Failure to reject `option_scid_alias` on an announced channel
维护者通常 2 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 65/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- c
调研方向
从 channel_type_accept() 开始，追踪 channel_flags 如何经过 openingd 和 dualopend 的 funding 路径传递。复现 v1 funding protocol 中一个已公告的 open_channel 设置 option_scid_alias 的情况，并以 smite fuzzing 发现作为上下文。完成的标准是：无效组合在接收时被拒绝，同时有效的 channel type 继续通过协议。
由索引模型根据 Issue 内容生成。
描述
BOLT 2 forbids the sender of open_channel from setting the option_scid_alias bit in channel_type when announce_channel is true:
The sending node:
- if it includes
open_channel_tlvs:
- MUST set
channel_type:
- if
announce_channelistrue(not0):
- MUST NOT send
channel_typewith theoption_scid_aliasbit set.
CLN never generates this combination as opener, but it does not reject it on receipt: channel_type_accept() never sees channel_flags, so the fundee happily replies with accept_channel echoing back option_scid_alias on a channel it will then announce. The spec does not specify rules for the acceptor in this case, so accepting it is not itself a violation, but the resulting channel is internally inconsistent.
Impact
Both openingd and dualopend are affected. The effect is that both can exchange announcement_signatures and publicly announce the channel using its real short_channel_id. However, per BOLT, when the agreed channel type has option_scid_alias set, a node MUST NOT allow incoming HTLCs to that channel using the real short_channel_id. So if the peer returns its signatures, CLN ends up announcing a channel to the whole network and then refusing every HTLC (addressed to that short_channel_id) it is asked to forward to the peer, which only affects the peer.
Only forwards towards the peer are affected, inbound HTLCs still work. For CLN, this means gaining some bad reputation for unnecessarily failing HTLCs. Other than that, this is purely a spec-compliance issue.
Discovery
This bug was found while fuzzing the v1 funding protocol with smite.
- 主要语言
- C
- 星标
- 3.1k
- 派生
- 1k
- 平均合并
- 4 天 2 小时
- 30 天内合并 PR
- 45
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
ElementsProject/lightning 的其他 Issue
-
难度 1/5 1 小时以内 新手友好度 90/100
ElementsProject/lightning#9593 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
ElementsProject/lightning#9322 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
ElementsProject/lightning#9206 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
ElementsProject/lightning#9187 · 1 条评论 · 1 个 reaction ·
维护者通常 2 天内回复
-
QA
难度 1/5 1 小时以内 新手友好度 88/100
ElementsProject/lightning#9117 · 2 条评论 ·
维护者通常 2 天内回复
查看 ElementsProject/lightning 的全部 Issue
相似的 Issue
-
rc_runtime_activate_richpresence leaves a half-initialised entry when the buffer allocation fails未关闭
难度 1/5 1 小时以内 新手友好度 88/100
RetroAchievements/rcheevos#558 ·
-
good first issue priority:low type:docs
难度 2/5 1-3 小时 新手友好度 82/100
crazy-goat/php-fpm-ng#920 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 74/100
-
难度 2/5 1-3 小时 新手友好度 88/100
libsdl-org/SDL#16464 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100