Skip to content

Commit 812714f

Browse files
committed
Merge #9484: Introduce assumevalid setting to skip validation presumed valid scripts.
7b5e3fe Add assumevalid testcase (John Newbery) e440ac7 Introduce assumevalid setting to skip presumed valid scripts. (Gregory Maxwell)
2 parents b0819c7 + 7b5e3fe commit 812714f

File tree

8 files changed

+266
-12
lines changed

8 files changed

+266
-12
lines changed

doc/release-notes.md

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ Fee Estimation Changes
5252
(previously 25) and for RPC calls (previously 2).
5353

5454
Removal of Priority Estimation
55-
------------------------------
55+
-------------------------------
5656

5757
- Estimation of "priority" needed for a transaction to be included within a target
5858
number of blocks has been removed. The rpc calls are deprecated and will either
@@ -76,6 +76,27 @@ P2P connection management
7676

7777
- New connections to manually added peers are much faster.
7878

79+
Introduction of assumed-valid blocks
80+
-------------------------------------
81+
82+
- A significant portion of the initial block download time is spent verifying
83+
scripts/signatures. Although the verification must pass to ensure the security
84+
of the system, no other result from this verification is needed: If the node
85+
knew the history of a given block were valid it could skip checking scripts
86+
for its ancestors.
87+
88+
- A new configuration option 'assumevalid' is provided to express this knowledge
89+
to the software. Unlike the 'checkpoints' in the past this setting does not
90+
force the use of a particular chain: chains that are consistent with it are
91+
processed quicker, but other chains are still accepted if they'd otherwise
92+
be chosen as best. Also unlike 'checkpoints' the user can configure which
93+
block history is assumed true, this means that even outdated software can
94+
sync more quickly if the setting is updated by the user.
95+
96+
- Because the validity of a chain history is a simple objective fact it is much
97+
easier to review this setting. As a result the software ships with a default
98+
value adjusted to match the current chain shortly before release. The use
99+
of this default value can be disabled by setting -assumevalid=0
79100

80101
0.14.0 Change log
81102
=================

doc/release-process.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@ Before every minor and major release:
1313
* Update version in sources (see below)
1414
* Write release notes (see below)
1515
* Update `src/chainparams.cpp` nMinimumChainWork with information from the getblockchaininfo rpc.
16+
* Update `src/chainparams.cpp` defaultAssumeValid with information from the getblockhash rpc.
17+
- The selected value must not be orphaned so it may be useful to set the value two blocks back from the tip.
18+
- Testnet should be set some tens of thousands back from the tip due to reorgs there.
19+
- This update should be reviewed with a reindex-chainstate with assumevalid=0 to catch any defect
20+
that causes rejection of blocks in the past history.
1621

