投稿
LND マカロン

LND マカロン

tanakei
tanakei

・ThunderHubで焼いたマカロンがlncli printmacaroonでどう見えるか確認した。

ThunderHub              macaroon permissions
---------------------------------------------------------------
get invoices                   invoices:read
create invoices              invoices:write
get payments                offchain:read
pay invoices                   offchain:write
get chain transactions  onchain:read
send to chain address   onchain:write
create chain address    address:write
get wallet info               info:read
stop daemon                  info:write

この結果によれば、offchain:wirteとonchain:writeの権限がなければそのマカロンを使うクライアントは勝手にBTCを送金することができない。
info:writeがなければ勝手にLNDを止めたりすることができない。

・lncli printmacaroonでデフォルトで作られるmacaroonのpermissionsを調べてみた。
admin.macaroon

{
    "version": 2,
    "location": "lnd",
    "root_key_id": "0",
    "permissions": [
        "address:read",
        "address:write",
        "info:read",
        "info:write",
        "invoices:read",
        "invoices:write",
        "macaroon:generate",
        "macaroon:read",
        "macaroon:write",
        "message:read",
        "message:write",
        "offchain:read",
        "offchain:write",
        "onchain:read",
        "onchain:write",
        "peers:read",
        "peers:write",
        "signer:generate",
        "signer:read"
    ],
    "caveats": null
}

chainnotifier.macaroon

{
    "version": 2,
    "location": "lnd",
    "root_key_id": "0",
    "permissions": [
        "onchain:read"
    ],
    "caveats": null
}

invoice.macaroon

{
    "version": 2,
    "location": "lnd",
    "root_key_id": "0",
    "permissions": [
        "address:read",
        "address:write",
        "invoices:read",
        "invoices:write",
        "onchain:read"
    ],
    "caveats": null
}

invoices.macaroon

{
    "version": 2,
    "location": "lnd",
    "root_key_id": "0",
    "permissions": [
        "invoices:read",
        "invoices:write"
    ],
    "caveats": null
}

readonly.macaroon

{
    "version": 2,
    "location": "lnd",
    "root_key_id": "0",
    "permissions": [
        "address:read",
        "info:read",
        "invoices:read",
        "macaroon:read",
        "message:read",
        "offchain:read",
        "onchain:read",
        "peers:read",
        "signer:read"
    ],
    "caveats": null
}

 router.macaroon

{
    "version": 2,
    "location": "lnd",
    "root_key_id": "0",
    "permissions": [
        "offchain:read",
        "offchain:write"
    ],
    "caveats": null
}

signer.macaroon

{
    "version": 2,
    "location": "lnd",
    "root_key_id": "0",
    "permissions": [
        "signer:generate",
        "signer:read"
    ],
    "caveats": null
}

walletkit.macaroon

{
    "version": 2,
    "location": "lnd",
    "root_key_id": "0",
    "permissions": [
        "address:read",
        "address:write",
        "onchain:read",
        "onchain:write"
    ],
    "caveats": null
}

・lncli listpermissions コマンドですべての RPC メソッド URI と、それらを呼び出すために必要なマカロン権限を一覧表示できる。
LND v0.18.5-betaでやると1344行ほどのJSONができる。
AddInvoiceだとinvoice:writeのpermissionを持つmacaroonを使えばインボイスを作れるようだ。

        "/lnrpc.Lightning/AddInvoice":  {
            "permissions":  [
                {
                    "entity":  "invoices",
                    "action":  "write"
                }
            ]
        },

lncli listpermissionsからentityとactionを抜き出してみた。

"entity":  "address",
"entity":  "info",
"entity":  "invoices",
"entity":  "macaroon",
"entity":  "message",
"entity":  "offchain",
"entity":  "onchain",
"entity":  "peers",
"entity":  "signer",

