Optionally disable all state-based policy checks in test signer

The signer we use in tests tracks the state of the channel and
refuses to sign when the channel attempts an invalid state
transition. In the next commit, however, we'll add an upgrade test
which will fail these checks as the the state won't get copied from
previous versions of LDK to this version.

Thus, here, we add the ability to disable all state-based checks
in the signer.

Author: TheBlueMatt

fuzz/src/chanmon_consistency.rs

@@ -382,7 +382,7 @@ impl SignerProvider for KeyProvider {
 			channel_keys_id,
 		);
 		let revoked_commitment = self.make_enforcement_state_cell(keys.commitment_seed);
-		TestChannelSigner::new_with_revoked(keys, revoked_commitment, false)
+		TestChannelSigner::new_with_revoked(keys, revoked_commitment, false, false)
 	}
 
 	fn read_chan_signer(&self, buffer: &[u8]) -> Result<Self::EcdsaSigner, DecodeError> {
@@ -391,7 +391,7 @@ impl SignerProvider for KeyProvider {
 		let inner: InMemorySigner = ReadableArgs::read(&mut reader, self)?;
 		let state = self.make_enforcement_state_cell(inner.commitment_seed);
 
-		Ok(TestChannelSigner::new_with_revoked(inner, state, false))
+		Ok(TestChannelSigner::new_with_revoked(inner, state, false, false))
 	}
 
 	fn get_destination_script(&self, _channel_keys_id: [u8; 32]) -> Result<ScriptBuf, ()> {

fuzz/src/full_stack.rs

@@ -462,14 +462,14 @@ impl SignerProvider for KeyProvider {
 		f = key;
 		let signer = InMemorySigner::new(&secp_ctx, a, b, c, d, e, f, value, keys_id, keys_id);
 
-		TestChannelSigner::new_with_revoked(signer, state, false)
+		TestChannelSigner::new_with_revoked(signer, state, false, false)
 	}
 
 	fn read_chan_signer(&self, mut data: &[u8]) -> Result<TestChannelSigner, DecodeError> {
 		let inner: InMemorySigner = ReadableArgs::read(&mut data, self)?;
 		let state = Arc::new(Mutex::new(EnforcementState::new()));
 
-		Ok(TestChannelSigner::new_with_revoked(inner, state, false))
+		Ok(TestChannelSigner::new_with_revoked(inner, state, false, false))
 	}
 
 	fn get_destination_script(&self, _channel_keys_id: [u8; 32]) -> Result<ScriptBuf, ()> {

lightning/src/util/test_channel_signer.rs

@@ -75,6 +75,7 @@ pub struct TestChannelSigner {
 	/// Channel state used for policy enforcement
 	pub state: Arc<Mutex<EnforcementState>>,
 	pub disable_revocation_policy_check: bool,
+	pub disable_all_state_policy_checks: bool,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
@@ -124,7 +125,12 @@ impl TestChannelSigner {
 	/// Construct an TestChannelSigner
 	pub fn new(inner: InMemorySigner) -> Self {
 		let state = Arc::new(Mutex::new(EnforcementState::new()));
-		Self { inner, state, disable_revocation_policy_check: false }
+		Self {
+			inner,
+			state,
+			disable_revocation_policy_check: false,
+			disable_all_state_policy_checks: false,
+		}
 	}
 
 	/// Construct an TestChannelSigner with externally managed storage
@@ -134,9 +140,9 @@ impl TestChannelSigner {
 	/// here, usually by an implementation of KeysInterface.
 	pub fn new_with_revoked(
 		inner: InMemorySigner, state: Arc<Mutex<EnforcementState>>,
-		disable_revocation_policy_check: bool,
+		disable_revocation_policy_check: bool, disable_all_state_policy_checks: bool,
 	) -> Self {
-		Self { inner, state, disable_revocation_policy_check }
+		Self { inner, state, disable_revocation_policy_check, disable_all_state_policy_checks }
 	}
 
 	pub fn channel_type_features(&self) -> &ChannelTypeFeatures {
@@ -180,12 +186,12 @@ impl ChannelSigner for TestChannelSigner {
 		if !self.is_signer_available(SignerOp::ReleaseCommitmentSecret) {
 			return Err(());
 		}
-		{
-			let mut state = self.state.lock().unwrap();
+		let mut state = self.state.lock().unwrap();
+		if !self.disable_all_state_policy_checks {
 			assert!(idx == state.last_holder_revoked_commitment || idx == state.last_holder_revoked_commitment - 1, "can only revoke the current or next unrevoked commitment - trying {}, last revoked {}", idx, state.last_holder_revoked_commitment);
 			assert!(idx > state.last_holder_commitment, "cannot revoke the last holder commitment - attempted to revoke {} last commitment {}", idx, state.last_holder_commitment);
-			state.last_holder_revoked_commitment = idx;
 		}
+		state.last_holder_revoked_commitment = idx;
 		self.inner.release_commitment_secret(idx)
 	}
 