1722
Before every major release:
1823

qa/rpc-tests/assumevalid.py

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
#!/usr/bin/env python3
2+
# Copyright (c) 2014-2016 The Bitcoin Core developers
3+
# Distributed under the MIT software license, see the accompanying
4+
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
5+
'''
6+
assumevalid.py
7+
8+
Test logic for skipping signature validation on blocks which we've assumed
9+
valid (https://github.com/bitcoin/bitcoin/pull/9484)
10+
11+
We build a chain that includes and invalid signature for one of the
12+
transactions:
13+
14+
0: genesis block
15+
1: block 1 with coinbase transaction output.
16+
2-101: bury that block with 100 blocks so the coinbase transaction
17+
output can be spent
18+
102: a block containing a transaction spending the coinbase
19+
transaction output. The transaction has an invalid signature.
20+
103-2202: bury the bad block with just over two weeks' worth of blocks
21+
(2100 blocks)
22+
23+
Start three nodes:
24+
25+
- node0 has no -assumevalid parameter. Try to sync to block 2202. It will
26+
reject block 102 and only sync as far as block 101
27+
- node1 has -assumevalid set to the hash of block 102. Try to sync to
28+
block 2202. node1 will sync all the way to block 2202.
29+
- node2 has -assumevalid set to the hash of block 102. Try to sync to
30+
block 200. node2 will reject block 102 since it's assumed valid, but it
31+
isn't buried by at least two weeks' work.
32+
'''
33+
34+
from test_framework.mininode import *
35+
from test_framework.test_framework import BitcoinTestFramework
36+
from test_framework.util import *
37+
from test_framework.blocktools import create_block, create_coinbase
38+
from test_framework.key import CECKey
39+
from test_framework.script import *
40+
41+
class BaseNode(SingleNodeConnCB):
42+
def __init__(self):
43+
SingleNodeConnCB.__init__(self)
44+
self.last_inv = None
45+
self.last_headers = None
46+
self.last_block = None
47+
self.last_getdata = None
48+
self.block_announced = False
49+
self.last_getheaders = None
50+
self.disconnected = False
51+
self.last_blockhash_announced = None
52+
53+
def on_close(self, conn):
54+
self.disconnected = True
55+
56+
def wait_for_disconnect(self, timeout=60):
57+
test_function = lambda: self.disconnected
58+
assert(wait_until(test_function, timeout=timeout))
59+
return
60+
61+
def send_header_for_blocks(self, new_blocks):
62+
headers_message = msg_headers()
63+
headers_message.headers = [ CBlockHeader(b) for b in new_blocks ]
64+
self.send_message(headers_message)
65+
66+
class SendHeadersTest(BitcoinTestFramework):
67+
def __init__(self):
68+
super().__init__()
69+
self.setup_clean_chain = True
70+
self.num_nodes = 3
71+
72+
def setup_network(self):
73+
# Start node0. We don't start the other nodes yet since
74+
# we need to pre-mine a block with an invalid transaction
75+
# signature so we can pass in the block hash as assumevalid.
76+
self.nodes = []
77+
self.nodes.append(start_node(0, self.options.tmpdir, ["-debug"]))
78+
79+
def run_test(self):
80+
81+
# Connect to node0
82+
node0 = BaseNode()
83+
connections = []
84+
connections.append(NodeConn('127.0.0.1', p2p_port(0), self.nodes[0], node0))
85+
node0.add_connection(connections[0])
86+
87+
NetworkThread().start() # Start up network handling in another thread
88+
node0.wait_for_verack()
89+
90+
# Build the blockchain
91+
self.tip = int(self.nodes[0].getbestblockhash(), 16)
92+
self.block_time = self.nodes[0].getblock(self.nodes[0].getbestblockhash())['time'] + 1
93+
94+
self.blocks = []
95+
96+
# Get a pubkey for the coinbase TXO
97+
coinbase_key = CECKey()
98+
coinbase_key.set_secretbytes(b"horsebattery")
99+
coinbase_pubkey = coinbase_key.get_pubkey()
100+
101+
# Create the first block with a coinbase output to our key
102+
height = 1
103+
block = create_block(self.tip, create_coinbase(height, coinbase_pubkey), self.block_time)
104+
self.blocks.append(block)
105+
self.block_time += 1
106+
block.solve()
107+
# Save the coinbase for later
108+
self.block1 = block
109+
self.tip = block.sha256
110+
height += 1
111+
112+
# Bury the block 100 deep so the coinbase output is spendable
113+
for i in range(100):
114+
block = create_block(self.tip, create_coinbase(height), self.block_time)
115+
block.solve()
116+
self.blocks.append(block)
117+
self.tip = block.sha256
118+
self.block_time += 1
119+
height += 1
120+
121+
# Create a transaction spending the coinbase output with an invalid (null) signature
122+
tx = CTransaction()
123+
tx.vin.append(CTxIn(COutPoint(self.block1.vtx[0].sha256, 0), scriptSig=b""))
124+
tx.vout.append(CTxOut(49*100000000, CScript([OP_TRUE])))
125+
tx.calc_sha256()
126+
127+
block102 = create_block(self.tip, create_coinbase(height), self.block_time)
128+
self.block_time += 1
129+
block102.vtx.extend([tx])
130+
block102.hashMerkleRoot = block102.calc_merkle_root()
131+
block102.rehash()
132+
block102.solve()
133+
self.blocks.append(block102)
134+
self.tip = block102.sha256
135+
self.block_time += 1
136+
height += 1
137+
138+
# Bury the assumed valid block 2100 deep
139+
for i in range(2100):
140+
block = create_block(self.tip, create_coinbase(height), self.block_time)
141+
block.nVersion = 4
142+
block.solve()
143+
self.blocks.append(block)
144+
self.tip = block.sha256
145+
self.block_time += 1
146+
height += 1
147+
148+
# Start node1 and node2 with assumevalid so they accept a block with a bad signature.
149+
self.nodes.append(start_node(1, self.options.tmpdir,
150+
["-debug", "-assumevalid=" + hex(block102.sha256)]))
151+
node1 = BaseNode() # connects to node1
152+
connections.append(NodeConn('127.0.0.1', p2p_port(1), self.nodes[1], node1))
153+
node1.add_connection(connections[1])
154+
node1.wait_for_verack()
155+
156+
self.nodes.append(start_node(2, self.options.tmpdir,
157+
["-debug", "-assumevalid=" + hex(block102.sha256)]))
158+
node2 = BaseNode() # connects to node2
159+
connections.append(NodeConn('127.0.0.1', p2p_port(2), self.nodes[2], node2))
160+
node2.add_connection(connections[2])
161+
node2.wait_for_verack()
162+
163+
# send header lists to all three nodes
164+
node0.send_header_for_blocks(self.blocks[0:2000])
165+
node0.send_header_for_blocks(self.blocks[2000:])
166+
node1.send_header_for_blocks(self.blocks[0:2000])
167+
node1.send_header_for_blocks(self.blocks[2000:])
168+
node2.send_header_for_blocks(self.blocks[0:200])
169+
170+
# Send 102 blocks to node0. Block 102 will be rejected.
171+
for i in range(101):
172+
node0.send_message(msg_block(self.blocks[i]))
173+
node0.sync_with_ping() # make sure the most recent block is synced
174+
node0.send_message(msg_block(self.blocks[101]))
175+
assert_equal(self.nodes[0].getblock(self.nodes[0].getbestblockhash())['height'], 101)
176+
177+
# Send 3102 blocks to node1. All blocks will be accepted.
178+
for i in range(2202):
179+
node1.send_message(msg_block(self.blocks[i]))
180+
node1.sync_with_ping() # make sure the most recent block is synced
181+
assert_equal(self.nodes[1].getblock(self.nodes[1].getbestblockhash())['height'], 2202)
182+
183+
# Send 102 blocks to node2. Block 102 will be rejected.
184+
for i in range(101):
185+
node2.send_message(msg_block(self.blocks[i]))
186+
node2.sync_with_ping() # make sure the most recent block is synced
187+
node2.send_message(msg_block(self.blocks[101]))
188+
assert_equal(self.nodes[2].getblock(self.nodes[2].getbestblockhash())['height'], 101)
189+
190+
if __name__ == '__main__':
191+
SendHeadersTest().main()

