Merge pull request #45 from Roasbeef/macaroon-pouch

lndclient+cmd/loopd: use unique macaroon per sub-server to avoid users having to delete admin.macaroon

Author: Roasbeef

cmd/loopd/config.go

@@ -1,9 +1,9 @@
 package main
 
 type lndConfig struct {
-	Host         string `long:"host" description:"lnd instance rpc address"`
-	MacaroonPath string `long:"macaroonpath" description:"Path to lnd macaroon"`
-	TLSPath      string `long:"tlspath" description:"Path to lnd tls certificate"`
+	Host        string `long:"host" description:"lnd instance rpc address"`
+	MacaroonDir string `long:"macaroondir" description:"Path to the directory containing all the required lnd macaroons"`
+	TLSPath     string `long:"tlspath" description:"Path to lnd tls certificate"`
 }
 
 type viewParameters struct{}

cmd/loopd/daemon.go

@@ -34,7 +34,8 @@ func daemon(config *config) error {
 
 	// Create an instance of the loop client library.
 	swapClient, cleanup, err := getClient(
-		config.Network, config.SwapServer, config.Insecure, &lnd.LndServices,
+		config.Network, config.SwapServer, config.Insecure,
+		&lnd.LndServices,
 	)
 	if err != nil {
 		return err

cmd/loopd/utils.go

@@ -11,7 +11,7 @@ import (
 // getLnd returns an instance of the lnd services proxy.
 func getLnd(network string, cfg *lndConfig) (*lndclient.GrpcLndServices, error) {
 	return lndclient.NewLndServices(
-		cfg.Host, "client", network, cfg.MacaroonPath, cfg.TLSPath,
+		cfg.Host, "client", network, cfg.MacaroonDir, cfg.TLSPath,
 	)
 }
 

go.mod

@@ -15,5 +15,5 @@ require (
 	golang.org/x/net v0.0.0-20190313220215-9f648a60d977
 	google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19
 	google.golang.org/grpc v1.19.0
-	gopkg.in/macaroon.v2 v2.1.0
+	gopkg.in/macaroon.v2 v2.1.0 // indirect
 )

lndclient/chainnotifier_client.go

@@ -28,13 +28,16 @@ type ChainNotifierClient interface {
 }
 
 type chainNotifierClient struct {
-	client chainrpc.ChainNotifierClient
-	wg     sync.WaitGroup
+	client   chainrpc.ChainNotifierClient
+	chainMac serializedMacaroon
+
+	wg sync.WaitGroup
 }
 
-func newChainNotifierClient(conn *grpc.ClientConn) *chainNotifierClient {
+func newChainNotifierClient(conn *grpc.ClientConn, chainMac serializedMacaroon) *chainNotifierClient {
 	return &chainNotifierClient{
-		client: chainrpc.NewChainNotifierClient(conn),
+		client:   chainrpc.NewChainNotifierClient(conn),
+		chainMac: chainMac,
 	}
 }
 
@@ -54,7 +57,8 @@ func (s *chainNotifierClient) RegisterSpendNtfn(ctx context.Context,
 		}
 	}
 
-	resp, err := s.client.RegisterSpendNtfn(ctx, &chainrpc.SpendRequest{
+	macaroonAuth := s.chainMac.WithMacaroonAuth(ctx)
+	resp, err := s.client.RegisterSpendNtfn(macaroonAuth, &chainrpc.SpendRequest{
 		HeightHint: uint32(heightHint),
 		Outpoint:   rpcOutpoint,
 		Script:     pkScript,
@@ -125,16 +129,15 @@ func (s *chainNotifierClient) RegisterConfirmationsNtfn(ctx context.Context,
 	if txid != nil {
 		txidSlice = txid[:]
 	}
-	confStream, err := s.client.
-		RegisterConfirmationsNtfn(
-			ctx,
-			&chainrpc.ConfRequest{
-				Script:     pkScript,
-				NumConfs:   uint32(numConfs),
-				HeightHint: uint32(heightHint),
-				Txid:       txidSlice,
-			},
-		)
+	confStream, err := s.client.RegisterConfirmationsNtfn(
+		s.chainMac.WithMacaroonAuth(ctx),
+		&chainrpc.ConfRequest{
+			Script:     pkScript,
+			NumConfs:   uint32(numConfs),
+			HeightHint: uint32(heightHint),
+			Txid:       txidSlice,
+		},
+	)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -203,8 +206,9 @@ func (s *chainNotifierClient) RegisterConfirmationsNtfn(ctx context.Context,
 func (s *chainNotifierClient) RegisterBlockEpochNtfn(ctx context.Context) (
 	chan int32, chan error, error) {
 
-	blockEpochClient, err := s.client.
-		RegisterBlockEpochNtfn(ctx, &chainrpc.BlockEpoch{})
+	blockEpochClient, err := s.client.RegisterBlockEpochNtfn(
+		s.chainMac.WithMacaroonAuth(ctx), &chainrpc.BlockEpoch{},
+	)
 	if err != nil {
 		return nil, nil, err
 	}

lndclient/invoices_client.go

@@ -33,13 +33,15 @@ type InvoiceUpdate struct {
 }
 
 type invoicesClient struct {
-	client invoicesrpc.InvoicesClient
-	wg     sync.WaitGroup
+	client     invoicesrpc.InvoicesClient
+	invoiceMac serializedMacaroon
+	wg         sync.WaitGroup
 }
 
