupted.
 /// Contains a developer-readable error message.
-#[derive(Debug)]
+#[derive(Clone, Debug)]
 pub struct MonitorUpdateError(pub &'static str);
 
 /// An event to be processed by the ChannelManager.
@@ -623,7 +625,7 @@ impl Readable for ChannelMonitorUpdateStep {
 /// the "reorg path" (ie disconnecting blocks until you find a common ancestor from both the
 /// returned block hash and the the current chain and then reconnecting blocks to get to the
 /// best chain) upon deserializing the object!
-pub struct ChannelMonitor<ChanSigner: ChannelKeys> {
+pub struct ChannelMonitor<Signer: Sign> {
        latest_update_id: u64,
        commitment_transaction_number_obscure_factor: u64,
 
@@ -632,7 +634,7 @@ pub struct ChannelMonitor<ChanSigner: ChannelKeys> {
        counterparty_payment_script: Script,
        shutdown_script: Script,
 
-       key_derivation_params: (u64, u64),
+       channel_keys_id: [u8; 32],
        holder_revocation_basepoint: PublicKey,
        funding_info: (OutPoint, Script),
        current_counterparty_commitment_txid: Option<Txid>,
@@ -691,9 +693,9 @@ pub struct ChannelMonitor<ChanSigner: ChannelKeys> {
        outputs_to_watch: HashMap<Txid, Vec<(u32, Script)>>,
 
        #[cfg(test)]
-       pub onchain_tx_handler: OnchainTxHandler<ChanSigner>,
+       pub onchain_tx_handler: OnchainTxHandler<Signer>,
        #[cfg(not(test))]
-       onchain_tx_handler: OnchainTxHandler<ChanSigner>,
+       onchain_tx_handler: OnchainTxHandler<Signer>,
 
        // This is set when the Channel[Manager] generated a ChannelMonitorUpdate which indicated the
        // channel has been force-closed. After this is set, no further holder commitment transaction
@@ -721,14 +723,14 @@ pub struct ChannelMonitor<ChanSigner: ChannelKeys> {
 #[cfg(any(test, feature = "fuzztarget", feature = "_test_utils"))]
 /// Used only in testing and fuzztarget to check serialization roundtrips don't change the
 /// underlying object
-impl<ChanSigner: ChannelKeys> PartialEq for ChannelMonitor<ChanSigner> {
+impl<Signer: Sign> PartialEq for ChannelMonitor<Signer> {
        fn eq(&self, other: &Self) -> bool {
                if self.latest_update_id != other.latest_update_id ||
                        self.commitment_transaction_number_obscure_factor != other.commitment_transaction_number_obscure_factor ||
                        self.destination_script != other.destination_script ||
                        self.broadcasted_holder_revokable_script != other.broadcasted_holder_revokable_script ||
                        self.counterparty_payment_script != other.counterparty_payment_script ||
-                       self.key_derivation_params != other.key_derivation_params ||
+                       self.channel_keys_id != other.channel_keys_id ||
                        self.holder_revocation_basepoint != other.holder_revocation_basepoint ||
                        self.funding_info != other.funding_info ||
                        self.current_counterparty_commitment_txid != other.current_counterparty_commitment_txid ||
@@ -761,7 +763,7 @@ impl<ChanSigner: ChannelKeys> PartialEq for ChannelMonitor<ChanSigner> {
        }
 }
 
-impl<ChanSigner: ChannelKeys> Writeable for ChannelMonitor<ChanSigner> {
+impl<Signer: Sign> Writeable for ChannelMonitor<Signer> {
        fn write<W: Writer>(&self, writer: &mut W) -> Result<(), Error> {
                //TODO: We still write out all the serialization here manually instead of using the fancy
                //serialization framework we have, we should migrate things over to it.
@@ -786,7 +788,7 @@ impl<ChanSigner: ChannelKeys> Writeable for ChannelMonitor<ChanSigner> {
                self.counterparty_payment_script.write(writer)?;
                self.shutdown_script.write(writer)?;
 
-               self.key_derivation_params.write(writer)?;
+               self.channel_keys_id.write(writer)?;
                self.holder_revocation_basepoint.write(writer)?;
                writer.write_all(&self.funding_info.0.txid[..])?;
                writer.write_all(&byte_utils::be16_to_array(self.funding_info.0.index))?;
@@ -948,13 +950,13 @@ impl<ChanSigner: ChannelKeys> Writeable for ChannelMonitor<ChanSigner> {
        }
 }
 
