438 lines
18 KiB
Rust
438 lines
18 KiB
Rust
// SPDX-License-Identifier: CC0-1.0
|
|
|
|
//! A witness.
|
|
//!
|
|
//! This module contains the [`Witness`] struct and related methods to operate on it
|
|
|
|
use internals::compact_size;
|
|
use io::{BufRead, Write};
|
|
|
|
use crate::consensus::encode::{self, Error, ReadExt, WriteExt, MAX_VEC_SIZE};
|
|
use crate::consensus::{Decodable, Encodable};
|
|
use crate::crypto::ecdsa;
|
|
use crate::prelude::Vec;
|
|
#[cfg(doc)]
|
|
use crate::script::ScriptExt as _;
|
|
use crate::taproot::{self, TAPROOT_ANNEX_PREFIX};
|
|
use crate::Script;
|
|
|
|
#[rustfmt::skip] // Keep public re-exports separate.
|
|
#[doc(inline)]
|
|
pub use primitives::witness::{Iter, Witness};
|
|
|
|
impl Decodable for Witness {
|
|
fn consensus_decode<R: BufRead + ?Sized>(r: &mut R) -> Result<Self, Error> {
|
|
let witness_elements = r.read_compact_size()? as usize;
|
|
// Minimum size of witness element is 1 byte, so if the count is
|
|
// greater than MAX_VEC_SIZE we must return an error.
|
|
if witness_elements > MAX_VEC_SIZE {
|
|
return Err(encode::ParseError::OversizedVectorAllocation {
|
|
requested: witness_elements,
|
|
max: MAX_VEC_SIZE,
|
|
}
|
|
.into());
|
|
}
|
|
if witness_elements == 0 {
|
|
Ok(Witness::default())
|
|
} else {
|
|
// Leave space at the head for element positions.
|
|
// We will rotate them to the end of the Vec later.
|
|
let witness_index_space = witness_elements * 4;
|
|
let mut cursor = witness_index_space;
|
|
|
|
// this number should be determined as high enough to cover most witness, and low enough
|
|
// to avoid wasting space without reallocating
|
|
let mut content = vec![0u8; cursor + 128];
|
|
|
|
for i in 0..witness_elements {
|
|
let element_size = r.read_compact_size()? as usize;
|
|
let element_size_len = compact_size::encoded_size(element_size);
|
|
let required_len = cursor
|
|
.checked_add(element_size)
|
|
.ok_or(encode::Error::Parse(encode::ParseError::OversizedVectorAllocation {
|
|
requested: usize::MAX,
|
|
max: MAX_VEC_SIZE,
|
|
}))?
|
|
.checked_add(element_size_len)
|
|
.ok_or(encode::Error::Parse(encode::ParseError::OversizedVectorAllocation {
|
|
requested: usize::MAX,
|
|
max: MAX_VEC_SIZE,
|
|
}))?;
|
|
|
|
if required_len > MAX_VEC_SIZE + witness_index_space {
|
|
return Err(encode::ParseError::OversizedVectorAllocation {
|
|
requested: required_len,
|
|
max: MAX_VEC_SIZE,
|
|
}
|
|
.into());
|
|
}
|
|
|
|
// We will do content.rotate_left(witness_index_space) later.
|
|
// Encode the position's value AFTER we rotate left.
|
|
encode_cursor(&mut content, 0, i, cursor - witness_index_space);
|
|
|
|
resize_if_needed(&mut content, required_len);
|
|
cursor += (&mut content[cursor..cursor + element_size_len])
|
|
.emit_compact_size(element_size)?;
|
|
r.read_exact(&mut content[cursor..cursor + element_size])?;
|
|
cursor += element_size;
|
|
}
|
|
content.truncate(cursor);
|
|
// Index space is now at the end of the Vec
|
|
content.rotate_left(witness_index_space);
|
|
let indices_start = cursor - witness_index_space;
|
|
Ok(Witness::from_parts__unstable(content, witness_elements, indices_start))
|
|
}
|
|
}
|
|
}
|
|
|
|
fn resize_if_needed(vec: &mut Vec<u8>, required_len: usize) {
|
|
if required_len >= vec.len() {
|
|
let mut new_len = vec.len().max(1);
|
|
while new_len <= required_len {
|
|
new_len *= 2;
|
|
}
|
|
vec.resize(new_len, 0);
|
|
}
|
|
}
|
|
|
|
impl Encodable for Witness {
|
|
// `self.content` includes the varints so encoding here includes them, as expected.
