fedimint_tonic_lnd/

lib.rs

/// This is part of public interface so it's re-exported.
pub use tonic;

pub use error::ConnectError;
use error::InternalConnectError;
use hyper::Uri;
use hyper_util::client::legacy::connect::HttpConnector;
use std::path::{Path, PathBuf};
use std::str::FromStr;
use tonic::codegen::InterceptedService;

type Service = InterceptedService<
    hyper_util::client::legacy::Client<
        hyper_rustls::HttpsConnector<HttpConnector>,
        tonic::body::Body,
    >,
    MacaroonInterceptor,
>;

/// Convenience type alias for lightning client.
#[cfg(feature = "lightningrpc")]
pub type LightningClient = lnrpc::lightning_client::LightningClient<Service>;

/// Convenience type alias for wallet client.
#[cfg(feature = "walletrpc")]
pub type WalletKitClient = walletrpc::wallet_kit_client::WalletKitClient<Service>;

/// Convenience type alias for peers service client.
#[cfg(feature = "peersrpc")]
pub type PeersClient = peersrpc::peers_client::PeersClient<Service>;

/// Convenience type alias for versioner service client.
#[cfg(feature = "versionrpc")]
pub type VersionerClient = verrpc::versioner_client::VersionerClient<Service>;

/// Convenience type alias for signer client.
#[cfg(feature = "signrpc")]
pub type SignerClient = signrpc::signer_client::SignerClient<Service>;

/// Convenience type alias for router client.
#[cfg(feature = "routerrpc")]
pub type RouterClient = routerrpc::router_client::RouterClient<Service>;

/// Convenience type alias for invoices client.
#[cfg(feature = "invoicesrpc")]
pub type InvoicesClient = invoicesrpc::invoices_client::InvoicesClient<Service>;

/// Convenience type alias for state service client.
#[cfg(feature = "staterpc")]
pub type StateClient = staterpc::state_client::StateClient<Service>;

/// The client returned by `connect` function
///
/// This is a convenience type which you most likely want to use instead of raw client.
#[derive(Clone)]
pub struct Client {
    #[cfg(feature = "lightningrpc")]
    lightning: LightningClient,
    #[cfg(feature = "walletrpc")]
    wallet: WalletKitClient,
    #[cfg(feature = "signrpc")]
    signer: SignerClient,
    #[cfg(feature = "peersrpc")]
    peers: PeersClient,
    #[cfg(feature = "versionrpc")]
    version: VersionerClient,
    #[cfg(feature = "routerrpc")]
    router: RouterClient,
    #[cfg(feature = "invoicesrpc")]
    invoices: InvoicesClient,
    #[cfg(feature = "staterpc")]
    state: StateClient,
}

impl Client {
    /// Returns the lightning client.
    #[cfg(feature = "lightningrpc")]
    pub fn lightning(&mut self) -> &mut LightningClient {
        &mut self.lightning
    }

    /// Returns the wallet client.
    #[cfg(feature = "walletrpc")]
    pub fn wallet(&mut self) -> &mut WalletKitClient {
        &mut self.wallet
    }

    /// Returns the signer client.
    #[cfg(feature = "signrpc")]
    pub fn signer(&mut self) -> &mut SignerClient {
        &mut self.signer
    }

    /// Returns the versioner client.
    #[cfg(feature = "versionrpc")]
    pub fn versioner(&mut self) -> &mut VersionerClient {
        &mut self.version
    }

    /// Returns the peers client.
    #[cfg(feature = "peersrpc")]
    pub fn peers(&mut self) -> &mut PeersClient {
        &mut self.peers
    }

    /// Returns the router client.
    #[cfg(feature = "routerrpc")]
    pub fn router(&mut self) -> &mut RouterClient {
        &mut self.router
    }

    /// Returns the invoices client.
    #[cfg(feature = "invoicesrpc")]
    pub fn invoices(&mut self) -> &mut InvoicesClient {
        &mut self.invoices
    }

    /// Returns the state service client.
    #[cfg(feature = "staterpc")]
    pub fn state(&mut self) -> &mut StateClient {
        &mut self.state
    }
}

/// [`tonic::Status`] is re-exported as `Error` for convenience.
pub type Error = tonic::Status;

mod error;

macro_rules! try_map_err {
    ($result:expr, $mapfn:expr) => {
        match $result {
            Ok(value) => value,
            Err(error) => return Err($mapfn(error).into()),
        }
    };
}