@@ -195,12 +201,14 @@ impl ChannelSigner for TestChannelSigner {
 	) -> Result<(), ()> {
 		let mut state = self.state.lock().unwrap();
 		let idx = holder_tx.commitment_number();
-		assert!(
-			idx == state.last_holder_commitment || idx == state.last_holder_commitment - 1,
-			"expecting to validate the current or next holder commitment - trying {}, current {}",
-			idx,
-			state.last_holder_commitment
-		);
+		if !self.disable_all_state_policy_checks {
+			assert!(
+				idx == state.last_holder_commitment || idx == state.last_holder_commitment - 1,
+				"expecting to validate the current or next holder commitment - trying {}, current {}",
+				idx,
+				state.last_holder_commitment
+			);
+		}
 		state.last_holder_commitment = idx;
 		Ok(())
 	}
@@ -211,7 +219,9 @@ impl ChannelSigner for TestChannelSigner {
 			return Err(());
 		}
 		let mut state = self.state.lock().unwrap();
-		assert!(idx == state.last_counterparty_revoked_commitment || idx == state.last_counterparty_revoked_commitment - 1, "expecting to validate the current or next counterparty revocation - trying {}, current {}", idx, state.last_counterparty_revoked_commitment);
+		if !self.disable_all_state_policy_checks {
+			assert!(idx == state.last_counterparty_revoked_commitment || idx == state.last_counterparty_revoked_commitment - 1, "expecting to validate the current or next counterparty revocation - trying {}, current {}", idx, state.last_counterparty_revoked_commitment);
+		}
 		state.last_counterparty_revoked_commitment = idx;
 		Ok(())
 	}
@@ -236,14 +246,14 @@ impl EcdsaChannelSigner for TestChannelSigner {
 	) -> Result<(Signature, Vec<Signature>), ()> {
 		self.verify_counterparty_commitment_tx(commitment_tx, secp_ctx);
 
-		{
-			#[cfg(test)]
-			if !self.is_signer_available(SignerOp::SignCounterpartyCommitment) {
-				return Err(());
-			}
-			let mut state = self.state.lock().unwrap();
-			let actual_commitment_number = commitment_tx.commitment_number();
-			let last_commitment_number = state.last_counterparty_commitment;
+		#[cfg(test)]
+		if !self.is_signer_available(SignerOp::SignCounterpartyCommitment) {
+			return Err(());
+		}
+		let mut state = self.state.lock().unwrap();
+		let actual_commitment_number = commitment_tx.commitment_number();
+		let last_commitment_number = state.last_counterparty_commitment;
+		if !self.disable_all_state_policy_checks {
 			// These commitment numbers are backwards counting.  We expect either the same as the previously encountered,
 			// or the next one.
 			assert!(
@@ -261,9 +271,9 @@ impl EcdsaChannelSigner for TestChannelSigner {
 				actual_commitment_number,
 				state.last_counterparty_revoked_commitment
 			);
-			state.last_counterparty_commitment =
-				cmp::min(last_commitment_number, actual_commitment_number)
 		}
+		state.last_counterparty_commitment =
+			cmp::min(last_commitment_number, actual_commitment_number);
 