|
|
fn consensus_encode<W: Write + ?Sized>(&self, w: &mut W) -> Result<usize, io::Error> {
|
|
let mut written = w.emit_compact_size(self.len())?;
|
|
|
|
for element in self.iter() {
|
|
written += encode::consensus_encode_with_size(element, w)?
|
|
}
|
|
|
|
Ok(written)
|
|
}
|
|
}
|
|
|
|
crate::internal_macros::define_extension_trait! {
|
|
/// Extension functionality for the [`Witness`] type.
|
|
pub trait WitnessExt impl for Witness {
|
|
/// Creates a witness required to spend a P2WPKH output.
|
|
///
|
|
/// The witness will be made up of the DER encoded signature + sighash_type followed by the
|
|
/// serialized public key. Also useful for spending a P2SH-P2WPKH output.
|
|
///
|
|
/// It is expected that `pubkey` is related to the secret key used to create `signature`.
|
|
fn p2wpkh(signature: ecdsa::Signature, pubkey: secp256k1::PublicKey) -> Witness {
|
|
let mut witness = Witness::new();
|
|
witness.push(signature.serialize());
|
|
witness.push(pubkey.serialize());
|
|
witness
|
|
}
|
|
|
|
/// Creates a witness required to do a key path spend of a P2TR output.
|
|
fn p2tr_key_spend(signature: &taproot::Signature) -> Witness {
|
|
let mut witness = Witness::new();
|
|
witness.push(signature.serialize());
|
|
witness
|
|
}
|
|
|
|
/// Pushes, as a new element on the witness, an ECDSA signature.
|
|
///
|
|
/// Pushes the DER encoded signature + sighash_type, requires an allocation.
|
|
fn push_ecdsa_signature(&mut self, signature: ecdsa::Signature) {
|
|
self.push(signature.serialize())
|
|
}
|
|
|
|
/// Get Tapscript following BIP341 rules regarding accounting for an annex.
|
|
///
|
|
/// This does not guarantee that this represents a P2TR [`Witness`]. It
|
|
/// merely gets the second to last or third to last element depending on
|
|
/// the first byte of the last element being equal to 0x50.
|
|
///
|
|
/// See [`Script::is_p2tr`] to check whether this is actually a Taproot witness.
|
|
fn tapscript(&self) -> Option<&Script> {
|
|
self.last().and_then(|last| {
|
|
// From BIP341:
|
|
// If there are at least two witness elements, and the first byte of
|
|
// the last element is 0x50, this last element is called annex a
|
|
// and is removed from the witness stack.
|
|
if self.len() >= 3 && last.first() == Some(&TAPROOT_ANNEX_PREFIX) {
|
|
self.nth(self.len() - 3).map(Script::from_bytes)
|
|
} else if self.len() >= 2 {
|
|
self.nth(self.len() - 2).map(Script::from_bytes)
|
|
} else {
|
|
None
|
|
}
|
|
})
|
|
}
|
|
|
|
/// Get the taproot control block following BIP341 rules.
|
|
///
|
|
/// This does not guarantee that this represents a P2TR [`Witness`]. It
|
|
/// merely gets the last or second to last element depending on the first
|
|
/// byte of the last element being equal to 0x50.
|
|
///
|
|
/// See [`Script::is_p2tr`] to check whether this is actually a Taproot witness.
|
|
fn taproot_control_block(&self) -> Option<&[u8]> {
|
|
self.last().and_then(|last| {
|
|
// From BIP341:
|
|
// If there are at least two witness elements, and the first byte of
|
|
// the last element is 0x50, this last element is called annex a
|
|
// and is removed from the witness stack.
|
|
if self.len() >= 3 && last.first() == Some(&TAPROOT_ANNEX_PREFIX) {
|
|
self.nth(self.len() - 2)
|
|
} else if self.len() >= 2 {
|
|
Some(last)
|
|
} else {
|
|
None
|
|
}
|
|
})
|
|
}
|
|
|
|
/// Get the taproot annex following BIP341 rules.
|
|
///
|
|
/// This does not guarantee that this represents a P2TR [`Witness`].
|
|
///
|
|
/// See [`Script::is_p2tr`] to check whether this is actually a Taproot witness.
