LCOV - code coverage report
Current view: top level - src/script - interpreter.h (source / functions) Hit Total Coverage
Test: fuzz_coverage.info Lines: 5 33 15.2 %
Date: 2023-11-06 23:13:05 Functions: 4 26 15.4 %
Branches: 0 0 -

           Branch data     Line data    Source code
       1                 :            : // Copyright (c) 2009-2010 Satoshi Nakamoto
       2                 :            : // Copyright (c) 2009-2022 The Bitcoin Core developers
       3                 :            : // Distributed under the MIT software license, see the accompanying
       4                 :            : // file COPYING or http://www.opensource.org/licenses/mit-license.php.
       5                 :            : 
       6                 :            : #ifndef BITCOIN_SCRIPT_INTERPRETER_H
       7                 :            : #define BITCOIN_SCRIPT_INTERPRETER_H
       8                 :            : 
       9                 :            : #include <hash.h>
      10                 :            : #include <script/script_error.h>
      11                 :            : #include <span.h>
      12                 :            : #include <primitives/transaction.h>
      13                 :            : 
      14                 :            : #include <optional>
      15                 :            : #include <vector>
      16                 :            : #include <stdint.h>
      17                 :            : 
      18                 :            : class CPubKey;
      19                 :            : class XOnlyPubKey;
      20                 :            : class CScript;
      21                 :            : class CTransaction;
      22                 :            : class CTxOut;
      23                 :            : class uint256;
      24                 :            : 
      25                 :            : /** Signature hash types/flags */
      26                 :            : enum
      27                 :            : {
      28                 :            :     SIGHASH_ALL = 1,
      29                 :            :     SIGHASH_NONE = 2,
      30                 :            :     SIGHASH_SINGLE = 3,
      31                 :            :     SIGHASH_ANYONECANPAY = 0x80,
      32                 :            : 
      33                 :            :     SIGHASH_DEFAULT = 0, //!< Taproot only; implied when sighash byte is missing, and equivalent to SIGHASH_ALL
      34                 :            :     SIGHASH_OUTPUT_MASK = 3,
      35                 :            :     SIGHASH_INPUT_MASK = 0x80,
      36                 :            : };
      37                 :            : 
      38                 :            : /** Script verification flags.
      39                 :            :  *
      40                 :            :  *  All flags are intended to be soft forks: the set of acceptable scripts under
      41                 :            :  *  flags (A | B) is a subset of the acceptable scripts under flag (A).
      42                 :            :  */
      43                 :            : enum : uint32_t {
      44                 :            :     SCRIPT_VERIFY_NONE      = 0,
      45                 :            : 
      46                 :            :     // Evaluate P2SH subscripts (BIP16).
      47                 :            :     SCRIPT_VERIFY_P2SH      = (1U << 0),
      48                 :            : 
      49                 :            :     // Passing a non-strict-DER signature or one with undefined hashtype to a checksig operation causes script failure.
      50                 :            :     // Evaluating a pubkey that is not (0x04 + 64 bytes) or (0x02 or 0x03 + 32 bytes) by checksig causes script failure.
      51                 :            :     // (not used or intended as a consensus rule).
      52                 :            :     SCRIPT_VERIFY_STRICTENC = (1U << 1),
      53                 :            : 
      54                 :            :     // Passing a non-strict-DER signature to a checksig operation causes script failure (BIP62 rule 1)
      55                 :            :     SCRIPT_VERIFY_DERSIG    = (1U << 2),
      56                 :            : 
      57                 :            :     // Passing a non-strict-DER signature or one with S > order/2 to a checksig operation causes script failure
      58                 :            :     // (BIP62 rule 5).
      59                 :            :     SCRIPT_VERIFY_LOW_S     = (1U << 3),
      60                 :            : 
      61                 :            :     // verify dummy stack item consumed by CHECKMULTISIG is of zero-length (BIP62 rule 7).
      62                 :            :     SCRIPT_VERIFY_NULLDUMMY = (1U << 4),
      63                 :            : 
      64                 :            :     // Using a non-push operator in the scriptSig causes script failure (BIP62 rule 2).
      65                 :            :     SCRIPT_VERIFY_SIGPUSHONLY = (1U << 5),
      66                 :            : 
      67                 :            :     // Require minimal encodings for all push operations (OP_0... OP_16, OP_1NEGATE where possible, direct
      68                 :            :     // pushes up to 75 bytes, OP_PUSHDATA up to 255 bytes, OP_PUSHDATA2 for anything larger). Evaluating
      69                 :            :     // any other push causes the script to fail (BIP62 rule 3).
