mirrors/core-lightning
1
0
Fork 0
mirror of https://github.com/ElementsProject/lightning.git synced 2024-11-19 09:54:16 +01:00
Code Issues Projects Releases Wiki Activity
50a0321759
core-lightning/common/hsm_version.h

34 lines
2.2 KiB
C
Raw Normal View History

hsmd: introduce a simple API versioning scheme. With the rise of external HSMs like VLS, this is no longer an internal-only API. Fortunately, it doesn't change very fast so maintenance should not be a huge burden. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2022-10-17 02:34:08 +02:00
#ifndef LIGHTNING_COMMON_HSM_VERSION_H
#define LIGHTNING_COMMON_HSM_VERSION_H
#include "config.h"
/* We give a maximum and minimum compatibility version to HSM, to allow
* some API adaptation. */
Makefile: check that hsm_version.h changes if wire/hsmd_wire.csv contents does Otherwise I know we'll miss it. Simply check for a mention: we could well change things multiple times within a single release. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2022-10-17 02:35:01 +02:00
common/hsm_version: list sha256 for every known version. Makes it easier when we remove support for a version. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2023-03-14 06:15:50 +01:00
/* wire/hsmd_wire.csv contents by version:
* v1: 409cffa355ab6cc76bd298910adca9936a68223267ddc4815ba16aeac5d0acc3
* v2: dd89bf9323dff42200003fb864abb6608f3aa645b636fdae3ec81d804ac05196
* v3: edd3d288fc88a5470adc2f99abcbfe4d4af29fae0c7a80b4226f28810a815524
hsmd: deprecate reply_v1. We promised two versions after v0.12, and here we are. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2023-03-14 06:16:50 +01:00
* v3 without v1: 3f813898f7de490e9126ab817e1c9a29af79c0413d5e37068acedce3ea7b5429
hsmd: new version, which tells us the HSM version, and capabilities. Importantly, adds the version number at the *front* to help future parsing. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Header from folded patch 'fix-hsm-check-pubkey.patch': fixup! hsmd: capability addition: ability to check pubkeys.
2023-03-21 04:58:09 +01:00
* v4: 41a730986c51b930e2d8d12b3169d24966c2004e08d424bdda310edbbde5ba70
hsmd: capability addition: ability to check pubkeys. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2023-03-21 04:58:15 +01:00
* v4 with check_pubkey: 48b3992745aa3c6ab6ce5cdaee9082cb7d70017f523d322015e9710bf49fd193
hsmd: add support for lightningd signing onchain txs. We previously used WIRE_HSMD_SIGN_DELAYED_PAYMENT_TO_US, WIRE_HSMD_SIGN_REMOTE_HTLC_TO_US, WIRE_HSMD_SIGN_PENALTY_TO_US and WIRE_HSMD_SIGN_LOCAL_HTLC_TX which allow onchaind to sign txs, but only for its specific channel. We now want lightningd to sign these, but it's not bound to a specific channel. So let's add variants that don't require that. We are also now explicit about *what input* to sign. It's always zero for now, but future combinations may change that. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2023-04-06 01:32:48 +02:00
* v4 with sign_any_penalty_to_us: ead7963185194a515d1f14d2c44401392575299d68ce9a13d8a12baff3cf4f35
hsmd: command to sign anchor spends. This is kind of a withdrawl to ourselves, except we also spend a channel to-local anchor. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2023-06-26 01:04:21 +02:00
* v4 with sign_anchorspend: 8a30722e38b56e82af566b9629ff18da01fcebd1e80ec67f04d8b3a2fa66d81c
hsmd: routine to sign HTLC tx merged with our own tx. Since HTLC txs when using anchors are SIGHASH_SINGLE|SIGHASH_ANYONECANPAY, we can attach other inputs to give it a higher feerate. But we need the HSMd to actually sign the combo. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2023-06-26 01:14:21 +02:00