|
|
fn taproot_annex(&self) -> Option<&[u8]> {
|
|
self.last().and_then(|last| {
|
|
// From BIP341:
|
|
// If there are at least two witness elements, and the first byte of
|
|
// the last element is 0x50, this last element is called annex a
|
|
// and is removed from the witness stack.
|
|
if self.len() >= 2 && last.first() == Some(&TAPROOT_ANNEX_PREFIX) {
|
|
Some(last)
|
|
} else {
|
|
None
|
|
}
|
|
})
|
|
}
|
|
|
|
/// Get the p2wsh witness script following BIP141 rules.
|
|
///
|
|
/// This does not guarantee that this represents a P2WS [`Witness`].
|
|
///
|
|
/// See [`Script::is_p2wsh`] to check whether this is actually a P2WSH witness.
|
|
fn witness_script(&self) -> Option<&Script> { self.last().map(Script::from_bytes) }
|
|
|
|
}
|
|
}
|
|
|
|
mod sealed {
|
|
pub trait Sealed {}
|
|
impl Sealed for super::Witness {}
|
|
}
|
|
|
|
/// Correctness Requirements: value must always fit within u32
|
|
// This is duplicated in `primitives::witness`, if you change it please do so over there also.
|
|
#[inline]
|
|
fn encode_cursor(bytes: &mut [u8], start_of_indices: usize, index: usize, value: usize) {
|
|
let start = start_of_indices + index * 4;
|
|
let end = start + 4;
|
|
bytes[start..end]
|
|
.copy_from_slice(&u32::to_ne_bytes(value.try_into().expect("larger than u32")));
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod test {
|
|
use hex::test_hex_unwrap as hex;
|
|
|
|
use super::*;
|
|
use crate::consensus::{deserialize, encode, serialize};
|
|
use crate::hex::DisplayHex;
|
|
use crate::sighash::EcdsaSighashType;
|
|
use crate::Transaction;
|
|
|
|
#[test]
|
|
fn exact_sized_iterator() {
|
|
let mut witness = Witness::default();
|
|
for i in 0..5 {
|
|
assert_eq!(witness.iter().len(), i);
|
|
witness.push([0u8]);
|
|
}
|
|
let mut iter = witness.iter();
|
|
for i in (0..=5).rev() {
|
|
assert_eq!(iter.len(), i);
|
|
iter.next();
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn test_push_ecdsa_sig() {
|
|
// The very first signature in block 734,958
|
|
let sig_bytes =
|
|
hex!("304402207c800d698f4b0298c5aac830b822f011bb02df41eb114ade9a6702f364d5e39c0220366900d2a60cab903e77ef7dd415d46509b1f78ac78906e3296f495aa1b1b541");
|
|
let signature = secp256k1::ecdsa::Signature::from_der(&sig_bytes).unwrap();
|
|
let mut witness = Witness::default();
|
|
let signature = crate::ecdsa::Signature { signature, sighash_type: EcdsaSighashType::All };
|
|
witness.push_ecdsa_signature(signature);
|
|
let expected_witness = vec![hex!(
|
|
"304402207c800d698f4b0298c5aac830b822f011bb02df41eb114ade9a6702f364d5e39c0220366900d2a60cab903e77ef7dd415d46509b1f78ac78906e3296f495aa1b1b54101")
|
|
];
|
|
assert_eq!(witness.to_vec(), expected_witness);
|
|
}
|
|
|
|
#[test]
|
|
fn consensus_serialize() {
|
|
let el_0 = hex!("03d2e15674941bad4a996372cb87e1856d3652606d98562fe39c5e9e7e413f2105");
|
|
let el_1 = hex!("000000");
|
|
|
|
let mut want_witness = Witness::default();
|
|
want_witness.push(&el_0);
|
|
want_witness.push(&el_1);
|
|
|
|
let vec = vec![el_0.clone(), el_1.clone()];
|
|
|
|
// Puts a CompactSize at the front as well as one at the front of each element.
|
|
let want_ser: Vec<u8> = encode::serialize(&vec);
|
|
|
|
// `from_slice` expects bytes slices _without_ leading `CompactSize`.