      70                 :            :     // In addition, whenever a stack element is interpreted as a number, it must be of minimal length (BIP62 rule 4).
      71                 :            :     SCRIPT_VERIFY_MINIMALDATA = (1U << 6),
      72                 :            : 
      73                 :            :     // Discourage use of NOPs reserved for upgrades (NOP1-10)
      74                 :            :     //
      75                 :            :     // Provided so that nodes can avoid accepting or mining transactions
      76                 :            :     // containing executed NOP's whose meaning may change after a soft-fork,
      77                 :            :     // thus rendering the script invalid; with this flag set executing
      78                 :            :     // discouraged NOPs fails the script. This verification flag will never be
      79                 :            :     // a mandatory flag applied to scripts in a block. NOPs that are not
      80                 :            :     // executed, e.g.  within an unexecuted IF ENDIF block, are *not* rejected.
      81                 :            :     // NOPs that have associated forks to give them new meaning (CLTV, CSV)
      82                 :            :     // are not subject to this rule.
      83                 :            :     SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS  = (1U << 7),
      84                 :            : 
      85                 :            :     // Require that only a single stack element remains after evaluation. This changes the success criterion from
      86                 :            :     // "At least one stack element must remain, and when interpreted as a boolean, it must be true" to
      87                 :            :     // "Exactly one stack element must remain, and when interpreted as a boolean, it must be true".
      88                 :            :     // (BIP62 rule 6)
      89                 :            :     // Note: CLEANSTACK should never be used without P2SH or WITNESS.
      90                 :            :     // Note: WITNESS_V0 and TAPSCRIPT script execution have behavior similar to CLEANSTACK as part of their
      91                 :            :     //       consensus rules. It is automatic there and does not need this flag.
      92                 :            :     SCRIPT_VERIFY_CLEANSTACK = (1U << 8),
      93                 :            : 
      94                 :            :     // Verify CHECKLOCKTIMEVERIFY
      95                 :            :     //
      96                 :            :     // See BIP65 for details.
      97                 :            :     SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY = (1U << 9),
      98                 :            : 
      99                 :            :     // support CHECKSEQUENCEVERIFY opcode
     100                 :            :     //
     101                 :            :     // See BIP112 for details
     102                 :            :     SCRIPT_VERIFY_CHECKSEQUENCEVERIFY = (1U << 10),
     103                 :            : 
     104                 :            :     // Support segregated witness
     105                 :            :     //
     106                 :            :     SCRIPT_VERIFY_WITNESS = (1U << 11),
     107                 :            : 
     108                 :            :     // Making v1-v16 witness program non-standard
     109                 :            :     //
     110                 :            :     SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM = (1U << 12),
     111                 :            : 
     112                 :            :     // Segwit script only: Require the argument of OP_IF/NOTIF to be exactly 0x01 or empty vector
     113                 :            :     //
     114                 :            :     // Note: TAPSCRIPT script execution has behavior similar to MINIMALIF as part of its consensus
     115                 :            :     //       rules. It is automatic there and does not depend on this flag.
     116                 :            :     SCRIPT_VERIFY_MINIMALIF = (1U << 13),
     117                 :            : 
     118                 :            :     // Signature(s) must be empty vector if a CHECK(MULTI)SIG operation failed
     119                 :            :     //
     120                 :            :     SCRIPT_VERIFY_NULLFAIL = (1U << 14),
     121                 :            : 
     122                 :            :     // Public keys in segregated witness scripts must be compressed
     123                 :            :     //
     124                 :            :     SCRIPT_VERIFY_WITNESS_PUBKEYTYPE = (1U << 15),
     125                 :            : 
     126                 :            :     // Making OP_CODESEPARATOR and FindAndDelete fail any non-segwit scripts
     127                 :            :     //
     128                 :            :     SCRIPT_VERIFY_CONST_SCRIPTCODE = (1U << 16),
     129                 :            : 
     130                 :            :     // Taproot/Tapscript validation (BIPs 341 & 342)
     131                 :            :     //
     132                 :            :     SCRIPT_VERIFY_TAPROOT = (1U << 17),
     133                 :            : 
     134                 :            :     // Making unknown Taproot leaf versions non-standard
     135                 :            :     //
     136                 :            :     SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION = (1U << 18),
     137                 :            : 
     138                 :            :     // Making unknown OP_SUCCESS non-standard
     139                 :            :     SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS = (1U << 19),
     140                 :            : 
     141                 :            :     // Making unknown public key versions (in BIP 342 scripts) non-standard
     142                 :            :     SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_PUBKEYTYPE = (1U << 20),
     143                 :            : 
     144                 :            :     // Constants to point to the highest flag in use. Add new flags above this line.