* v4 with sign_htlc_tx_mingle: b9247e75d41ee1b3fc2f7db0bac8f4e92d544ab2f017d430ae3a000589c384e5
hsmd: Add sign splice command Changelog-None
2023-07-27 22:09:41 +02:00
* v4 with splicing: 06f21012936f825913af289fa81af1512c9ada1cb97c611698975a8fd287edbb
hsmd: rename "capabilities" flags for hsm fds to "permissions" I obviously like the word "capabilities" since I reused it to refer to the HSM's overall features :( Suggested-by: @ksedgwic Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2023-08-07 07:51:40 +02:00
* v4 with capabilities called permissions: 7c5bf8ec7cf30302740db85260a9d1ac2c5b0323a2376c28df6b611831f91655
hsmd: name the hsmd_ready_channel to hsmd_setup_channel Originally VLS used hsmd_ready_channel as an early call during channel setup, but later the BOLT-2 spec changed the name of funding_locked to channel_ready. This is very confusing because the hsmd_ready_channel is not directly related to the new channel_ready. This commit is renaming the hsmd_ready_channel to hsmd_setup_channel. Link: https://github.com/ElementsProject/lightning/issues/6717 Suggested-by: Ken Sedgwick Signed-off-by: Vincenzo Palazzo <vincenzopalazzodev@gmail.com>
2023-09-26 22:55:29 +02:00
* v4 with renaming of channel_ready to setup_channel: 60b92a0930b631cc77df564cb9235e6cb220f4337a2bb00e5153145e0bf8c80e
splice: Add hsmd_check_outpoint and hsmd_lock_outpoint In general, a validating signer may be under a different operational environment than the node, and therefore may have a different source of on-chain data. The signer may therefore temporarily disagree on whether a funding or splice transaction is locked (buried). We would like to ensure agreement between the signer and the node on how to progress a channel's state. The following message are added to provide a solution: - `check_outpoint(outpoint) -> bool` - check if the signer agrees that a funding candidate outpoint is buried - `lock_outpoint(outpoint)` - change the funding/splice state to locked Link: https://github.com/ElementsProject/lightning/issues/6722 Suggested-by: @devrandom Co-Developed-by: Ken Sedgwick <ken@bonsai.com> Changelog-Added: hsmd protocol: Added hsmd_check_outpoint and hsmd_lock_outpoint Signed-off-by: Vincenzo Palazzo <vincenzopalazzodev@gmail.com>
2023-09-24 17:51:06 +02:00
* v4 with buried outpoint check: f44fae666895cab0347b3de7c245267c71cc7de834827b83e286e86318c08aec
hsmd: Implement hsmd_forget_channel for Channel Deletion in HSMD Changelog-Added: hsmd: Added hsmd_forget_channel to enable explicit channel deletion. ([#6987]) Motivation: Previously, a signer prematurely forgetting a channel led to failures in unresolved channel requests. This update introduces hsmd_forget_channel, allowing nodes to explicitly notify signers when a channel is irrevocably resolved and can be safely forgotten. This ensures synchronized channel cleanup between nodes and signers. This change maintains backward and forward compatibility. Nodes explicitly check whether a signer has `WIRE_HSMD_FORGET_CHANNEL` capability before sending the message. Nodes without `WIRE_HSMD_FORGET_CHANNEL` capability won't send this message. Signers capable of handling this message but not receiving it will continue to use conservative pruning methods. Fixes #6987
2023-12-04 04:39:45 +01:00
* v4 with forget_channel: d87c6934ea188f92785d38d7cd0b13ed7f76aa7417f3200baf0c7b5aa832fe29
hsmd: separate revoke_commitment_tx ChangeLog-Added: Added hsmd_revoke_commitment_tx to ensure synchronization of local state with remote signers.