|
|
let got_witness = Witness::from_slice(&vec);
|
|
assert_eq!(got_witness, want_witness);
|
|
|
|
let got_ser = encode::serialize(&got_witness);
|
|
assert_eq!(got_ser, want_ser);
|
|
|
|
let rinsed: Witness = encode::deserialize(&got_ser).unwrap();
|
|
assert_eq!(rinsed, want_witness)
|
|
}
|
|
|
|
#[test]
|
|
fn test_get_tapscript() {
|
|
let tapscript = hex!("deadbeef");
|
|
let control_block = hex!("02");
|
|
// annex starting with 0x50 causes the branching logic.
|
|
let annex = hex!("50");
|
|
|
|
let witness_vec = vec![tapscript.clone(), control_block.clone()];
|
|
let witness_vec_annex = vec![tapscript.clone(), control_block, annex];
|
|
|
|
let witness_serialized: Vec<u8> = serialize(&witness_vec);
|
|
let witness_serialized_annex: Vec<u8> = serialize(&witness_vec_annex);
|
|
|
|
let witness = deserialize::<Witness>(&witness_serialized[..]).unwrap();
|
|
let witness_annex = deserialize::<Witness>(&witness_serialized_annex[..]).unwrap();
|
|
|
|
// With or without annex, the tapscript should be returned.
|
|
assert_eq!(witness.tapscript(), Some(Script::from_bytes(&tapscript[..])));
|
|
assert_eq!(witness_annex.tapscript(), Some(Script::from_bytes(&tapscript[..])));
|
|
}
|
|
|
|
#[test]
|
|
fn test_get_control_block() {
|
|
let tapscript = hex!("deadbeef");
|
|
let control_block = hex!("02");
|
|
// annex starting with 0x50 causes the branching logic.
|
|
let annex = hex!("50");
|
|
|
|
let witness_vec = vec![tapscript.clone(), control_block.clone()];
|
|
let witness_vec_annex = vec![tapscript.clone(), control_block.clone(), annex];
|
|
|
|
let witness_serialized: Vec<u8> = serialize(&witness_vec);
|
|
let witness_serialized_annex: Vec<u8> = serialize(&witness_vec_annex);
|
|
|
|
let witness = deserialize::<Witness>(&witness_serialized[..]).unwrap();
|
|
let witness_annex = deserialize::<Witness>(&witness_serialized_annex[..]).unwrap();
|
|
|
|
// With or without annex, the tapscript should be returned.
|
|
assert_eq!(witness.taproot_control_block(), Some(&control_block[..]));
|
|
assert_eq!(witness_annex.taproot_control_block(), Some(&control_block[..]));
|
|
}
|
|
|
|
#[test]
|
|
fn test_get_annex() {
|
|
let tapscript = hex!("deadbeef");
|
|
let control_block = hex!("02");
|
|
// annex starting with 0x50 causes the branching logic.
|
|
let annex = hex!("50");
|
|
|
|
let witness_vec = vec![tapscript.clone(), control_block.clone()];
|
|
let witness_vec_annex = vec![tapscript.clone(), control_block.clone(), annex.clone()];
|
|
|
|
let witness_serialized: Vec<u8> = serialize(&witness_vec);
|
|
let witness_serialized_annex: Vec<u8> = serialize(&witness_vec_annex);
|
|
|
|
let witness = deserialize::<Witness>(&witness_serialized[..]).unwrap();
|
|
let witness_annex = deserialize::<Witness>(&witness_serialized_annex[..]).unwrap();
|
|
|
|
// With or without annex, the tapscript should be returned.
|
|
assert_eq!(witness.taproot_annex(), None);
|
|
assert_eq!(witness_annex.taproot_annex(), Some(&annex[..]));
|
|
|
|
// Now for keyspend
|
|
let signature = hex!("deadbeef");
|
|
// annex starting with 0x50 causes the branching logic.
|
|
let annex = hex!("50");
|
|
|
|
let witness_vec = vec![signature.clone()];
|
|
let witness_vec_annex = vec![signature.clone(), annex.clone()];
|
|
|
|
let witness_serialized: Vec<u8> = serialize(&witness_vec);
|
|
let witness_serialized_annex: Vec<u8> = serialize(&witness_vec_annex);
|
|
|
|
let witness = deserialize::<Witness>(&witness_serialized[..]).unwrap();
|
|
let witness_annex = deserialize::<Witness>(&witness_serialized_annex[..]).unwrap();
|
|
|
|
// With or without annex, the tapscript should be returned.
