Skip to content

Commit cf667af

Browse files
pinheadmzpinheadmz
authored
Merge pull request #738 from pinheadmz/macaroon-unique
Enable unique lnd root keys and macaroons
2 parents 3c04378 + 7c58bb0 commit cf667af

File tree

11 files changed

+108
-51
lines changed

11 files changed

+108
-51
lines changed

‎resources/charts/bitcoincore/charts/lnd/templates/configmap.yaml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -20,25 +20,27 @@ data:
2020
tlsextradomain={{ include "lnd.fullname" . }}
2121
tls.cert: |
2222
-----BEGIN CERTIFICATE-----
23-
MIIB8TCCAZagAwIBAgIUJDsR6mmY+TaO9pCfjtotlbOkzJMwCgYIKoZIzj0EAwIw
23+
MIIB+DCCAZ6gAwIBAgIUSbyK/9viFWS3cLoPkmxZsW8fcH8wCgYIKoZIzj0EAwIw
2424
MjEfMB0GA1UECgwWbG5kIGF1dG9nZW5lcmF0ZWQgY2VydDEPMA0GA1UEAwwGd2Fy
25-
bmV0MB4XDTI0MTExMTE2NTM1MFoXDTM0MTEwOTE2NTM1MFowMjEfMB0GA1UECgwW
25+
bmV0MB4XDTI1MDkwMzE1NDgzNFoXDTM1MDkwMTE1NDgzNFowMjEfMB0GA1UECgwW
2626
bG5kIGF1dG9nZW5lcmF0ZWQgY2VydDEPMA0GA1UEAwwGd2FybmV0MFkwEwYHKoZI
27-
zj0CAQYIKoZIzj0DAQcDQgAEBVltIvaTlAQI/3FFatTqVflZuZdRJ0SmRMSJrFLP
28-
tp0fxE7hmteSt6gjQriy90fP8j9OJXBNAjt915kLY4zVvqOBiTCBhjAOBgNVHQ8B
27+
zj0CAQYIKoZIzj0DAQcDQgAENIGvS4bQr/zzUQnIqgJIYrPEdPMXVkv3yEyJRCFg
28+
PyZTvxWUJy7AI3VKb7ubIXawYcnPBe7K1sgBAbTPz1c8sqOBkTCBjjAOBgNVHQ8B
2929
Af8EBAMCAqQwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAd
30-
BgNVHQ4EFgQU5d8QMrwhLgTkDjWA+eXZGz+dybUwLwYDVR0RBCgwJoIJbG9jYWxo
31-
b3N0ggEqhwR/AAABhxAAAAAAAAAAAAAAAAAAAAABMAoGCCqGSM49BAMCA0kAMEYC
32-
IQDPofN0fEl5gTwCYhk3nZbjMqJhZ8BsSJ6K8XRhxr7zbwIhAPsgQCFOqUWg632O
33-
NEO53OQ6CIqnpxSskjsFNH4ZBQOE
30+
BgNVHQ4EFgQUNhDWW7rajlA9sNGI/1Q5BDLH/rMwNwYDVR0RBDAwLoIJbG9jYWxo
31+
b3N0ggkqLmRlZmF1bHSHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwCgYIKoZIzj0E
32+
AwIDSAAwRQIhAOFm85wvwPZMJg0+16Sh0FkKqAuGVmllHnriWHQJ1NhuAiAfoxzE
33+
9ooZuDwKy0Y3dP4DfJCrOlFNTHfp3abG7VQ+VQ==
3434
-----END CERTIFICATE-----
35+
3536
tls.key: |
3637
-----BEGIN EC PRIVATE KEY-----
37-
MHcCAQEEIIcFtWTLQv5JaRRxdkPKkO98OrvgeztbZ7h8Ev/4UbE4oAoGCCqGSM49
38-
AwEHoUQDQgAEBVltIvaTlAQI/3FFatTqVflZuZdRJ0SmRMSJrFLPtp0fxE7hmteS
39-
t6gjQriy90fP8j9OJXBNAjt915kLY4zVvg==
38+
MHcCAQEEIEKlsxGkakClpHqXbr6tqEey634Xc364DgGMJxLdiLHIoAoGCCqGSM49
39+
AwEHoUQDQgAENIGvS4bQr/zzUQnIqgJIYrPEdPMXVkv3yEyJRCFgPyZTvxWUJy7A
40+
I3VKb7ubIXawYcnPBe7K1sgBAbTPz1c8sg==
4041
-----END EC PRIVATE KEY-----
41-
MACAROON_HEX: 0201036c6e6402f801030a1062beabbf2a614b112128afa0c0b4fdd61201301a160a0761646472657373120472656164120577726974651a130a04696e666f120472656164120577726974651a170a08696e766f69636573120472656164120577726974651a210a086d616361726f6f6e120867656e6572617465120472656164120577726974651a160a076d657373616765120472656164120577726974651a170a086f6666636861696e120472656164120577726974651a160a076f6e636861696e120472656164120577726974651a140a057065657273120472656164120577726974651a180a067369676e6572120867656e657261746512047265616400000620b17be53e367290871681055d0de15587f6d1cd47d1248fe2662ae27f62cfbdc6
42+
43+
MACAROON_HEX: {{ .Values.adminMacaroon }}
4244
---
4345
apiVersion: v1
4446
kind: ConfigMap

