1// Copyright (c) 2019-present The Bitcoin Core developers
2// Distributed under the MIT software license, see the accompanying
3// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5#include <wallet/scriptpubkeyman.h>
6
7#include <coins.h>
8#include <hash.h>
9#include <key_io.h>
10#include <node/types.h>
11#include <outputtype.h>
12#include <script/descriptor.h>
13#include <script/script.h>
14#include <script/sign.h>
15#include <script/solver.h>
16#include <util/bip32.h>
17#include <util/check.h>
18#include <util/log.h>
19#include <util/strencodings.h>
20#include <util/string.h>
21#include <util/time.h>
22#include <util/translation.h>
23
24#include <optional>
25
26using common::PSBTError;
27using util::ToString;
28
29namespace wallet {
30
31typedef std::vector<unsigned char> valtype;
32
33// Legacy wallet IsMine(). Used only in migration
34// DO NOT USE ANYTHING IN THIS NAMESPACE OUTSIDE OF MIGRATION
35namespace {
36
37/**
38 * This is an enum that tracks the execution context of a script, similar to
39 * SigVersion in script/interpreter. It is separate however because we want to
40 * distinguish between top-level scriptPubKey execution and P2SH redeemScript
41 * execution (a distinction that has no impact on consensus rules).
42 */
43enum class IsMineSigVersion
44{
45    TOP = 0,        //!< scriptPubKey execution
46    P2SH = 1,       //!< P2SH redeemScript
47    WITNESS_V0 = 2, //!< P2WSH witness script execution
48};
49
50/**
51 * This is an internal representation of isminetype + invalidity.
52 * Its order is significant, as we return the max of all explored
53 * possibilities.
54 */
55enum class IsMineResult
56{
57    NO = 0,         //!< Not ours
58    WATCH_ONLY = 1, //!< Included in watch-only balance
59    SPENDABLE = 2,  //!< Included in all balances
60    INVALID = 3,    //!< Not spendable by anyone (uncompressed pubkey in segwit, P2SH inside P2SH or witness, witness inside witness)
61};
62
63bool PermitsUncompressed(IsMineSigVersion sigversion)
64{
65    return sigversion == IsMineSigVersion::TOP || sigversion == IsMineSigVersion::P2SH;
66}
67
68bool HaveKeys(const std::vector<valtype>& pubkeys, const LegacyDataSPKM& keystore)
69{
70    for (const valtype& pubkey : pubkeys) {
71        CKeyID keyID = CPubKey(pubkey).GetID();
72        if (!keystore.HaveKey(keyID)) return false;
73    }
74    return true;
75}
76
77//! Recursively solve script and return spendable/watchonly/invalid status.
78//!
79//! @param keystore            legacy key and script store
80//! @param scriptPubKey        script to solve
81//! @param sigversion          script type (top-level / redeemscript / witnessscript)
82//! @param recurse_scripthash  whether to recurse into nested p2sh and p2wsh
83//!                            scripts or simply treat any script that has been
84//!                            stored in the keystore as spendable
85// NOLINTNEXTLINE(misc-no-recursion)
86IsMineResult LegacyWalletIsMineInnerDONOTUSE(const LegacyDataSPKM& keystore, const CScript& scriptPubKey, IsMineSigVersion sigversion, bool recurse_scripthash=true)
87{
88    IsMineResult ret = IsMineResult::NO;
89
90    std::vector<valtype> vSolutions;
91    TxoutType whichType = Solver(scriptPubKey, vSolutions);
92
93    CKeyID keyID;
94    switch (whichType) {
95    case TxoutType::NONSTANDARD:
96    case TxoutType::NULL_DATA:
97    case TxoutType::WITNESS_UNKNOWN:
98    case TxoutType::WITNESS_V1_TAPROOT:
99    case TxoutType::ANCHOR:
100        break;
101    case TxoutType::PUBKEY:
102        keyID = CPubKey(vSolutions[0]).GetID();
103        if (!PermitsUncompressed(sigversion) && vSolutions[0].size() != 33) {
104            return IsMineResult::INVALID;
105        }
106        if (keystore.HaveKey(keyID)) {
107            ret = std::max(ret, IsMineResult::SPENDABLE);
108        }
109        break;
110    case TxoutType::WITNESS_V0_KEYHASH:
111    {
112        if (sigversion == IsMineSigVersion::WITNESS_V0) {
113            // P2WPKH inside P2WSH is invalid.
114            return IsMineResult::INVALID;
115        }
116        if (sigversion == IsMineSigVersion::TOP && !keystore.HaveCScript(CScriptID(CScript() << OP_0 << vSolutions[0]))) {
117            // We do not support bare witness outputs unless the P2SH version of it would be
118            // acceptable as well. This protects against matching before segwit activates.
119            // This also applies to the P2WSH case.