-func newInvoicesClient(conn *grpc.ClientConn) *invoicesClient {
+func newInvoicesClient(conn *grpc.ClientConn, invoiceMac serializedMacaroon) *invoicesClient {
 	return &invoicesClient{
-		client: invoicesrpc.NewInvoicesClient(conn),
+		client:     invoicesrpc.NewInvoicesClient(conn),
+		invoiceMac: invoiceMac,
 	}
 }
 
@@ -53,6 +55,7 @@ func (s *invoicesClient) SettleInvoice(ctx context.Context,
 	rpcCtx, cancel := context.WithTimeout(ctx, rpcTimeout)
 	defer cancel()
 
+	rpcCtx = s.invoiceMac.WithMacaroonAuth(ctx)
 	_, err := s.client.SettleInvoice(rpcCtx, &invoicesrpc.SettleInvoiceMsg{
 		Preimage: preimage[:],
 	})
@@ -66,6 +69,7 @@ func (s *invoicesClient) CancelInvoice(ctx context.Context,
 	rpcCtx, cancel := context.WithTimeout(ctx, rpcTimeout)
 	defer cancel()
 
+	rpcCtx = s.invoiceMac.WithMacaroonAuth(rpcCtx)
 	_, err := s.client.CancelInvoice(rpcCtx, &invoicesrpc.CancelInvoiceMsg{
 		PaymentHash: hash[:],
 	})
@@ -77,11 +81,12 @@ func (s *invoicesClient) SubscribeSingleInvoice(ctx context.Context,
 	hash lntypes.Hash) (<-chan InvoiceUpdate,
 	<-chan error, error) {
 
-	invoiceStream, err := s.client.
-		SubscribeSingleInvoice(ctx,
-			&lnrpc.PaymentHash{
-				RHash: hash[:],
-			})
+	invoiceStream, err := s.client.SubscribeSingleInvoice(
+		s.invoiceMac.WithMacaroonAuth(ctx),
+		&lnrpc.PaymentHash{
+			RHash: hash[:],
+		},
+	)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -135,6 +140,7 @@ func (s *invoicesClient) AddHoldInvoice(ctx context.Context,
 		Private:    true,
 	}
 
+	rpcCtx = s.invoiceMac.WithMacaroonAuth(rpcCtx)
 	resp, err := s.client.AddHoldInvoice(rpcCtx, rpcIn)
 	if err != nil {
 		return "", err

lndclient/lightning_client.go

@@ -78,17 +78,19 @@ var (
 )
 
 type lightningClient struct {
-	client lnrpc.LightningClient
-	wg     sync.WaitGroup
-	params *chaincfg.Params
+	client   lnrpc.LightningClient
+	wg       sync.WaitGroup
+	params   *chaincfg.Params
+	adminMac serializedMacaroon
 }
 
 func newLightningClient(conn *grpc.ClientConn,
-	params *chaincfg.Params) *lightningClient {
+	params *chaincfg.Params, adminMac serializedMacaroon) *lightningClient {
 
 	return &lightningClient{
-		client: lnrpc.NewLightningClient(conn),
-		params: params,
+		client:   lnrpc.NewLightningClient(conn),
+		params:   params,
+		adminMac: adminMac,
 	}
 }
 
@@ -110,6 +112,7 @@ func (s *lightningClient) ConfirmedWalletBalance(ctx context.Context) (
 	rpcCtx, cancel := context.WithTimeout(ctx, rpcTimeout)
 	defer cancel()
 
+	rpcCtx = s.adminMac.WithMacaroonAuth(rpcCtx)
 	resp, err := s.client.WalletBalance(rpcCtx, &lnrpc.WalletBalanceRequest{})
 	if err != nil {
 		return 0, err
@@ -122,6 +125,7 @@ func (s *lightningClient) GetInfo(ctx context.Context) (*Info, error) {
 	rpcCtx, cancel := context.WithTimeout(ctx, rpcTimeout)
 	defer cancel()
 
+	rpcCtx = s.adminMac.WithMacaroonAuth(rpcCtx)
 	resp, err := s.client.GetInfo(rpcCtx, &lnrpc.GetInfoRequest{})
 	if err != nil {
 		return nil, err
@@ -159,6 +163,7 @@ func (s *lightningClient) EstimateFeeToP2WSH(ctx context.Context,
 		return 0, err
 	}
 
+	rpcCtx = s.adminMac.WithMacaroonAuth(rpcCtx)
 	resp, err := s.client.EstimateFee(
 		rpcCtx,
 		&lnrpc.EstimateFeeRequest{
@@ -216,6 +221,7 @@ func (s *lightningClient) payInvoice(ctx context.Context, invoice string,
 
 	hash := lntypes.Hash(*payReq.PaymentHash)
 
+	ctx = s.adminMac.WithMacaroonAuth(ctx)
 	for {
 		// Create no timeout context as this call can block for a long
 		// time.
@@ -329,6 +335,7 @@ func (s *lightningClient) AddInvoice(ctx context.Context,
 		rpcIn.RHash = in.Hash[:]
 	}
 
+	rpcCtx = s.adminMac.WithMacaroonAuth(rpcCtx)
 	resp, err := s.client.AddInvoice(rpcCtx, rpcIn)
 	if err != nil {
 		return lntypes.Hash{}, "", err