src/chainparams.cpp

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,9 @@ class CMainParams : public CChainParams {
9999
// The best chain should have at least this much work.
100100
consensus.nMinimumChainWork = uint256S("0x0000000000000000000000000000000000000000002cb971dd56d1c583c20f90");
101101

102+
// By default assume that the signatures in ancestors of this block are valid.
103+
consensus.defaultAssumeValid = uint256S("0x0000000000000000030abc968e1bd635736e880b946085c93152969b9a81a6e2"); //447235
104+
102105
/**
103106
* The message start string is designed to be unlikely to occur in normal data.
104107
* The characters are rarely used upper ASCII, not valid as UTF-8, and produce
@@ -201,6 +204,9 @@ class CTestNetParams : public CChainParams {
201204
// The best chain should have at least this much work.
202205
consensus.nMinimumChainWork = uint256S("0x0000000000000000000000000000000000000000000000198b4def2baa9338d6");
203206

207+
// By default assume that the signatures in ancestors of this block are valid.
208+
consensus.defaultAssumeValid = uint256S("0x000000000871ee6842d3648317ccc8a435eb8cc3c2429aee94faff9ba26b05a0"); //1043841
209+
204210
pchMessageStart[0] = 0x0b;
205211
pchMessageStart[1] = 0x11;
206212
pchMessageStart[2] = 0x09;
@@ -283,6 +289,9 @@ class CRegTestParams : public CChainParams {
283289
// The best chain should have at least this much work.
284290
consensus.nMinimumChainWork = uint256S("0x00");
285291