120            break;
121        }
122        ret = std::max(ret, LegacyWalletIsMineInnerDONOTUSE(keystore, GetScriptForDestination(PKHash(uint160(vSolutions[0]))), IsMineSigVersion::WITNESS_V0));
123        break;
124    }
125    case TxoutType::PUBKEYHASH:
126        keyID = CKeyID(uint160(vSolutions[0]));
127        if (!PermitsUncompressed(sigversion)) {
128            CPubKey pubkey;
129            if (keystore.GetPubKey(keyID, pubkey) && !pubkey.IsCompressed()) {
130                return IsMineResult::INVALID;
131            }
132        }
133        if (keystore.HaveKey(keyID)) {
134            ret = std::max(ret, IsMineResult::SPENDABLE);
135        }
136        break;
137    case TxoutType::SCRIPTHASH:
138    {
139        if (sigversion != IsMineSigVersion::TOP) {
140            // P2SH inside P2WSH or P2SH is invalid.
141            return IsMineResult::INVALID;
142        }
143        CScriptID scriptID = CScriptID(uint160(vSolutions[0]));
144        CScript subscript;
145        if (keystore.GetCScript(scriptID, subscript)) {
146            ret = std::max(ret, recurse_scripthash ? LegacyWalletIsMineInnerDONOTUSE(keystore, subscript, IsMineSigVersion::P2SH) : IsMineResult::SPENDABLE);
147        }
148        break;
149    }
150    case TxoutType::WITNESS_V0_SCRIPTHASH:
151    {
152        if (sigversion == IsMineSigVersion::WITNESS_V0) {
153            // P2WSH inside P2WSH is invalid.
154            return IsMineResult::INVALID;
155        }
156        if (sigversion == IsMineSigVersion::TOP && !keystore.HaveCScript(CScriptID(CScript() << OP_0 << vSolutions[0]))) {
157            break;
158        }
159        CScriptID scriptID{RIPEMD160(vSolutions[0])};
160        CScript subscript;
161        if (keystore.GetCScript(scriptID, subscript)) {
162            ret = std::max(ret, recurse_scripthash ? LegacyWalletIsMineInnerDONOTUSE(keystore, subscript, IsMineSigVersion::WITNESS_V0) : IsMineResult::SPENDABLE);
163        }
164        break;
165    }
166
167    case TxoutType::MULTISIG:
168    {
169        // Never treat bare multisig outputs as ours (they can still be made watchonly-though)
170        if (sigversion == IsMineSigVersion::TOP) {
171            break;
172        }
173
174        // Only consider transactions "mine" if we own ALL the
175        // keys involved. Multi-signature transactions that are
176        // partially owned (somebody else has a key that can spend
177        // them) enable spend-out-from-under-you attacks, especially
178        // in shared-wallet situations.
179        std::vector<valtype> keys(vSolutions.begin()+1, vSolutions.begin()+vSolutions.size()-1);
180        if (!PermitsUncompressed(sigversion)) {
181            for (size_t i = 0; i < keys.size(); i++) {
182                if (keys[i].size() != 33) {
183                    return IsMineResult::INVALID;
184                }
185            }
186        }
187        if (HaveKeys(keys, keystore)) {
188            ret = std::max(ret, IsMineResult::SPENDABLE);
189        }
190        break;
191    }
192    } // no default case, so the compiler can warn about missing cases
193
194    if (ret == IsMineResult::NO && keystore.HaveWatchOnly(scriptPubKey)) {
195        ret = std::max(ret, IsMineResult::WATCH_ONLY);
196    }
197    return ret;
198}
199
200} // namespace
201
202bool LegacyDataSPKM::IsMine(const CScript& script) const
203{
204    switch (LegacyWalletIsMineInnerDONOTUSE(*this, script, IsMineSigVersion::TOP)) {
205    case IsMineResult::INVALID:
206    case IsMineResult::NO:
207        return false;
208    case IsMineResult::WATCH_ONLY:
209    case IsMineResult::SPENDABLE:
210        return true;
211    }
212    assert(false);
213}
214
215bool LegacyDataSPKM::CheckDecryptionKey(const CKeyingMaterial& master_key)
216{
217    {
218        LOCK(cs_KeyStore);
219        assert(mapKeys.empty());
220
221        bool keyPass = mapCryptedKeys.empty(); // Always pass when there are no encrypted keys
222        bool keyFail = false;
223        CryptedKeyMap::const_iterator mi = mapCryptedKeys.begin();
224        WalletBatch batch(m_storage.GetDatabase());
225        for (; mi != mapCryptedKeys.end(); ++mi)
226        {
227            const CPubKey &vchPubKey = (*mi).second.first;
228            const std::vector<unsigned char> &vchCryptedSecret = (*mi).second.second;
229            CKey key;
230            if (!DecryptKey(master_key, vchCryptedSecret, vchPubKey, key))
231            {
232                keyFail = true;
233                break;
234            }
235            keyPass = true;
236            if (fDecryptionThoroughlyChecked)
237                break;
238            else {
239                // Rewrite these encrypted keys with checksums
240                batch.WriteCryptedKey(vchPubKey, vchCryptedSecret, mapKeyMetadata[vchPubKey.GetID()]);
241            }
242        }
243        if (keyPass && keyFail)
244        {
245            LogWarning("The wallet is probably corrupted: Some keys decrypt but not all.");
246            throw std::runtime_error("Error unlocking wallet: some keys decrypt but not all. Your wallet file may be corrupt.");
247        }
248        if (keyFail || !keyPass)
249            return false;
250        fDecryptionThoroughlyChecked = true;