|
|
assert_eq!(witness.taproot_annex(), None);
|
|
assert_eq!(witness_annex.taproot_annex(), Some(&annex[..]));
|
|
}
|
|
|
|
#[test]
|
|
fn test_tx() {
|
|
const S: &str = "02000000000102b44f26b275b8ad7b81146ba3dbecd081f9c1ea0dc05b97516f56045cfcd3df030100000000ffffffff1cb4749ae827c0b75f3d0a31e63efc8c71b47b5e3634a4c698cd53661cab09170100000000ffffffff020b3a0500000000001976a9143ea74de92762212c96f4dd66c4d72a4deb20b75788ac630500000000000016001493a8dfd1f0b6a600ab01df52b138cda0b82bb7080248304502210084622878c94f4c356ce49c8e33a063ec90f6ee9c0208540888cfab056cd1fca9022014e8dbfdfa46d318c6887afd92dcfa54510e057565e091d64d2ee3a66488f82c0121026e181ffb98ebfe5a64c983073398ea4bcd1548e7b971b4c175346a25a1c12e950247304402203ef00489a0d549114977df2820fab02df75bebb374f5eee9e615107121658cfa02204751f2d1784f8e841bff6d3bcf2396af2f1a5537c0e4397224873fbd3bfbe9cf012102ae6aa498ce2dd204e9180e71b4fb1260fe3d1a95c8025b34e56a9adf5f278af200000000";
|
|
let tx_bytes = hex!(S);
|
|
let tx: Transaction = deserialize(&tx_bytes).unwrap();
|
|
|
|
let expected_wit = ["304502210084622878c94f4c356ce49c8e33a063ec90f6ee9c0208540888cfab056cd1fca9022014e8dbfdfa46d318c6887afd92dcfa54510e057565e091d64d2ee3a66488f82c01", "026e181ffb98ebfe5a64c983073398ea4bcd1548e7b971b4c175346a25a1c12e95"];
|
|
for (i, wit_el) in tx.input[0].witness.iter().enumerate() {
|
|
assert_eq!(expected_wit[i], wit_el.to_lower_hex_string());
|
|
}
|
|
assert_eq!(expected_wit[1], tx.input[0].witness.last().unwrap().to_lower_hex_string());
|
|
assert_eq!(
|
|
expected_wit[0],
|
|
tx.input[0].witness.second_to_last().unwrap().to_lower_hex_string()
|
|
);
|
|
assert_eq!(expected_wit[0], tx.input[0].witness.nth(0).unwrap().to_lower_hex_string());
|
|
assert_eq!(expected_wit[1], tx.input[0].witness.nth(1).unwrap().to_lower_hex_string());
|
|
assert_eq!(None, tx.input[0].witness.nth(2));
|
|
assert_eq!(expected_wit[0], tx.input[0].witness[0].to_lower_hex_string());
|
|
assert_eq!(expected_wit[1], tx.input[0].witness[1].to_lower_hex_string());
|
|
|
|
let tx_bytes_back = serialize(&tx);
|
|
assert_eq!(tx_bytes_back, tx_bytes);
|
|
}
|
|
|
|
#[test]
|
|
fn fuzz_cases() {
|
|
let bytes = hex!("26ff0000000000c94ce592cf7a4cbb68eb00ce374300000057cd0000000000000026");
|
|
assert!(deserialize::<Witness>(&bytes).is_err()); // OversizedVectorAllocation
|
|
|
|
let bytes = hex!("24000000ffffffffffffffffffffffff");
|
|
assert!(deserialize::<Witness>(&bytes).is_err()); // OversizedVectorAllocation
|
|
}
|
|
}
|
|
|
|
#[cfg(bench)]
|
|
mod benches {
|
|
use test::{black_box, Bencher};
|
|
|
|
use super::{Witness, WitnessExt};
|
|
|
|
#[bench]
|
|
pub fn bench_big_witness_to_vec(bh: &mut Bencher) {
|
|
let raw_witness = [[1u8]; 5];
|
|
let witness = Witness::from_slice(&raw_witness);
|
|
|
|
bh.iter(|| {
|
|
black_box(witness.to_vec());
|
|
});
|
|
}
|
|
|
|
#[bench]
|
|
pub fn bench_witness_to_vec(bh: &mut Bencher) {
|
|
let raw_witness = vec![vec![1u8]; 3];
|
|
let witness = Witness::from_slice(&raw_witness);
|
|
|
|
bh.iter(|| {
|
|
black_box(witness.to_vec());
|
|
});
|
|
}
|
|
}
|