‎resources/charts/bitcoincore/charts/lnd/templates/pod.yaml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ metadata:
1414
chain: {{ .Values.global.chain }}
1515
annotations:
1616
kubectl.kubernetes.io/default-container: "lnd"
17+
adminMacaroon: {{ .Values.adminMacaroon }}
1718
spec:
1819
{{- with .Values.imagePullSecrets }}
1920
imagePullSecrets:
@@ -40,9 +41,20 @@ spec:
4041
livenessProbe:
4142
{{- toYaml .Values.livenessProbe | nindent 8 }}
4243
readinessProbe:
43-
{{- toYaml .Values.readinessProbe | nindent 8 }}
44+
{{- toYaml .Values.readinessProbe | nindent 8 }}
4445
startupProbe:
45-
{{- toYaml .Values.startupProbe | nindent 8 }}
46+
failureThreshold: 10
47+
periodSeconds: 30
48+
successThreshold: 1
49+
timeoutSeconds: 60
50+
exec:
51+
command:
52+
- /bin/sh
53+
- -c
54+
- |
55+
PHRASE=`curl --silent --insecure https://localhost:8080/v1/genseed | grep -o '\[[^]]*\]'`
56+
curl --insecure https://localhost:8080/v1/initwallet --data "{\"macaroon_root_key\":\"{{ .Values.macaroonRootKey }}\", \"wallet_password\":\"AAAAAAAAAAA=\", \"cipher_seed_mnemonic\": $PHRASE}"
57+
4658
resources:
4759
{{- toYaml .Values.resources | nindent 8 }}
4860
volumeMounts:

‎resources/charts/bitcoincore/charts/lnd/values.yaml‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -81,18 +81,6 @@ readinessProbe:
8181
tcpSocket:
8282
port: 10009
8383
timeoutSeconds: 1
84-
startupProbe:
85-
failureThreshold: 10
86-
periodSeconds: 30
87-
successThreshold: 1
88-
timeoutSeconds: 60
89-
exec:
90-
command:
91-
- /bin/sh
92-
- -c
93-
- |
94-
PHRASE=`curl --silent --insecure https://localhost:8080/v1/genseed | grep -o '\[[^]]*\]'`
95-
curl --insecure https://localhost:8080/v1/initwallet --data "{\"macaroon_root_key\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\", \"wallet_password\":\"AAAAAAAAAAA=\", \"cipher_seed_mnemonic\": $PHRASE}"
9684

9785
# Additional volumes on the output Deployment definition.
9886
volumes: []
@@ -113,6 +101,9 @@ tolerations: []
113101

114102
affinity: {}
115103

104+
macaroonRootKey: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
105+
adminMacaroon: 0201036c6e6402f801030a1062beabbf2a614b112128afa0c0b4fdd61201301a160a0761646472657373120472656164120577726974651a130a04696e666f120472656164120577726974651a170a08696e766f69636573120472656164120577726974651a210a086d616361726f6f6e120867656e6572617465120472656164120577726974651a160a076d657373616765120472656164120577726974651a170a086f6666636861696e120472656164120577726974651a160a076f6e636861696e120472656164120577726974651a140a057065657273120472656164120577726974651a180a067369676e6572120867656e657261746512047265616400000620b17be53e367290871681055d0de15587f6d1cd47d1248fe2662ae27f62cfbdc6
106+
116107
baseConfig: |
117108
norest=false
118109
restlisten=0.0.0.0:8080

