Commit graph

39 commits

Author SHA1 Message Date
Elle Mouton
21983bab75
rules: thread context through 2025-01-13 09:23:20 +02:00
bitromortac
66e6d63349
firewall: obfuscate ConnectPeer
Also adds a privacy flag that controls obfuscation of network addresses.
2024-07-02 18:21:42 +02:00
bitromortac
bca729a5af
firewall: obfuscate OpenChannelSync 2024-07-02 18:21:42 +02:00
bitromortac
275a882e96
firewall: obfuscate BatchOpenChannel
We obfuscate fields from the batch channel open requests and
responses.
2024-07-02 18:21:42 +02:00
bitromortac
e797abd2a8
firewall: obfuscate PendingChannels
Only obfuscate pending open channels for now.
2024-07-02 18:21:42 +02:00
bitromortac
ef84753f6b
firewall: obfuscate ClosedChannels
For closes we need to know the close type and settle balances to know
which peers should be avoided in the future.
2024-07-02 18:21:42 +02:00
bitromortac
a7246e1dae
firewall: obfuscate WalletBalance 2024-07-02 18:21:41 +02:00
bitromortac
203d0b7234
firewall: refactor privacy mapper tests
Pull out transaction related constants to the top of the test.
Adds a debug comment that is useful for this code. It is often needed to
check the human readable representation of a message.
2024-07-02 18:21:41 +02:00
bitromortac
7489f0a0b2
rules: pass in lnd connection identifier
We pass a random lnd connection identifier to the rule enforcer that is
unique per lnd connection lifetime. It is used to generate unique
request identifiers that amend the non-unique request identifiers that
are passed from lnd.
2024-07-02 15:04:26 +02:00
bitromortac
916ddec0d7
firewall: return altered intercepted message
This allows us to rewrite a request.
2024-07-02 15:04:25 +02:00
bitromortac
962d6667a8
firewall: error back for streaming rpcs 2024-07-02 15:04:25 +02:00
bitromortac
8f2ab273bb
rules: handle interfering rule violations
We collect errors of all rule enforcers, handling errors in all of them
should an error occur. This is to roll back state consistently.
2024-07-02 15:04:25 +02:00
bitromortac
07bcfe19c0
firewall: intercept with privacy flags
gRPC message interception depends now on privacy flags.
2024-04-25 14:49:46 +02:00
bitromortac
c961472789
firewall: obfuscate config depending on flags 2024-04-25 14:49:46 +02:00
bitromortac
1636bb2bd6
firewall+rules: map with privacy flags
We change the rule mapping to accept the newly added privacy flags. Peer
and channel restrictions can be controlled with privacy flags.
2024-04-25 14:49:46 +02:00
bitromortac
cb542a5015
firewall+firewalldb: add SessionDB interface
SessionDB is an interface that gives helper methods for how privacy
mapping should be done. A mock for SessionDB is added to save on some
code repetition, the privacy flags functionality is used in a later
test.
2024-04-25 14:49:45 +02:00
shuoer86
ab47cd64f7
firewall+firewalldb: fix typos 2023-11-25 10:31:03 +08:00
Oliver Gugger
b3c0d0e9b1
multi: bump lnd to v0.17.0-beta 2023-10-03 19:51:57 +02:00
bitromortac
eb58941e76
rpcserver+firewall: obfuscate configuration
We obfuscate pubkeys, channel points and ids entered in configurations.