     145                 :            :     //
     146                 :            :     SCRIPT_VERIFY_END_MARKER
     147                 :            : };
     148                 :            : 
     149                 :            : bool CheckSignatureEncoding(const std::vector<unsigned char> &vchSig, unsigned int flags, ScriptError* serror);
     150                 :            : 
     151                 :          0 : struct PrecomputedTransactionData
     152                 :            : {
     153                 :            :     // BIP341 precomputed data.
     154                 :            :     // These are single-SHA256, see https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#cite_note-16.
     155                 :            :     uint256 m_prevouts_single_hash;
     156                 :            :     uint256 m_sequences_single_hash;
     157                 :            :     uint256 m_outputs_single_hash;
     158                 :            :     uint256 m_spent_amounts_single_hash;
     159                 :            :     uint256 m_spent_scripts_single_hash;
     160                 :            :     //! Whether the 5 fields above are initialized.
     161                 :        400 :     bool m_bip341_taproot_ready = false;
     162                 :            : 
     163                 :            :     // BIP143 precomputed data (double-SHA256).
     164                 :            :     uint256 hashPrevouts, hashSequence, hashOutputs;
     165                 :            :     //! Whether the 3 fields above are initialized.
     166                 :        400 :     bool m_bip143_segwit_ready = false;
     167                 :            : 
     168                 :            :     std::vector<CTxOut> m_spent_outputs;
     169                 :            :     //! Whether m_spent_outputs is initialized.
     170                 :        400 :     bool m_spent_outputs_ready = false;
     171                 :            : 
     172                 :       1600 :     PrecomputedTransactionData() = default;
     173                 :            : 
     174                 :            :     /** Initialize this PrecomputedTransactionData with transaction data.
     175                 :            :      *
     176                 :            :      * @param[in]   tx             The transaction for which data is being precomputed.
     177                 :            :      * @param[in]   spent_outputs  The CTxOuts being spent, one for each tx.vin, in order.
     178                 :            :      * @param[in]   force          Whether to precompute data for all optional features,
     179                 :            :      *                             regardless of what is in the inputs (used at signing
     180                 :            :      *                             time, when the inputs aren't filled in yet). */
     181                 :            :     template <class T>
     182                 :            :     void Init(const T& tx, std::vector<CTxOut>&& spent_outputs, bool force = false);
     183                 :            : 
     184                 :            :     template <class T>
     185                 :            :     explicit PrecomputedTransactionData(const T& tx);
     186                 :            : };
     187                 :            : 
     188                 :            : enum class SigVersion
     189                 :            : {
     190                 :            :     BASE = 0,        //!< Bare scripts and BIP16 P2SH-wrapped redeemscripts
     191                 :            :     WITNESS_V0 = 1,  //!< Witness v0 (P2WPKH and P2WSH); see BIP 141
     192                 :            :     TAPROOT = 2,     //!< Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, key path spending; see BIP 341
     193                 :            :     TAPSCRIPT = 3,   //!< Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, script path spending, leaf version 0xc0; see BIP 342
     194                 :            : };
     195                 :            : 
     196                 :          0 : struct ScriptExecutionData
     197                 :            : {
     198                 :            :     //! Whether m_tapleaf_hash is initialized.
     199                 :          0 :     bool m_tapleaf_hash_init = false;
     200                 :            :     //! The tapleaf hash.
     201                 :            :     uint256 m_tapleaf_hash;
     202                 :            : 
     203                 :            :     //! Whether m_codeseparator_pos is initialized.
     204                 :          0 :     bool m_codeseparator_pos_init = false;
     205                 :            :     //! Opcode position of the last executed OP_CODESEPARATOR (or 0xFFFFFFFF if none executed).
     206                 :            :     uint32_t m_codeseparator_pos;
     207                 :            : 
     208                 :            :     //! Whether m_annex_present and (when needed) m_annex_hash are initialized.
     209                 :          0 :     bool m_annex_init = false;
     210                 :            :     //! Whether an annex is present.
     211                 :            :     bool m_annex_present;
     212                 :            :     //! Hash of the annex data.
     213                 :            :     uint256 m_annex_hash;
     214                 :            : 
     215                 :            :     //! Whether m_validation_weight_left is initialized.
     216                 :          0 :     bool m_validation_weight_left_init = false;
     217                 :            :     //! How much validation weight is left (decremented for every successful non-empty signature check).
