@@ -16,7 +16,7 @@ use bitcoin::blockdata::transaction::{Transaction, TxOut};
16
16
use bitcoin:: hash_types:: { BlockHash , Txid } ;
17
17
use bitcoin:: network:: constants:: Network ;
18
18
19
- use chain:: channelmonitor:: { ChannelMonitor , ChannelMonitorUpdate , ChannelMonitorUpdateErr , MonitorEvent } ;
19
+ use chain:: channelmonitor:: { ChannelMonitor , ChannelMonitorUpdate , MonitorEvent } ;
20
20
use chain:: keysinterface:: Sign ;
21
21
use chain:: transaction:: { OutPoint , TransactionData } ;
22
22
@@ -175,6 +175,67 @@ pub trait Confirm {
175
175
fn get_relevant_txids ( & self ) -> Vec < Txid > ;
176
176
}
177
177
178
+ /// An error enum representing a failure to persist a channel monitor update.
179
+ #[ derive( Clone , Copy , Debug , PartialEq ) ]
180
+ pub enum ChannelMonitorUpdateErr {
181
+ /// Used to indicate a temporary failure (eg connection to a watchtower or remote backup of
182
+ /// our state failed, but is expected to succeed at some point in the future).
183
+ ///
184
+ /// Such a failure will "freeze" a channel, preventing us from revoking old states or
185
+ /// submitting new commitment transactions to the counterparty. Once the update(s) which failed
186
+ /// have been successfully applied, ChannelManager::channel_monitor_updated can be used to
187
+ /// restore the channel to an operational state.
188
+ ///
189
+ /// Note that a given ChannelManager will *never* re-generate a given ChannelMonitorUpdate. If
190
+ /// you return a TemporaryFailure you must ensure that it is written to disk safely before
191
+ /// writing out the latest ChannelManager state.
192
+ ///
193
+ /// Even when a channel has been "frozen" updates to the ChannelMonitor can continue to occur
194
+ /// (eg if an inbound HTLC which we forwarded was claimed upstream resulting in us attempting
195
+ /// to claim it on this channel) and those updates must be applied wherever they can be. At
196
+ /// least one such updated ChannelMonitor must be persisted otherwise PermanentFailure should
197
+ /// be returned to get things on-chain ASAP using only the in-memory copy. Obviously updates to
198
+ /// the channel which would invalidate previous ChannelMonitors are not made when a channel has
199
+ /// been "frozen".
200
+ ///
201
+ /// Note that even if updates made after TemporaryFailure succeed you must still call
202
+ /// channel_monitor_updated to ensure you have the latest monitor and re-enable normal channel
203
+ /// operation.
204
+ ///
205
+ /// Note that the update being processed here will not be replayed for you when you call
206
+ /// ChannelManager::channel_monitor_updated, so you must store the update itself along
207
+ /// with the persisted ChannelMonitor on your own local disk prior to returning a
208
+ /// TemporaryFailure. You may, of course, employ a journaling approach, storing only the
209
+ /// ChannelMonitorUpdate on disk without updating the monitor itself, replaying the journal at
210
+ /// reload-time.
211
+ ///
212
+ /// For deployments where a copy of ChannelMonitors and other local state are backed up in a
213
+ /// remote location (with local copies persisted immediately), it is anticipated that all
214
+ /// updates will return TemporaryFailure until the remote copies could be updated.
215
+ TemporaryFailure ,
216
+ /// Used to indicate no further channel monitor updates will be allowed (eg we've moved on to a
217
+ /// different watchtower and cannot update with all watchtowers that were previously informed
218
+ /// of this channel).
219
+ ///
220
+ /// At reception of this error, ChannelManager will force-close the channel and return at
221
+ /// least a final ChannelMonitorUpdate::ChannelForceClosed which must be delivered to at
222
+ /// least one ChannelMonitor copy. Revocation secret MUST NOT be released and offchain channel
223
+ /// update must be rejected.
224
+ ///
225
+ /// This failure may also signal a failure to update the local persisted copy of one of
226
+ /// the channel monitor instance.
227
+ ///
228
+ /// Note that even when you fail a holder commitment transaction update, you must store the
229
+ /// update to ensure you can claim from it in case of a duplicate copy of this ChannelMonitor
230
+ /// broadcasts it (e.g distributed channel-monitor deployment)
231
+ ///
232
+ /// In case of distributed watchtowers deployment, the new version must be written to disk, as
233
+ /// state may have been stored but rejected due to a block forcing a commitment broadcast. This
234
+ /// storage is used to claim outputs of rejected state confirmed onchain by another watchtower,
235
+ /// lagging behind on block processing.
236
+ PermanentFailure ,
237
+ }
238
+
178
239
/// The `Watch` trait defines behavior for watching on-chain activity pertaining to channels as
179
240
/// blocks are connected and disconnected.
180
241
///
@@ -193,9 +254,7 @@ pub trait Confirm {
193
254
/// funds in the channel. See [`ChannelMonitorUpdateErr`] for more details about how to handle
194
255
/// multiple instances.
195
256
///
196
- /// [`ChannelMonitor`]: channelmonitor::ChannelMonitor
197
- /// [`ChannelMonitorUpdateErr`]: channelmonitor::ChannelMonitorUpdateErr
198
- /// [`PermanentFailure`]: channelmonitor::ChannelMonitorUpdateErr::PermanentFailure
257
+ /// [`PermanentFailure`]: ChannelMonitorUpdateErr::PermanentFailure
199
258
pub trait Watch < ChannelSigner : Sign > {
200
259
/// Watches a channel identified by `funding_txo` using `monitor`.
201
260
///
@@ -217,7 +276,6 @@ pub trait Watch<ChannelSigner: Sign> {
217
276
/// [`ChannelMonitorUpdateErr`] for invariants around returning an error.
218
277
///
219
278
/// [`update_monitor`]: channelmonitor::ChannelMonitor::update_monitor
220
- /// [`ChannelMonitorUpdateErr`]: channelmonitor::ChannelMonitorUpdateErr
221
279
fn update_channel ( & self , funding_txo : OutPoint , update : ChannelMonitorUpdate ) -> Result < ( ) , ChannelMonitorUpdateErr > ;
222
280
223
281
/// Returns any monitor events since the last call. Subsequent calls must only return new
@@ -242,7 +300,7 @@ pub trait Watch<ChannelSigner: Sign> {
242
300
/// processed later. Then, in order to block until the data has been processed, any [`Watch`]
243
301
/// invocation that has called the `Filter` must return [`TemporaryFailure`].
244
302
///
245
- /// [`TemporaryFailure`]: channelmonitor:: ChannelMonitorUpdateErr::TemporaryFailure
303
+ /// [`TemporaryFailure`]: ChannelMonitorUpdateErr::TemporaryFailure
246
304
/// [BIP 157]: https://github.com/bitcoin/bips/blob/master/bip-0157.mediawiki
247
305
/// [BIP 158]: https://github.com/bitcoin/bips/blob/master/bip-0158.mediawiki
248
306
pub trait Filter {
0 commit comments