p2p_segwit.py raw
1 #!/usr/bin/env python3
2 # Copyright (c) 2016-2022 The Limenka developers
3 # Distributed under the MIT software license, see the accompanying
4 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
5 """Test segwit transactions and blocks on P2P network."""
6 from decimal import Decimal
7 import random
8
9 from test_framework.blocktools import (
10 WITNESS_COMMITMENT_HEADER,
11 add_witness_commitment,
12 create_block,
13 create_coinbase,
14 )
15 from test_framework.messages import (
16 MAX_BIP125_RBF_SEQUENCE,
17 CBlockHeader,
18 CInv,
19 COutPoint,
20 CTransaction,
21 CTxIn,
22 CTxInWitness,
23 CTxOut,
24 CTxWitness,
25 MAX_BLOCK_WEIGHT,
26 MSG_BLOCK,
27 MSG_TX,
28 MSG_WITNESS_FLAG,
29 MSG_WITNESS_TX,
30 MSG_WTX,
31 NODE_NETWORK,
32 NODE_WITNESS,
33 msg_no_witness_block,
34 msg_getdata,
35 msg_headers,
36 msg_inv,
37 msg_tx,
38 msg_block,
39 msg_no_witness_tx,
40 ser_uint256,
41 ser_vector,
42 sha256,
43 )
44 from test_framework.p2p import (
45 P2PInterface,
46 p2p_lock,
47 P2P_SERVICES,
48 )
49 from test_framework.script import (
50 CScript,
51 CScriptNum,
52 CScriptOp,
53 MAX_SCRIPT_ELEMENT_SIZE,
54 OP_0,
55 OP_1,
56 OP_2,
57 OP_16,
58 OP_2DROP,
59 OP_CHECKMULTISIG,
60 OP_CHECKSIG,
61 OP_DROP,
62 OP_ELSE,
63 OP_ENDIF,
64 OP_IF,
65 OP_RETURN,
66 OP_TRUE,
67 SIGHASH_ALL,
68 SIGHASH_ANYONECANPAY,
69 SIGHASH_NONE,
70 SIGHASH_SINGLE,
71 hash160,
72 sign_input_legacy,
73 sign_input_segwitv0,
74 )
75 from test_framework.script_util import (
76 key_to_p2pk_script,
77 key_to_p2wpkh_script,
78 keyhash_to_p2pkh_script,
79 script_to_p2sh_script,
80 script_to_p2wsh_script,
81 )
82 from test_framework.test_framework import LimenkaTestFramework
83 from test_framework.util import (
84 assert_equal,
85 assert_equal_without_usage,
86 assert_raises_rpc_error,
87 ensure_for,
88 softfork_active,
89 )
90 from test_framework.wallet import MiniWallet
91 from test_framework.wallet_util import generate_keypair
92
93
94 MAX_SIGOP_COST = 80000
95
96 SEGWIT_HEIGHT = 120
97
98 class UTXO():
99 """Used to keep track of anyone-can-spend outputs that we can use in the tests."""
100 def __init__(self, sha256, n, value):
101 self.sha256 = sha256
102 self.n = n
103 self.nValue = value
104
105
106 def subtest(func):
107 """Wraps the subtests for logging and state assertions."""
108 def func_wrapper(self, *args, **kwargs):
109 self.log.info("Subtest: {} (Segwit active = {})".format(func.__name__, self.segwit_active))
110 # Assert segwit status is as expected
111 assert_equal(softfork_active(self.nodes[0], 'segwit'), self.segwit_active)
112 func(self, *args, **kwargs)
113 # Each subtest should leave some utxos for the next subtest
114 assert self.utxo
115 self.sync_blocks()
116 # Assert segwit status is as expected at end of subtest
117 assert_equal(softfork_active(self.nodes[0], 'segwit'), self.segwit_active)
118
119 return func_wrapper
120
121
122 def sign_p2pk_witness_input(script, tx_to, in_idx, hashtype, value, key):
123 """Add signature for a P2PK witness script."""
124 tx_to.wit.vtxinwit[in_idx].scriptWitness.stack = [script]
125 sign_input_segwitv0(tx_to, in_idx, script, value, key, hashtype)
126
127 def test_transaction_acceptance(node, p2p, tx, with_witness, accepted, reason=None):
128 """Send a transaction to the node and check that it's accepted to the mempool
129
130 - Submit the transaction over the p2p interface
131 - use the getrawmempool rpc to check for acceptance."""
132 reason = [reason] if reason else []
133 with node.assert_debug_log(expected_msgs=reason):
134 p2p.send_and_ping(msg_tx(tx) if with_witness else msg_no_witness_tx(tx))
135 assert_equal(tx.hash in node.getrawmempool(), accepted)
136
137
138 def test_witness_block(node, p2p, block, accepted, with_witness=True, reason=None):
139 """Send a block to the node and check that it's accepted
140
141 - Submit the block over the p2p interface
142 - use the getbestblockhash rpc to check for acceptance."""
143 reason = [reason] if reason else []
144 with node.assert_debug_log(expected_msgs=reason):
145 p2p.send_and_ping(msg_block(block) if with_witness else msg_no_witness_block(block))
146 assert_equal(node.getbestblockhash() == block.hash, accepted)
147
148
149 class TestP2PConn(P2PInterface):
150 def __init__(self, wtxidrelay=False):
151 super().__init__(wtxidrelay=wtxidrelay)
152 self.getdataset = set()
153 self.last_wtxidrelay = []
154 self.lastgetdata = []
155 self.wtxidrelay = wtxidrelay
156
157 # Don't send getdata message replies to invs automatically.
158 # We'll send the getdata messages explicitly in the test logic.
159 def on_inv(self, message):
160 pass
161
162 def on_getdata(self, message):
163 self.lastgetdata = message.inv
164 for inv in message.inv:
165 self.getdataset.add(inv.hash)
166
167 def on_wtxidrelay(self, message):
168 self.last_wtxidrelay.append(message)
169
170 def announce_tx_and_wait_for_getdata(self, tx, success=True, use_wtxid=False):
171 if success:
172 # sanity check
173 assert (self.wtxidrelay and use_wtxid) or (not self.wtxidrelay and not use_wtxid)
174 with p2p_lock:
175 self.last_message.pop("getdata", None)
176 if use_wtxid:
177 wtxid = tx.calc_sha256(True)
178 self.send_message(msg_inv(inv=[CInv(MSG_WTX, wtxid)]))
179 else:
180 self.send_message(msg_inv(inv=[CInv(MSG_TX, tx.sha256)]))
181
182 if success:
183 if use_wtxid:
184 self.wait_for_getdata([wtxid])
185 else:
186 self.wait_for_getdata([tx.sha256])
187 else:
188 ensure_for(duration=5, f=lambda: not self.last_message.get("getdata"))
189
190 def announce_block_and_wait_for_getdata(self, block, use_header, timeout=60):
191 with p2p_lock:
192 self.last_message.pop("getdata", None)
193 msg = msg_headers()
194 msg.headers = [CBlockHeader(block)]
195 if use_header:
196 self.send_message(msg)
197 else:
198 self.send_message(msg_inv(inv=[CInv(MSG_BLOCK, block.sha256)]))
199 self.wait_for_getheaders(block_hash=block.hashPrevBlock, timeout=timeout)
200 self.send_message(msg)
201 self.wait_for_getdata([block.sha256], timeout=timeout)
202
203 def request_block(self, blockhash, inv_type, timeout=60):
204 with p2p_lock:
205 self.last_message.pop("block", None)
206 self.send_message(msg_getdata(inv=[CInv(inv_type, blockhash)]))
207 self.wait_for_block(blockhash, timeout=timeout)
208 return self.last_message["block"].block
209
210 class SegWitTest(LimenkaTestFramework):
211 def set_test_params(self):
212 self.setup_clean_chain = True
213 self.num_nodes = 2
214 # whitelist peers to speed up tx relay / mempool sync
215 self.noban_tx_relay = True
216 # This test tests SegWit both pre and post-activation, so use the normal BIP9 activation.
217 self.extra_args = [
218 # -par=1 should not affect validation outcome or logging/reported failures. It is kept
219 # here to exercise the code path still (as it is distinct for multithread script
220 # validation).
221 ["-acceptnonstdtxn=1", f"-testactivationheight=segwit@{SEGWIT_HEIGHT}", "-par=1"],
222 ["-acceptnonstdtxn=0", f"-testactivationheight=segwit@{SEGWIT_HEIGHT}"],
223 ]
224 self.supports_cli = False
225
226 # Helper functions
227
228 def build_next_block(self):
229 """Build a block on top of node0's tip."""
230 tip = self.nodes[0].getbestblockhash()
231 height = self.nodes[0].getblockcount() + 1
232 block_time = self.nodes[0].getblockheader(tip)["mediantime"] + 1
233 block = create_block(int(tip, 16), create_coinbase(height), block_time)
234 block.rehash()
235 return block
236
237 def update_witness_block_with_transactions(self, block, tx_list, nonce=0):
238 """Add list of transactions to block, adds witness commitment, then solves."""
239 block.vtx.extend(tx_list)
240 add_witness_commitment(block, nonce)
241 block.solve()
242
243 def run_test(self):
244 # Setup the p2p connections
245 # self.test_node sets P2P_SERVICES, i.e. NODE_WITNESS | NODE_NETWORK
246 self.test_node = self.nodes[0].add_p2p_connection(TestP2PConn(), services=P2P_SERVICES)
247 # self.old_node sets only NODE_NETWORK
248 self.old_node = self.nodes[0].add_p2p_connection(TestP2PConn(), services=NODE_NETWORK)
249 # self.std_node is for testing node1 (requires standard txs)
250 self.std_node = self.nodes[1].add_p2p_connection(TestP2PConn(), services=P2P_SERVICES)
251 # self.std_wtx_node is for testing node1 with wtxid relay
252 self.std_wtx_node = self.nodes[1].add_p2p_connection(TestP2PConn(wtxidrelay=True), services=P2P_SERVICES)
253
254 assert self.test_node.nServices & NODE_WITNESS != 0
255
256 # Keep a place to store utxo's that can be used in later tests
257 self.utxo = []
258
259 self.log.info("Starting tests before segwit activation")
260 self.segwit_active = False
261 self.wallet = MiniWallet(self.nodes[0])
262
263 self.test_non_witness_transaction()
264 self.test_v0_outputs_arent_spendable()
265 self.test_block_relay()
266 self.test_unnecessary_witness_before_segwit_activation()
267 self.test_witness_tx_relay_before_segwit_activation()
268 self.test_standardness_v0()
269
270 self.log.info("Advancing to segwit activation")
271 self.advance_to_segwit_active()
272
273 # Segwit status 'active'
274
275 self.test_p2sh_witness()
276 self.test_witness_commitments()
277 self.test_block_malleability()
278 self.test_witness_block_size()
279 self.test_submit_block()
280 self.test_extra_witness_data()
281 self.test_max_witness_push_length()
282 self.test_max_witness_script_length()
283 self.test_witness_input_length()
284 self.test_block_relay()
285 self.test_tx_relay_after_segwit_activation()
286 self.test_standardness_v0()
287 self.test_segwit_versions()
288 self.test_premature_coinbase_witness_spend()
289 self.test_uncompressed_pubkey()
290 self.test_signature_version_1()
291 self.test_non_standard_witness_blinding()
292 self.test_non_standard_witness()
293 self.test_witness_sigops()
294 self.test_superfluous_witness()
295 self.test_wtxid_relay()
296
297 # Individual tests
298
299 @subtest
300 def test_non_witness_transaction(self):
301 """See if sending a regular transaction works, and create a utxo to use in later tests."""
302 # Mine a block with an anyone-can-spend coinbase,
303 # let it mature, then try to spend it.
304
305 block = self.build_next_block()
306 block.solve()
307 self.test_node.send_and_ping(msg_no_witness_block(block)) # make sure the block was processed
308 txid = block.vtx[0].sha256
309
310 self.generate(self.wallet, 99) # let the block mature
311
312 # Create a transaction that spends the coinbase
313 tx = CTransaction()
314 tx.vin.append(CTxIn(COutPoint(txid, 0), b""))
315 tx.vout.append(CTxOut(49 * 100000000, CScript([OP_TRUE, OP_DROP] * 15 + [OP_TRUE])))
316 tx.calc_sha256()
317
318 # Check that serializing it with or without witness is the same
319 # This is a sanity check of our testing framework.
320 assert_equal(msg_no_witness_tx(tx).serialize(), msg_tx(tx).serialize())
321
322 self.test_node.send_and_ping(msg_tx(tx)) # make sure the block was processed
323 assert tx.hash in self.nodes[0].getrawmempool()
324 # Save this transaction for later
325 self.utxo.append(UTXO(tx.sha256, 0, 49 * 100000000))
326 self.generate(self.nodes[0], 1)
327
328 @subtest
329 def test_unnecessary_witness_before_segwit_activation(self):
330 """Verify that blocks with witnesses are rejected before activation."""
331
332 tx = CTransaction()
333 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
334 tx.vout.append(CTxOut(self.utxo[0].nValue - 1000, CScript([OP_TRUE])))
335 tx.wit.vtxinwit.append(CTxInWitness())
336 tx.wit.vtxinwit[0].scriptWitness.stack = [CScript([CScriptNum(1)])]
337
338 # Verify the hash with witness differs from the txid
339 # (otherwise our testing framework must be broken!)
340 tx.rehash()
341 assert tx.sha256 != tx.calc_sha256(with_witness=True)
342
343 # Construct a block that includes the transaction.
344 block = self.build_next_block()
345 self.update_witness_block_with_transactions(block, [tx])
346 # Sending witness data before activation is not allowed (anti-spam
347 # rule).
348 test_witness_block(self.nodes[0], self.test_node, block, accepted=False, reason='unexpected-witness')
349
350 # But it should not be permanently marked bad...