     218                 :            :     int64_t m_validation_weight_left;
     219                 :            : 
     220                 :            :     //! The hash of the corresponding output
     221                 :            :     std::optional<uint256> m_output_hash;
     222                 :            : };
     223                 :            : 
     224                 :            : /** Signature hash sizes */
     225                 :            : static constexpr size_t WITNESS_V0_SCRIPTHASH_SIZE = 32;
     226                 :            : static constexpr size_t WITNESS_V0_KEYHASH_SIZE = 20;
     227                 :            : static constexpr size_t WITNESS_V1_TAPROOT_SIZE = 32;
     228                 :            : 
     229                 :            : static constexpr uint8_t TAPROOT_LEAF_MASK = 0xfe;
     230                 :            : static constexpr uint8_t TAPROOT_LEAF_TAPSCRIPT = 0xc0;
     231                 :            : static constexpr size_t TAPROOT_CONTROL_BASE_SIZE = 33;
     232                 :            : static constexpr size_t TAPROOT_CONTROL_NODE_SIZE = 32;
     233                 :            : static constexpr size_t TAPROOT_CONTROL_MAX_NODE_COUNT = 128;
     234                 :            : static constexpr size_t TAPROOT_CONTROL_MAX_SIZE = TAPROOT_CONTROL_BASE_SIZE + TAPROOT_CONTROL_NODE_SIZE * TAPROOT_CONTROL_MAX_NODE_COUNT;
     235                 :            : 
     236                 :            : extern const HashWriter HASHER_TAPSIGHASH; //!< Hasher with tag "TapSighash" pre-fed to it.
     237                 :            : extern const HashWriter HASHER_TAPLEAF;    //!< Hasher with tag "TapLeaf" pre-fed to it.
     238                 :            : extern const HashWriter HASHER_TAPBRANCH;  //!< Hasher with tag "TapBranch" pre-fed to it.
     239                 :            : 
     240                 :            : template <class T>
     241                 :            : uint256 SignatureHash(const CScript& scriptCode, const T& txTo, unsigned int nIn, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache = nullptr);
     242                 :            : 
     243                 :          0 : class BaseSignatureChecker
     244                 :            : {
     245                 :            : public:
     246                 :          0 :     virtual bool CheckECDSASignature(const std::vector<unsigned char>& scriptSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const
     247                 :            :     {
     248                 :          0 :         return false;
     249                 :            :     }
     250                 :            : 
     251                 :          0 :     virtual bool CheckSchnorrSignature(Span<const unsigned char> sig, Span<const unsigned char> pubkey, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* serror = nullptr) const
     252                 :            :     {
     253                 :          0 :         return false;
     254                 :            :     }
     255                 :            : 
     256                 :          0 :     virtual bool CheckLockTime(const CScriptNum& nLockTime) const
     257                 :            :     {
     258                 :          0 :          return false;
     259                 :            :     }
     260                 :            : 
     261                 :          0 :     virtual bool CheckSequence(const CScriptNum& nSequence) const
     262                 :            :     {
     263                 :          0 :          return false;
     264                 :            :     }
     265                 :            : 
     266                 :          4 :     virtual ~BaseSignatureChecker() {}
     267                 :            : };
     268                 :            : 
     269                 :            : /** Enum to specify what *TransactionSignatureChecker's behavior should be
     270                 :            :  *  when dealing with missing transaction data.
