Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lncli: add command to create new macaroon #1160

Merged
merged 3 commits into from Oct 25, 2019

Conversation

guggero
Copy link
Collaborator

@guggero guggero commented Apr 30, 2018

As discussed in #1147 there is a need to create macaroons with custom permissions set since the three existing macaroon files admin.macaroon, invoice.macaroon and readonly.macaroon aren't fine-grained enough.

A new gRPC method named NewMacaroon is added:

  • Introduces a new permission entity named macaroon (could be used for macaroon based RPCs mentioned in Add support for accounting-based macaroons #291 too).
  • write access to the entity macaroon is necessary to call the method NewMacaroon.
  • The admin.macaroon gets write access to the entity macaroon.
  • A new command is added to lncli named newmacaroon that calls this gRPC method.
  • As parameters to the NewMacaroon method a list of entity/action pairs for the allowed operations can be passed.

Example:

lncli newmacaroon --permission=invoices/write --permission=invoices/read --save_to=~/.lnd/custom-invoice.macaroon --timeout=10

Creates a macaroon that is valid for reading and writing invoices during the next 10 seconds.

Closes #283, #1147, #3516.

NOTE for release notes: Users will need to delete or move their admin.macaroon, readonly.macaroon and invoices.macaroon before starting 0.9, otherwise they won't get regenerated macaroons that have the required permission (macaroon:generate) to mint custom macaroons.

@vegardengen
Copy link
Contributor

vegardengen commented Apr 30, 2018

This one actually conflicts with #1147

Would it make sense to make this into one common PR? Or merge one, then rebase/fix conflicts after that?

@meshcollider meshcollider added macaroons cli Related to the command line interface gRPC labels May 1, 2018
@guggero
Copy link
Collaborator Author

guggero commented May 1, 2018

If either of the two PRs is merged, I'll rebase the other one. The functionality should not conflict, both commands have their usefulness IMO, even if there is overlap in some of the command arguments.

@Roasbeef Roasbeef requested a review from aakselrod May 1, 2018
@guggero guggero force-pushed the new-macaroon branch 6 times, most recently from 898a08e to de4c7ca Compare May 8, 2018
@guggero guggero force-pushed the new-macaroon branch 3 times, most recently from 4e4cca6 to 0cd3c8a Compare May 12, 2018
@guggero guggero force-pushed the new-macaroon branch 2 times, most recently from 140edb9 to 2d79147 Compare May 23, 2018
@guggero guggero force-pushed the new-macaroon branch 2 times, most recently from 5c0a41f to 798db9c Compare Jun 1, 2018
@guggero guggero force-pushed the new-macaroon branch 3 times, most recently from f829b7e to b04419a Compare Jun 9, 2018
@guggero guggero force-pushed the new-macaroon branch 2 times, most recently from 850f64b to 6fbc5b7 Compare Jun 14, 2018
@guggero guggero force-pushed the new-macaroon branch 2 times, most recently from ca7c476 to e17108b Compare Jul 1, 2018
@Roasbeef Roasbeef added P3 might get fixed, nice to have needs review PR needs review by regular contributors needs testing PR hasn't yet been actively tested on testnet/mainnet labels Jul 10, 2018
cmd/lncli/cmd_new_macaroon.go Outdated Show resolved Hide resolved
cmd/lncli/cmd_new_macaroon.go Outdated Show resolved Hide resolved
cmd/lncli/cmd_new_macaroon.go Outdated Show resolved Hide resolved
lnrpc/README.md Show resolved Hide resolved
rpcserver.go Outdated Show resolved Hide resolved
rpcserver.go Outdated Show resolved Hide resolved
rpcserver.go Show resolved Hide resolved
rpcserver.go Outdated Show resolved Hide resolved
@guggero guggero removed this from Needs review in High Priority Oct 23, 2019
@guggero guggero removed this from Needs review in Macaroon Evolution Oct 23, 2019
rpcserver.go Outdated Show resolved Hide resolved
rpcserver.go Outdated Show resolved Hide resolved
rpcserver.go Outdated Show resolved Hide resolved
rpcserver.go Show resolved Hide resolved
cmd/lncli/cmd_new_macaroon.go Outdated Show resolved Hide resolved
rpcserver.go Outdated Show resolved Hide resolved
cmd/lncli/cmd_new_macaroon.go Outdated Show resolved Hide resolved
cmd/lncli/cmd_new_macaroon.go Outdated Show resolved Hide resolved
Copy link
Collaborator

@wpaulino wpaulino left a comment

LGTM 💥

I think another nice follow-up would be to allow lncli to use a custom macaroon through a flag as hex to prevent having to save it to a file.

cmd/lncli/cmd_new_macaroon.go Outdated Show resolved Hide resolved
rpcserver.go Show resolved Hide resolved
@guggero
Copy link
Collaborator Author

guggero commented Oct 24, 2019

@Roasbeef asked me to rename the service to BakeMacaroon.

rpcserver.go Outdated Show resolved Hide resolved
v0.9.0-beta automation moved this from Needs Review to Approved Oct 24, 2019
@Roasbeef Roasbeef merged commit b110a3a into lightningnetwork:master Oct 25, 2019
1 of 2 checks passed
v0.9.0-beta automation moved this from Approved to Done Oct 25, 2019
@guggero guggero deleted the new-macaroon branch Oct 28, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cli Related to the command line interface gRPC macaroons needs review PR needs review by regular contributors needs testing PR hasn't yet been actively tested on testnet/mainnet P3 might get fixed, nice to have v0.9.0
Projects
No open projects
v0.9.0-beta
  
Done
Development

Successfully merging this pull request may close these issues.

7 participants