292+
// By default assume that the signatures in ancestors of this block are valid.
293+
consensus.defaultAssumeValid = uint256S("0x00");
294+
286295
pchMessageStart[0] = 0xfa;
287296
pchMessageStart[1] = 0xbf;
288297
pchMessageStart[2] = 0xb5;

src/consensus/params.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ struct Params {
6262
int64_t nPowTargetTimespan;
6363
int64_t DifficultyAdjustmentInterval() const { return nPowTargetTimespan / nPowTargetSpacing; }
6464
uint256 nMinimumChainWork;
65+
uint256 defaultAssumeValid;
6566
};
6667
} // namespace Consensus
6768

src/init.cpp

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -329,8 +329,7 @@ std::string HelpMessage(HelpMessageMode mode)
329329
strUsage += HelpMessageOpt("-blocknotify=<cmd>", _("Execute command when the best block changes (%s in cmd is replaced by block hash)"));
330330
if (showDebug)
331331
strUsage += HelpMessageOpt("-blocksonly", strprintf(_("Whether to operate in a blocks only mode (default: %u)"), DEFAULT_BLOCKSONLY));
332-
strUsage += HelpMessageOpt("-checkblocks=<n>", strprintf(_("How many blocks to check at startup (default: %u, 0 = all)"), DEFAULT_CHECKBLOCKS));
333-
strUsage += HelpMessageOpt("-checklevel=<n>", strprintf(_("How thorough the block verification of -checkblocks is (0-4, default: %u)"), DEFAULT_CHECKLEVEL));
332+
strUsage +=HelpMessageOpt("-assumevalid=<hex>", strprintf(_("If this block is in the chain assume that it and its ancestors are valid and potentially skip their script verification (0 to verify all, default: %s, testnet: %s)"), Params(CBaseChainParams::MAIN).GetConsensus().defaultAssumeValid.GetHex(), Params(CBaseChainParams::TESTNET).GetConsensus().defaultAssumeValid.GetHex()));
334333
strUsage += HelpMessageOpt("-conf=<file>", strprintf(_("Specify configuration file (default: %s)"), BITCOIN_CONF_FILENAME));
335334
if (mode == HMM_BITCOIND)
336335
{
@@ -420,6 +419,8 @@ std::string HelpMessage(HelpMessageMode mode)
420419
strUsage += HelpMessageOpt("-uacomment=<cmt>", _("Append comment to the user agent string"));
421420
if (showDebug)
422421
{
422+
strUsage += HelpMessageOpt("-checkblocks=<n>", strprintf(_("How many blocks to check at startup (default: %u, 0 = all)"), DEFAULT_CHECKBLOCKS));
423+
strUsage += HelpMessageOpt("-checklevel=<n>", strprintf(_("How thorough the block verification of -checkblocks is (0-4, default: %u)"), DEFAULT_CHECKLEVEL));
423424
strUsage += HelpMessageOpt("-checkblockindex", strprintf("Do a full consistency check for mapBlockIndex, setBlockIndexCandidates, chainActive and mapBlocksUnlinked occasionally. Also sets -checkmempool (default: %u)", Params(CBaseChainParams::MAIN).DefaultConsistencyChecks()));
424425
strUsage += HelpMessageOpt("-checkmempool=<n>", strprintf("Run checks every <n> transactions (default: %u)", Params(CBaseChainParams::MAIN).DefaultConsistencyChecks()));
425426
strUsage += HelpMessageOpt("-checkpoints", strprintf("Disable expensive verification for known chain history (default: %u)", DEFAULT_CHECKPOINTS_ENABLED));
@@ -924,6 +925,12 @@ bool AppInitParameterInteraction()
924925
fCheckBlockIndex = GetBoolArg("-checkblockindex", chainparams.DefaultConsistencyChecks());
925926
fCheckpointsEnabled = GetBoolArg("-checkpoints", DEFAULT_CHECKPOINTS_ENABLED);
926927

928+
hashAssumeValid = uint256S(GetArg("-assumevalid", chainparams.GetConsensus().defaultAssumeValid.GetHex()));
929+
if (!hashAssumeValid.IsNull())
930+
LogPrintf("Assuming ancestors of block %s have valid signatures.\n", hashAssumeValid.GetHex());
931+
else
932+
LogPrintf("Validating signatures for all blocks.\n");
933+
927934
// mempool limits
928935
int64_t nMempoolSizeMax = GetArg("-maxmempool", DEFAULT_MAX_MEMPOOL_SIZE) * 1000000;
929936
int64_t nMempoolSizeMin = GetArg("-limitdescendantsize", DEFAULT_DESCENDANT_SIZE_LIMIT) * 1000 * 40;

src/validation.cpp

Lines changed: 26 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ uint64_t nPruneTarget = 0;
7878
int64_t nMaxTipAge = DEFAULT_MAX_TIP_AGE;
7979
bool fEnableReplacement = DEFAULT_ENABLE_REPLACEMENT;
8080