2024-01-22 17:35:43 +01:00
* v5 with hsmd_revoke_commitment_tx: 5742538f87ef5d5bf55b66dc19e52c8683cfeb1b887d3e64ba530ba9a4d8e638
hsmd: add command to allow lightningd to sign channel announcement. Before this it was channeld doing it, which was tied to a particular channel. Create an API for lightningd to sign for any channel. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2024-01-31 04:16:16 +01:00
* v5 with sign_any_cannouncement: 5fdb9068c43a21887dc03f7dce410d2e3eeff6277f0d49b4fc56595a798fd4a4
hsmd: remove deprecated init v2 Signed-off-by: Vincenzo Palazzo <vincenzopalazzodev@gmail.com>
2024-02-20 09:44:52 +01:00
* v5 drop init v2: 5024454532fe5a78bb7558000cb344190888b9915360d3d56ddca22eaba9b872
hsmd: add preinit message to set HSM dev flags. This should make VLS's life easier: they can ignore dev flags they don't understand, but we will know their capabilites after init and so know what they didn't understand (if required). The only flag for now is a flag to force failure for "preapprove" calls. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2024-04-04 05:36:13 +02:00
* v5 with dev_preinit: b93e18534a468a4aa9f7015db42e9c363c32aeee5f9146b36dc953ebbdc3d33c
hsmd: add variant of preapprove commands to have it check only, not do anything. Apparently VLS actually does something when we preapprove: if caller is just checking we want to tell it not to do that! I put in a flag so we can test both old and new APIs. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2024-04-04 05:36:13 +02:00
* v5 with preapprove_check: 0ed6dd4ea2c02b67c51b1420b3d07ab2227a4c06ce7e2942d946967687e9baf7
hsmd: HSM_VERSION 6: get_per_commitment_point never returns secret Changelog-Changed: hsmd: HSM_VERSION 6: get_per_commitment_point does not imply index - 2 is revoked, makes it safe to call on any index.
2024-03-15 22:07:59 +01:00
* v6 no secret from get_per_commitment_point: 0cad1790beb3473d64355f4cb4f64daa80c28c8a241998b7ef0223385d7ffff9
hsmd: create an hsm variant to sign a bolt12 invoice using a tweak on our key. The current interface, if given a tweak, uses a *different secret key* and tweaks it. This was an early experiment: we will switch to using a secret tweak for invoice_requests like we do for invoice path ids. To make sure there's no funny business, *hsmd* hashes to form the tweak (i.e. no zero tweaks!). Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2024-08-01 02:03:35 +02:00
* v6 with sign_bolt12_2 (tweak using node id): 8fcb731279a10af3f95aeb8be1da6b2ced76a1984afa18c5f46a03515d70ea0e
hsmd: add command to allow lightningd to sign channel announcement. Before this it was channeld doing it, which was tied to a particular channel. Create an API for lightningd to sign for any channel. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2024-01-31 04:16:16 +01:00
*/
hsmd: increase the min version Increasing the min version of the hsmd due that we added new code that required the hsmd to sign an announcements. One of the solution is to increase the min version in this way a signer like VLS fails directly during the init phase. Link: https://github.com/ElementsProject/lightning/issues/7074 Changelog-None: hsmd: increase the min version Signed-off-by: Vincenzo Palazzo <vincenzopalazzodev@gmail.com>
2024-02-19 10:04:01 +01:00
#define HSM_MIN_VERSION 5
hsmd: HSM_VERSION 6: get_per_commitment_point never returns secret Changelog-Changed: hsmd: HSM_VERSION 6: get_per_commitment_point does not imply index - 2 is revoked, makes it safe to call on any index.
2024-03-15 22:07:59 +01:00
#define HSM_MAX_VERSION 6
hsmd: introduce a simple API versioning scheme. With the rise of external HSMs like VLS, this is no longer an internal-only API. Fortunately, it doesn't change very fast so maintenance should not be a huge burden. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2022-10-17 02:34:08 +02:00
#endif /* LIGHTNING_COMMON_HSM_VERSION_H */
Reference in New Issue Copy Permalink