Commit graph

12188 commits

Author SHA1 Message Date
naveen
844dbc08e7
mod:replace mongo driver to address CVE-2021-20329
* The mongo driver has CVE https://github.com/advisories/GHSA-f6mq-5m25-4r72
* The mongo driver is an indirect reference and cannot be directly
upgraded.
* https://deps.dev/advisory/OSV/GO-2021-0112?from=%2Fgo%2Fgithub.com%252Flightningnetwork%252Flnd
* The fix will replace the reference of the library with the fixed
  version.
2021-10-01 13:48:47 +00:00
Oliver Gugger
c43b9e4fe7
Merge pull request #5759 from naveensrinivasan/naveen/feat/fix-GO-2021-0053
mod:replace gogo/protobuf for GO-2021-0053
2021-10-01 15:45:54 +02:00
naveen
d5e3302265
mod : replace gogo/protobuf for GO-2021-0053
The gogo/protobuf has OSV GO-2021-0053
https://deps.dev/advisory/OSV/GO-2021-0053?from=%2Fgo%2Fgithub.com%252Flightningnetwork%252Flnd

This is used indirectly and has to be replaced in go.mod to avoid the
direct reference to that version.

The OSV has been addressed in v1.3.2
2021-10-01 13:07:52 +00:00
Oliver Gugger
036041d671
Merge pull request #5665 from LN-Zap/upstream/feat/single-utxo-reserved
lnd: use change output index from authoring TX to check reserved value
2021-10-01 09:51:28 +02:00
Bjarne Magnussen
1d84c1d739
docs: add to release notes 2021-10-01 08:21:46 +02:00
Bjarne Magnussen
a5a477e311
lnd: add optional change output index to check reserved wallet balance 2021-10-01 08:21:29 +02:00
Olaoluwa Osuntokun
32fa48df7d
Merge pull request #5770 from Crypt-iQ/dust_threshold_0619
lnwallet+htlcswitch: make Switch dust-aware
2021-09-30 20:20:19 -07:00
Olaoluwa Osuntokun
8ba68ca59f
Merge pull request #5789 from naveensrinivasan/naveen/feat/fix-CVE-2021-29482
mod: Upgraded xz library to FIX the CVE-2021-29482
2021-09-30 20:16:13 -07:00
Olaoluwa Osuntokun
91edfaed85
Merge pull request #5802 from yyforyongyu/5318-fix-addr-format
lndcfg: give verbose err when failed to load config
2021-09-30 20:14:08 -07:00
Olaoluwa Osuntokun
c6b250c479
Merge pull request #5807 from ellemouton/bumpNeutrinoVersion
go.mod: latest neutrino commit
2021-09-30 20:13:03 -07:00
Olaoluwa Osuntokun
dd7bfa0c4a
Merge pull request #5650 from Roasbeef/go-1-17
build: upgrade all CI+build infra to Go 1.17
2021-09-30 19:12:29 -07:00
eugene
25a0fe2902
docs: update release notes for 0.13.3 2021-09-30 13:44:35 -04:00
eugene
702b3a3258
multi: introduce config-level DustThreshold for defining threshold 2021-09-30 13:44:35 -04:00
eugene
3897baff0a
htlcswitch: call evaluateDustThreshold in SendHTLC, handlePacketForward
This commit makes SendHTLC (we are the source) evaluate the dust
threshold of the outgoing channel against the default threshold of
500K satoshis. If the threshold is exceeded by adding this HTLC, we
fail backwards. It also makes handlePacketForward (we are forwarding)
evaluate the dust threshold of the incoming channel and the outgoing
channel and fails backwards if either channel's dust sum exceeds the
default threshold.
2021-09-30 13:44:34 -04:00
eugene
0ce6194e1e
htlcswitch: extend ChannelLink iface with dustHandler iface
This allows the Switch to determine the dust exposure of a certain
channel and allows the link to set the feerate of the mailbox given
a fee update.
2021-09-30 13:44:34 -04:00
eugene
0b24603aef
htlcswitch: extend Mailbox iface with dust, fee methods
This commit extends the Mailbox interface with the SetDustClosure,
SetFeeRate, and DustPackets methods. This enables the mailbox to
report the dust exposure to the Switch when the Switch decides whether
to forward a dust packet. The dust is counted from the time an Add is
introduced via AddPacket until it is removed via AckPacket. This can
lead to some packets being counted twice before they are signed for,
but this is a trade-off between accuracy and simplicity.
2021-09-30 13:44:34 -04:00
eugene
7d16e58b5c
lnwallet: introduce GetDustSum method to calculate worst-case dust sum
It over-estimates the local or remote commitment's dust sum by
counting all updates in both updateLogs that are dust using the
trimmed-to-dust mechanism if applicable. The over-estimation is done
because ensuring an accurate counting is a trade-off between code
simplicity and accuracy.
2021-09-30 13:44:26 -04:00
Elle Mouton
9a27cd93c3
go.mod: latest neutrino commit 2021-09-30 09:30:10 +02:00
Olaoluwa Osuntokun
34cb9357ee
Merge pull request #5808 from Crypt-iQ/shutdown_clean_flakefix_0929
htlcswitch: fix flake in TestShutdownIfChannelClean
2021-09-29 17:43:09 -07:00
Olaoluwa Osuntokun
6ae6f8026b
build: retract v0.0.2
A stray version of lnd was pushed out waaaay back in 2016 that can trip
up `pkg.go.dev` and things like `go get`. Using the new Go 1.16 feature,
we can now "retract" this version, which marks it as being unavailable.
2021-09-29 17:31:50 -07:00
Olaoluwa Osuntokun
6b73f01683
build: set min Go version to 1.16 in go.mod 2021-09-29 17:31:45 -07:00
Olaoluwa Osuntokun
9b9e1d329a
docs/release-notes: add new entry for bump to Go 1.17 2021-09-29 17:31:42 -07:00
Olaoluwa Osuntokun
d6fc6f4960
docs: advertise Go 1.16 as min Go version in INSTALL.md 2021-09-29 17:31:40 -07:00
Oliver Gugger
0b4e03f5fc
multi: add golang 1.17 compatible build tags
With go 1.17 a change to the build flags was implemented:
https://go.googlesource.com/proposal/+/master/design/draft-gobuild.md