The channel id lengths for different block heights can be checked with:
```python
len(str(1 << 40 | 2923 << 16 | 30))
len(str(10_000_000 << 40 | 2923 << 16 | 30))
```
2023-09-05 13:03:58 +02:00
bitromortac
5580d6861d
firewalldb: export DecodeChannelPoint and restrict 2023-09-01 08:03:21 +02:00
Elle Mouton
d0bc3c37f1
firewalldb: add FetchAllPairs to PrivacyMapTx interface
This commit adds a new FetchAllPairs to the PrivacyMapTx interface. This
method returns a new PrivacyMapPairs struct which is an in-memory
privacy map DB. The PrivacyMapPairs struct implements a new
PrivacyMapReader interface which can be used to pass around read only
access to the PrivacyMapPairs struct.
2023-08-31 16:56:59 +02:00
Elle Mouton
a14d7ae17b
firewall: map session ID to group ID in privacy mapper interceptor 2023-08-30 12:34:29 +02:00
Elle Mouton
3c837a9bc6
firewall: map session ID to group ID 2023-08-30 12:34:29 +02:00
Elle Mouton
921874608c
firewall: update ActionsReadDB to get group actions 2023-08-30 12:34:29 +02:00
positiveblue
c267ef64eb
multi: update lnd dependency to v0.16.0-beta.rc3
- Bump lnd and other module dependencies.
- Bump Go build version & RPCs
- Refactor itests to use the new lnd itest framework.
2023-03-15 08:36:23 -07:00
Elle Mouton
8e61eb90da
multi: make request logger level configurable 2023-02-13 19:33:55 +02:00
bitromortac
2d57c25850
firewall: redefine obfuscation interval 2023-02-13 19:33:55 +02:00
Elle Mouton
1506f57320
privacy_mapper: construct new response msgs
In this commit, in the response handlers of the privacy mapper, we
construct new response messages instead of overwriting existing messages
in order to minimize the chances of private data slipping through
accidentally.
2023-02-13 19:33:55 +02:00
bitromortac
a74ae880c4
firewall: randomize responses with PrivacyMapper
Adds amount, timestamp, and channel initiator obfuscation to the two
response handlers `handleFwdHistoryResponse` and
`handleListChannelsResponse`.

In order to preserve privacy and still ensure functioning of algorithms
that rely on the randomized data, a trade-off between randomization and
accuracy needs to be found.

We choose ten minutes for forwarding timestamps as this breaks time
correlation of payments.

The amount obfuscation is chosen to be 5% and applies to the forwarding
amount and channel details to hide balances. We also remove details of
pending HTLCs in channels. Random obfuscation for amounts is chosen here
instead of rounding to have non-deterministic alteration of amounts,
which is especially important for forwardings to also break amount
correlation. Randomly varying around a certain value will statistically
skew averages less than rounding for algorithms that rely on
aggregation of individual data.

The privacy mapper is chosen to accept a randomness input in order to
ensure deterministic testing even when other handlers are changed in the
future.
2023-02-13 19:33:34 +02:00
bitromortac
5a453cd36c
firewall: add amount fuzzing
Adds helper functions to randomize amounts, timestamps, and booleans.
Amounts are randomized based on a percentage and timestamps based on an
absolute scale.
2023-01-27 06:47:14 +02:00
Elle Mouton
3d669d6ac3
firewall: Add Privacy Mapper interceptor 2023-01-27 06:47:13 +02:00
Elle Mouton
a7c5e97401
multi: implement rule-enforcer 2023-01-27 06:47:13 +02:00
Elle Mouton
e8065428e6
firewall: add WithPrivacy to RequestInfo 2023-01-27 06:47:13 +02:00
Elle Mouton
b59888cfa4
multi: let request logger persist Actions 2023-01-27 06:47:12 +02:00
Elle Mouton
edf195ebd9
firewall: changes to initial structure 2023-01-27 06:47:11 +02:00
Elle Mouton
bc61be5e29
firewall: allow request with no macaroon 2023-01-27 06:47:11 +02:00
Oliver Gugger
3f8789fb3e
firewall: implement firewall 2023-01-27 06:47:11 +02:00
Oliver Gugger
6d76e22d2d
firewall: add macaroon caveat logic 2023-01-27 06:47:11 +02:00
Oliver Gugger
8f0bc2f6cb
log+firewall: add firewall package 2023-01-27 06:47:11 +02:00