‎resources/plugins/simln/charts/simln/templates/configmap.yaml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,19 @@ metadata:
55
data:
66
tls.cert: |
77
-----BEGIN CERTIFICATE-----
8-
MIIB8TCCAZagAwIBAgIUJDsR6mmY+TaO9pCfjtotlbOkzJMwCgYIKoZIzj0EAwIw
8+
MIIB+DCCAZ6gAwIBAgIUSbyK/9viFWS3cLoPkmxZsW8fcH8wCgYIKoZIzj0EAwIw
99
MjEfMB0GA1UECgwWbG5kIGF1dG9nZW5lcmF0ZWQgY2VydDEPMA0GA1UEAwwGd2Fy
10-
bmV0MB4XDTI0MTExMTE2NTM1MFoXDTM0MTEwOTE2NTM1MFowMjEfMB0GA1UECgwW
10+
bmV0MB4XDTI1MDkwMzE1NDgzNFoXDTM1MDkwMTE1NDgzNFowMjEfMB0GA1UECgwW
1111
bG5kIGF1dG9nZW5lcmF0ZWQgY2VydDEPMA0GA1UEAwwGd2FybmV0MFkwEwYHKoZI
12-
zj0CAQYIKoZIzj0DAQcDQgAEBVltIvaTlAQI/3FFatTqVflZuZdRJ0SmRMSJrFLP
13-
tp0fxE7hmteSt6gjQriy90fP8j9OJXBNAjt915kLY4zVvqOBiTCBhjAOBgNVHQ8B
12+
zj0CAQYIKoZIzj0DAQcDQgAENIGvS4bQr/zzUQnIqgJIYrPEdPMXVkv3yEyJRCFg
13+
PyZTvxWUJy7AI3VKb7ubIXawYcnPBe7K1sgBAbTPz1c8sqOBkTCBjjAOBgNVHQ8B
1414
Af8EBAMCAqQwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAd
15-
BgNVHQ4EFgQU5d8QMrwhLgTkDjWA+eXZGz+dybUwLwYDVR0RBCgwJoIJbG9jYWxo
16-
b3N0ggEqhwR/AAABhxAAAAAAAAAAAAAAAAAAAAABMAoGCCqGSM49BAMCA0kAMEYC
17-
IQDPofN0fEl5gTwCYhk3nZbjMqJhZ8BsSJ6K8XRhxr7zbwIhAPsgQCFOqUWg632O
18-
NEO53OQ6CIqnpxSskjsFNH4ZBQOE
15+
BgNVHQ4EFgQUNhDWW7rajlA9sNGI/1Q5BDLH/rMwNwYDVR0RBDAwLoIJbG9jYWxo
16+
b3N0ggkqLmRlZmF1bHSHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwCgYIKoZIzj0E
17+
AwIDSAAwRQIhAOFm85wvwPZMJg0+16Sh0FkKqAuGVmllHnriWHQJ1NhuAiAfoxzE
18+
9ooZuDwKy0Y3dP4DfJCrOlFNTHfp3abG7VQ+VQ==
1919
-----END CERTIFICATE-----
20+
2021
{{- $configMaps := lookup "v1" "ConfigMap" .Release.Namespace "" }}
2122
{{- range $configMaps.items }}
2223
{{- if and .metadata.labels (hasKey .metadata.labels "role") (eq (index .metadata.labels "role") "macaroon-ref") }}

‎resources/scenarios/commander.py‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,9 +70,13 @@
7070
)
7171

7272
if pod.metadata.labels["mission"] == "lightning":
73-
lnnode = LND(pod.metadata.name, pod.status.pod_ip)
73+
if "lnd" in pod.metadata.labels["app.kubernetes.io/name"]:
74+
lnnode = LND(
75+
pod.metadata.name, pod.status.pod_ip, pod.metadata.annotations["adminMacaroon"]
76+
)
7477
if "cln" in pod.metadata.labels["app.kubernetes.io/name"]:
7578
lnnode = CLN(pod.metadata.name, pod.status.pod_ip)
79+
assert lnnode
7680
WARNET["lightning"].append(lnnode)
7781