351 # Resend without witness information.
352 self.test_node.send_and_ping(msg_no_witness_block(block)) # make sure the block was processed
353 assert_equal(self.nodes[0].getbestblockhash(), block.hash)
354
355 # Update our utxo list; we spent the first entry.
356 self.utxo.pop(0)
357 self.utxo.append(UTXO(tx.sha256, 0, tx.vout[0].nValue))
358
359 @subtest
360 def test_block_relay(self):
361 """Test that block requests to NODE_WITNESS peer are with MSG_WITNESS_FLAG.
362
363 This is true regardless of segwit activation.
364 Also test that we don't ask for blocks from unupgraded peers."""
365
366 blocktype = 2 | MSG_WITNESS_FLAG
367
368 # test_node has set NODE_WITNESS, so all getdata requests should be for
369 # witness blocks.
370 # Test announcing a block via inv results in a getdata, and that
371 # announcing a block with a header results in a getdata
372 block1 = self.build_next_block()
373 block1.solve()
374
375 # Send an empty headers message, to clear out any prior getheaders
376 # messages that our peer may be waiting for us on.
377 self.test_node.send_message(msg_headers())
378
379 self.test_node.announce_block_and_wait_for_getdata(block1, use_header=False)
380 assert self.test_node.last_message["getdata"].inv[0].type == blocktype
381 test_witness_block(self.nodes[0], self.test_node, block1, True)
382
383 block2 = self.build_next_block()
384 block2.solve()
385
386 self.test_node.announce_block_and_wait_for_getdata(block2, use_header=True)
387 assert self.test_node.last_message["getdata"].inv[0].type == blocktype
388 test_witness_block(self.nodes[0], self.test_node, block2, True)
389
390 # Check that we can getdata for witness blocks or regular blocks,
391 # and the right thing happens.
392 if not self.segwit_active:
393 # Before activation, we should be able to request old blocks with
394 # or without witness, and they should be the same.
395 chain_height = self.nodes[0].getblockcount()
396 # Pick 10 random blocks on main chain, and verify that getdata's
397 # for MSG_BLOCK, MSG_WITNESS_BLOCK, and rpc getblock() are equal.
398 all_heights = list(range(chain_height + 1))
399 random.shuffle(all_heights)
400 all_heights = all_heights[0:10]
401 for height in all_heights:
402 block_hash = self.nodes[0].getblockhash(height)
403 rpc_block = self.nodes[0].getblock(block_hash, False)
404 block_hash = int(block_hash, 16)
405 block = self.test_node.request_block(block_hash, 2)
406 wit_block = self.test_node.request_block(block_hash, 2 | MSG_WITNESS_FLAG)
407 assert_equal(block.serialize(), wit_block.serialize())
408 assert_equal(block.serialize(), bytes.fromhex(rpc_block))
409 else:
410 # After activation, witness blocks and non-witness blocks should
411 # be different. Verify rpc getblock() returns witness blocks, while
412 # getdata respects the requested type.
413 block = self.build_next_block()
414 self.update_witness_block_with_transactions(block, [])
415 # This gives us a witness commitment.
416 assert len(block.vtx[0].wit.vtxinwit) == 1
417 assert len(block.vtx[0].wit.vtxinwit[0].scriptWitness.stack) == 1
418 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
419 # Now try to retrieve it...
420 rpc_block = self.nodes[0].getblock(block.hash, False)
421 non_wit_block = self.test_node.request_block(block.sha256, 2)
422 wit_block = self.test_node.request_block(block.sha256, 2 | MSG_WITNESS_FLAG)
423 assert_equal(wit_block.serialize(), bytes.fromhex(rpc_block))
424 assert_equal(wit_block.serialize(False), non_wit_block.serialize())
425 assert_equal(wit_block.serialize(), block.serialize())
426
427 # Test size, vsize, weight
428 rpc_details = self.nodes[0].getblock(block.hash, True)
429 assert_equal(rpc_details["size"], len(block.serialize()))
430 assert_equal(rpc_details["strippedsize"], len(block.serialize(False)))
431 assert_equal(rpc_details["weight"], block.get_weight())
432
433 # Upgraded node should not ask for blocks from unupgraded
434 block4 = self.build_next_block()
435 block4.solve()
436 self.old_node.getdataset = set()
437
438 # Blocks can be requested via direct-fetch (immediately upon processing the announcement)
439 # or via parallel download (with an indeterminate delay from processing the announcement)
440 # so to test that a block is NOT requested, we could guess a time period to sleep for,
441 # and then check. We can avoid the sleep() by taking advantage of transaction getdata's
442 # being processed after block getdata's, and announce a transaction as well,
443 # and then check to see if that particular getdata has been received.
444 # Since 0.14, inv's will only be responded to with a getheaders, so send a header
445 # to announce this block.
446 msg = msg_headers()
447 msg.headers = [CBlockHeader(block4)]
448 self.old_node.send_message(msg)
449 self.old_node.announce_tx_and_wait_for_getdata(block4.vtx[0])
450 assert block4.sha256 not in self.old_node.getdataset
451
452 @subtest
453 def test_v0_outputs_arent_spendable(self):
454 """Test that v0 outputs aren't spendable before segwit activation.
455
456 ~6 months after segwit activation, the SCRIPT_VERIFY_WITNESS flag was
457 backdated so that it applies to all blocks, going back to the genesis
458 block.
459
460 Consequently, version 0 witness outputs are never spendable without
461 witness, and so can't be spent before segwit activation (the point at which
462 blocks are permitted to contain witnesses)."""
463
464 # Create two outputs, a p2wsh and p2sh-p2wsh
465 witness_script = CScript([OP_TRUE])
466 script_pubkey = script_to_p2wsh_script(witness_script)
467 p2sh_script_pubkey = script_to_p2sh_script(script_pubkey)
468
469 value = self.utxo[0].nValue // 3
470
471 tx = CTransaction()
472 tx.vin = [CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b'')]
473 tx.vout = [CTxOut(value, script_pubkey), CTxOut(value, p2sh_script_pubkey)]
474 tx.vout.append(CTxOut(value, CScript([OP_TRUE])))
475 tx.rehash()
476 txid = tx.sha256
477
478 # Add it to a block
479 block = self.build_next_block()
480 self.update_witness_block_with_transactions(block, [tx])
481 # Verify that segwit isn't activated. A block serialized with witness
482 # should be rejected prior to activation.
483 test_witness_block(self.nodes[0], self.test_node, block, accepted=False, with_witness=True, reason='unexpected-witness')
484 # Now send the block without witness. It should be accepted
485 test_witness_block(self.nodes[0], self.test_node, block, accepted=True, with_witness=False)
486
487 # Now try to spend the outputs. This should fail since SCRIPT_VERIFY_WITNESS is always enabled.
488 p2wsh_tx = CTransaction()
489 p2wsh_tx.vin = [CTxIn(COutPoint(txid, 0), b'')]
490 p2wsh_tx.vout = [CTxOut(value, CScript([OP_TRUE]))]
491 p2wsh_tx.wit.vtxinwit.append(CTxInWitness())
492 p2wsh_tx.wit.vtxinwit[0].scriptWitness.stack = [CScript([OP_TRUE])]
493 p2wsh_tx.rehash()
494
495 p2sh_p2wsh_tx = CTransaction()
496 p2sh_p2wsh_tx.vin = [CTxIn(COutPoint(txid, 1), CScript([script_pubkey]))]
497 p2sh_p2wsh_tx.vout = [CTxOut(value, CScript([OP_TRUE]))]
498 p2sh_p2wsh_tx.wit.vtxinwit.append(CTxInWitness())
499 p2sh_p2wsh_tx.wit.vtxinwit[0].scriptWitness.stack = [CScript([OP_TRUE])]
500 p2sh_p2wsh_tx.rehash()
501
502 for tx in [p2wsh_tx, p2sh_p2wsh_tx]:
503
504 block = self.build_next_block()
505 self.update_witness_block_with_transactions(block, [tx])
506
507 # When the block is serialized with a witness, the block will be rejected because witness
508 # data isn't allowed in blocks that don't commit to witness data.
509 test_witness_block(self.nodes[0], self.test_node, block, accepted=False, with_witness=True, reason='unexpected-witness')
510
511 # When the block is serialized without witness, validation fails because the transaction is
512 # invalid (transactions are always validated with SCRIPT_VERIFY_WITNESS so a segwit v0 transaction
513 # without a witness is invalid).
514 test_witness_block(self.nodes[0], self.test_node, block, accepted=False, with_witness=False,
515 reason='mandatory-script-verify-flag-failed (Witness program was passed an empty witness)')
516
517 self.utxo.pop(0)
518 self.utxo.append(UTXO(txid, 2, value))
519
520 @subtest
521 def test_witness_tx_relay_before_segwit_activation(self):
522
523 # Generate a transaction that doesn't require a witness, but send it
524 # with a witness. Should be rejected for premature-witness, but should
525 # not be added to recently rejected list.
526 tx = CTransaction()
527 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
528 tx.vout.append(CTxOut(self.utxo[0].nValue - 1000, CScript([OP_TRUE, OP_DROP] * 15 + [OP_TRUE])))
529 tx.wit.vtxinwit.append(CTxInWitness())
530 tx.wit.vtxinwit[0].scriptWitness.stack = [b'a']
531 tx.rehash()
532
533 tx_hash = tx.sha256
534 tx_value = tx.vout[0].nValue
535
536 # Verify that if a peer doesn't set nServices to include NODE_WITNESS,
537 # the getdata is just for the non-witness portion.
538 self.old_node.announce_tx_and_wait_for_getdata(tx)
539 assert self.old_node.last_message["getdata"].inv[0].type == MSG_TX
540
541 # Since we haven't delivered the tx yet, inv'ing the same tx from
542 # a witness transaction ought not result in a getdata.
543 self.test_node.announce_tx_and_wait_for_getdata(tx, success=False)
544
545 # Delivering this transaction with witness should fail (no matter who
546 # its from)
547 assert_equal(len(self.nodes[0].getrawmempool()), 0)
548 assert_equal(len(self.nodes[1].getrawmempool()), 0)
549 test_transaction_acceptance(self.nodes[0], self.old_node, tx, with_witness=True, accepted=False)
550 test_transaction_acceptance(self.nodes[0], self.test_node, tx, with_witness=True, accepted=False)
551
552 # But eliminating the witness should fix it
553 test_transaction_acceptance(self.nodes[0], self.test_node, tx, with_witness=False, accepted=True)
554
555 # Cleanup: mine the first transaction and update utxo
556 self.generate(self.nodes[0], 1)
557 assert_equal(len(self.nodes[0].getrawmempool()), 0)
558
559 self.utxo.pop(0)
560 self.utxo.append(UTXO(tx_hash, 0, tx_value))
561
562 @subtest
563 def test_standardness_v0(self):
564 """Test V0 txout standardness.
565
566 V0 segwit outputs and inputs are always standard.
567 V0 segwit inputs may only be mined after activation, but not before."""
568
569 witness_script = CScript([OP_TRUE])
570 script_pubkey = script_to_p2wsh_script(witness_script)
571 p2sh_script_pubkey = script_to_p2sh_script(witness_script)
572
573 # First prepare a p2sh output (so that spending it will pass standardness)
574 p2sh_tx = CTransaction()
575 p2sh_tx.vin = [CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b"")]
576 p2sh_tx.vout = [CTxOut(self.utxo[0].nValue - 1000, p2sh_script_pubkey)]
577 p2sh_tx.rehash()
578
579 # Mine it on test_node to create the confirmed output.
580 test_transaction_acceptance(self.nodes[0], self.test_node, p2sh_tx, with_witness=True, accepted=True)
581 self.generate(self.nodes[0], 1)
582
583 # Now test standardness of v0 P2WSH outputs.
584 # Start by creating a transaction with two outputs.
585 tx = CTransaction()
586 tx.vin = [CTxIn(COutPoint(p2sh_tx.sha256, 0), CScript([witness_script]))]
587 tx.vout = [CTxOut(p2sh_tx.vout[0].nValue - 10000, script_pubkey)]
588 tx.vout.append(CTxOut(8000, script_pubkey)) # Might burn this later
589 tx.vin[0].nSequence = MAX_BIP125_RBF_SEQUENCE # Just to have the option to bump this tx from the mempool
590 tx.rehash()
591
592 # This is always accepted, since the mempool policy is to consider segwit as always active
593 # and thus allow segwit outputs
594 test_transaction_acceptance(self.nodes[1], self.std_node, tx, with_witness=True, accepted=True)
595
596 # Now create something that looks like a P2PKH output. This won't be spendable.
597 witness_hash = sha256(witness_script)
598 script_pubkey = CScript([OP_0, hash160(witness_hash)])
599 tx2 = CTransaction()
600 # tx was accepted, so we spend the second output.
601 tx2.vin = [CTxIn(COutPoint(tx.sha256, 1), b"")]
602 tx2.vout = [CTxOut(7000, script_pubkey)]
603 tx2.wit.vtxinwit.append(CTxInWitness())
604 tx2.wit.vtxinwit[0].scriptWitness.stack = [witness_script]
605 tx2.rehash()
606
607 test_transaction_acceptance(self.nodes[1], self.std_node, tx2, with_witness=True, accepted=True)
608
609 # Now update self.utxo for later tests.
610 tx3 = CTransaction()
611 # tx and tx2 were both accepted. Don't bother trying to reclaim the
612 # P2PKH output; just send tx's first output back to an anyone-can-spend.