"action":  "generate"
"action":  "read"
"action":  "write"

lncli とjqを組み合わせると例えば以下コマンドでinvoices:writeを必要とするRPCの一覧を表示できる。
invoices:writeだとAddInvoiceの他にホドルインボイス作成でも使ってるようだ。

lncli listpermissions | jq -r '.method_permissions | to_entries[] 
| select(.value.permissions[] | select(.entity == "invoices" and .action == "write")) | .key'
/invoicesrpc.Invoices/AddHoldInvoice
/invoicesrpc.Invoices/CancelInvoice
/invoicesrpc.Invoices/HtlcModifier
/invoicesrpc.Invoices/LookupInvoiceV2
/invoicesrpc.Invoices/SettleInvoice
/lnrpc.Lightning/AddInvoice

invoices:readだと以下となる。

/invoicesrpc.Invoices/SubscribeSingleInvoice
/lnrpc.Lightning/ListInvoices
/lnrpc.Lightning/LookupInvoice
/lnrpc.Lightning/SubscribeInvoices

LNの主だった機能のRPCはoffchainが必要ぽいので抜き出してみた。
offchain:write
チャネルの開閉、ペイメントの送信までやってるみたい。
デフォルトのmacaroonでoffchain:writeを持ってるのはadminとrouterの2つだけ。openchannel,closechannelはonchain:writeのpermissionも必要なようだ。

/autopilotrpc.Autopilot/ModifyStatus
/autopilotrpc.Autopilot/SetScores
/lnrpc.Lightning/AbandonChannel
/lnrpc.Lightning/BatchOpenChannel
/lnrpc.Lightning/ChannelAcceptor
/lnrpc.Lightning/CloseChannel
/lnrpc.Lightning/DeleteAllPayments
/lnrpc.Lightning/DeletePayment
/lnrpc.Lightning/FundingStateStep
/lnrpc.Lightning/OpenChannel
/lnrpc.Lightning/OpenChannelSync
/lnrpc.Lightning/RestoreChannelBackups
/lnrpc.Lightning/SendCustomMessage
/lnrpc.Lightning/SendPayment
/lnrpc.Lightning/SendPaymentSync
/lnrpc.Lightning/SendToRoute
/lnrpc.Lightning/SendToRouteSync
/lnrpc.Lightning/UpdateChannelPolicy
/routerrpc.Router/HtlcInterceptor
/routerrpc.Router/ResetMissionControl
/routerrpc.Router/SendPayment
/routerrpc.Router/SendPaymentV2
/routerrpc.Router/SendToRoute
/routerrpc.Router/SendToRouteV2
/routerrpc.Router/SetMissionControlConfig
/routerrpc.Router/UpdateChanStatus
/routerrpc.Router/XAddLocalChanAliases
/routerrpc.Router/XDeleteLocalChanAliases
/routerrpc.Router/XImportMissionControl
/wtclientrpc.WatchtowerClient/AddTower
/wtclientrpc.WatchtowerClient/DeactivateTower
/wtclientrpc.WatchtowerClient/RemoveTower
/wtclientrpc.WatchtowerClient/TerminateSession
        "/lnrpc.Lightning/OpenChannel":  {
            "permissions":  [
                {
                    "entity":  "onchain",
                    "action":  "write"
                },
                {
                    "entity":  "offchain",
                    "action":  "write"
                }
            ]
        },