The formatter now automatically adds the forward-compatible build tag
format and the linter checks for them, so we need to include them in our
code.
2021-09-29 17:31:37 -07:00
Olaoluwa Osuntokun
d973cf1060
build: upgrade all CI+build infra to Go 1.17 2021-09-29 17:31:34 -07:00
Oliver Gugger
7aa9661d42
lntest: use errgroup for node startup
This commit fixes a nil pointer issue when a node fails to start up.
Because require.NoErrorf() doesn't abort a test immediately if run
inside a goroutine, this lead to the test continuing with nil node
references which lead to a panic later on.
2021-09-29 17:31:32 -07:00
Olaoluwa Osuntokun
dd4cf268a0
Merge pull request #5804 from guggero/itest-setup-error
lntest: use errgroup for node startup [skip ci]
2021-09-29 17:31:17 -07:00
Olaoluwa Osuntokun
aac824d6ef
Merge pull request #5781 from Crypt-iQ/accurate_dust0922
multi: replace DefaultDustLimit with accurate dust limit
2021-09-29 16:28:18 -07:00
eugene
b0018f2387
docs: update release notes for 0.14.0 2021-09-29 17:09:29 -04:00
eugene
49877545ba
htlcswitch: fix flake in TestShutdownIfChannelClean
When Alice receives a CommitSig near the end of the test, the test
assumed that she wouldn't reply with a RevokeAndAck message before
shutdownAssert was called. This led to a test flake. Instead, only
call shutdownAssert after we've received the RevokeAndAck.
2021-09-29 17:04:53 -04:00
eugene
b8bfaf076f
docs: update release notes for 0.13.3 2021-09-29 13:33:12 -04:00
eugene
950063840a
funding+lnwallet: validate ChannelReserve is above DustLimit
This is necessary and is implied by BOLT#02. Both ChannelReserve
parameters should be above both DustLimit parameters. Otherwise,
it is possible for one side to have nothing at stake.
2021-09-29 13:33:12 -04:00
eugene
fdcd726f9a
multi: replace DefaultDustLimit with script-specific DustLimitForSize
This commit updates call-sites to use the proper dust limits for
various script types. This also updates the default dust limit used
in the funding flow to be 354 satoshis instead of 573 satoshis.
2021-09-29 13:33:10 -04:00
naveen
04f57c6f57
mod: Upgraded xz library to FIX the CVE-2021-29482
Included a replace directive to avoid using an high severity CVE
https://github.com/advisories/GHSA-25xm-hr59-7c27

This library is indirectly referenced and cannot be upgraded directly.