613 self.sync_mempools([self.nodes[0], self.nodes[1]])
614 tx3.vin = [CTxIn(COutPoint(tx.sha256, 0), b"")]
615 tx3.vout = [CTxOut(tx.vout[0].nValue - 1000, CScript([OP_TRUE, OP_DROP] * 15 + [OP_TRUE]))]
616 tx3.wit.vtxinwit.append(CTxInWitness())
617 tx3.wit.vtxinwit[0].scriptWitness.stack = [witness_script]
618 tx3.rehash()
619 if not self.segwit_active:
620 # Just check mempool acceptance, but don't add the transaction to the mempool, since witness is disallowed
621 # in blocks and the tx is impossible to mine right now.
622 testres3 = self.nodes[0].testmempoolaccept([tx3.serialize_with_witness().hex()])
623 testres3[0]["fees"].pop("effective-feerate")
624 testres3[0]["fees"].pop("effective-includes")
625 assert_equal_without_usage(testres3,
626 [{
627 'txid': tx3.hash,
628 'wtxid': tx3.getwtxid(),
629 'allowed': True,
630 'vsize': tx3.get_vsize(),
631 'fees': {
632 'base': Decimal('0.00001000'),
633 },
634 }],
635 )
636 # Create the same output as tx3, but by replacing tx
637 tx3_out = tx3.vout[0]
638 tx3 = tx
639 tx3.vout = [tx3_out]
640 tx3.rehash()
641 testres3_replaced = self.nodes[0].testmempoolaccept([tx3.serialize_with_witness().hex()])
642 testres3_replaced[0]["fees"].pop("effective-feerate")
643 testres3_replaced[0]["fees"].pop("effective-includes")
644 assert_equal_without_usage(testres3_replaced,
645 [{
646 'txid': tx3.hash,
647 'wtxid': tx3.getwtxid(),
648 'allowed': True,
649 'vsize': tx3.get_vsize(),
650 'fees': {
651 'base': Decimal('0.00011000'),
652 },
653 }],
654 )
655 test_transaction_acceptance(self.nodes[0], self.test_node, tx3, with_witness=True, accepted=True)
656
657 self.generate(self.nodes[0], 1)
658 self.utxo.pop(0)
659 self.utxo.append(UTXO(tx3.sha256, 0, tx3.vout[0].nValue))
660 assert_equal(len(self.nodes[1].getrawmempool()), 0)
661
662 @subtest
663 def advance_to_segwit_active(self):
664 """Mine enough blocks to activate segwit."""
665 assert not softfork_active(self.nodes[0], 'segwit')
666 height = self.nodes[0].getblockcount()
667 self.generate(self.nodes[0], SEGWIT_HEIGHT - height - 2)
668 assert not softfork_active(self.nodes[0], 'segwit')
669 self.generate(self.nodes[0], 1)
670 assert softfork_active(self.nodes[0], 'segwit')
671 self.segwit_active = True
672
673 @subtest
674 def test_p2sh_witness(self):
675 """Test P2SH wrapped witness programs."""
676
677 # Prepare the p2sh-wrapped witness output
678 witness_script = CScript([OP_DROP, OP_TRUE])
679 p2wsh_pubkey = script_to_p2wsh_script(witness_script)
680 script_pubkey = script_to_p2sh_script(p2wsh_pubkey)
681 script_sig = CScript([p2wsh_pubkey]) # a push of the redeem script
682
683 # Fund the P2SH output
684 tx = CTransaction()
685 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
686 tx.vout.append(CTxOut(self.utxo[0].nValue - 1000, script_pubkey))
687 tx.rehash()
688
689 # Verify mempool acceptance and block validity
690 test_transaction_acceptance(self.nodes[0], self.test_node, tx, with_witness=False, accepted=True)
691 block = self.build_next_block()
692 self.update_witness_block_with_transactions(block, [tx])
693 test_witness_block(self.nodes[0], self.test_node, block, accepted=True, with_witness=True)
694 self.sync_blocks()
695
696 # Now test attempts to spend the output.
697 spend_tx = CTransaction()
698 spend_tx.vin.append(CTxIn(COutPoint(tx.sha256, 0), script_sig))
699 spend_tx.vout.append(CTxOut(tx.vout[0].nValue - 1000, CScript([OP_TRUE])))
700 spend_tx.rehash()
701
702 # This transaction should not be accepted into the mempool pre- or
703 # post-segwit. Mempool acceptance will use SCRIPT_VERIFY_WITNESS which
704 # will require a witness to spend a witness program regardless of
705 # segwit activation. Note that older limenkad's that are not
706 # segwit-aware would also reject this for failing CLEANSTACK.
707 with self.nodes[0].assert_debug_log(
708 expected_msgs=[spend_tx.hash, 'was not accepted: mempool-script-verify-flag-failed (Witness program was passed an empty witness)']):
709 test_transaction_acceptance(self.nodes[0], self.test_node, spend_tx, with_witness=False, accepted=False)
710
711 # The transaction was detected as witness stripped above and not added to the reject
712 # filter. Trying again will check it again and result in the same error.
713 with self.nodes[0].assert_debug_log(
714 expected_msgs=[spend_tx.hash, 'was not accepted: mempool-script-verify-flag-failed (Witness program was passed an empty witness)']):
715 test_transaction_acceptance(self.nodes[0], self.test_node, spend_tx, with_witness=False, accepted=False)
716
717 # Try to put the witness script in the scriptSig, should also fail.
718 spend_tx.vin[0].scriptSig = CScript([p2wsh_pubkey, b'a'])
719 spend_tx.rehash()
720 with self.nodes[0].assert_debug_log(
721 expected_msgs=[spend_tx.hash, 'was not accepted: mempool-script-verify-flag-failed (Script evaluated without error but finished with a false/empty top stack element)']):
722 test_transaction_acceptance(self.nodes[0], self.test_node, spend_tx, with_witness=False, accepted=False)
723
724 # Now put the witness script in the witness, should succeed after
725 # segwit activates.
726 spend_tx.vin[0].scriptSig = script_sig
727 spend_tx.rehash()
728 spend_tx.wit.vtxinwit.append(CTxInWitness())
729 spend_tx.wit.vtxinwit[0].scriptWitness.stack = [b'a', witness_script]
730
731 # Verify mempool acceptance
732 test_transaction_acceptance(self.nodes[0], self.test_node, spend_tx, with_witness=True, accepted=True)
733 block = self.build_next_block()
734 self.update_witness_block_with_transactions(block, [spend_tx])
735
736 # If we're after activation, then sending this with witnesses should be valid.
737 # This no longer works before activation, because SCRIPT_VERIFY_WITNESS
738 # is always set.
739 # TODO: rewrite this test to make clear that it only works after activation.
740 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
741
742 # Update self.utxo
743 self.utxo.pop(0)
744 self.utxo.append(UTXO(spend_tx.sha256, 0, spend_tx.vout[0].nValue))
745
746 @subtest
747 def test_witness_commitments(self):
748 """Test witness commitments.
749
750 This test can only be run after segwit has activated."""
751
752 # First try a correct witness commitment.
753 block = self.build_next_block()
754 add_witness_commitment(block)
755 block.solve()
756
757 # Test the test -- witness serialization should be different
758 assert msg_block(block).serialize() != msg_no_witness_block(block).serialize()
759
760 # This empty block should be valid.
761 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
762
763 # Try to tweak the nonce
764 block_2 = self.build_next_block()
765 add_witness_commitment(block_2, nonce=28)
766 block_2.solve()
767
768 # The commitment should have changed!
769 assert block_2.vtx[0].vout[-1] != block.vtx[0].vout[-1]
770
771 # This should also be valid.
772 test_witness_block(self.nodes[0], self.test_node, block_2, accepted=True)
773
774 # Now test commitments with actual transactions
775 tx = CTransaction()
776 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
777
778 # Let's construct a witness script
779 witness_script = CScript([OP_TRUE])
780 script_pubkey = script_to_p2wsh_script(witness_script)
781 tx.vout.append(CTxOut(self.utxo[0].nValue - 1000, script_pubkey))
782 tx.rehash()
783
784 # tx2 will spend tx1, and send back to a regular anyone-can-spend address
785 tx2 = CTransaction()
786 tx2.vin.append(CTxIn(COutPoint(tx.sha256, 0), b""))
787 tx2.vout.append(CTxOut(tx.vout[0].nValue - 1000, witness_script))
788 tx2.wit.vtxinwit.append(CTxInWitness())
789 tx2.wit.vtxinwit[0].scriptWitness.stack = [witness_script]
790 tx2.rehash()
791
792 block_3 = self.build_next_block()
793 self.update_witness_block_with_transactions(block_3, [tx, tx2], nonce=1)
794 # Add an extra OP_RETURN output that matches the witness commitment template,
795 # even though it has extra data after the incorrect commitment.
796 # This block should fail.
797 block_3.vtx[0].vout.append(CTxOut(0, CScript([OP_RETURN, WITNESS_COMMITMENT_HEADER + ser_uint256(2), 10])))
798 block_3.vtx[0].rehash()
799 block_3.hashMerkleRoot = block_3.calc_merkle_root()
800 block_3.solve()
801
802 test_witness_block(self.nodes[0], self.test_node, block_3, accepted=False, reason='bad-witness-merkle-match')
803
804 # Add a different commitment with different nonce, but in the
805 # right location, and with some funds burned(!).
806 # This should succeed (nValue shouldn't affect finding the
807 # witness commitment).
808 add_witness_commitment(block_3, nonce=0)
809 block_3.vtx[0].vout[0].nValue -= 1
810 block_3.vtx[0].vout[-1].nValue += 1
811 block_3.vtx[0].rehash()
812 block_3.hashMerkleRoot = block_3.calc_merkle_root()
813 assert len(block_3.vtx[0].vout) == 4 # 3 OP_returns
814 block_3.solve()
815 test_witness_block(self.nodes[0], self.test_node, block_3, accepted=True)
816
817 # Finally test that a block with no witness transactions can
818 # omit the commitment.
819 block_4 = self.build_next_block()
820 tx3 = CTransaction()
821 tx3.vin.append(CTxIn(COutPoint(tx2.sha256, 0), b""))
822 tx3.vout.append(CTxOut(tx.vout[0].nValue - 1000, witness_script))
823 tx3.rehash()
824 block_4.vtx.append(tx3)
825 block_4.hashMerkleRoot = block_4.calc_merkle_root()
826 block_4.solve()
827 test_witness_block(self.nodes[0], self.test_node, block_4, with_witness=False, accepted=True)
828
829 # Update available utxo's for use in later test.
830 self.utxo.pop(0)
831 self.utxo.append(UTXO(tx3.sha256, 0, tx3.vout[0].nValue))
832
833 @subtest
834 def test_block_malleability(self):
835
836 # Make sure that a block that has too big a virtual size
837 # because of a too-large coinbase witness is not permanently
838 # marked bad.
839 block = self.build_next_block()
840 add_witness_commitment(block)
841 block.solve()
842
843 block.vtx[0].wit.vtxinwit[0].scriptWitness.stack.append(b'a' * 5000000)
844 assert block.get_weight() > MAX_BLOCK_WEIGHT
845
846 # We can't send over the p2p network, because this is too big to relay
847 # TODO: repeat this test with a block that can be relayed
848 assert_equal('bad-witness-nonce-size', self.nodes[0].submitblock(block.serialize().hex()))
849
850 assert self.nodes[0].getbestblockhash() != block.hash
851
852 block.vtx[0].wit.vtxinwit[0].scriptWitness.stack.pop()
853 assert block.get_weight() < MAX_BLOCK_WEIGHT
854 assert_equal(None, self.nodes[0].submitblock(block.serialize().hex()))
855
856 assert self.nodes[0].getbestblockhash() == block.hash
857
858 # Now make sure that malleating the witness reserved value doesn't
859 # result in a block permanently marked bad.
860 block = self.build_next_block()
861 add_witness_commitment(block)
862 block.solve()
863
864 # Change the nonce -- should not cause the block to be permanently
865 # failed
866 block.vtx[0].wit.vtxinwit[0].scriptWitness.stack = [ser_uint256(1)]
867 test_witness_block(self.nodes[0], self.test_node, block, accepted=False, reason='bad-witness-merkle-match')
868
869 # Changing the witness reserved value doesn't change the block hash
870 block.vtx[0].wit.vtxinwit[0].scriptWitness.stack = [ser_uint256(0)]
871 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
872
873 @subtest
874 def test_witness_block_size(self):
875 # TODO: Test that non-witness carrying blocks can't exceed 1MB
876 # Skipping this test for now; this is covered in feature_block.py
877
878 # Test that witness-bearing blocks are limited at ceil(base + wit/4) <= 1MB.
879 block = self.build_next_block()
880
881 assert len(self.utxo) > 0
882
883 # Create a P2WSH transaction.
884 # The witness script will be a bunch of OP_2DROP's, followed by OP_TRUE.
885 # This should give us plenty of room to tweak the spending tx's
886 # virtual size.
