Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for accounting-based macaroons #291

Closed
4 tasks
aakselrod opened this issue Aug 29, 2017 · 3 comments
Closed
4 tasks

Add support for accounting-based macaroons #291

aakselrod opened this issue Aug 29, 2017 · 3 comments
Labels
advanced Issues suitable for very experienced developers authentication gRPC macaroons P3 might get fixed, nice to have security General label for issues/PRs related to the security of the software

Comments

@aakselrod
Copy link
Contributor

There is a large set of functionality that can be added by extending lnd's macaroon implementation by adding internal state. This partially draws on #286, but also adds root key deletion/expiration with garbage collection. This functionality could enable use cases described in issue #20 such as:

  • Giving a process or user a macaroon with a predetermined, one-time budget
  • Giving a process or user a macaroon with a predetermined, periodic budget
  • Giving a process or user the ability to manually open channels and send on-chain payments
  • Allowing a process or user to use only channels it has opened

This would be a pretty massive functionality addition as well as reimagining of much of the API. To do this, we would need to do the following:

  • Add per-macaroon off-chain and on-chain balance tracking to the macaroon database with expiration and expired macaroon deletion.
  • Add on-chain balance macaroon generation to NewAddress, NewWitnessAddress, and CloseChannel and consumption to OpenChannel, OpenChannelSync, SendCoins, and SendMany.
  • Add off-chain balance macaroon generation to OpenChannel and OpenChannelSync and consumption to SendPayment, SendPaymentSync, and CloseChannel.
  • Add RPCs for CheckMacaroonBalance, SubdivideMacaroonBalance, and CombineMacaroonBalance to manage macaroon balances.

There are other possibilities and potential issues to watch out for listed in my previous comment on issue #20, so this is only preliminary. This implementation is likely to get fairly complicated.

@Roasbeef Roasbeef added advanced Issues suitable for very experienced developers authentication gRPC macaroons security General label for issues/PRs related to the security of the software labels Aug 29, 2017
@guggero
Copy link
Collaborator

guggero commented Jul 2, 2018

I'll start working on accounting-based macaroons. This issue lists features for several PRs IMHO, so I'll start with a basic off-chain balance macaroon. Then we'll see where we get from there.

@Roasbeef Roasbeef added the P3 might get fixed, nice to have label Jul 10, 2018
@Kixunil
Copy link
Contributor

Kixunil commented Dec 16, 2018

I'm definitely interested in this. It would be useful for mitigating attacks against Joule browser extension.

@Roasbeef
Copy link
Member

Will be obviated by #5101

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
advanced Issues suitable for very experienced developers authentication gRPC macaroons P3 might get fixed, nice to have security General label for issues/PRs related to the security of the software
Projects
None yet
Development

No branches or pull requests

4 participants