7882
for cm in cmaps.items:

‎resources/scenarios/ln_framework/ln.py‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,6 @@
88

99
import requests
1010

11-
# hard-coded deterministic lnd credentials
12-
ADMIN_MACAROON_HEX = "0201036c6e6402f801030a1062beabbf2a614b112128afa0c0b4fdd61201301a160a0761646472657373120472656164120577726974651a130a04696e666f120472656164120577726974651a170a08696e766f69636573120472656164120577726974651a210a086d616361726f6f6e120867656e6572617465120472656164120577726974651a160a076d657373616765120472656164120577726974651a170a086f6666636861696e120472656164120577726974651a160a076f6e636861696e120472656164120577726974651a140a057065657273120472656164120577726974651a180a067369676e6572120867656e657261746512047265616400000620b17be53e367290871681055d0de15587f6d1cd47d1248fe2662ae27f62cfbdc6"
1311
# Don't worry about lnd's self-signed certificates
1412
INSECURE_CONTEXT = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
1513
INSECURE_CONTEXT.check_hostname = False
@@ -286,13 +284,14 @@ def update(self, txid_hex: str, policy: dict, capacity: int) -> dict:
286284

287285

288286
class LND(LNNode):
289-
def __init__(self, pod_name, ip_address):
287+
def __init__(self, pod_name, ip_address, admin_macaroon_hex):
290288
super().__init__(pod_name, ip_address)
291289
self.conn = http.client.HTTPSConnection(
292290
host=pod_name, port=8080, timeout=5, context=INSECURE_CONTEXT
293291
)
292+
self.admin_macaroon_hex = admin_macaroon_hex
294293
self.headers = {
295-
"Grpc-Metadata-macaroon": ADMIN_MACAROON_HEX,
294+
"Grpc-Metadata-macaroon": admin_macaroon_hex,
296295
"Connection": "close",
297296
}
298297
self.impl = "lnd"

‎resources/scripts/ssl/openssl-config.cnf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,6 @@ subjectAltName = @alt_names
2323

2424
[ alt_names ]
2525
DNS.1 = localhost
26-
DNS.2 = *
26+
DNS.2 = *.default
2727
IP.1 = 127.0.0.1
2828
IP.2 = ::1

‎resources/scripts/ssl/tls.cert‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIB8TCCAZagAwIBAgIUJDsR6mmY+TaO9pCfjtotlbOkzJMwCgYIKoZIzj0EAwIw
2+
MIIB+DCCAZ6gAwIBAgIUSbyK/9viFWS3cLoPkmxZsW8fcH8wCgYIKoZIzj0EAwIw
33
MjEfMB0GA1UECgwWbG5kIGF1dG9nZW5lcmF0ZWQgY2VydDEPMA0GA1UEAwwGd2Fy
4-
bmV0MB4XDTI0MTExMTE2NTM1MFoXDTM0MTEwOTE2NTM1MFowMjEfMB0GA1UECgwW
4+
bmV0MB4XDTI1MDkwMzE1NDgzNFoXDTM1MDkwMTE1NDgzNFowMjEfMB0GA1UECgwW
55
bG5kIGF1dG9nZW5lcmF0ZWQgY2VydDEPMA0GA1UEAwwGd2FybmV0MFkwEwYHKoZI
6-
zj0CAQYIKoZIzj0DAQcDQgAEBVltIvaTlAQI/3FFatTqVflZuZdRJ0SmRMSJrFLP
7-
tp0fxE7hmteSt6gjQriy90fP8j9OJXBNAjt915kLY4zVvqOBiTCBhjAOBgNVHQ8B
6+
zj0CAQYIKoZIzj0DAQcDQgAENIGvS4bQr/zzUQnIqgJIYrPEdPMXVkv3yEyJRCFg
7+
PyZTvxWUJy7AI3VKb7ubIXawYcnPBe7K1sgBAbTPz1c8sqOBkTCBjjAOBgNVHQ8B
88
Af8EBAMCAqQwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB/zAd
9-
BgNVHQ4EFgQU5d8QMrwhLgTkDjWA+eXZGz+dybUwLwYDVR0RBCgwJoIJbG9jYWxo
10-
b3N0ggEqhwR/AAABhxAAAAAAAAAAAAAAAAAAAAABMAoGCCqGSM49BAMCA0kAMEYC
11-
IQDPofN0fEl5gTwCYhk3nZbjMqJhZ8BsSJ6K8XRhxr7zbwIhAPsgQCFOqUWg632O
12-
NEO53OQ6CIqnpxSskjsFNH4ZBQOE
9+
BgNVHQ4EFgQUNhDWW7rajlA9sNGI/1Q5BDLH/rMwNwYDVR0RBDAwLoIJbG9jYWxo
10+
b3N0ggkqLmRlZmF1bHSHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwCgYIKoZIzj0E
11+
AwIDSAAwRQIhAOFm85wvwPZMJg0+16Sh0FkKqAuGVmllHnriWHQJ1NhuAiAfoxzE
12+
9ooZuDwKy0Y3dP4DfJCrOlFNTHfp3abG7VQ+VQ==
1313
-----END CERTIFICATE-----