887 NUM_DROPS = 200 # 201 max ops per script!
888 NUM_OUTPUTS = 50
889
890 witness_script = CScript([OP_2DROP] * NUM_DROPS + [OP_TRUE])
891 script_pubkey = script_to_p2wsh_script(witness_script)
892
893 prevout = COutPoint(self.utxo[0].sha256, self.utxo[0].n)
894 value = self.utxo[0].nValue
895
896 parent_tx = CTransaction()
897 parent_tx.vin.append(CTxIn(prevout, b""))
898 child_value = int(value / NUM_OUTPUTS)
899 for _ in range(NUM_OUTPUTS):
900 parent_tx.vout.append(CTxOut(child_value, script_pubkey))
901 parent_tx.vout[0].nValue -= 50000
902 assert parent_tx.vout[0].nValue > 0
903 parent_tx.rehash()
904
905 child_tx = CTransaction()
906 for i in range(NUM_OUTPUTS):
907 child_tx.vin.append(CTxIn(COutPoint(parent_tx.sha256, i), b""))
908 child_tx.vout = [CTxOut(value - 100000, CScript([OP_TRUE]))]
909 for _ in range(NUM_OUTPUTS):
910 child_tx.wit.vtxinwit.append(CTxInWitness())
911 child_tx.wit.vtxinwit[-1].scriptWitness.stack = [b'a' * 195] * (2 * NUM_DROPS) + [witness_script]
912 child_tx.rehash()
913 self.update_witness_block_with_transactions(block, [parent_tx, child_tx])
914
915 additional_bytes = MAX_BLOCK_WEIGHT - block.get_weight()
916 i = 0
917 while additional_bytes > 0:
918 # Add some more bytes to each input until we hit MAX_BLOCK_WEIGHT+1
919 extra_bytes = min(additional_bytes + 1, 55)
920 block.vtx[-1].wit.vtxinwit[int(i / (2 * NUM_DROPS))].scriptWitness.stack[i % (2 * NUM_DROPS)] = b'a' * (195 + extra_bytes)
921 additional_bytes -= extra_bytes
922 i += 1
923
924 block.vtx[0].vout.pop() # Remove old commitment
925 add_witness_commitment(block)
926 block.solve()
927 assert_equal(block.get_weight(), MAX_BLOCK_WEIGHT + 1)
928 # Make sure that our test case would exceed the old max-network-message
929 # limit
930 assert len(block.serialize()) > 2 * 1024 * 1024
931
932 test_witness_block(self.nodes[0], self.test_node, block, accepted=False, reason='bad-blk-weight')
933
934 # Now resize the second transaction to make the block fit.
935 cur_length = len(block.vtx[-1].wit.vtxinwit[0].scriptWitness.stack[0])
936 block.vtx[-1].wit.vtxinwit[0].scriptWitness.stack[0] = b'a' * (cur_length - 1)
937 block.vtx[0].vout.pop()
938 add_witness_commitment(block)
939 block.solve()
940 assert block.get_weight() == MAX_BLOCK_WEIGHT
941
942 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
943
944 # Update available utxo's
945 self.utxo.pop(0)
946 self.utxo.append(UTXO(block.vtx[-1].sha256, 0, block.vtx[-1].vout[0].nValue))
947
948 @subtest
949 def test_submit_block(self):
950 """Test that submitblock adds the nonce automatically when possible."""
951 block = self.build_next_block()
952
953 # Try using a custom nonce and then don't supply it.
954 # This shouldn't possibly work.
955 add_witness_commitment(block, nonce=1)
956 block.vtx[0].wit = CTxWitness() # drop the nonce
957 block.solve()
958 assert_equal('bad-witness-merkle-match', self.nodes[0].submitblock(block.serialize().hex()))
959 assert self.nodes[0].getbestblockhash() != block.hash
960
961 # Now redo commitment with the standard nonce, but let limenkad fill it in.
962 add_witness_commitment(block, nonce=0)
963 block.vtx[0].wit = CTxWitness()
964 block.solve()
965 assert_equal(None, self.nodes[0].submitblock(block.serialize().hex()))
966 assert_equal(self.nodes[0].getbestblockhash(), block.hash)
967
968 # This time, add a tx with non-empty witness, but don't supply
969 # the commitment.
970 block_2 = self.build_next_block()
971
972 add_witness_commitment(block_2)
973
974 block_2.solve()
975
976 # Drop commitment and nonce -- submitblock should not fill in.
977 block_2.vtx[0].vout.pop()
978 block_2.vtx[0].wit = CTxWitness()
979
980 assert_equal('bad-txnmrklroot', self.nodes[0].submitblock(block_2.serialize().hex()))
981 # Tip should not advance!
982 assert self.nodes[0].getbestblockhash() != block_2.hash
983
984 @subtest
985 def test_extra_witness_data(self):
986 """Test extra witness data in a transaction."""
987
988 block = self.build_next_block()
989
990 witness_script = CScript([OP_DROP, OP_TRUE])
991 script_pubkey = script_to_p2wsh_script(witness_script)
992
993 # First try extra witness data on a tx that doesn't require a witness
994 tx = CTransaction()
995 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
996 tx.vout.append(CTxOut(self.utxo[0].nValue - 2000, script_pubkey))
997 tx.vout.append(CTxOut(1000, CScript([OP_TRUE]))) # non-witness output
998 tx.wit.vtxinwit.append(CTxInWitness())
999 tx.wit.vtxinwit[0].scriptWitness.stack = [CScript([])]
1000 tx.rehash()
1001 self.update_witness_block_with_transactions(block, [tx])
1002
1003 # Extra witness data should not be allowed.
1004 test_witness_block(self.nodes[0], self.test_node, block, accepted=False,
1005 reason='mandatory-script-verify-flag-failed (Witness provided for non-witness script)')
1006
1007 # Try extra signature data. Ok if we're not spending a witness output.
1008 block.vtx[1].wit.vtxinwit = []
1009 block.vtx[1].vin[0].scriptSig = CScript([OP_0])
1010 block.vtx[1].rehash()
1011 add_witness_commitment(block)
1012 block.solve()
1013
1014 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1015
1016 # Now try extra witness/signature data on an input that DOES require a
1017 # witness
1018 tx2 = CTransaction()
1019 tx2.vin.append(CTxIn(COutPoint(tx.sha256, 0), b"")) # witness output
1020 tx2.vin.append(CTxIn(COutPoint(tx.sha256, 1), b"")) # non-witness
1021 tx2.vout.append(CTxOut(tx.vout[0].nValue, CScript([OP_TRUE])))
1022 tx2.wit.vtxinwit.extend([CTxInWitness(), CTxInWitness()])
1023 tx2.wit.vtxinwit[0].scriptWitness.stack = [CScript([CScriptNum(1)]), CScript([CScriptNum(1)]), witness_script]
1024 tx2.wit.vtxinwit[1].scriptWitness.stack = []
1025
1026 block = self.build_next_block()
1027 self.update_witness_block_with_transactions(block, [tx2])
1028
1029 # This has extra witness data, so it should fail.
1030 test_witness_block(self.nodes[0], self.test_node, block, accepted=False,
1031 reason='mandatory-script-verify-flag-failed (Stack size must be exactly one after execution)')
1032
1033 # Now get rid of the extra witness, but add extra scriptSig data
1034 tx2.vin[0].scriptSig = CScript([OP_TRUE])
1035 tx2.vin[1].scriptSig = CScript([OP_TRUE])
1036 tx2.wit.vtxinwit[0].scriptWitness.stack.pop(0)
1037 tx2.wit.vtxinwit[1].scriptWitness.stack = []
1038 tx2.rehash()
1039 add_witness_commitment(block)
1040 block.solve()
1041
1042 # This has extra signature data for a witness input, so it should fail.
1043 test_witness_block(self.nodes[0], self.test_node, block, accepted=False,
1044 reason='mandatory-script-verify-flag-failed (Witness requires empty scriptSig)')
1045
1046 # Now get rid of the extra scriptsig on the witness input, and verify
1047 # success (even with extra scriptsig data in the non-witness input)
1048 tx2.vin[0].scriptSig = b""
1049 tx2.rehash()
1050 add_witness_commitment(block)
1051 block.solve()
1052
1053 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1054
1055 # Update utxo for later tests
1056 self.utxo.pop(0)
1057 self.utxo.append(UTXO(tx2.sha256, 0, tx2.vout[0].nValue))
1058
1059 @subtest
1060 def test_max_witness_push_length(self):
1061 """Test that witness stack can only allow up to MAX_SCRIPT_ELEMENT_SIZE byte pushes."""
1062
1063 block = self.build_next_block()
1064
1065 witness_script = CScript([OP_DROP, OP_TRUE])
1066 script_pubkey = script_to_p2wsh_script(witness_script)
1067
1068 tx = CTransaction()
1069 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
1070 tx.vout.append(CTxOut(self.utxo[0].nValue - 1000, script_pubkey))
1071 tx.rehash()
1072
1073 tx2 = CTransaction()
1074 tx2.vin.append(CTxIn(COutPoint(tx.sha256, 0), b""))
1075 tx2.vout.append(CTxOut(tx.vout[0].nValue - 1000, CScript([OP_TRUE])))
1076 tx2.wit.vtxinwit.append(CTxInWitness())
1077 # First try a 521-byte stack element
1078 tx2.wit.vtxinwit[0].scriptWitness.stack = [b'a' * (MAX_SCRIPT_ELEMENT_SIZE + 1), witness_script]
1079 tx2.rehash()
1080
1081 self.update_witness_block_with_transactions(block, [tx, tx2])
1082 test_witness_block(self.nodes[0], self.test_node, block, accepted=False,
1083 reason='mandatory-script-verify-flag-failed (Push value size limit exceeded)')
1084
1085 # Now reduce the length of the stack element
1086 tx2.wit.vtxinwit[0].scriptWitness.stack[0] = b'a' * (MAX_SCRIPT_ELEMENT_SIZE)
1087
1088 add_witness_commitment(block)
1089 block.solve()
1090 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1091
1092 # Update the utxo for later tests
1093 self.utxo.pop()
1094 self.utxo.append(UTXO(tx2.sha256, 0, tx2.vout[0].nValue))
1095
1096 @subtest
1097 def test_max_witness_script_length(self):
1098 """Test that witness outputs greater than 10kB can't be spent."""
1099
1100 MAX_WITNESS_SCRIPT_LENGTH = 10000
1101
1102 # This script is 19 max pushes (9937 bytes), then 64 more opcode-bytes.
1103 long_witness_script = CScript([b'a' * MAX_SCRIPT_ELEMENT_SIZE] * 19 + [OP_DROP] * 63 + [OP_TRUE])
1104 assert len(long_witness_script) == MAX_WITNESS_SCRIPT_LENGTH + 1
1105 long_script_pubkey = script_to_p2wsh_script(long_witness_script)
1106
1107 block = self.build_next_block()
1108
1109 tx = CTransaction()
1110 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
1111 tx.vout.append(CTxOut(self.utxo[0].nValue - 1000, long_script_pubkey))
1112 tx.rehash()
1113
1114 tx2 = CTransaction()
1115 tx2.vin.append(CTxIn(COutPoint(tx.sha256, 0), b""))
1116 tx2.vout.append(CTxOut(tx.vout[0].nValue - 1000, CScript([OP_TRUE])))
1117 tx2.wit.vtxinwit.append(CTxInWitness())
1118 tx2.wit.vtxinwit[0].scriptWitness.stack = [b'a'] * 44 + [long_witness_script]
1119 tx2.rehash()
1120
1121 self.update_witness_block_with_transactions(block, [tx, tx2])
1122
1123 test_witness_block(self.nodes[0], self.test_node, block, accepted=False,
1124 reason='mandatory-script-verify-flag-failed (Script is too big)')
1125
1126 # Try again with one less byte in the witness script
1127 witness_script = CScript([b'a' * MAX_SCRIPT_ELEMENT_SIZE] * 19 + [OP_DROP] * 62 + [OP_TRUE])
1128 assert len(witness_script) == MAX_WITNESS_SCRIPT_LENGTH
1129 script_pubkey = script_to_p2wsh_script(witness_script)
1130
1131 tx.vout[0] = CTxOut(tx.vout[0].nValue, script_pubkey)
1132 tx.rehash()
1133 tx2.vin[0].prevout.hash = tx.sha256
1134 tx2.wit.vtxinwit[0].scriptWitness.stack = [b'a'] * 43 + [witness_script]
1135 tx2.rehash()
1136 block.vtx = [block.vtx[0]]
1137 self.update_witness_block_with_transactions(block, [tx, tx2])
1138 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1139
1140 self.utxo.pop()
1141 self.utxo.append(UTXO(tx2.sha256, 0, tx2.vout[0].nValue))
1142
1143 @subtest
1144 def test_witness_input_length(self):
1145 """Test that vin length must match vtxinwit length."""
1146
1147 witness_script = CScript([OP_DROP, OP_TRUE])
1148 script_pubkey = script_to_p2wsh_script(witness_script)
1149
1150 # Create a transaction that splits our utxo into many outputs
1151 tx = CTransaction()
1152 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
1153 value = self.utxo[0].nValue
1154 for _ in range(10):
1155 tx.vout.append(CTxOut(int(value / 10), script_pubkey))
1156 tx.vout[0].nValue -= 1000
1157 assert tx.vout[0].nValue >= 0
1158
1159 block = self.build_next_block()
1160 self.update_witness_block_with_transactions(block, [tx])
1161 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1162
1163 # Try various ways to spend tx that should all break.
1164 # This "broken" transaction serializer will not normalize
1165 # the length of vtxinwit.
1166 class BrokenCTransaction(CTransaction):
1167 def serialize_with_witness(self):
1168 flags = 0
1169 if not self.wit.is_null():
1170 flags |= 1
1171 r = b""
1172 r += self.version.to_bytes(4, "little")
1173 if flags:
1174 dummy = []
1175 r += ser_vector(dummy)
1176 r += flags.to_bytes(1, "little")
1177 r += ser_vector(self.vin)
1178 r += ser_vector(self.vout)
1179 if flags & 1:
1180 r += self.wit.serialize()
1181 r += self.nLockTime.to_bytes(4, "little")
1182 return r
1183
1184 tx2 = BrokenCTransaction()
1185 for i in range(10):
1186 tx2.vin.append(CTxIn(COutPoint(tx.sha256, i), b""))
1187 tx2.vout.append(CTxOut(value - 3000, CScript([OP_TRUE])))
1188
1189 # First try using a too long vtxinwit
1190 for i in range(11):
1191 tx2.wit.vtxinwit.append(CTxInWitness())
1192 tx2.wit.vtxinwit[i].scriptWitness.stack = [b'a', witness_script]
1193
1194 block = self.build_next_block()
1195 self.update_witness_block_with_transactions(block, [tx2])
1196 test_witness_block(self.nodes[0], self.test_node, block, accepted=False, reason='bad-txnmrklroot')
1197
1198 # Now try using a too short vtxinwit
1199 tx2.wit.vtxinwit.pop()
1200 tx2.wit.vtxinwit.pop()
1201
1202 block.vtx = [block.vtx[0]]
1203 self.update_witness_block_with_transactions(block, [tx2])
1204 # This block doesn't result in a specific reject reason, but an iostream exception:
1205 # "Exception 'CDataStream::read(): end of data: unspecified iostream_category error' (...) caught"
1206 test_witness_block(self.nodes[0], self.test_node, block, accepted=False)
1207
1208 # Now make one of the intermediate witnesses be incorrect
1209 tx2.wit.vtxinwit.append(CTxInWitness())
1210 tx2.wit.vtxinwit[-1].scriptWitness.stack = [b'a', witness_script]
1211 tx2.wit.vtxinwit[5].scriptWitness.stack = [witness_script]
1212
1213 block.vtx = [block.vtx[0]]
1214 self.update_witness_block_with_transactions(block, [tx2])
1215 test_witness_block(self.nodes[0], self.test_node, block, accepted=False,
1216 reason='mandatory-script-verify-flag-failed (Operation not valid with the current stack size)')
1217
1218 # Fix the broken witness and the block should be accepted.
