Where validation becomes chain state

4251{
4252    AssertLockNotHeld(cs_main);
4253    {
4254        LOCK(cs_main);
4255        for (const CBlockHeader& header : headers) {
4256            CBlockIndex *pindex = nullptr; // Use a temp pindex instead of ppindex to avoid a const_cast
4257            bool accepted{AcceptBlockHeader(header, state, &pindex, min_pow_checked)};
4258            CheckBlockIndex();
4259
4260            if (!accepted) {
4261                return false;
4262            }
4263            if (ppindex) {
4264                *ppindex = pindex;
4265            }
4266        }
4267    }
4268    if (NotifyHeaderTip()) {
4269        if (IsInitialBlockDownload() && ppindex && *ppindex) {
4270            const CBlockIndex& last_accepted{**ppindex};
4271            int64_t blocks_left{(NodeClock::now() - last_accepted.Time()) / GetConsensus().PowTargetSpacing()};
4272            blocks_left = std::max<int64_t>(0, blocks_left);
4273            const double progress{100.0 * last_accepted.nHeight / (last_accepted.nHeight + blocks_left)};
4274            LogInfo("Synchronizing blockheaders, height: %d (~%.2f%%)\n", last_accepted.nHeight, progress);
4275        }
4276    }
4277    return true;
4278}
4279
4280void ChainstateManager::ReportHeadersPresync(int64_t height, int64_t timestamp)
4281{
4282    AssertLockNotHeld(GetMutex());
4283    {
4284        LOCK(GetMutex());
4285        // Don't report headers presync progress if we already have a post-minchainwork header chain.
4286        // This means we lose reporting for potentially legitimate, but unlikely, deep reorgs, but
4287        // prevent attackers that spam low-work headers from filling our logs.
4288        if (m_best_header->nChainWork >= UintToArith256(GetConsensus().nMinimumChainWork)) return;
4289        // Rate limit headers presync updates to 4 per second, as these are not subject to DoS
4290        // protection.
4291        auto now = MockableSteadyClock::now();
4292        if (now < m_last_presync_update + std::chrono::milliseconds{250}) return;
4293        m_last_presync_update = now;
4294    }
4295    bool initial_download = IsInitialBlockDownload();
4296    GetNotifications().headerTip(GetSynchronizationState(initial_download, m_blockman.m_blockfiles_indexed), height, timestamp, /*presync=*/true);
4297    if (initial_download) {
4298        int64_t blocks_left{(NodeClock::now() - NodeSeconds{std::chrono::seconds{timestamp}}) / GetConsensus().PowTargetSpacing()};
4299        blocks_left = std::max<int64_t>(0, blocks_left);
4300        const double progress{100.0 * height / (height + blocks_left)};
4301        LogInfo("Pre-synchronizing blockheaders, height: %d (~%.2f%%)\n", height, progress);
4302    }
4303}
4304
4305/** Store block on disk. If dbp is non-nullptr, the file is known to already reside on disk */
4306bool ChainstateManager::AcceptBlock(const std::shared_ptr<const CBlock>& pblock, BlockValidationState& state, CBlockIndex** ppindex, bool fRequested, const FlatFilePos* dbp, bool* fNewBlock, bool min_pow_checked)
4307{
4308    const CBlock& block = *pblock;
4309
4310    if (fNewBlock) *fNewBlock = false;
4311    AssertLockHeld(cs_main);
4312
4313    CBlockIndex *pindexDummy = nullptr;
4314    CBlockIndex *&pindex = ppindex ? *ppindex : pindexDummy;
4315
4316    bool accepted_header{AcceptBlockHeader(block, state, &pindex, min_pow_checked)};
4317    CheckBlockIndex();
4318
4319    if (!accepted_header)
4320        return false;
4321
4322    // Check all requested blocks that we do not already have for validity and
4323    // save them to disk. Skip processing of unrequested blocks as an anti-DoS
4324    // measure, unless the blocks have more work than the active chain tip, and
4325    // aren't too far ahead of it, so are likely to be attached soon.