offchain:read
readの方はチャネルやインボイスの状態を確認するためのpermissionのようだ。

/lnrpc.Lightning/ChannelBalance
/lnrpc.Lightning/ClosedChannels
/lnrpc.Lightning/DecodePayReq
/lnrpc.Lightning/ExportAllChannelBackups
/lnrpc.Lightning/ExportChannelBackup
/lnrpc.Lightning/FeeReport
/lnrpc.Lightning/ForwardingHistory
/lnrpc.Lightning/GetDebugInfo
/lnrpc.Lightning/ListAliases
/lnrpc.Lightning/ListChannels
/lnrpc.Lightning/ListPayments
/lnrpc.Lightning/LookupHtlcResolution
/lnrpc.Lightning/PendingChannels
/lnrpc.Lightning/SubscribeChannelBackups
/lnrpc.Lightning/SubscribeChannelEvents
/lnrpc.Lightning/SubscribeCustomMessages
/lnrpc.Lightning/VerifyChanBackup
/routerrpc.Router/BuildRoute
/routerrpc.Router/EstimateRouteFee
/routerrpc.Router/GetMissionControlConfig
/routerrpc.Router/QueryMissionControl
/routerrpc.Router/QueryProbability
/routerrpc.Router/SubscribeHtlcEvents
/routerrpc.Router/TrackPayment
/routerrpc.Router/TrackPaymentV2
/routerrpc.Router/TrackPayments
/wtclientrpc.WatchtowerClient/GetTowerInfo
/wtclientrpc.WatchtowerClient/ListTowers
/wtclientrpc.WatchtowerClient/Policy
/wtclientrpc.WatchtowerClient/Stats

・おまけ1
RPCメソッド名にopenを含む要素を抽出するコマンド

lncli listpermissions | jq '.method_permissions | to_entries[] | select(.key | test("open"; "i"))'
{
  "key": "/lnrpc.Lightning/BatchOpenChannel",
  "value": {
    "permissions": [
      {
        "entity": "onchain",
        "action": "write"
      },
      {
        "entity": "offchain",
        "action": "write"
      }
    ]
  }
}
{
  "key": "/lnrpc.Lightning/OpenChannel",
  "value": {
    "permissions": [
      {
        "entity": "onchain",
        "action": "write"
      },
      {
        "entity": "offchain",
        "action": "write"
      }
    ]
  }
}
{
  "key": "/lnrpc.Lightning/OpenChannelSync",
  "value": {
    "permissions": [
      {
        "entity": "onchain",
        "action": "write"
      },
      {
        "entity": "offchain",
        "action": "write"
      }
    ]
  }
}

・おまけ２
thunderhubで作ったmacaroonはテキストで出力されコピペして使うもので、macaroonファイルになってない。
HEXをmacaroonファイルにするには以下コマンドでできる。HEXをコピペして置換する。またYOURSの箇所を自分でわかりやすい名称に置換すると良い。

echo -n "HEX" | xxd -r -p > YOURS.macaroon

thunderhubで"Create Invoices, Get Invoices, Get Wallet Info, Get Payments, Pay Invoices"をチェックして作ったmacaroonのpermissionsは以下となる。

{
    "version": 2,
    "location": "lnd",
    "root_key_id": "0",
    "permissions": [
        "info:read",
        "invoices:read",
        "invoices:write",
        "offchain:read",
        "offchain:write"
    ],
    "caveats": null
}

offchain:writeはあるがonchain:writeがないのでチャネル開閉はできないはず。

この続き : 0字 / 画像 0枚
100

会員登録 / ログインして続きを読む

カテゴリ :テック

関連記事

Multi Path Payment(MPP)で送金する
0
6
100
teatwo
teatwo
IPFSは永続的にコンテンツをホストできるWebではない

IPFSは永続的にコンテンツをホストできるWebではない
0
5
ocknamo
ocknamo
貢献度報酬タスク管理ツール「hideaki.α版」を静かにリリース

貢献度報酬タスク管理ツール「hideaki.α版」を静かにリリース
0
4

Lapp一覧
0
1
Spotlight
Spotlight
Umbrel を WiFi に接続する方法

Umbrel を WiFi に接続する方法
0
9
piyo
piyo

ユーザビリティの考察
4
0
100
Yuya
Yuya

記事を書いた人

tanakei
tanakei

甘いもの大好きメタボ猫。マイペースなのはしょうがない。 nostr:npub10zeurmg22wc89l8m3npw9cyu45cun0lvs6w3ep69cdpa25pna65s0994qz

SNSにシェア

このクリエイターの人気記事

【Umbrel】BlueWallet Lightning & tailscaleで便利で快適なLightningウォレットを作ろう！

573

【Umbrel】LNURLが使いたいから自分で環境つくってみた

337

Bitcoin CPUソロマイニング(マイニングプール無し)

332