 		Ok(self
 			.inner
@@ -284,14 +294,16 @@ impl EcdsaChannelSigner for TestChannelSigner {
 			return Err(());
 		}
 		let trusted_tx = self.verify_holder_commitment_tx(commitment_tx, secp_ctx);
-		let state = self.state.lock().unwrap();
-		let commitment_number = trusted_tx.commitment_number();
-		if state.last_holder_revoked_commitment - 1 != commitment_number
-			&& state.last_holder_revoked_commitment - 2 != commitment_number
-		{
-			if !self.disable_revocation_policy_check {
-				panic!("can only sign the next two unrevoked commitment numbers, revoked={} vs requested={} for {}",
-				       state.last_holder_revoked_commitment, commitment_number, self.inner.commitment_seed[0])
+		if !self.disable_all_state_policy_checks {
+			let state = self.state.lock().unwrap();
+			let commitment_number = trusted_tx.commitment_number();
+			if state.last_holder_revoked_commitment - 1 != commitment_number
+				&& state.last_holder_revoked_commitment - 2 != commitment_number
+			{
+				if !self.disable_revocation_policy_check {
+					panic!("can only sign the next two unrevoked commitment numbers, revoked={} vs requested={} for {}",
+						   state.last_holder_revoked_commitment, commitment_number, self.inner.commitment_seed[0])
+				}
 			}
 		}
 		Ok(self.inner.sign_holder_commitment(commitment_tx, secp_ctx).unwrap())
@@ -351,13 +363,15 @@ impl EcdsaChannelSigner for TestChannelSigner {
 		if !self.is_signer_available(SignerOp::SignHolderHtlcTransaction) {
 			return Err(());
 		}
-		let state = self.state.lock().unwrap();
-		if state.last_holder_revoked_commitment - 1 != htlc_descriptor.per_commitment_number
-			&& state.last_holder_revoked_commitment - 2 != htlc_descriptor.per_commitment_number
-		{
-			if !self.disable_revocation_policy_check {
-				panic!("can only sign the next two unrevoked commitment numbers, revoked={} vs requested={} for {}",
-				       state.last_holder_revoked_commitment, htlc_descriptor.per_commitment_number, self.inner.commitment_seed[0])
+		if !self.disable_all_state_policy_checks {
+			let state = self.state.lock().unwrap();
+			if state.last_holder_revoked_commitment - 1 != htlc_descriptor.per_commitment_number
+				&& state.last_holder_revoked_commitment - 2 != htlc_descriptor.per_commitment_number
+			{
+				if !self.disable_revocation_policy_check {
+					panic!("can only sign the next two unrevoked commitment numbers, revoked={} vs requested={} for {}",
+						   state.last_holder_revoked_commitment, htlc_descriptor.per_commitment_number, self.inner.commitment_seed[0])
+				}
 			}
 		}
 		assert_eq!(htlc_tx.input[input], htlc_descriptor.unsigned_tx_input());

lightning/src/util/test_utils.rs

@@ -375,7 +375,7 @@ impl SignerProvider for OnlyReadsKeysInterface {
 		let inner: InMemorySigner = ReadableArgs::read(&mut reader, self)?;
 		let state = Arc::new(Mutex::new(EnforcementState::new()));
 
-		Ok(TestChannelSigner::new_with_revoked(inner, state, false))
+		Ok(TestChannelSigner::new_with_revoked(inner, state, false, false))
 	}
 
 	fn get_destination_script(&self, _channel_keys_id: [u8; 32]) -> Result<ScriptBuf, ()> {
@@ -1451,6 +1451,7 @@ pub struct TestKeysInterface {
 	pub backing: sign::PhantomKeysManager,
 	pub override_random_bytes: Mutex<Option<[u8; 32]>>,
 	pub disable_revocation_policy_check: bool,
+	pub disable_all_state_policy_checks: bool,
 	enforcement_states: Mutex<HashMap<[u8; 32], Arc<Mutex<EnforcementState>>>>,
 	expectations: Mutex<Option<VecDeque<OnGetShutdownScriptpubkey>>>,
 	pub unavailable_signers_ops: Mutex<HashMap<[u8; 32], HashSet<SignerOp>>>,
@@ -1515,8 +1516,9 @@ impl SignerProvider for TestKeysInterface {
 	) -> TestChannelSigner {
 		let keys = self.backing.derive_channel_signer(channel_value_satoshis, channel_keys_id);
 		let state = self.make_enforcement_state_cell(keys.commitment_seed);
-		let signer =
-			TestChannelSigner::new_with_revoked(keys, state, self.disable_revocation_policy_check);
+		let rev_checks = self.disable_revocation_policy_check;
+		let state_checks = self.disable_all_state_policy_checks;
+		let signer = TestChannelSigner::new_with_revoked(keys, state, rev_checks, state_checks);
 		#[cfg(test)]
 		if let Some(ops) = self.unavailable_signers_ops.lock().unwrap().get(&channel_keys_id) {
 			for &op in ops {
@@ -1556,6 +1558,7 @@ impl TestKeysInterface {
 			backing: sign::PhantomKeysManager::new(seed, now.as_secs(), now.subsec_nanos(), seed),
 			override_random_bytes: Mutex::new(None),
 			disable_revocation_policy_check: false,
+			disable_all_state_policy_checks: false,
 			enforcement_states: Mutex::new(new_hash_map()),
 			expectations: Mutex::new(None),
 			unavailable_signers_ops: Mutex::new(new_hash_map()),