/// Messages and other types generated by `tonic`/`prost`
///
/// This is the go-to module you will need to look in to find documentation on various message
/// types. However it may be better to start from methods on the [`LightningClient`](lnrpc::lightning_client::LightningClient) type.
#[cfg(feature = "lightningrpc")]
pub mod lnrpc {
    tonic::include_proto!("lnrpc");
}

#[cfg(feature = "walletrpc")]
pub mod walletrpc {
    tonic::include_proto!("walletrpc");
}

#[cfg(feature = "signrpc")]
pub mod signrpc {
    tonic::include_proto!("signrpc");
}

#[cfg(feature = "peersrpc")]
pub mod peersrpc {
    tonic::include_proto!("peersrpc");
}

#[cfg(feature = "routerrpc")]
pub mod routerrpc {
    tonic::include_proto!("routerrpc");
}

#[cfg(feature = "versionrpc")]
pub mod verrpc {
    tonic::include_proto!("verrpc");
}

#[cfg(feature = "invoicesrpc")]
pub mod invoicesrpc {
    tonic::include_proto!("invoicesrpc");
}

#[cfg(feature = "staterpc")]
pub mod staterpc {
    tonic::include_proto!("staterpc");
}

/// Supplies requests with macaroon
#[derive(Clone)]
pub struct MacaroonInterceptor {
    macaroon: String,
}

impl tonic::service::Interceptor for MacaroonInterceptor {
    fn call(&mut self, mut request: tonic::Request<()>) -> Result<tonic::Request<()>, Error> {
        request.metadata_mut().insert(
            "macaroon",
            tonic::metadata::MetadataValue::from_str(&self.macaroon)
                .expect("hex produced non-ascii"),
        );
        Ok(request)
    }
}

async fn load_macaroon(
    path: impl AsRef<Path> + Into<PathBuf>,
) -> Result<String, InternalConnectError> {
    let macaroon =
        tokio::fs::read(&path)
            .await
            .map_err(|error| InternalConnectError::ReadFile {
                file: path.into(),
                error,
            })?;
    Ok(hex::encode(macaroon))
}

/// Connects to LND using given address and credentials
///
/// This function does all required processing of the cert file and macaroon file, so that you
/// don't have to. The address must begin with "https://", though.
///
/// This is considered the recommended way to connect to LND. An alternative function to use
/// already-read certificate or macaroon data is currently **not** provided to discourage such use.
/// LND occasionally changes that data which would lead to errors and in turn in worse application.
///
/// If you have a motivating use case for use of direct data feel free to open an issue and
/// explain.
#[cfg_attr(feature = "tracing", tracing::instrument(name = "Connecting to LND"))]
pub async fn connect<CP, MP>(
    address: String,
    cert_file: CP,
    macaroon_file: MP,
) -> Result<Client, ConnectError>
where
    CP: AsRef<Path> + Into<PathBuf> + std::fmt::Debug,
    MP: AsRef<Path> + Into<PathBuf> + std::fmt::Debug,
{
    let connector = hyper_rustls::HttpsConnectorBuilder::new()
        .with_tls_config(tls::config(cert_file).await?)
        .https_or_http()
        .enable_http2()
        .build();
    let client = hyper_util::client::legacy::Client::builder(hyper_util::rt::TokioExecutor::new())
        .build(connector);

    // The client implements Service trait directly
    let macaroon = load_macaroon(macaroon_file).await?;

    let svc = InterceptedService::new(client, MacaroonInterceptor { macaroon });
    let uri =
        Uri::from_str(address.as_str()).map_err(|error| InternalConnectError::InvalidAddress {
            address,
            error: Box::new(error),
        })?;

    let client = Client {
        #[cfg(feature = "lightningrpc")]
        lightning: lnrpc::lightning_client::LightningClient::with_origin(svc.clone(), uri.clone()),
        #[cfg(feature = "walletrpc")]
        wallet: walletrpc::wallet_kit_client::WalletKitClient::with_origin(
            svc.clone(),
            uri.clone(),
        ),
        #[cfg(feature = "peersrpc")]
        peers: peersrpc::peers_client::PeersClient::with_origin(svc.clone(), uri.clone()),
        #[cfg(feature = "signrpc")]
        signer: signrpc::signer_client::SignerClient::with_origin(svc.clone(), uri.clone()),
        #[cfg(feature = "versionrpc")]
        version: verrpc::versioner_client::VersionerClient::with_origin(svc.clone(), uri.clone()),
        #[cfg(feature = "routerrpc")]
        router: routerrpc::router_client::RouterClient::with_origin(svc.clone(), uri.clone()),
        #[cfg(feature = "invoicesrpc")]
        invoices: invoicesrpc::invoices_client::InvoicesClient::with_origin(
            svc.clone(),
            uri.clone(),
        ),
        #[cfg(feature = "staterpc")]
        state: staterpc::state_client::StateClient::with_origin(svc.clone(), uri.clone()),
    };
    Ok(client)
}