4326    bool fAlreadyHave = pindex->nStatus & BLOCK_HAVE_DATA;
4327    bool fHasMoreOrSameWork = (ActiveTip() ? pindex->nChainWork >= ActiveTip()->nChainWork : true);
4328    // Blocks that are too out-of-order needlessly limit the effectiveness of
4329    // pruning, because pruning will not delete block files that contain any
4330    // blocks which are too close in height to the tip.  Apply this test
4331    // regardless of whether pruning is enabled; it should generally be safe to
4332    // not process unrequested blocks.
4333    bool fTooFarAhead{pindex->nHeight > ActiveHeight() + int(MIN_BLOCKS_TO_KEEP)};
4334
4335    // TODO: Decouple this function from the block download logic by removing fRequested
4336    // This requires some new chain data structure to efficiently look up if a
4337    // block is in a chain leading to a candidate for best tip, despite not
4338    // being such a candidate itself.
4339    // Note that this would break the getblockfrompeer RPC
4340
4341    // TODO: deal better with return value and error conditions for duplicate
4342    // and unrequested blocks.
4343    if (fAlreadyHave) return true;
4344    if (!fRequested) {  // If we didn't ask for it:
4345        if (pindex->nTx != 0) return true;    // This is a previously-processed block that was pruned
4346        if (!fHasMoreOrSameWork) return true; // Don't process less-work chains
4347        if (fTooFarAhead) return true;        // Block height is too high
4348
4349        // Protect against DoS attacks from low-work chains.
4350        // If our tip is behind, a peer could try to send us
4351        // low-work blocks on a fake chain that we would never
4352        // request; don't process these.
4353        if (pindex->nChainWork < MinimumChainWork()) return true;
4354    }
4355
4356    const CChainParams& params{GetParams()};
4357
4358    if (!CheckBlock(block, state, params.GetConsensus()) ||
4359        !ContextualCheckBlock(block, state, *this, pindex->pprev)) {
4360        if (Assume(state.IsInvalid())) {
4361            ActiveChainstate().InvalidBlockFound(pindex, state);
4362        }
4363        LogError("%s: %s\n", __func__, state.ToString());
4364        return false;
4365    }
4366
4367    // Header is valid/has work, merkle tree and segwit merkle tree are good...RELAY NOW
4368    // (but if it does not build on our best tip, let the SendMessages loop relay it)
4369    if (!IsInitialBlockDownload() && ActiveTip() == pindex->pprev && m_options.signals) {
4370        m_options.signals->NewPoWValidBlock(pindex, pblock);
4371    }
4372
4373    // Write block to history file
4374    if (fNewBlock) *fNewBlock = true;
4375    try {
4376        FlatFilePos blockPos{};
4377        if (dbp) {
4378            blockPos = *dbp;
4379            m_blockman.UpdateBlockInfo(block, pindex->nHeight, blockPos);
4380        } else {
4381            blockPos = m_blockman.WriteBlock(block, pindex->nHeight);
4382            if (blockPos.IsNull()) {
4383                state.Error(strprintf("%s: Failed to find position to write new block to disk", __func__));
4384                return false;
4385            }
4386        }
4387        ReceivedBlockTransactions(block, pindex, blockPos);
4388    } catch (const std::runtime_error& e) {
4389        return FatalError(GetNotifications(), state, strprintf(_("System error while saving block to disk: %s"), e.what()));
4390    }
4391
4392    // TODO: FlushStateToDisk() handles flushing of both block and chainstate
4393    // data, so we should move this to ChainstateManager so that we can be more
4394    // intelligent about how we flush.
4395    // For now, since FlushStateMode::NONE is used, all that can happen is that
4396    // the block files may be pruned, so we can just call this on one
4397    // chainstate (particularly if we haven't implemented pruning with
4398    // background validation yet).
4399    //
4400    // Flush errors (e.g. low disk space during pruning) are ignored, so that
4401    // callers can't mistreat a flush failure as a block validation failure.
4402    // The fatal error notification inside FlushStateToDisk still fires,
4403    // so the node will shut down on unrecoverable flush errors regardless.
4404    // For state a dummy value is used, and the return value is ignored.