-impl<ChanSigner: ChannelKeys> ChannelMonitor<ChanSigner> {
-       pub(crate) fn new(keys: ChanSigner, shutdown_pubkey: &PublicKey,
+impl<Signer: Sign> ChannelMonitor<Signer> {
+       pub(crate) fn new(secp_ctx: Secp256k1<secp256k1::All>, keys: Signer, shutdown_pubkey: &PublicKey,
                          on_counterparty_tx_csv: u16, destination_script: &Script, funding_info: (OutPoint, Script),
                          channel_parameters: &ChannelTransactionParameters,
                          funding_redeemscript: Script, channel_value_satoshis: u64,
                          commitment_transaction_number_obscure_factor: u64,
-                         initial_holder_commitment_tx: HolderCommitmentTransaction) -> ChannelMonitor<ChanSigner> {
+                         initial_holder_commitment_tx: HolderCommitmentTransaction) -> ChannelMonitor<Signer> {
 
                assert!(commitment_transaction_number_obscure_factor <= (1 << 48));
                let our_channel_close_key_hash = WPubkeyHash::hash(&shutdown_pubkey.serialize());
@@ -967,11 +969,9 @@ impl<ChanSigner: ChannelKeys> ChannelMonitor<ChanSigner> {
                let counterparty_htlc_base_key = counterparty_channel_parameters.pubkeys.htlc_basepoint;
                let counterparty_tx_cache = CounterpartyCommitmentTransaction { counterparty_delayed_payment_base_key, counterparty_htlc_base_key, on_counterparty_tx_csv, per_htlc: HashMap::new() };
 
-               let key_derivation_params = keys.key_derivation_params();
+               let channel_keys_id = keys.channel_keys_id();
                let holder_revocation_basepoint = keys.pubkeys().revocation_basepoint;
 
-               let secp_ctx = Secp256k1::new();
-
                // block for Rust 1.34 compat
                let (holder_commitment_tx, current_holder_commitment_number) = {
                        let trusted_tx = initial_holder_commitment_tx.trust();
@@ -992,7 +992,8 @@ impl<ChanSigner: ChannelKeys> ChannelMonitor<ChanSigner> {
                };
 
                let onchain_tx_handler =
-                       OnchainTxHandler::new(destination_script.clone(), keys, channel_parameters.clone(), initial_holder_commitment_tx);
+                       OnchainTxHandler::new(destination_script.clone(), keys,
+                       channel_parameters.clone(), initial_holder_commitment_tx, secp_ctx.clone());
 
                let mut outputs_to_watch = HashMap::new();
                outputs_to_watch.insert(funding_info.0.txid, vec![(funding_info.0.index as u32, funding_info.1.clone())]);
@@ -1006,7 +1007,7 @@ impl<ChanSigner: ChannelKeys> ChannelMonitor<ChanSigner> {
                        counterparty_payment_script,
                        shutdown_script,
 
-                       key_derivation_params,
+                       channel_keys_id,
                        holder_revocation_basepoint,
                        funding_info,
                        current_counterparty_commitment_txid: None,
@@ -2201,22 +2202,24 @@ impl<ChanSigner: ChannelKeys> ChannelMonitor<ChanSigner> {
                                break;
                        } else if let Some(ref broadcasted_holder_revokable_script) = self.broadcasted_holder_revokable_script {
                                if broadcasted_holder_revokable_script.0 == outp.script_pubkey {
-                                       spendable_output =  Some(SpendableOutputDescriptor::DynamicOutputP2WSH {
+                                       spendable_output =  Some(SpendableOutputDescriptor::DelayedPaymentOutput(DelayedPaymentOutputDescriptor {
                                                outpoint: OutPoint { txid: tx.txid(), index: i as u16 },
                                                per_commitment_point: broadcasted_holder_revokable_script.1,
                                                to_self_delay: self.on_holder_tx_csv,
                                                output: outp.clone(),
-                                               key_derivation_params: self.key_derivation_params,
                                                revocation_pubkey: broadcasted_holder_revokable_script.2.clone(),
-                                       });
+                                               channel_keys_id: self.channel_keys_id,
+                                               channel_value_satoshis: self.channel_value_satoshis,
+                                       }));
                                        break;
                                }
                        } else if self.counterparty_payment_script == outp.script_pubkey {
-                               spendable_output = Some(SpendableOutputDescriptor::StaticOutputCounterpartyPayment {
+                               spendable_output = Some(SpendableOutputDescriptor::StaticPaymentOutput(StaticPaymentOutputDescriptor {
                                        outpoint: OutPoint { txid: tx.txid(), index: i as u16 },
                                        output: outp.clone(),
-                                       key_derivation_params: self.key_derivation_params,
-                               });
+                                       channel_keys_id: self.channel_keys_id,
+                                       channel_value_satoshis: self.channel_value_satoshis,
+                               }));
                                break;
                        } else if outp.script_pubkey == self.shutdown_script {
                                spendable_output = Some(SpendableOutputDescriptor::StaticOutput {
@@ -2251,7 +2254,7 @@ impl<ChanSigner: ChannelKeys> ChannelMonitor<ChanSigner> {
 /// transaction and losing money. This is a risk because previous channel states
 /// are toxic, so it's important that whatever channel state is persisted is
 /// kept up-to-date.
-pub trait Persist<Keys: ChannelKeys>: Send + Sync {
+pub trait Persist<ChannelSigner: Sign>: Send + Sync {
        /// Persist a new channel's data. The data can be stored any way you want, but
        /// the identifier provided by Rust-Lightning is the channel's outpoint (and
        /// it is up to you to maintain a correct mapping between the outpoint and the
@@ -2263,7 +2266,7 @@ pub trait Persist<Keys: ChannelKeys>: Send + Sync {
        ///
        /// [`ChannelMonitor::serialize_for_disk`]: struct.ChannelMonitor.html#method.serialize_for_disk
        /// [`ChannelMonitorUpdateErr`]: enum.ChannelMonitorUpdateErr.html
-       fn persist_new_channel(&self, id: OutPoint, data: &ChannelMonitor<Keys>) -> Result<(), ChannelMonitorUpdateErr>;
+       fn persist_new_channel(&self, id: OutPoint, data: &ChannelMonitor<ChannelSigner>) -> Result<(), ChannelMonitorUpdateErr>;
 
