Inside Bitcoin

1501
1502        # Should fail policy test.
1503        test_transaction_acceptance(self.nodes[0], self.test_node, tx3, True, False, 'mempool-script-verify-flag-failed (Using non-compressed keys in segwit)')
1504        # But passes consensus.
1505        block = self.build_next_block()
1506        self.update_witness_block_with_transactions(block, [tx3])
1507        test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1508
1509        # Test 3: P2SH(P2WSH)
1510        # Try to spend the P2SH output created in the last test.
1511        # Send it to a P2PKH output, which we'll use in the next test.
1512        script_pubkey = keyhash_to_p2pkh_script(pubkeyhash)
1513        tx4 = CTransaction()
1514        tx4.vin.append(CTxIn(COutPoint(tx3.txid_int, 0), script_sig))
1515        tx4.vout.append(CTxOut(tx3.vout[0].nValue - 1000, script_pubkey))
1516        tx4.wit.vtxinwit.append(CTxInWitness())
1517        sign_p2pk_witness_input(witness_script, tx4, 0, SIGHASH_ALL, tx3.vout[0].nValue, key)
1518
1519        # Should fail policy test.
1520        test_transaction_acceptance(self.nodes[0], self.test_node, tx4, True, False, 'mempool-script-verify-flag-failed (Using non-compressed keys in segwit)')
1521        block = self.build_next_block()
1522        self.update_witness_block_with_transactions(block, [tx4])
1523        test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1524
1525        # Test 4: Uncompressed pubkeys should still be valid in non-segwit
1526        # transactions.
1527        tx5 = CTransaction()
1528        tx5.vin.append(CTxIn(COutPoint(tx4.txid_int, 0), b""))
1529        tx5.vout.append(CTxOut(tx4.vout[0].nValue - 1000, CScript([OP_TRUE])))
1530        tx5.vin[0].scriptSig = CScript([pubkey])
1531        sign_input_legacy(tx5, 0, script_pubkey, key)
1532        # Should pass policy and consensus.
1533        test_transaction_acceptance(self.nodes[0], self.test_node, tx5, True, True)
1534        block = self.build_next_block()
1535        self.update_witness_block_with_transactions(block, [tx5])
1536        test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1537        self.utxo.append(UTXO(tx5.txid_int, 0, tx5.vout[0].nValue))
1538
1539    @subtest
1540    def test_signature_version_1(self):
1541        key, pubkey = generate_keypair()
1542        witness_script = key_to_p2pk_script(pubkey)
1543        script_pubkey = script_to_p2wsh_script(witness_script)
1544
1545        # First create a witness output for use in the tests.
1546        tx = CTransaction()
1547        tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
1548        tx.vout.append(CTxOut(self.utxo[0].nValue - 1000, script_pubkey))
1549
1550        test_transaction_acceptance(self.nodes[0], self.test_node, tx, with_witness=True, accepted=True)
1551        # Mine this transaction in preparation for following tests.
1552        block = self.build_next_block()
1553        self.update_witness_block_with_transactions(block, [tx])
1554        test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1555        self.sync_blocks()
1556        self.utxo.pop(0)
1557
1558        # Test each hashtype
1559        prev_utxo = UTXO(tx.txid_int, 0, tx.vout[0].nValue)
1560        for sigflag in [0, SIGHASH_ANYONECANPAY]:
1561            for hashtype in [SIGHASH_ALL, SIGHASH_NONE, SIGHASH_SINGLE]:
1562                hashtype |= sigflag
1563                block = self.build_next_block()
1564                tx = CTransaction()
1565                tx.vin.append(CTxIn(COutPoint(prev_utxo.sha256, prev_utxo.n), b""))
1566                tx.vout.append(CTxOut(prev_utxo.nValue - 1000, script_pubkey))
1567                tx.wit.vtxinwit.append(CTxInWitness())
1568                # Too-large input value
1569                sign_p2pk_witness_input(witness_script, tx, 0, hashtype, prev_utxo.nValue + 1, key)
1570                self.update_witness_block_with_transactions(block, [tx])
1571                test_witness_block(self.nodes[0], self.test_node, block, accepted=False,
1572                                   reason='block-script-verify-flag-failed (Script evaluated without error '
1573                                          'but finished with a false/empty top stack element')
1574
1575                # Too-small input value
1576                sign_p2pk_witness_input(witness_script, tx, 0, hashtype, prev_utxo.nValue - 1, key)
1577                block.vtx.pop()  # remove last tx
1578                self.update_witness_block_with_transactions(block, [tx])
1579                test_witness_block(self.nodes[0], self.test_node, block, accepted=False,
1580                                   reason='block-script-verify-flag-failed (Script evaluated without error '
1581                                          'but finished with a false/empty top stack element')
1582
1583                # Now try correct value
1584                sign_p2pk_witness_input(witness_script, tx, 0, hashtype, prev_utxo.nValue, key)
1585                block.vtx.pop()
1586                self.update_witness_block_with_transactions(block, [tx])
1587                test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1588
1589                prev_utxo = UTXO(tx.txid_int, 0, tx.vout[0].nValue)
1590
1591        # Test combinations of signature hashes.