1219 tx2.wit.vtxinwit[5].scriptWitness.stack = [b'a', witness_script]
1220 block.vtx = [block.vtx[0]]
1221 self.update_witness_block_with_transactions(block, [tx2])
1222 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1223
1224 self.utxo.pop()
1225 self.utxo.append(UTXO(tx2.sha256, 0, tx2.vout[0].nValue))
1226
1227 @subtest
1228 def test_tx_relay_after_segwit_activation(self):
1229 """Test transaction relay after segwit activation.
1230
1231 After segwit activates, verify that mempool:
1232 - rejects transactions with unnecessary/extra witnesses
1233 - accepts transactions with valid witnesses
1234 and that witness transactions are relayed to non-upgraded peers."""
1235
1236 # Generate a transaction that doesn't require a witness, but send it
1237 # with a witness. Should be rejected because we can't use a witness
1238 # when spending a non-witness output.
1239 tx = CTransaction()
1240 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
1241 tx.vout.append(CTxOut(self.utxo[0].nValue - 1000, CScript([OP_TRUE, OP_DROP] * 15 + [OP_TRUE])))
1242 tx.wit.vtxinwit.append(CTxInWitness())
1243 tx.wit.vtxinwit[0].scriptWitness.stack = [b'a']
1244 tx.rehash()
1245
1246 tx_hash = tx.sha256
1247
1248 # Verify that unnecessary witnesses are rejected.
1249 self.test_node.announce_tx_and_wait_for_getdata(tx)
1250 assert_equal(len(self.nodes[0].getrawmempool()), 0)
1251 test_transaction_acceptance(self.nodes[0], self.test_node, tx, with_witness=True, accepted=False)
1252
1253 # Verify that removing the witness succeeds.
1254 test_transaction_acceptance(self.nodes[0], self.test_node, tx, with_witness=False, accepted=True)
1255
1256 # Now try to add extra witness data to a valid witness tx.
1257 witness_script = CScript([OP_TRUE])
1258 script_pubkey = script_to_p2wsh_script(witness_script)
1259 tx2 = CTransaction()
1260 tx2.vin.append(CTxIn(COutPoint(tx_hash, 0), b""))
1261 tx2.vout.append(CTxOut(tx.vout[0].nValue - 1000, script_pubkey))
1262 tx2.rehash()
1263
1264 tx3 = CTransaction()
1265 tx3.vin.append(CTxIn(COutPoint(tx2.sha256, 0), b""))
1266 tx3.wit.vtxinwit.append(CTxInWitness())
1267
1268 # Add too-large for IsStandard witness and check that it does not enter reject filter
1269 p2sh_script = CScript([OP_TRUE])
1270 witness_script2 = CScript([b'a' * 400000])
1271 tx3.vout.append(CTxOut(tx2.vout[0].nValue - 1000, script_to_p2sh_script(p2sh_script)))
1272 tx3.wit.vtxinwit[0].scriptWitness.stack = [witness_script2]
1273 tx3.rehash()
1274
1275 # Node will not be blinded to the transaction, requesting it any number of times
1276 # if it is being announced via txid relay.
1277 # Node will be blinded to the transaction via wtxid, however.
1278 self.std_node.announce_tx_and_wait_for_getdata(tx3)
1279 self.std_wtx_node.announce_tx_and_wait_for_getdata(tx3, use_wtxid=True)
1280 test_transaction_acceptance(self.nodes[1], self.std_node, tx3, True, False, 'tx-size')
1281 self.std_node.announce_tx_and_wait_for_getdata(tx3)
1282 self.std_wtx_node.announce_tx_and_wait_for_getdata(tx3, use_wtxid=True, success=False)
1283
1284 # Remove witness stuffing, instead add extra witness push on stack
1285 tx3.vout[0] = CTxOut(tx2.vout[0].nValue - 1000, CScript([OP_TRUE, OP_DROP] * 15 + [OP_TRUE]))
1286 tx3.wit.vtxinwit[0].scriptWitness.stack = [CScript([CScriptNum(1)]), witness_script]
1287 tx3.rehash()
1288
1289 test_transaction_acceptance(self.nodes[0], self.test_node, tx2, with_witness=True, accepted=True)
1290 test_transaction_acceptance(self.nodes[0], self.test_node, tx3, with_witness=True, accepted=False)
1291
1292 # Now do the opposite: strip the witness entirely. This will be detected as witness stripping and
1293 # the (w)txid won't be added to the reject filter: we can try again and get the same error.
1294 tx3.wit.vtxinwit[0].scriptWitness.stack = []
1295 reason = "was not accepted: mempool-script-verify-flag-failed (Witness program was passed an empty witness)"
1296 test_transaction_acceptance(self.nodes[0], self.test_node, tx3, with_witness=False, accepted=False, reason=reason)
1297 test_transaction_acceptance(self.nodes[0], self.test_node, tx3, with_witness=False, accepted=False, reason=reason)
1298
1299 # Get rid of the extra witness, and verify acceptance.
1300 tx3.wit.vtxinwit[0].scriptWitness.stack = [witness_script]
1301 # Also check that old_node gets a tx announcement, even though this is
1302 # a witness transaction.
1303 self.old_node.wait_for_inv([CInv(MSG_TX, tx2.sha256)]) # wait until tx2 was inv'ed
1304 test_transaction_acceptance(self.nodes[0], self.test_node, tx3, with_witness=True, accepted=True)
1305 self.old_node.wait_for_inv([CInv(MSG_TX, tx3.sha256)])
1306
1307 # Test that getrawtransaction returns correct witness information
1308 # hash, size, vsize
1309 raw_tx = self.nodes[0].getrawtransaction(tx3.hash, 1)
1310 assert_equal(int(raw_tx["hash"], 16), tx3.calc_sha256(True))
1311 assert_equal(raw_tx["size"], len(tx3.serialize_with_witness()))
1312 vsize = tx3.get_vsize()
1313 assert_equal(raw_tx["vsize"], vsize)
1314 assert_equal(raw_tx["weight"], tx3.get_weight())
1315 assert_equal(len(raw_tx["vin"][0]["txinwitness"]), 1)
1316 assert_equal(raw_tx["vin"][0]["txinwitness"][0], witness_script.hex())
1317 assert vsize != raw_tx["size"]
1318
1319 # Cleanup: mine the transactions and update utxo for next test
1320 self.generate(self.nodes[0], 1)
1321 assert_equal(len(self.nodes[0].getrawmempool()), 0)
1322
1323 self.utxo.pop(0)
1324 self.utxo.append(UTXO(tx3.sha256, 0, tx3.vout[0].nValue))
1325
1326 @subtest
1327 def test_segwit_versions(self):
1328 """Test validity of future segwit version transactions.
1329
1330 Future segwit versions are non-standard to spend, but valid in blocks.
1331 Sending to future segwit versions is always allowed.
1332 Can run this before and after segwit activation."""
1333
1334 NUM_SEGWIT_VERSIONS = 17 # will test OP_0, OP1, ..., OP_16
1335 if len(self.utxo) < NUM_SEGWIT_VERSIONS:
1336 tx = CTransaction()
1337 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
1338 split_value = (self.utxo[0].nValue - 4000) // NUM_SEGWIT_VERSIONS
1339 for _ in range(NUM_SEGWIT_VERSIONS):
1340 tx.vout.append(CTxOut(split_value, CScript([OP_TRUE])))
1341 tx.rehash()
1342 block = self.build_next_block()
1343 self.update_witness_block_with_transactions(block, [tx])
1344 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1345 self.utxo.pop(0)
1346 for i in range(NUM_SEGWIT_VERSIONS):
1347 self.utxo.append(UTXO(tx.sha256, i, split_value))
1348
1349 self.sync_blocks()
1350 temp_utxo = []
1351 tx = CTransaction()
1352 witness_script = CScript([OP_TRUE])
1353 witness_hash = sha256(witness_script)
1354 assert_equal(len(self.nodes[1].getrawmempool()), 0)
1355 for version in list(range(OP_1, OP_16 + 1)) + [OP_0]:
1356 # First try to spend to a future version segwit script_pubkey.
1357 if version == OP_1:
1358 # Don't use 32-byte v1 witness (used by Taproot; see BIP 341)
1359 script_pubkey = CScript([CScriptOp(version), witness_hash[:31]])
1360 else:
1361 script_pubkey = CScript([CScriptOp(version), witness_hash])
1362 tx.vin = [CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b"")]
1363 tx.vout = [CTxOut(self.utxo[0].nValue - 1000, script_pubkey)]
1364 tx.rehash()
1365 test_transaction_acceptance(self.nodes[1], self.std_node, tx, with_witness=True, accepted=False)
1366 test_transaction_acceptance(self.nodes[0], self.test_node, tx, with_witness=True, accepted=True)
1367 self.utxo.pop(0)
1368 temp_utxo.append(UTXO(tx.sha256, 0, tx.vout[0].nValue))
1369
1370 self.generate(self.nodes[0], 1) # Mine all the transactions
1371 assert len(self.nodes[0].getrawmempool()) == 0
1372
1373 # Finally, verify that version 0 -> version 2 transactions
1374 # are standard
1375 script_pubkey = CScript([CScriptOp(OP_2), witness_hash])
1376 tx2 = CTransaction()
1377 tx2.vin = [CTxIn(COutPoint(tx.sha256, 0), b"")]
1378 tx2.vout = [CTxOut(tx.vout[0].nValue - 1000, script_pubkey)]
1379 tx2.wit.vtxinwit.append(CTxInWitness())
1380 tx2.wit.vtxinwit[0].scriptWitness.stack = [witness_script]
1381 tx2.rehash()
1382 # Gets accepted to both policy-enforcing nodes and others.
1383 test_transaction_acceptance(self.nodes[0], self.test_node, tx2, with_witness=True, accepted=True)
1384 test_transaction_acceptance(self.nodes[1], self.std_node, tx2, with_witness=True, accepted=True)
1385 temp_utxo.pop() # last entry in temp_utxo was the output we just spent
1386 temp_utxo.append(UTXO(tx2.sha256, 0, tx2.vout[0].nValue))
1387
1388 # Spend everything in temp_utxo into an segwit v1 output.
1389 tx3 = CTransaction()
1390 total_value = 0
1391 for i in temp_utxo:
1392 tx3.vin.append(CTxIn(COutPoint(i.sha256, i.n), b""))
1393 tx3.wit.vtxinwit.append(CTxInWitness())
1394 total_value += i.nValue
1395 tx3.wit.vtxinwit[-1].scriptWitness.stack = [witness_script]
1396 tx3.vout.append(CTxOut(total_value - 1000, script_pubkey))
1397 tx3.rehash()
1398
1399 # First we test this transaction against std_node
1400 # making sure the txid is added to the reject filter
1401 self.std_node.announce_tx_and_wait_for_getdata(tx3)
1402 test_transaction_acceptance(self.nodes[1], self.std_node, tx3, with_witness=True, accepted=False, reason="bad-txns-input-witness-unknown")
1403 # Now the node will no longer ask for getdata of this transaction when advertised by same txid
1404 self.std_node.announce_tx_and_wait_for_getdata(tx3, success=False)
1405
1406 # Spending a higher version witness output is not allowed by policy,
1407 # even with the node that accepts non-standard txs.
1408 test_transaction_acceptance(self.nodes[0], self.test_node, tx3, with_witness=True, accepted=False, reason="reserved for soft-fork upgrades")
1409
1410 # Building a block with the transaction must be valid, however.
1411 block = self.build_next_block()
1412 self.update_witness_block_with_transactions(block, [tx2, tx3])
1413 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1414 self.sync_blocks()
1415
1416 # Add utxo to our list
1417 self.utxo.append(UTXO(tx3.sha256, 0, tx3.vout[0].nValue))
1418
1419 @subtest
1420 def test_premature_coinbase_witness_spend(self):
1421
1422 block = self.build_next_block()
1423 # Change the output of the block to be a witness output.
1424 witness_script = CScript([OP_TRUE])
1425 script_pubkey = script_to_p2wsh_script(witness_script)
1426 block.vtx[0].vout[0].scriptPubKey = script_pubkey
1427 # This next line will rehash the coinbase and update the merkle
1428 # root, and solve.
1429 self.update_witness_block_with_transactions(block, [])
1430 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1431
1432 spend_tx = CTransaction()
1433 spend_tx.vin = [CTxIn(COutPoint(block.vtx[0].sha256, 0), b"")]
1434 spend_tx.vout = [CTxOut(block.vtx[0].vout[0].nValue, witness_script)]
1435 spend_tx.wit.vtxinwit.append(CTxInWitness())
1436 spend_tx.wit.vtxinwit[0].scriptWitness.stack = [witness_script]
1437 spend_tx.rehash()
1438
1439 # Now test a premature spend.