        /// Update one channel's data. The provided `ChannelMonitor` has already
        /// applied the given update.
@@ -2292,13 +2295,29 @@ pub trait Persist<Keys: ChannelKeys>: Send + Sync {
        /// [`ChannelMonitor::serialize_for_disk`]: struct.ChannelMonitor.html#method.serialize_for_disk
        /// [`ChannelMonitorUpdate::write`]: struct.ChannelMonitorUpdate.html#method.write
        /// [`ChannelMonitorUpdateErr`]: enum.ChannelMonitorUpdateErr.html
-       fn update_persisted_channel(&self, id: OutPoint, update: &ChannelMonitorUpdate, data: &ChannelMonitor<Keys>) -> Result<(), ChannelMonitorUpdateErr>;
+       fn update_persisted_channel(&self, id: OutPoint, update: &ChannelMonitorUpdate, data: &ChannelMonitor<ChannelSigner>) -> Result<(), ChannelMonitorUpdateErr>;
+}
+
+impl<Signer: Sign, T: Deref, F: Deref, L: Deref> chain::Listen for (RefCell<ChannelMonitor<Signer>>, T, F, L)
+where
+       T::Target: BroadcasterInterface,
+       F::Target: FeeEstimator,
+       L::Target: Logger,
+{
+       fn block_connected(&self, block: &Block, height: u32) {
+               let txdata: Vec<_> = block.txdata.iter().enumerate().collect();
+               self.0.borrow_mut().block_connected(&block.header, &txdata, height, &*self.1, &*self.2, &*self.3);
+       }
+
+       fn block_disconnected(&self, header: &BlockHeader, height: u32) {
+               self.0.borrow_mut().block_disconnected(header, height, &*self.1, &*self.2, &*self.3);
+       }
 }
 
 const MAX_ALLOC_SIZE: usize = 64*1024;
 
-impl<'a, ChanSigner: ChannelKeys, K: KeysInterface<ChanKeySigner = ChanSigner>> ReadableArgs<&'a K>
-               for (BlockHash, ChannelMonitor<ChanSigner>) {
+impl<'a, Signer: Sign, K: KeysInterface<Signer = Signer>> ReadableArgs<&'a K>
+               for (BlockHash, ChannelMonitor<Signer>) {
        fn read<R: ::std::io::Read>(reader: &mut R, keys_manager: &'a K) -> Result<Self, DecodeError> {
                macro_rules! unwrap_obj {
                        ($key: expr) => {
@@ -2332,7 +2351,7 @@ impl<'a, ChanSigner: ChannelKeys, K: KeysInterface<ChanKeySigner = ChanSigner>>
                let counterparty_payment_script = Readable::read(reader)?;
                let shutdown_script = Readable::read(reader)?;
 
-               let key_derivation_params = Readable::read(reader)?;
+               let channel_keys_id = Readable::read(reader)?;
                let holder_revocation_basepoint = Readable::read(reader)?;
                // Technically this can fail and serialize fail a round-trip, but only for serialization of
                // barely-init'd ChannelMonitors that we can't do anything with.
@@ -2538,6 +2557,9 @@ impl<'a, ChanSigner: ChannelKeys, K: KeysInterface<ChanKeySigner = ChanSigner>>
                let lockdown_from_offchain = Readable::read(reader)?;
                let holder_tx_signed = Readable::read(reader)?;
 