4405    BlockValidationState flush_state_ignore;
4406    (void)ActiveChainstate().FlushStateToDisk(flush_state_ignore, FlushStateMode::NONE);
4407
4408    CheckBlockIndex();
4409
4410    return true;
4411}
4412
4413bool ChainstateManager::ProcessNewBlock(const std::shared_ptr<const CBlock>& block, bool force_processing, bool min_pow_checked, bool* new_block)
4414{
4415    AssertLockNotHeld(cs_main);
4416
4417    {
4418        CBlockIndex *pindex = nullptr;
4419        if (new_block) *new_block = false;
4420        BlockValidationState state;
4421
4422        // CheckBlock() does not support multi-threaded block validation because CBlock::fChecked can cause data race.
4423        // Therefore, the following critical section must include the CheckBlock() call as well.
4424        LOCK(cs_main);
4425
4426        // Skipping AcceptBlock() for CheckBlock() failures means that we will never mark a block as invalid if
4427        // CheckBlock() fails.  This is protective against consensus failure if there are any unknown forms of block
4428        // malleability that cause CheckBlock() to fail; see e.g. CVE-2012-2459 and
4429        // https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-February/016697.html.  Because CheckBlock() is
4430        // not very expensive, the anti-DoS benefits of caching failure (of a definitely-invalid block) are not substantial.
4431        bool ret = CheckBlock(*block, state, GetConsensus());
4432        if (ret) {
4433            // Store to disk
4434            ret = AcceptBlock(block, state, &pindex, force_processing, nullptr, new_block, min_pow_checked);
4435        }
4436        if (!ret) {
4437            if (m_options.signals) {
4438                m_options.signals->BlockChecked(block, state);
4439            }
4440            LogError("%s: AcceptBlock FAILED (%s)\n", __func__, state.ToString());
4441            return false;
4442        }
4443    }
4444
4445    NotifyHeaderTip();
4446
4447    BlockValidationState state; // Only used to report errors, not invalidity - ignore it
4448    if (!ActiveChainstate().ActivateBestChain(state, block)) {
4449        LogError("%s: ActivateBestChain failed (%s)\n", __func__, state.ToString());
4450        return false;
4451    }
4452
4453    Chainstate* bg_chain{WITH_LOCK(cs_main, return HistoricalChainstate())};
4454    BlockValidationState bg_state;
4455    if (bg_chain && !bg_chain->ActivateBestChain(bg_state, block)) {
4456        LogError("%s: [background] ActivateBestChain failed (%s)\n", __func__, bg_state.ToString());
4457        return false;
4458     }
4459
4460    return true;
4461}
4462
4463MempoolAcceptResult ChainstateManager::ProcessTransaction(const CTransactionRef& tx, bool test_accept)
4464{
4465    AssertLockHeld(cs_main);
4466    Chainstate& active_chainstate = ActiveChainstate();
4467    if (!active_chainstate.GetMempool()) {
4468        TxValidationState state;
4469        state.Invalid(TxValidationResult::TX_NO_MEMPOOL, "no-mempool");
4470        return MempoolAcceptResult::Failure(state);
4471    }
4472    auto result = AcceptToMemoryPool(active_chainstate, tx, GetTime(), /*bypass_limits=*/ false, test_accept);
4473    active_chainstate.GetMempool()->check(active_chainstate.CoinsTip(), active_chainstate.m_chain.Height() + 1);
4474    return result;
4475}
4476
4477
4478BlockValidationState TestBlockValidity(
4479    Chainstate& chainstate,
4480    const CBlock& block,
4481    const bool check_pow,
4482    const bool check_merkle_root)
4483{
4484    // Lock must be held throughout this function for two reasons:
4485    // 1. We don't want the tip to change during several of the validation steps
4486    // 2. To prevent a CheckBlock() race condition for fChecked, see ProcessNewBlock()
4487    AssertLockHeld(chainstate.m_chainman.GetMutex());
4488
4489    BlockValidationState state;
4490    CBlockIndex* tip{Assert(chainstate.m_chain.Tip())};
4491
4492    if (block.hashPrevBlock != *Assert(tip->phashBlock)) {
4493        state.Invalid({}, "inconclusive-not-best-prevblk");
4494        return state;
4495    }
4496
4497    // For signets CheckBlock() verifies the challenge iff fCheckPow is set.
4498    if (!CheckBlock(block, state, chainstate.m_chainman.GetConsensus(), /*fCheckPow=*/check_pow, /*fCheckMerkleRoot=*/check_merkle_root)) {
4499        // This should never happen, but belt-and-suspenders don't approve the
4500        // block if it does.