The https://github.com/fergusstrange/embedded-postgres/pull/42 was
merged to fix the CVE issue.
2021-09-29 15:16:26 +00:00
Oliver Gugger
3385d38414
Merge pull request #5766 from JssDWt/update-csharp-grpc-docs-grpc.net.client
Update C# grpc docs to use Grpc.Net.Client
2021-09-29 12:02:03 +02:00
Oliver Gugger
5aeb728f80
lntest: use errgroup for node startup
This commit fixes a nil pointer issue when a node fails to start up.
Because require.NoErrorf() doesn't abort a test immediately if run
inside a goroutine, this lead to the test continuing with nil node
references which lead to a panic later on.
2021-09-29 11:57:53 +02:00
Olaoluwa Osuntokun
7f3c59033b
Merge pull request #5527 from ErikEk/isset-validateconfig
config: sync-freelist being ignored
2021-09-28 20:35:57 -07:00
Olaoluwa Osuntokun
884cc0d191
Merge pull request #5768 from priyanshiiit/lookupInvoice
lnd: adds NOT_FOUND status code for LookupInvoice
2021-09-28 14:33:29 -07:00
yyforyongyu
e2129cd8a9
docs: update release note for load config err 2021-09-29 04:53:03 +08:00
yyforyongyu
98ca821085
lndcfg: give verbose err when failed to load config 2021-09-29 04:37:05 +08:00
Oliver Gugger
410606b082
Merge pull request #5797 from guggero/fix-nil-channel
rpcserver: fix nil issue with historical channels
2021-09-28 11:02:12 +02:00
Olaoluwa Osuntokun
42ce27f663
Merge pull request #5745 from Roasbeef/contract-court-move
multi: move breach arbiter and utxo nursery into contractcourt package
2021-09-27 21:33:51 -07:00
Olaoluwa Osuntokun
7bde1662e2
multi: move breach arbiter and utxo nursery into contractcourt package
In this commit, we take an initial step towards converting the existing
breach arbiter and utxo nursery logic into contract resolvers by moving
the files as is, into the `contractcourt` pacakge.

This commit is primarily move only, though we had to massage some
interfaces and config names along the way to make things compile and the
tests run properly.
2021-09-27 19:10:31 -07:00
Oliver Gugger
e067dc73b7
rpcserver: fix nil issue with historical channels [skip ci]
Fixes #5796.
Some historical channels might not have the forwarding packages
recorded. And since the error might be silenced, the historical channel
might be nil.
2021-09-27 22:26:03 +02:00
Oliver Gugger
be2566cf26
Merge pull request #5053 from guggero/verify-count
verify-install: add keys to repo, pin signatures to keys
2021-09-27 18:28:05 +02:00
Oliver Gugger
421add062c
docs: add release notes 2021-09-27 15:49:12 +02:00
Oliver Gugger
d7d1574095
scripts: verify version in manifest
To make a downgrade attack harder, we also check that the version string
is contained in the manifest, on the same line as the hash.
2021-09-27 15:49:12 +02:00
Oliver Gugger
5bafff2cf2
scripts: allow packaged release archive to be verified
Instead of only allowing to verify installed/unpacked binaries, we also
allow a single binary or packaged release archive to be verified.
2021-09-27 15:49:11 +02:00
Oliver Gugger
5afed8ab62
docker: add keys to docker image
Because the PGP keys are no longer downloaded from Keybase but are used
from the repo directly, we also have to copy them to the Docker image so
we can run the script without needing to supply them through a volume.
2021-09-27 15:49:11 +02:00
Oliver Gugger
6d0368a189
scripts: pin signatures to keys
With this commit we add a new restriction that checks that the
username in the signature file (manifest-<username>-<version>.sig) actually
does have a signing key and that the signature was created with that key.
The signature is only counted towards the minimum of 5 signatures if
that check is successful.
The changes in this commit were inspired by @kixunil in #5048.
2021-09-27 15:49:11 +02:00