81+
uint256 hashAssumeValid;
8182

8283
CFeeRate minRelayTxFee = CFeeRate(DEFAULT_MIN_RELAY_TX_FEE);
8384
CAmount maxTxFee = DEFAULT_TRANSACTION_MAXFEE;
@@ -1389,11 +1390,10 @@ bool CheckInputs(const CTransaction& tx, CValidationState &state, const CCoinsVi
13891390
// Only if ALL inputs pass do we perform expensive ECDSA signature checks.
13901391
// Helps prevent CPU exhaustion attacks.
13911392

1392-
// Skip ECDSA signature verification when connecting blocks before the
1393-
// last block chain checkpoint. Assuming the checkpoints are valid this
1393+
// Skip script verification when connecting blocks under the
1394+
// assumedvalid block. Assuming the assumedvalid block is valid this
13941395
// is safe because block merkle hashes are still computed and checked,
1395-
// and any change will be caught at the next checkpoint. Of course, if
1396-
// the checkpoint is for a chain that's invalid due to false scriptSigs
1396+
// Of course, if an assumed valid block is invalid due to false scriptSigs
13971397
// this optimization would allow an invalid chain to be accepted.
13981398
if (fScriptChecks) {
13991399
for (unsigned int i = 0; i < tx.vin.size(); i++) {
@@ -1721,11 +1721,28 @@ bool ConnectBlock(const CBlock& block, CValidationState& state, CBlockIndex* pin
17211721
}
17221722

17231723
bool fScriptChecks = true;
1724-
if (fCheckpointsEnabled) {
1725-
CBlockIndex *pindexLastCheckpoint = Checkpoints::GetLastCheckpoint(chainparams.Checkpoints());
1726-
if (pindexLastCheckpoint && pindexLastCheckpoint->GetAncestor(pindex->nHeight) == pindex) {
1727-
// This block is an ancestor of a checkpoint: disable script checks
1728-
fScriptChecks = false;
1724+
if (!hashAssumeValid.IsNull()) {
1725+
// We've been configured with the hash of a block which has been externally verified to have a valid history.
1726+
// A suitable default value is included with the software and updated from time to time. Because validity
1727+
// relative to a piece of software is an objective fact these defaults can be easily reviewed.
1728+
// This setting doesn't force the selection of any particular chain but makes validating some faster by
1729+
// effectively caching the result of part of the verification.
1730+
BlockMap::const_iterator it = mapBlockIndex.find(hashAssumeValid);
1731+
if (it != mapBlockIndex.end()) {
1732+
if (it->second->GetAncestor(pindex->nHeight) == pindex &&
1733+
pindexBestHeader->GetAncestor(pindex->nHeight) == pindex &&
1734+
pindexBestHeader->nChainWork >= UintToArith256(chainparams.GetConsensus().nMinimumChainWork)) {
1735+
// This block is a member of the assumed verified chain and an ancestor of the best header.
1736+
// The equivalent time check discourages hashpower from extorting the network via DOS attack
1737+
// into accepting an invalid block through telling users they must manually set assumevalid.
1738+
// Requiring a software change or burying the invalid block, regardless of the setting, makes
1739+
// it hard to hide the implication of the demand. This also avoids having release candidates
1740+
// that are hardly doing any signature verification at all in testing without having to
1741+
// artificially set the default assumed verified block further back.
1742+
// The test against nMinimumChainWork prevents the skipping when denied access to any chain at
1743+
// least as good as the expected chain.
1744+
fScriptChecks = (GetBlockProofEquivalentTime(*pindexBestHeader, *pindex, *pindexBestHeader, chainparams.GetConsensus()) <= 60 * 60 * 24 * 7 * 2);
1745+
}
17291746
}
17301747
}
17311748

src/validation.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,9 @@ extern CAmount maxTxFee;
186186
extern int64_t nMaxTipAge;
187187
extern bool fEnableReplacement;
188188

189+
/** Block hash whose ancestors we will assume to have valid scripts without checking them. */
190+
extern uint256 hashAssumeValid;
191+
189192
/** Best header we've seen so far (used for getheaders queries' starting points). */
190193
extern CBlockIndex *pindexBestHeader;
191194

0 commit comments

Comments
 (0)