1440 self.generate(self.nodes[0], 98)
1441 block2 = self.build_next_block()
1442 self.update_witness_block_with_transactions(block2, [spend_tx])
1443 test_witness_block(self.nodes[0], self.test_node, block2, accepted=False, reason='bad-txns-premature-spend-of-coinbase')
1444
1445 # Advancing one more block should allow the spend.
1446 self.generate(self.nodes[0], 1)
1447 block2 = self.build_next_block()
1448 self.update_witness_block_with_transactions(block2, [spend_tx])
1449 test_witness_block(self.nodes[0], self.test_node, block2, accepted=True)
1450 self.sync_blocks()
1451
1452 @subtest
1453 def test_uncompressed_pubkey(self):
1454 """Test uncompressed pubkey validity in segwit transactions.
1455
1456 Uncompressed pubkeys are no longer supported in default relay policy,
1457 but (for now) are still valid in blocks."""
1458
1459 # Segwit transactions using uncompressed pubkeys are not accepted
1460 # under default policy, but should still pass consensus.
1461 key, pubkey = generate_keypair(compressed=False)
1462 assert_equal(len(pubkey), 65) # This should be an uncompressed pubkey
1463
1464 utxo = self.utxo.pop(0)
1465
1466 # Test 1: P2WPKH
1467 # First create a P2WPKH output that uses an uncompressed pubkey
1468 pubkeyhash = hash160(pubkey)
1469 script_pkh = key_to_p2wpkh_script(pubkey)
1470 tx = CTransaction()
1471 tx.vin.append(CTxIn(COutPoint(utxo.sha256, utxo.n), b""))
1472 tx.vout.append(CTxOut(utxo.nValue - 1000, script_pkh))
1473 tx.rehash()
1474
1475 # Confirm it in a block.
1476 block = self.build_next_block()
1477 self.update_witness_block_with_transactions(block, [tx])
1478 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1479
1480 # Now try to spend it. Send it to a P2WSH output, which we'll
1481 # use in the next test.
1482 witness_script = key_to_p2pk_script(pubkey)
1483 script_wsh = script_to_p2wsh_script(witness_script)
1484
1485 tx2 = CTransaction()
1486 tx2.vin.append(CTxIn(COutPoint(tx.sha256, 0), b""))
1487 tx2.vout.append(CTxOut(tx.vout[0].nValue - 1000, script_wsh))
1488 script = keyhash_to_p2pkh_script(pubkeyhash)
1489 tx2.wit.vtxinwit.append(CTxInWitness())
1490 tx2.wit.vtxinwit[0].scriptWitness.stack = [pubkey]
1491 sign_input_segwitv0(tx2, 0, script, tx.vout[0].nValue, key)
1492
1493 # Should fail policy test.
1494 test_transaction_acceptance(self.nodes[0], self.test_node, tx2, True, False, 'mempool-script-verify-flag-failed (Using non-compressed keys in segwit)')
1495 # But passes consensus.
1496 block = self.build_next_block()
1497 self.update_witness_block_with_transactions(block, [tx2])
1498 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1499
1500 # Test 2: P2WSH
1501 # Try to spend the P2WSH output created in last test.
1502 # Send it to a P2SH(P2WSH) output, which we'll use in the next test.
1503 script_p2sh = script_to_p2sh_script(script_wsh)
1504 script_sig = CScript([script_wsh])
1505
1506 tx3 = CTransaction()
1507 tx3.vin.append(CTxIn(COutPoint(tx2.sha256, 0), b""))
1508 tx3.vout.append(CTxOut(tx2.vout[0].nValue - 1000, script_p2sh))
1509 tx3.wit.vtxinwit.append(CTxInWitness())
1510 sign_p2pk_witness_input(witness_script, tx3, 0, SIGHASH_ALL, tx2.vout[0].nValue, key)
1511
1512 # Should fail policy test.
1513 test_transaction_acceptance(self.nodes[0], self.test_node, tx3, True, False, 'mempool-script-verify-flag-failed (Using non-compressed keys in segwit)')
1514 # But passes consensus.
1515 block = self.build_next_block()
1516 self.update_witness_block_with_transactions(block, [tx3])
1517 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1518
1519 # Test 3: P2SH(P2WSH)
1520 # Try to spend the P2SH output created in the last test.
1521 # Send it to a P2PKH output, which we'll use in the next test.
1522 script_pubkey = keyhash_to_p2pkh_script(pubkeyhash)
1523 tx4 = CTransaction()
1524 tx4.vin.append(CTxIn(COutPoint(tx3.sha256, 0), script_sig))
1525 tx4.vout.append(CTxOut(tx3.vout[0].nValue - 1000, script_pubkey))
1526 tx4.wit.vtxinwit.append(CTxInWitness())
1527 sign_p2pk_witness_input(witness_script, tx4, 0, SIGHASH_ALL, tx3.vout[0].nValue, key)
1528
1529 # Should fail policy test.
1530 test_transaction_acceptance(self.nodes[0], self.test_node, tx4, True, False, 'mempool-script-verify-flag-failed (Using non-compressed keys in segwit)')
1531 block = self.build_next_block()
1532 self.update_witness_block_with_transactions(block, [tx4])
1533 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1534
1535 # Test 4: Uncompressed pubkeys should still be valid in non-segwit
1536 # transactions.
1537 tx5 = CTransaction()
1538 tx5.vin.append(CTxIn(COutPoint(tx4.sha256, 0), b""))
1539 tx5.vout.append(CTxOut(tx4.vout[0].nValue - 1000, CScript([OP_TRUE])))
1540 tx5.vin[0].scriptSig = CScript([pubkey])
1541 sign_input_legacy(tx5, 0, script_pubkey, key)
1542 # Should pass policy and consensus.
1543 test_transaction_acceptance(self.nodes[0], self.test_node, tx5, True, True)
1544 block = self.build_next_block()
1545 self.update_witness_block_with_transactions(block, [tx5])
1546 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1547 self.utxo.append(UTXO(tx5.sha256, 0, tx5.vout[0].nValue))
1548
1549 @subtest
1550 def test_signature_version_1(self):
1551 key, pubkey = generate_keypair()
1552 witness_script = key_to_p2pk_script(pubkey)
1553 script_pubkey = script_to_p2wsh_script(witness_script)
1554
1555 # First create a witness output for use in the tests.
1556 tx = CTransaction()
1557 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
1558 tx.vout.append(CTxOut(self.utxo[0].nValue - 1000, script_pubkey))
1559 tx.rehash()
1560
1561 test_transaction_acceptance(self.nodes[0], self.test_node, tx, with_witness=True, accepted=True)
1562 # Mine this transaction in preparation for following tests.
1563 block = self.build_next_block()
1564 self.update_witness_block_with_transactions(block, [tx])
1565 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1566 self.sync_blocks()
1567 self.utxo.pop(0)
1568
1569 # Test each hashtype
1570 prev_utxo = UTXO(tx.sha256, 0, tx.vout[0].nValue)
1571 for sigflag in [0, SIGHASH_ANYONECANPAY]:
1572 for hashtype in [SIGHASH_ALL, SIGHASH_NONE, SIGHASH_SINGLE]:
1573 hashtype |= sigflag
1574 block = self.build_next_block()
1575 tx = CTransaction()
1576 tx.vin.append(CTxIn(COutPoint(prev_utxo.sha256, prev_utxo.n), b""))
1577 tx.vout.append(CTxOut(prev_utxo.nValue - 1000, script_pubkey))
1578 tx.wit.vtxinwit.append(CTxInWitness())
1579 # Too-large input value
1580 sign_p2pk_witness_input(witness_script, tx, 0, hashtype, prev_utxo.nValue + 1, key)
1581 self.update_witness_block_with_transactions(block, [tx])
1582 test_witness_block(self.nodes[0], self.test_node, block, accepted=False,
1583 reason='mandatory-script-verify-flag-failed (Script evaluated without error '
1584 'but finished with a false/empty top stack element')
1585
1586 # Too-small input value
1587 sign_p2pk_witness_input(witness_script, tx, 0, hashtype, prev_utxo.nValue - 1, key)
1588 block.vtx.pop() # remove last tx
1589 self.update_witness_block_with_transactions(block, [tx])
1590 test_witness_block(self.nodes[0], self.test_node, block, accepted=False,
1591 reason='mandatory-script-verify-flag-failed (Script evaluated without error '
1592 'but finished with a false/empty top stack element')
1593
1594 # Now try correct value
1595 sign_p2pk_witness_input(witness_script, tx, 0, hashtype, prev_utxo.nValue, key)
1596 block.vtx.pop()
1597 self.update_witness_block_with_transactions(block, [tx])
1598 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1599
1600 prev_utxo = UTXO(tx.sha256, 0, tx.vout[0].nValue)
1601
1602 # Test combinations of signature hashes.
1603 # Split the utxo into a lot of outputs.
1604 # Randomly choose up to 10 to spend, sign with different hashtypes, and
1605 # output to a random number of outputs. Repeat NUM_SIGHASH_TESTS times.
1606 # Ensure that we've tested a situation where we use SIGHASH_SINGLE with
1607 # an input index > number of outputs.
1608 NUM_SIGHASH_TESTS = 500
1609 temp_utxos = []
1610 tx = CTransaction()
1611 tx.vin.append(CTxIn(COutPoint(prev_utxo.sha256, prev_utxo.n), b""))
1612 split_value = prev_utxo.nValue // NUM_SIGHASH_TESTS
1613 for _ in range(NUM_SIGHASH_TESTS):
1614 tx.vout.append(CTxOut(split_value, script_pubkey))
1615 tx.wit.vtxinwit.append(CTxInWitness())
1616 sign_p2pk_witness_input(witness_script, tx, 0, SIGHASH_ALL, prev_utxo.nValue, key)
1617 for i in range(NUM_SIGHASH_TESTS):
1618 temp_utxos.append(UTXO(tx.sha256, i, split_value))
1619
1620 block = self.build_next_block()
1621 self.update_witness_block_with_transactions(block, [tx])
1622 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1623
1624 block = self.build_next_block()
1625 used_sighash_single_out_of_bounds = False
1626 for i in range(NUM_SIGHASH_TESTS):
1627 # Ping regularly to keep the connection alive
1628 if (not i % 100):
1629 self.test_node.sync_with_ping()
1630 # Choose random number of inputs to use.
1631 num_inputs = random.randint(1, 10)
1632 # Create a slight bias for producing more utxos
1633 num_outputs = random.randint(1, 11)
1634 random.shuffle(temp_utxos)
1635 assert len(temp_utxos) > num_inputs
1636 tx = CTransaction()
1637 total_value = 0
1638 for i in range(num_inputs):
1639 tx.vin.append(CTxIn(COutPoint(temp_utxos[i].sha256, temp_utxos[i].n), b""))
1640 tx.wit.vtxinwit.append(CTxInWitness())
1641 total_value += temp_utxos[i].nValue
1642 split_value = total_value // num_outputs
1643 for _ in range(num_outputs):
1644 tx.vout.append(CTxOut(split_value, script_pubkey))
1645 for i in range(num_inputs):
1646 # Now try to sign each input, using a random hashtype.
1647 anyonecanpay = 0
1648 if random.randint(0, 1):
1649 anyonecanpay = SIGHASH_ANYONECANPAY
1650 hashtype = random.randint(1, 3) | anyonecanpay
1651 sign_p2pk_witness_input(witness_script, tx, i, hashtype, temp_utxos[i].nValue, key)
1652 if (hashtype == SIGHASH_SINGLE and i >= num_outputs):
1653 used_sighash_single_out_of_bounds = True
1654 tx.rehash()
1655 for i in range(num_outputs):
1656 temp_utxos.append(UTXO(tx.sha256, i, split_value))
1657 temp_utxos = temp_utxos[num_inputs:]
1658
1659 block.vtx.append(tx)
1660
1661 # Test the block periodically, if we're close to maxblocksize
1662 if block.get_weight() > MAX_BLOCK_WEIGHT - 4000:
1663 self.update_witness_block_with_transactions(block, [])
1664 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1665 block = self.build_next_block()
1666
1667 if (not used_sighash_single_out_of_bounds):
1668 self.log.info("WARNING: this test run didn't attempt SIGHASH_SINGLE with out-of-bounds index value")
1669 # Test the transactions we've added to the block
1670 if (len(block.vtx) > 1):
1671 self.update_witness_block_with_transactions(block, [])
1672 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1673
1674 # Now test witness version 0 P2PKH transactions
1675 pubkeyhash = hash160(pubkey)
1676 script_pkh = key_to_p2wpkh_script(pubkey)
1677 tx = CTransaction()
1678 tx.vin.append(CTxIn(COutPoint(temp_utxos[0].sha256, temp_utxos[0].n), b""))
1679 tx.vout.append(CTxOut(temp_utxos[0].nValue, script_pkh))
1680 tx.wit.vtxinwit.append(CTxInWitness())
1681 sign_p2pk_witness_input(witness_script, tx, 0, SIGHASH_ALL, temp_utxos[0].nValue, key)
1682 tx2 = CTransaction()
1683 tx2.vin.append(CTxIn(COutPoint(tx.sha256, 0), b""))
1684 tx2.vout.append(CTxOut(tx.vout[0].nValue, CScript([OP_TRUE])))
1685
1686 script = keyhash_to_p2pkh_script(pubkeyhash)
1687 tx2.wit.vtxinwit.append(CTxInWitness())
1688 sign_input_segwitv0(tx2, 0, script, tx.vout[0].nValue, key)
1689 signature = tx2.wit.vtxinwit[0].scriptWitness.stack.pop()
1690
1691 # Check that we can't have a scriptSig
1692 tx2.vin[0].scriptSig = CScript([signature, pubkey])
1693 tx2.rehash()
1694 block = self.build_next_block()
1695 self.update_witness_block_with_transactions(block, [tx, tx2])
1696 test_witness_block(self.nodes[0], self.test_node, block, accepted=False,
1697 reason='mandatory-script-verify-flag-failed (Witness requires empty scriptSig)')
1698
1699 # Move the signature to the witness.