+               let mut secp_ctx = Secp256k1::new();
+               secp_ctx.seeded_randomize(&keys_manager.get_secure_random_bytes());
+
                Ok((last_block_hash.clone(), ChannelMonitor {
                        latest_update_id,
                        commitment_transaction_number_obscure_factor,
@@ -2547,7 +2569,7 @@ impl<'a, ChanSigner: ChannelKeys, K: KeysInterface<ChanKeySigner = ChanSigner>>
                        counterparty_payment_script,
                        shutdown_script,
 
-                       key_derivation_params,
+                       channel_keys_id,
                        holder_revocation_basepoint,
                        funding_info,
                        current_counterparty_commitment_txid,
@@ -2583,7 +2605,7 @@ impl<'a, ChanSigner: ChannelKeys, K: KeysInterface<ChanKeySigner = ChanSigner>>
                        holder_tx_signed,
 
                        last_block_hash,
-                       secp_ctx: Secp256k1::new(),
+                       secp_ctx,
                }))
        }
 }
@@ -2610,7 +2632,7 @@ mod tests {
        use bitcoin::secp256k1::key::{SecretKey,PublicKey};
        use bitcoin::secp256k1::Secp256k1;
        use std::sync::{Arc, Mutex};
-       use chain::keysinterface::InMemoryChannelKeys;
+       use chain::keysinterface::InMemorySigner;
 
        #[test]
        fn test_prune_preimages() {
@@ -2666,7 +2688,7 @@ mod tests {
                        }
                }
 
-               let keys = InMemoryChannelKeys::new(
+               let keys = InMemorySigner::new(
                        &secp_ctx,
                        SecretKey::from_slice(&[41; 32]).unwrap(),
                        SecretKey::from_slice(&[41; 32]).unwrap(),
@@ -2675,7 +2697,7 @@ mod tests {
                        SecretKey::from_slice(&[41; 32]).unwrap(),
                        [41; 32],
                        0,
-                       (0, 0)
+                       [0; 32]
                );
 
                let counterparty_pubkeys = ChannelPublicKeys {
@@ -2698,7 +2720,7 @@ mod tests {
                };
                // Prune with one old state and a holder commitment tx holding a few overlaps with the
                // old state.
-               let mut monitor = ChannelMonitor::new(keys,
+               let mut monitor = ChannelMonitor::new(Secp256k1::new(), keys,
                                                      &PublicKey::from_secret_key(&secp_ctx, &SecretKey::from_slice(&[42; 32]).unwrap()), 0, &Script::new(),
                                                      (OutPoint { txid: Txid::from_slice(&[43; 32]).unwrap(), index: 0 }, Script::new()),
                                                      &channel_parameters,
@@ -2816,7 +2838,7 @@ mod tests {
                                sign_input!(sighash_parts, idx, 0, inp, sum_actual_sigs);
                        }
                }
-               assert_eq!(base_weight + OnchainTxHandler::<InMemoryChannelKeys>::get_witnesses_weight(&inputs_des[..]),  claim_tx.get_weight() + /* max_length_sig */ (73 * inputs_des.len() - sum_actual_sigs));
+               assert_eq!(base_weight + OnchainTxHandler::<InMemorySigner>::get_witnesses_weight(&inputs_des[..]),  claim_tx.get_weight() + /* max_length_sig */ (73 * inputs_des.len() - sum_actual_sigs));
 
                // Claim tx with 1 offered HTLCs, 3 received HTLCs
                claim_tx.input.clear();
@@ -2840,7 +2862,7 @@ mod tests {
                                sign_input!(sighash_parts, idx, 0, inp, sum_actual_sigs);
                        }
                }
-               assert_eq!(base_weight + OnchainTxHandler::<InMemoryChannelKeys>::get_witnesses_weight(&inputs_des[..]),  claim_tx.get_weight() + /* max_length_sig */ (73 * inputs_des.len() - sum_actual_sigs));
+               assert_eq!(base_weight + OnchainTxHandler::<InMemorySigner>::get_witnesses_weight(&inputs_des[..]),  claim_tx.get_weight() + /* max_length_sig */ (73 * inputs_des.len() - sum_actual_sigs));
 
                // Justice tx with 1 revoked HTLC-Success tx output
                claim_tx.input.clear();
@@ -2862,7 +2884,7 @@ mod tests {
                                sign_input!(sighash_parts, idx, 0, inp, sum_actual_sigs);
                        }
                }
-               assert_eq!(base_weight + OnchainTxHandler::<InMemoryChannelKeys>::get_witnesses_weight(&inputs_des[..]), claim_tx.get_weight() + /* max_length_isg */ (73 * inputs_des.len() - sum_actual_sigs));
+               assert_eq!(base_weight + OnchainTxHandler::<InMemorySigner>::get_witnesses_weight(&inputs_des[..]), claim_tx.get_weight() + /* max_length_isg */ (73 * inputs_des.len() - sum_actual_sigs));
        }
 
        // Further testing is done in the ChannelManager integration tests.