1592        # Split the utxo into a lot of outputs.
1593        # Randomly choose up to 10 to spend, sign with different hashtypes, and
1594        # output to a random number of outputs.  Repeat NUM_SIGHASH_TESTS times.
1595        # Ensure that we've tested a situation where we use SIGHASH_SINGLE with
1596        # an input index > number of outputs.
1597        NUM_SIGHASH_TESTS = 500
1598        temp_utxos = []
1599        tx = CTransaction()
1600        tx.vin.append(CTxIn(COutPoint(prev_utxo.sha256, prev_utxo.n), b""))
1601        split_value = prev_utxo.nValue // NUM_SIGHASH_TESTS
1602        for _ in range(NUM_SIGHASH_TESTS):
1603            tx.vout.append(CTxOut(split_value, script_pubkey))
1604        tx.wit.vtxinwit.append(CTxInWitness())
1605        sign_p2pk_witness_input(witness_script, tx, 0, SIGHASH_ALL, prev_utxo.nValue, key)
1606        for i in range(NUM_SIGHASH_TESTS):
1607            temp_utxos.append(UTXO(tx.txid_int, i, split_value))
1608
1609        block = self.build_next_block()
1610        self.update_witness_block_with_transactions(block, [tx])
1611        test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1612
1613        block = self.build_next_block()
1614        used_sighash_single_out_of_bounds = False
1615        for i in range(NUM_SIGHASH_TESTS):
1616            # Ping regularly to keep the connection alive
1617            if (not i % 100):
1618                self.test_node.sync_with_ping()
1619            # Choose random number of inputs to use.
1620            num_inputs = random.randint(1, 10)
1621            # Create a slight bias for producing more utxos
1622            num_outputs = random.randint(1, 11)
1623            random.shuffle(temp_utxos)
1624            assert len(temp_utxos) > num_inputs
1625            tx = CTransaction()
1626            total_value = 0
1627            for i in range(num_inputs):
1628                tx.vin.append(CTxIn(COutPoint(temp_utxos[i].sha256, temp_utxos[i].n), b""))
1629                tx.wit.vtxinwit.append(CTxInWitness())
1630                total_value += temp_utxos[i].nValue
1631            split_value = total_value // num_outputs
1632            for _ in range(num_outputs):
1633                tx.vout.append(CTxOut(split_value, script_pubkey))
1634            for i in range(num_inputs):
1635                # Now try to sign each input, using a random hashtype.
1636                anyonecanpay = 0
1637                if random.randint(0, 1):
1638                    anyonecanpay = SIGHASH_ANYONECANPAY
1639                hashtype = random.randint(1, 3) | anyonecanpay
1640                sign_p2pk_witness_input(witness_script, tx, i, hashtype, temp_utxos[i].nValue, key)
1641                if (hashtype == SIGHASH_SINGLE and i >= num_outputs):
1642                    used_sighash_single_out_of_bounds = True
1643            for i in range(num_outputs):
1644                temp_utxos.append(UTXO(tx.txid_int, i, split_value))
1645            temp_utxos = temp_utxos[num_inputs:]
1646
1647            block.vtx.append(tx)
1648
1649            # Test the block periodically, if we're close to maxblocksize
1650            if block.get_weight() > MAX_BLOCK_WEIGHT - 4000:
1651                self.update_witness_block_with_transactions(block, [])
1652                test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1653                block = self.build_next_block()
1654
1655        if (not used_sighash_single_out_of_bounds):
1656            self.log.info("WARNING: this test run didn't attempt SIGHASH_SINGLE with out-of-bounds index value")
1657        # Test the transactions we've added to the block
1658        if (len(block.vtx) > 1):
1659            self.update_witness_block_with_transactions(block, [])
1660            test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1661
1662        # Now test witness version 0 P2PKH transactions
1663        pubkeyhash = hash160(pubkey)
1664        script_pkh = key_to_p2wpkh_script(pubkey)
1665        tx = CTransaction()
1666        tx.vin.append(CTxIn(COutPoint(temp_utxos[0].sha256, temp_utxos[0].n), b""))
1667        tx.vout.append(CTxOut(temp_utxos[0].nValue, script_pkh))
1668        tx.wit.vtxinwit.append(CTxInWitness())
1669        sign_p2pk_witness_input(witness_script, tx, 0, SIGHASH_ALL, temp_utxos[0].nValue, key)
1670        tx2 = CTransaction()
1671        tx2.vin.append(CTxIn(COutPoint(tx.txid_int, 0), b""))
1672        tx2.vout.append(CTxOut(tx.vout[0].nValue, CScript([OP_TRUE])))
1673
1674        script = keyhash_to_p2pkh_script(pubkeyhash)
1675        tx2.wit.vtxinwit.append(CTxInWitness())
1676        sign_input_segwitv0(tx2, 0, script, tx.vout[0].nValue, key)
1677        signature = tx2.wit.vtxinwit[0].scriptWitness.stack.pop()
1678
1679        # Check that we can't have a scriptSig
1680        tx2.vin[0].scriptSig = CScript([signature, pubkey])
1681        block = self.build_next_block()
1682        self.update_witness_block_with_transactions(block, [tx, tx2])
1683        test_witness_block(self.nodes[0], self.test_node, block, accepted=False,
1684                           reason='block-script-verify-flag-failed (Witness requires empty scriptSig)')
1685
1686        # Move the signature to the witness.