1700 block.vtx.pop()
1701 tx2.wit.vtxinwit.append(CTxInWitness())
1702 tx2.wit.vtxinwit[0].scriptWitness.stack = [signature, pubkey]
1703 tx2.vin[0].scriptSig = b""
1704 tx2.rehash()
1705
1706 self.update_witness_block_with_transactions(block, [tx2])
1707 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1708
1709 temp_utxos.pop(0)
1710
1711 # Update self.utxos for later tests by creating two outputs
1712 # that consolidate all the coins in temp_utxos.
1713 output_value = sum(i.nValue for i in temp_utxos) // 2
1714
1715 tx = CTransaction()
1716 index = 0
1717 # Just spend to our usual anyone-can-spend output
1718 tx.vout = [CTxOut(output_value, CScript([OP_TRUE]))] * 2
1719 for i in temp_utxos:
1720 # Use SIGHASH_ALL|SIGHASH_ANYONECANPAY so we can build up
1721 # the signatures as we go.
1722 tx.vin.append(CTxIn(COutPoint(i.sha256, i.n), b""))
1723 tx.wit.vtxinwit.append(CTxInWitness())
1724 sign_p2pk_witness_input(witness_script, tx, index, SIGHASH_ALL | SIGHASH_ANYONECANPAY, i.nValue, key)
1725 index += 1
1726 block = self.build_next_block()
1727 self.update_witness_block_with_transactions(block, [tx])
1728 test_witness_block(self.nodes[0], self.test_node, block, accepted=True)
1729
1730 for i in range(len(tx.vout)):
1731 self.utxo.append(UTXO(tx.sha256, i, tx.vout[i].nValue))
1732
1733 @subtest
1734 def test_non_standard_witness_blinding(self):
1735 """Test behavior of unnecessary witnesses in transactions does not blind the node for the transaction"""
1736
1737 # Create a p2sh output -- this is so we can pass the standardness
1738 # rules (an anyone-can-spend OP_TRUE would be rejected, if not wrapped
1739 # in P2SH).
1740 p2sh_program = CScript([OP_TRUE])
1741 script_pubkey = script_to_p2sh_script(p2sh_program)
1742
1743 # Now check that unnecessary witnesses can't be used to blind a node
1744 # to a transaction, eg by violating standardness checks.
1745 tx = CTransaction()
1746 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
1747 tx.vout.append(CTxOut(self.utxo[0].nValue - 1000, script_pubkey))
1748 tx.rehash()
1749 test_transaction_acceptance(self.nodes[0], self.test_node, tx, False, True)
1750 self.generate(self.nodes[0], 1)
1751
1752 # We'll add an unnecessary witness to this transaction that would cause
1753 # it to be non-standard, to test that violating policy with a witness
1754 # doesn't blind a node to a transaction. Transactions
1755 # rejected for having a witness shouldn't be added
1756 # to the rejection cache.
1757 tx2 = CTransaction()
1758 tx2.vin.append(CTxIn(COutPoint(tx.sha256, 0), CScript([p2sh_program])))
1759 tx2.vout.append(CTxOut(tx.vout[0].nValue - 1000, script_pubkey))
1760 tx2.wit.vtxinwit.append(CTxInWitness())
1761 tx2.wit.vtxinwit[0].scriptWitness.stack = [b'a' * 400]
1762 tx2.rehash()
1763 # This will be rejected due to a policy check:
1764 # No witness is allowed, since it is not a witness program but a p2sh program
1765 test_transaction_acceptance(self.nodes[1], self.std_node, tx2, True, False, 'bad-witness-nonwitness-input')
1766
1767 # If we send without witness, it should be accepted.
1768 test_transaction_acceptance(self.nodes[1], self.std_node, tx2, False, True)
1769
1770 # Now create a new anyone-can-spend utxo for the next test.
1771 tx3 = CTransaction()
1772 tx3.vin.append(CTxIn(COutPoint(tx2.sha256, 0), CScript([p2sh_program])))
1773 tx3.vout.append(CTxOut(tx2.vout[0].nValue - 1000, CScript([OP_TRUE, OP_DROP] * 15 + [OP_TRUE])))
1774 tx3.rehash()
1775 test_transaction_acceptance(self.nodes[0], self.test_node, tx2, False, True)
1776 test_transaction_acceptance(self.nodes[0], self.test_node, tx3, False, True)
1777
1778 self.generate(self.nodes[0], 1)
1779
1780 # Update our utxo list; we spent the first entry.
1781 self.utxo.pop(0)
1782 self.utxo.append(UTXO(tx3.sha256, 0, tx3.vout[0].nValue))
1783
1784 @subtest
1785 def test_non_standard_witness(self):
1786 """Test detection of non-standard P2WSH witness"""
1787 pad = chr(1).encode('latin-1')
1788
1789 # Create scripts for tests
1790 scripts = []
1791 scripts.append(CScript([OP_DROP] * 100))
1792 scripts.append(CScript([OP_DROP] * 99))
1793 scripts.append(CScript([pad * 59] * 59 + [OP_DROP] * 60))
1794 scripts.append(CScript([pad * 59] * 59 + [OP_DROP] * 61))
1795
1796 p2wsh_scripts = []
1797
1798 tx = CTransaction()
1799 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
1800
1801 # For each script, generate a pair of P2WSH and P2SH-P2WSH output.
1802 outputvalue = (self.utxo[0].nValue - 1000) // (len(scripts) * 2)
1803 for i in scripts:
1804 p2wsh = script_to_p2wsh_script(i)
1805 p2wsh_scripts.append(p2wsh)
1806 tx.vout.append(CTxOut(outputvalue, p2wsh))
1807 tx.vout.append(CTxOut(outputvalue, script_to_p2sh_script(p2wsh)))
1808 tx.rehash()
1809 txid = tx.sha256
1810 test_transaction_acceptance(self.nodes[0], self.test_node, tx, with_witness=False, accepted=True)
1811
1812 self.generate(self.nodes[0], 1)
1813
1814 # Creating transactions for tests
1815 p2wsh_txs = []
1816 p2sh_txs = []
1817 for i in range(len(scripts)):
1818 p2wsh_tx = CTransaction()
1819 p2wsh_tx.vin.append(CTxIn(COutPoint(txid, i * 2)))
1820 p2wsh_tx.vout.append(CTxOut(outputvalue - 5000, CScript([OP_0, hash160(b"")])))
1821 p2wsh_tx.wit.vtxinwit.append(CTxInWitness())
1822 p2wsh_tx.rehash()
1823 p2wsh_txs.append(p2wsh_tx)
1824 p2sh_tx = CTransaction()
1825 p2sh_tx.vin.append(CTxIn(COutPoint(txid, i * 2 + 1), CScript([p2wsh_scripts[i]])))
1826 p2sh_tx.vout.append(CTxOut(outputvalue - 5000, CScript([OP_0, hash160(b"")])))
1827 p2sh_tx.wit.vtxinwit.append(CTxInWitness())
1828 p2sh_tx.rehash()
1829 p2sh_txs.append(p2sh_tx)
1830
1831 # Testing native P2WSH
1832 # Witness stack size, excluding witnessScript, over 100 is non-standard
1833 p2wsh_txs[0].wit.vtxinwit[0].scriptWitness.stack = [pad] * 101 + [scripts[0]]
1834 test_transaction_acceptance(self.nodes[1], self.std_node, p2wsh_txs[0], True, False, 'bad-witness-stackitem-count')
1835 # Non-standard nodes should accept
1836 test_transaction_acceptance(self.nodes[0], self.test_node, p2wsh_txs[0], True, True)
1837
1838 # Stack element size over 80 bytes is non-standard
1839 p2wsh_txs[1].wit.vtxinwit[0].scriptWitness.stack = [pad * 81] * 100 + [scripts[1]]
1840 test_transaction_acceptance(self.nodes[1], self.std_node, p2wsh_txs[1], True, False, 'bad-witness-stackitem-size')
1841 # Non-standard nodes should accept
1842 test_transaction_acceptance(self.nodes[0], self.test_node, p2wsh_txs[1], True, True)
1843 # Standard nodes should accept if element size is not over 80 bytes
1844 p2wsh_txs[1].wit.vtxinwit[0].scriptWitness.stack = [pad * 80] * 100 + [scripts[1]]
1845 test_transaction_acceptance(self.nodes[1], self.std_node, p2wsh_txs[1], True, True)
1846
1847 # witnessScript size at 3600 bytes is standard
1848 p2wsh_txs[2].wit.vtxinwit[0].scriptWitness.stack = [pad, pad, scripts[2]]
1849 test_transaction_acceptance(self.nodes[0], self.test_node, p2wsh_txs[2], True, True)
1850 test_transaction_acceptance(self.nodes[1], self.std_node, p2wsh_txs[2], True, True)
1851
1852 # witnessScript size at 3601 bytes is non-standard
1853 p2wsh_txs[3].wit.vtxinwit[0].scriptWitness.stack = [pad, pad, pad, scripts[3]]
1854 test_transaction_acceptance(self.nodes[1], self.std_node, p2wsh_txs[3], True, False, 'bad-witness-script-size')
1855 # Non-standard nodes should accept
1856 test_transaction_acceptance(self.nodes[0], self.test_node, p2wsh_txs[3], True, True)
1857
1858 # Repeating the same tests with P2SH-P2WSH
1859 p2sh_txs[0].wit.vtxinwit[0].scriptWitness.stack = [pad] * 101 + [scripts[0]]
1860 test_transaction_acceptance(self.nodes[1], self.std_node, p2sh_txs[0], True, False, 'bad-witness-stackitem-count')
1861 test_transaction_acceptance(self.nodes[0], self.test_node, p2sh_txs[0], True, True)
1862 p2sh_txs[1].wit.vtxinwit[0].scriptWitness.stack = [pad * 81] * 100 + [scripts[1]]
1863 test_transaction_acceptance(self.nodes[1], self.std_node, p2sh_txs[1], True, False, 'bad-witness-stackitem-size')
1864 test_transaction_acceptance(self.nodes[0], self.test_node, p2sh_txs[1], True, True)
1865 p2sh_txs[1].wit.vtxinwit[0].scriptWitness.stack = [pad * 80] * 100 + [scripts[1]]
1866 test_transaction_acceptance(self.nodes[1], self.std_node, p2sh_txs[1], True, True)
1867 p2sh_txs[2].wit.vtxinwit[0].scriptWitness.stack = [pad, pad, scripts[2]]
1868 test_transaction_acceptance(self.nodes[0], self.test_node, p2sh_txs[2], True, True)
1869 test_transaction_acceptance(self.nodes[1], self.std_node, p2sh_txs[2], True, True)
1870 p2sh_txs[3].wit.vtxinwit[0].scriptWitness.stack = [pad, pad, pad, scripts[3]]
1871 test_transaction_acceptance(self.nodes[1], self.std_node, p2sh_txs[3], True, False, 'bad-witness-script-size')
1872 test_transaction_acceptance(self.nodes[0], self.test_node, p2sh_txs[3], True, True)
1873
1874 self.generate(self.nodes[0], 1) # Mine and clean up the mempool of non-standard node
1875 # Valid but non-standard transactions in a block should be accepted by standard node
1876 self.sync_blocks()
1877 assert_equal(len(self.nodes[0].getrawmempool()), 0)
1878 assert_equal(len(self.nodes[1].getrawmempool()), 0)
1879
1880 self.utxo.pop(0)
1881
1882 @subtest
1883 def test_witness_sigops(self):
1884 """Test sigop counting is correct inside witnesses."""
1885
1886 # Keep this under MAX_OPS_PER_SCRIPT (201)
1887 witness_script = CScript([OP_TRUE, OP_IF, OP_TRUE, OP_ELSE] + [OP_CHECKMULTISIG] * 5 + [OP_CHECKSIG] * 193 + [OP_ENDIF])
1888 script_pubkey = script_to_p2wsh_script(witness_script)
1889
1890 sigops_per_script = 20 * 5 + 193 * 1
1891 # We'll produce 2 extra outputs, one with a program that would take us
1892 # over max sig ops, and one with a program that would exactly reach max
1893 # sig ops
1894 outputs = (MAX_SIGOP_COST // sigops_per_script) + 2
1895 extra_sigops_available = MAX_SIGOP_COST % sigops_per_script
1896
1897 # We chose the number of checkmultisigs/checksigs to make this work:
1898 assert extra_sigops_available < 100 # steer clear of MAX_OPS_PER_SCRIPT
1899
1900 # This script, when spent with the first
1901 # N(=MAX_SIGOP_COST//sigops_per_script) outputs of our transaction,
1902 # would push us just over the block sigop limit.
1903 witness_script_toomany = CScript([OP_TRUE, OP_IF, OP_TRUE, OP_ELSE] + [OP_CHECKSIG] * (extra_sigops_available + 1) + [OP_ENDIF])
1904 script_pubkey_toomany = script_to_p2wsh_script(witness_script_toomany)
1905
1906 # If we spend this script instead, we would exactly reach our sigop
1907 # limit (for witness sigops).