     271                 :            :  */
     272                 :            : enum class MissingDataBehavior
     273                 :            : {
     274                 :            :     ASSERT_FAIL,  //!< Abort execution through assertion failure (for consensus code)
     275                 :            :     FAIL,         //!< Just act as if the signature was invalid
     276                 :            : };
     277                 :            : 
     278                 :            : template<typename T>
     279                 :            : bool SignatureHashSchnorr(uint256& hash_out, ScriptExecutionData& execdata, const T& tx_to, uint32_t in_pos, uint8_t hash_type, SigVersion sigversion, const PrecomputedTransactionData& cache, MissingDataBehavior mdb);
     280                 :            : 
     281                 :            : template <class T>
     282                 :          0 : class GenericTransactionSignatureChecker : public BaseSignatureChecker
     283                 :            : {
     284                 :            : private:
     285                 :            :     const T* txTo;
     286                 :            :     const MissingDataBehavior m_mdb;
     287                 :            :     unsigned int nIn;
     288                 :            :     const CAmount amount;
     289                 :            :     const PrecomputedTransactionData* txdata;
     290                 :            : 
     291                 :            : protected:
     292                 :            :     virtual bool VerifyECDSASignature(const std::vector<unsigned char>& vchSig, const CPubKey& vchPubKey, const uint256& sighash) const;
     293                 :            :     virtual bool VerifySchnorrSignature(Span<const unsigned char> sig, const XOnlyPubKey& pubkey, const uint256& sighash) const;
     294                 :            : 
     295                 :            : public:
     296                 :          0 :     GenericTransactionSignatureChecker(const T* txToIn, unsigned int nInIn, const CAmount& amountIn, MissingDataBehavior mdb) : txTo(txToIn), m_mdb(mdb), nIn(nInIn), amount(amountIn), txdata(nullptr) {}
     297                 :          0 :     GenericTransactionSignatureChecker(const T* txToIn, unsigned int nInIn, const CAmount& amountIn, const PrecomputedTransactionData& txdataIn, MissingDataBehavior mdb) : txTo(txToIn), m_mdb(mdb), nIn(nInIn), amount(amountIn), txdata(&txdataIn) {}
     298                 :            :     bool CheckECDSASignature(const std::vector<unsigned char>& scriptSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override;
     299                 :            :     bool CheckSchnorrSignature(Span<const unsigned char> sig, Span<const unsigned char> pubkey, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* serror = nullptr) const override;
     300                 :            :     bool CheckLockTime(const CScriptNum& nLockTime) const override;
     301                 :            :     bool CheckSequence(const CScriptNum& nSequence) const override;
     302                 :            : };
     303                 :            : 
     304                 :            : using TransactionSignatureChecker = GenericTransactionSignatureChecker<CTransaction>;
     305                 :            : using MutableTransactionSignatureChecker = GenericTransactionSignatureChecker<CMutableTransaction>;
     306                 :            : 
     307                 :          0 : class DeferringSignatureChecker : public BaseSignatureChecker
     308                 :            : {
     309                 :            : protected:
     310                 :            :     const BaseSignatureChecker& m_checker;
     311                 :            : 
     312                 :            : public:
     313                 :          0 :     DeferringSignatureChecker(const BaseSignatureChecker& checker) : m_checker(checker) {}
     314                 :            : 
     315                 :          0 :     bool CheckECDSASignature(const std::vector<unsigned char>& scriptSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override
     316                 :            :     {
     317                 :          0 :         return m_checker.CheckECDSASignature(scriptSig, vchPubKey, scriptCode, sigversion);
     318                 :            :     }
     319                 :            : 
     320                 :          0 :     bool CheckSchnorrSignature(Span<const unsigned char> sig, Span<const unsigned char> pubkey, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* serror = nullptr) const override
     321                 :            :     {
     322                 :          0 :         return m_checker.CheckSchnorrSignature(sig, pubkey, sigversion, execdata, serror);
     323                 :            :     }
     324                 :            : 
     325                 :          0 :     bool CheckLockTime(const CScriptNum& nLockTime) const override
     326                 :            :     {
     327                 :          0 :         return m_checker.CheckLockTime(nLockTime);
     328                 :            :     }
     329                 :          0 :     bool CheckSequence(const CScriptNum& nSequence) const override
     330                 :            :     {
     331                 :          0 :         return m_checker.CheckSequence(nSequence);
     332                 :            :     }
     333                 :            : };
     334                 :            : 
     335                 :            : /** Compute the BIP341 tapleaf hash from leaf version & script. */
     336                 :            : uint256 ComputeTapleafHash(uint8_t leaf_version, Span<const unsigned char> script);
     337                 :            : /** Compute the BIP341 tapbranch hash from two branches.
     338                 :            :   * Spans must be 32 bytes each. */
     339                 :            : uint256 ComputeTapbranchHash(Span<const unsigned char> a, Span<const unsigned char> b);
     340                 :            : /** Compute the BIP341 taproot script tree Merkle root from control block and leaf hash.
     341                 :            :  *  Requires control block to have valid length (33 + k*32, with k in {0,1,..,128}). */
     342                 :            : uint256 ComputeTaprootMerkleRoot(Span<const unsigned char> control, const uint256& tapleaf_hash);
     343                 :            : 
     344                 :            : bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, unsigned int flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* error = nullptr);
     345                 :            : bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, unsigned int flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* error = nullptr);
     346                 :            : bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, unsigned int flags, const BaseSignatureChecker& checker, ScriptError* serror = nullptr);
     347                 :            : 
     348                 :            : size_t CountWitnessSigOps(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, unsigned int flags);
     349                 :            : 
     350                 :            : int FindAndDelete(CScript& script, const CScript& b);
     351                 :            : 
     352                 :            : #endif // BITCOIN_SCRIPT_INTERPRETER_H

Generated by: LCOV version 1.14