‎resources/scripts/ssl/tls.key‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
-----BEGIN EC PRIVATE KEY-----
2-
MHcCAQEEIIcFtWTLQv5JaRRxdkPKkO98OrvgeztbZ7h8Ev/4UbE4oAoGCCqGSM49
3-
AwEHoUQDQgAEBVltIvaTlAQI/3FFatTqVflZuZdRJ0SmRMSJrFLPtp0fxE7hmteS
4-
t6gjQriy90fP8j9OJXBNAjt915kLY4zVvg==
2+
MHcCAQEEIEKlsxGkakClpHqXbr6tqEey634Xc364DgGMJxLdiLHIoAoGCCqGSM49
3+
AwEHoUQDQgAENIGvS4bQr/zzUQnIqgJIYrPEdPMXVkv3yEyJRCFgPyZTvxWUJy7A
4+
I3VKb7ubIXawYcnPBe7K1sgBAbTPz1c8sg==
55
-----END EC PRIVATE KEY-----

‎test/data/ln/network.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ nodes:
2424
circuitbreaker:
2525
enabled: true
2626
httpPort: 9235
27+
# Just 32 bytes of entropy encoded in base64
28+
macaroonRootKey: nmPScpcYkBBUXvEryzpYfjgY27j8hO9SiXO9qNQAJFs=
29+
# Derived from root key with `lncli bakemacaroon --root_key=...`
30+
adminMacaroon: 0201036c6e6402f801030a10b676fd9c5cbdfccedb1b932865ad57451201301a160a0761646472657373120472656164120577726974651a130a04696e666f120472656164120577726974651a170a08696e766f69636573120472656164120577726974651a210a086d616361726f6f6e120867656e6572617465120472656164120577726974651a160a076d657373616765120472656164120577726974651a170a086f6666636861696e120472656164120577726974651a160a076f6e636861696e120472656164120577726974651a140a057065657273120472656164120577726974651a180a067369676e6572120867656e657261746512047265616400000620cff489a728f1be62c41db20607e78e3b3173f5b51679b4489e429cc83648dac4
2731

2832
- name: tank-0004
2933
addnode:
@@ -36,6 +40,11 @@ nodes:
3640
target: tank-0005-ln
3741
capacity: 50000
3842
push_amt: 25000
43+
# Just 32 bytes of entropy encoded in base64
44+
macaroonRootKey: FmEMD2X1hKzxR5yAWgbAT5CbQWPOW+OdyztMMCTBThU=
45+
# Derived from root key with `lncli bakemacaroon --root_key=...`
46+
adminMacaroon: 0201036c6e6402f801030a102616e41d07f5df28869fe8f8147ed2861201301a160a0761646472657373120472656164120577726974651a130a04696e666f120472656164120577726974651a170a08696e766f69636573120472656164120577726974651a210a086d616361726f6f6e120867656e6572617465120472656164120577726974651a160a076d657373616765120472656164120577726974651a170a086f6666636861696e120472656164120577726974651a160a076f6e636861696e120472656164120577726974651a140a057065657273120472656164120577726974651a180a067369676e6572120867656e657261746512047265616400000620e40032ba0d91a7f046ed4596da67aa129cca0ff162e51444df2ce68fa6d16944
47+
3948
- name: tank-0005
4049
addnode:
4150
- tank-0000

0 commit comments

Comments
 (0)