1687        block.vtx.pop()
1688        tx2.wit.vtxinwit.append(CTxInWitness())
1689        tx2.wit.vtxinwit[0].scriptWitness.stack = [signature, pubkey]
1690        tx2.vin[0].scriptSig = b""
1691
1692        self.update_witness_block_with_transactions(block, [tx2])
1693        test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1694
1695        temp_utxos.pop(0)
1696
1697        # Update self.utxos for later tests by creating two outputs
1698        # that consolidate all the coins in temp_utxos.
1699        output_value = sum(i.nValue for i in temp_utxos) // 2
1700
1701        tx = CTransaction()
1702        index = 0
1703        # Just spend to our usual anyone-can-spend output
1704        tx.vout = [CTxOut(output_value, CScript([OP_TRUE]))] * 2
1705        for i in temp_utxos:
1706            # Use SIGHASH_ALL|SIGHASH_ANYONECANPAY so we can build up
1707            # the signatures as we go.
1708            tx.vin.append(CTxIn(COutPoint(i.sha256, i.n), b""))
1709            tx.wit.vtxinwit.append(CTxInWitness())
1710            sign_p2pk_witness_input(witness_script, tx, index, SIGHASH_ALL | SIGHASH_ANYONECANPAY, i.nValue, key)
1711            index += 1
1712        block = self.build_next_block()
1713        self.update_witness_block_with_transactions(block, [tx])
1714        test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1715
1716        for i in range(len(tx.vout)):
1717            self.utxo.append(UTXO(tx.txid_int, i, tx.vout[i].nValue))
1718
1719    @subtest
1720    def test_non_standard_witness_blinding(self):
1721        """Test behavior of unnecessary witnesses in transactions does not blind the node for the transaction"""
1722
1723        # Create a p2sh output -- this is so we can pass the standardness
1724        # rules (an anyone-can-spend OP_TRUE would be rejected, if not wrapped
1725        # in P2SH).
1726        p2sh_program = CScript([OP_TRUE])
1727        script_pubkey = script_to_p2sh_script(p2sh_program)
1728
1729        # Now check that unnecessary witnesses can't be used to blind a node
1730        # to a transaction, eg by violating standardness checks.
1731        tx = CTransaction()
1732        tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
1733        tx.vout.append(CTxOut(self.utxo[0].nValue - 1000, script_pubkey))
1734        test_transaction_acceptance(self.nodes[0], self.test_node, tx, False, True)
1735        self.generate(self.nodes[0], 1)
1736
1737        # We'll add an unnecessary witness to this transaction that would cause
1738        # it to be non-standard, to test that violating policy with a witness
1739        # doesn't blind a node to a transaction.  Transactions
1740        # rejected for having a witness shouldn't be added
1741        # to the rejection cache.
1742        tx2 = CTransaction()
1743        tx2.vin.append(CTxIn(COutPoint(tx.txid_int, 0), CScript([p2sh_program])))
1744        tx2.vout.append(CTxOut(tx.vout[0].nValue - 1000, script_pubkey))
1745        tx2.wit.vtxinwit.append(CTxInWitness())
1746        tx2.wit.vtxinwit[0].scriptWitness.stack = [b'a' * 400]
1747        # This will be rejected due to a policy check:
1748        # No witness is allowed, since it is not a witness program but a p2sh program
1749        test_transaction_acceptance(self.nodes[1], self.std_node, tx2, True, False, 'bad-witness-nonstandard')
1750