mod tls {
    use crate::error::{ConnectError, InternalConnectError};
    use rustls::client::danger::ServerCertVerifier;
    use rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified};
    use rustls::crypto::CryptoProvider;
    use rustls::crypto::WebPkiSupportedAlgorithms;
    use rustls::pki_types::{CertificateDer, ServerName, UnixTime};
    use rustls::{client::ClientConfig, DigitallySignedStruct, Error as TLSError, SignatureScheme};
    use std::{
        path::{Path, PathBuf},
        sync::Arc,
    };

    pub(crate) async fn config(
        path: impl AsRef<Path> + Into<PathBuf>,
    ) -> Result<ClientConfig, ConnectError> {
        Ok(ClientConfig::builder()
            .dangerous()
            .with_custom_certificate_verifier(Arc::new(CertVerifier::load(path).await?))
            .with_no_client_auth())
    }

    #[derive(Debug)]
    pub(crate) struct CertVerifier {
        certs: Vec<Vec<u8>>,
        supported_algs: WebPkiSupportedAlgorithms,
    }

    impl CertVerifier {
        pub(crate) async fn load(
            path: impl AsRef<Path> + Into<PathBuf>,
        ) -> Result<Self, InternalConnectError> {
            let contents = try_map_err!(tokio::fs::read(&path).await, |error| {
                InternalConnectError::ReadFile {
                    file: path.into(),
                    error,
                }
            });
            let mut reader = &*contents;

            let cert_der_vec = rustls_pemfile::certs(&mut reader).map_err(|error| {
                InternalConnectError::ParseCert {
                    file: path.into(),
                    error,
                }
            })?;
            let certs: Vec<Vec<u8>> = cert_der_vec
                .into_iter()
                .map(|cert_der| cert_der.to_vec())
                .collect();

            let provider = CryptoProvider::get_default()
                .clone()
                .expect("Must install default crypto provider");

            Ok(CertVerifier {
                certs,
                supported_algs: provider.signature_verification_algorithms,
            })
        }
    }

    impl ServerCertVerifier for CertVerifier {
        fn verify_server_cert(
            &self,
            end_entity: &CertificateDer,
            intermediates: &[CertificateDer],
            _server_name: &ServerName,
            _ocsp_response: &[u8],
            _now: UnixTime,
        ) -> Result<ServerCertVerified, TLSError> {
            let mut certs = intermediates
                .iter()
                .map(|c| c.as_ref().to_vec())
                .collect::<Vec<Vec<u8>>>();
            certs.push(end_entity.as_ref().to_vec());
            certs.sort();

            let mut our_certs = self.certs.clone();
            our_certs.sort();

            if self.certs.len() != certs.len() {
                return Err(TLSError::General(format!(
                    "Mismatched number of certificates (Expected: {}, Presented: {})",
                    self.certs.len(),
                    certs.len()
                )));
            }
            for (c, p) in our_certs.iter().zip(certs.iter()) {
                if *p != *c {
                    return Err(TLSError::General(
                        "Server certificates do not match ours".to_string(),
                    ));
                }
            }
            Ok(ServerCertVerified::assertion())
        }

        fn verify_tls12_signature(
            &self,
            message: &[u8],
            cert: &CertificateDer,
            dss: &DigitallySignedStruct,
        ) -> Result<HandshakeSignatureValid, TLSError> {
            rustls::crypto::verify_tls12_signature(message, cert, dss, &self.supported_algs)
        }

        fn verify_tls13_signature(
            &self,
            message: &[u8],
            cert: &CertificateDer,
            dss: &DigitallySignedStruct,
        ) -> Result<HandshakeSignatureValid, TLSError> {
            rustls::crypto::verify_tls13_signature(message, cert, dss, &self.supported_algs)
        }

        fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
            self.supported_algs.supported_schemes()
        }
    }
}