Enforce that revocation can only occur after we validated a new commitment

[rust-lightning] / lightning / src / ln / channel.rs

diff --git a/lightning/src/ln/channel.rs b/lightning/src/ln/channel.rs
index 434941e92fa97d6da6a84e6525727983b64baa01..2cd7e3c2ff9733678e4ce9ecda2187308c70094e 100644 (file)
--- a/lightning/src/ln/channel.rs
+++ b/lightning/src/ln/channel.rs
@@ -452,7 +452,6 @@ pub(super) struct Channel<Signer: Sign> {
        counterparty_max_commitment_tx_output: Mutex<(u64, u64)>,
 
        last_sent_closing_fee: Option<(u64, Signature)>, // (fee, holder_sig)
-       closing_fee_limits: Option<(u64, u64)>,
        target_closing_feerate_sats_per_kw: Option<u32>,
 
        /// If our counterparty sent us a closing_signed while we were waiting for a `ChannelMonitor`
@@ -460,6 +459,13 @@ pub(super) struct Channel<Signer: Sign> {
        /// closing_signed message and handling it in `maybe_propose_closing_signed`.
        pending_counterparty_closing_signed: Option<msgs::ClosingSigned>,
 
+       /// The minimum and maximum absolute fee we are willing to place on the closing transaction.
+       /// These are set once we reach `closing_negotiation_ready`.
+       #[cfg(test)]
+       pub(crate) closing_fee_limits: Option<(u64, u64)>,
+       #[cfg(not(test))]
+       closing_fee_limits: Option<(u64, u64)>,
+
        /// The hash of the block in which the funding transaction was included.
        funding_tx_confirmed_in: Option<BlockHash>,
        funding_tx_confirmation_height: u32,
@@ -1785,6 +1791,8 @@ impl<Signer: Sign> Channel<Signer> {
                        self.counterparty_funding_pubkey()
                );
 
+               self.holder_signer.validate_holder_commitment(&holder_commitment_tx);
+
                // Now that we're past error-generating stuff, update our local state:
 
                let funding_redeemscript = self.get_funding_redeemscript();
@@ -1859,6 +1867,7 @@ impl<Signer: Sign> Channel<Signer> {
                        self.counterparty_funding_pubkey()
                );
 
+               self.holder_signer.validate_holder_commitment(&holder_commitment_tx);
 
                let funding_redeemscript = self.get_funding_redeemscript();
                let funding_txo = self.get_funding_txo().unwrap();
@@ -2496,6 +2505,7 @@ impl<Signer: Sign> Channel<Signer> {
                );
 
                let next_per_commitment_point = self.holder_signer.get_per_commitment_point(self.cur_holder_commitment_transaction_number - 1, &self.secp_ctx);
+               self.holder_signer.validate_holder_commitment(&holder_commitment_tx);
                let per_commitment_secret = self.holder_signer.release_commitment_secret(self.cur_holder_commitment_transaction_number + 1);
 
                // Update state now that we've passed all the can-fail calls...
@@ -3629,7 +3639,7 @@ impl<Signer: Sign> Channel<Signer> {
                let funding_redeemscript = self.get_funding_redeemscript();
                let (mut closing_tx, used_total_fee) = self.build_closing_transaction(msg.fee_satoshis, false);
                if used_total_fee != msg.fee_satoshis {
-                       return Err(ChannelError::Close(format!("Remote sent us a closing_signed with a fee greater than the value they can claim. Fee in message: {}", msg.fee_satoshis)));
+                       return Err(ChannelError::Close(format!("Remote sent us a closing_signed with a fee other than the value they can claim. Fee in message: {}. Actual closing tx fee: {}", msg.fee_satoshis, used_total_fee)));
                }
                let mut sighash = hash_to_message!(&bip143::SigHashCache::new(&closing_tx).signature_hash(0, &funding_redeemscript, self.channel_value_satoshis, SigHashType::All)[..]);