1908 witness_script_justright = CScript([OP_TRUE, OP_IF, OP_TRUE, OP_ELSE] + [OP_CHECKSIG] * (extra_sigops_available) + [OP_ENDIF])
1909 script_pubkey_justright = script_to_p2wsh_script(witness_script_justright)
1910
1911 # First split our available utxo into a bunch of outputs
1912 split_value = self.utxo[0].nValue // outputs
1913 tx = CTransaction()
1914 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
1915 for _ in range(outputs):
1916 tx.vout.append(CTxOut(split_value, script_pubkey))
1917 tx.vout[-2].scriptPubKey = script_pubkey_toomany
1918 tx.vout[-1].scriptPubKey = script_pubkey_justright
1919 tx.rehash()
1920
1921 block_1 = self.build_next_block()
1922 self.update_witness_block_with_transactions(block_1, [tx])
1923 test_witness_block(self.nodes[0], self.test_node, block_1, accepted=True)
1924
1925 tx2 = CTransaction()
1926 # If we try to spend the first n-1 outputs from tx, that should be
1927 # too many sigops.
1928 total_value = 0
1929 for i in range(outputs - 1):
1930 tx2.vin.append(CTxIn(COutPoint(tx.sha256, i), b""))
1931 tx2.wit.vtxinwit.append(CTxInWitness())
1932 tx2.wit.vtxinwit[-1].scriptWitness.stack = [witness_script]
1933 total_value += tx.vout[i].nValue
1934 tx2.wit.vtxinwit[-1].scriptWitness.stack = [witness_script_toomany]
1935 tx2.vout.append(CTxOut(total_value, CScript([OP_TRUE])))
1936 tx2.rehash()
1937
1938 block_2 = self.build_next_block()
1939 self.update_witness_block_with_transactions(block_2, [tx2])
1940 test_witness_block(self.nodes[0], self.test_node, block_2, accepted=False, reason='bad-blk-sigops')
1941
1942 # Try dropping the last input in tx2, and add an output that has
1943 # too many sigops (contributing to legacy sigop count).
1944 checksig_count = (extra_sigops_available // 4) + 1
1945 script_pubkey_checksigs = CScript([OP_CHECKSIG] * checksig_count)
1946 tx2.vout.append(CTxOut(0, script_pubkey_checksigs))
1947 tx2.vin.pop()
1948 tx2.wit.vtxinwit.pop()
1949 tx2.vout[0].nValue -= tx.vout[-2].nValue
1950 tx2.rehash()
1951 block_3 = self.build_next_block()
1952 self.update_witness_block_with_transactions(block_3, [tx2])
1953 test_witness_block(self.nodes[0], self.test_node, block_3, accepted=False, reason='bad-blk-sigops')
1954
1955 # If we drop the last checksig in this output, the tx should succeed.
1956 block_4 = self.build_next_block()
1957 tx2.vout[-1].scriptPubKey = CScript([OP_CHECKSIG] * (checksig_count - 1))
1958 tx2.rehash()
1959 self.update_witness_block_with_transactions(block_4, [tx2])
1960 test_witness_block(self.nodes[0], self.test_node, block_4, accepted=True)
1961
1962 # Reset the tip back down for the next test
1963 self.sync_blocks()
1964 for x in self.nodes:
1965 x.invalidateblock(block_4.hash)
1966
1967 # Try replacing the last input of tx2 to be spending the last
1968 # output of tx
1969 block_5 = self.build_next_block()
1970 tx2.vout.pop()
1971 tx2.vin.append(CTxIn(COutPoint(tx.sha256, outputs - 1), b""))
1972 tx2.wit.vtxinwit.append(CTxInWitness())
1973 tx2.wit.vtxinwit[-1].scriptWitness.stack = [witness_script_justright]
1974 tx2.rehash()
1975 self.update_witness_block_with_transactions(block_5, [tx2])
1976 test_witness_block(self.nodes[0], self.test_node, block_5, accepted=True)
1977
1978 # In P2SH, sigops are counted as *legacy sigops* (no witness discount),
1979 # meaning each sigop costs 4x more than in witness.
1980 p2sh_sigops_per_script = sigops_per_script * 4
1981
1982 # Compute how many outputs we can create before exceeding MAX_SIGOP_COST
1983 # (same idea as P2WSH, but adjusted for 4x cost)
1984 p2sh_outputs = (MAX_SIGOP_COST // p2sh_sigops_per_script) + 2
1985
1986 # Remaining sigops we can still use after filling full scripts,
1987 # adjusted back (divide by 4) because we construct scripts in raw sigops
1988 p2sh_extra_sigops_available = (MAX_SIGOP_COST % p2sh_sigops_per_script) // 4
1989
1990 # Ensure we don't accidentally exceed MAX_OPS_PER_SCRIPT
1991 assert p2sh_extra_sigops_available < 100
1992
1993 # Base redeem script (same as witness_script, but now used in P2SH)
1994 redeem_script = witness_script
1995
1996 # Script that will push us over the sigop limit when used
1997 redeem_script_toomany = CScript([OP_TRUE, OP_IF, OP_TRUE, OP_ELSE] + [OP_CHECKSIG] * (p2sh_extra_sigops_available + 1) + [OP_ENDIF])
1998
1999 # Script that will bring us exactly to the sigop limit
2000 redeem_script_justright = CScript([OP_TRUE, OP_IF, OP_TRUE, OP_ELSE] + [OP_CHECKSIG] * p2sh_extra_sigops_available + [OP_ENDIF])
2001
2002 # Create a transaction that splits one UTXO into many P2SH outputs
2003 tx3 = CTransaction()
2004 tx3.vin.append(CTxIn(COutPoint(tx2.sha256, 0), b""))
2005
2006 # Split value evenly across outputs
2007 split_value = tx2.vout[0].nValue // p2sh_outputs
2008
2009 # Create outputs using the base redeem script
2010 for _ in range(p2sh_outputs):
2011 tx3.vout.append(CTxOut(split_value, script_to_p2sh_script(redeem_script)))
2012
2013 # Replace last two outputs:
2014 # - second-to-last: will exceed sigop limit when spent
2015 # - last: will exactly match sigop limit when spent
2016 tx3.vout[-2].scriptPubKey = script_to_p2sh_script(redeem_script_toomany)
2017 tx3.vout[-1].scriptPubKey = script_to_p2sh_script(redeem_script_justright)
2018
2019 # Mine block containing tx3 should be valid
2020 block_6 = self.build_next_block()
2021 self.update_witness_block_with_transactions(block_6, [tx3])
2022 test_witness_block(self.nodes[0], self.test_node, block_6, accepted=True)
2023
2024 # Now try to spend too many P2SH outputs should exceed sigop limit
2025 tx4 = CTransaction()
2026 total_value = 0
2027
2028 for i in range(p2sh_outputs - 1):
2029 # Use normal scripts for most inputs,
2030 # but last one uses the "too many sigops" script
2031 script = redeem_script if i < p2sh_outputs - 2 else redeem_script_toomany
2032
2033 # In P2SH, redeem script is provided in scriptSig
2034 tx4.vin.append(CTxIn(COutPoint(tx3.sha256, i), CScript([script])))
2035 total_value += tx3.vout[i].nValue
2036
2037 tx4.vout.append(CTxOut(total_value, CScript([OP_TRUE])))
2038
2039 # This block should be rejected due to too many sigops
2040 block_7 = self.build_next_block()
2041 self.update_witness_block_with_transactions(block_7, [tx4])
2042 test_witness_block(self.nodes[0], self.test_node, block_7,
2043 accepted=False, reason='bad-blk-sigops')
2044
2045 # Now construct a valid transaction that stays within sigop limits
2046 tx5 = CTransaction()
2047 total_value = 0
2048
2049 # Spend all but the last two outputs with normal redeem script
2050 for i in range(p2sh_outputs - 2):
2051 tx5.vin.append(CTxIn(COutPoint(tx3.sha256, i),
2052 CScript([redeem_script])))
2053 total_value += tx3.vout[i].nValue
2054
2055 # Use the "just right" script for final input (exact limit)
2056 tx5.vin.append(CTxIn(COutPoint(tx3.sha256, p2sh_outputs - 1),
2057 CScript([redeem_script_justright])))
2058 total_value += tx3.vout[-1].nValue
2059
2060 tx5.vout.append(CTxOut(total_value, CScript([OP_TRUE])))
2061
2062 # This block should be accepted (sigops exactly at limit)
2063 block_8 = self.build_next_block()
2064 self.update_witness_block_with_transactions(block_8, [tx5])
2065 test_witness_block(self.nodes[0], self.test_node, block_8, accepted=True)
2066
2067 # Cleanup and prep for next test
2068 self.utxo.pop(0)
2069 self.utxo.append(UTXO(tx5.sha256, 0, tx5.vout[0].nValue))
2070
2071 @subtest
2072 def test_superfluous_witness(self):
2073 # Serialization of tx that puts witness flag to 3 always
2074 def serialize_with_bogus_witness(tx):
2075 flags = 3
2076 r = b""
2077 r += tx.version.to_bytes(4, "little")
2078 if flags:
2079 dummy = []
2080 r += ser_vector(dummy)
2081 r += flags.to_bytes(1, "little")
2082 r += ser_vector(tx.vin)
2083 r += ser_vector(tx.vout)
2084 if flags & 1:
2085 if (len(tx.wit.vtxinwit) != len(tx.vin)):
2086 # vtxinwit must have the same length as vin
2087 tx.wit.vtxinwit = tx.wit.vtxinwit[:len(tx.vin)]
2088 for _ in range(len(tx.wit.vtxinwit), len(tx.vin)):
2089 tx.wit.vtxinwit.append(CTxInWitness())
2090 r += tx.wit.serialize()
2091 r += tx.nLockTime.to_bytes(4, "little")
2092 return r
2093
2094 class msg_bogus_tx(msg_tx):
2095 def serialize(self):
2096 return serialize_with_bogus_witness(self.tx)
2097
2098 tx = self.wallet.create_self_transfer()['tx']
2099 assert_raises_rpc_error(-22, "TX decode failed", self.nodes[0].decoderawtransaction, hexstring=serialize_with_bogus_witness(tx).hex(), iswitness=True)
2100 with self.nodes[0].assert_debug_log(['Unknown transaction optional data']):
2101 self.test_node.send_and_ping(msg_bogus_tx(tx))
2102 tx.wit.vtxinwit = [] # drop witness
2103 assert_raises_rpc_error(-22, "TX decode failed", self.nodes[0].decoderawtransaction, hexstring=serialize_with_bogus_witness(tx).hex(), iswitness=True)
2104 with self.nodes[0].assert_debug_log(['Superfluous witness record']):
2105 self.test_node.send_and_ping(msg_bogus_tx(tx))
2106
2107 @subtest
2108 def test_wtxid_relay(self):
2109 # Use brand new nodes to avoid contamination from earlier tests
2110 self.wtx_node = self.nodes[0].add_p2p_connection(TestP2PConn(wtxidrelay=True), services=P2P_SERVICES)
2111 self.tx_node = self.nodes[0].add_p2p_connection(TestP2PConn(wtxidrelay=False), services=P2P_SERVICES)
2112
2113 # Check wtxidrelay feature negotiation message through connecting a new peer
2114 def received_wtxidrelay():
2115 return (len(self.wtx_node.last_wtxidrelay) > 0)
2116 self.wtx_node.wait_until(received_wtxidrelay)
2117
2118 # Create a Segwit output from the latest UTXO
2119 # and announce it to the network
2120 witness_script = CScript([OP_TRUE])
2121 script_pubkey = script_to_p2wsh_script(witness_script)
2122
2123 tx = CTransaction()
2124 tx.vin.append(CTxIn(COutPoint(self.utxo[0].sha256, self.utxo[0].n), b""))
2125 tx.vout.append(CTxOut(self.utxo[0].nValue - 1000, script_pubkey))
2126 tx.rehash()
2127
2128 # Create a Segwit transaction
2129 tx2 = CTransaction()
2130 tx2.vin.append(CTxIn(COutPoint(tx.sha256, 0), b""))
2131 tx2.vout.append(CTxOut(tx.vout[0].nValue - 1000, script_pubkey))
2132 tx2.wit.vtxinwit.append(CTxInWitness())
2133 tx2.wit.vtxinwit[0].scriptWitness.stack = [witness_script]
2134 tx2.rehash()
2135
2136 # Announce Segwit transaction with wtxid
2137 # and wait for getdata
2138 self.wtx_node.announce_tx_and_wait_for_getdata(tx2, use_wtxid=True)
2139 with p2p_lock:
2140 lgd = self.wtx_node.lastgetdata[:]
2141 assert_equal(lgd, [CInv(MSG_WTX, tx2.calc_sha256(True))])
2142
2143 # Announce Segwit transaction from non wtxidrelay peer
2144 # and wait for getdata
2145 self.tx_node.announce_tx_and_wait_for_getdata(tx2, use_wtxid=False)
2146 with p2p_lock:
2147 lgd = self.tx_node.lastgetdata[:]
2148 assert_equal(lgd, [CInv(MSG_TX|MSG_WITNESS_FLAG, tx2.sha256)])
2149
2150 # Send tx2 through; it's an orphan so won't be accepted
2151 with p2p_lock:
2152 self.wtx_node.last_message.pop("getdata", None)
2153 test_transaction_acceptance(self.nodes[0], self.wtx_node, tx2, with_witness=True, accepted=False)
2154
2155 # Disconnect tx_node to avoid the possibility of it being selected for orphan resolution.
2156 self.tx_node.peer_disconnect()
2157
2158 # Expect a request for parent (tx) by txid despite use of WTX peer
2159 self.wtx_node.wait_for_getdata([tx.sha256], timeout=60)
2160 with p2p_lock:
2161 lgd = self.wtx_node.lastgetdata[:]
2162 assert_equal(lgd, [CInv(MSG_WITNESS_TX, tx.sha256)])
2163
2164 # Send tx through
2165 test_transaction_acceptance(self.nodes[0], self.wtx_node, tx, with_witness=False, accepted=True)
2166
2167 # Check tx2 is there now
2168 assert_equal(tx2.hash in self.nodes[0].getrawmempool(), True)
2169
2170
2171 if __name__ == '__main__':
2172 SegWitTest(__file__).main()
2173