github.com/Team-Kujira/tendermint@v0.34.24-indexer/crypto/merkle/proof.go (about)

     1  package merkle
     2  
     3  import (
     4  	"bytes"
     5  	"errors"
     6  	"fmt"
     7  
     8  	"github.com/tendermint/tendermint/crypto/tmhash"
     9  	tmcrypto "github.com/tendermint/tendermint/proto/tendermint/crypto"
    10  )
    11  
    12  const (
    13  	// MaxAunts is the maximum number of aunts that can be included in a Proof.
    14  	// This corresponds to a tree of size 2^100, which should be sufficient for all conceivable purposes.
    15  	// This maximum helps prevent Denial-of-Service attacks by limitting the size of the proofs.
    16  	MaxAunts = 100
    17  )
    18  
    19  // Proof represents a Merkle proof.
    20  // NOTE: The convention for proofs is to include leaf hashes but to
    21  // exclude the root hash.
    22  // This convention is implemented across IAVL range proofs as well.
    23  // Keep this consistent unless there's a very good reason to change
    24  // everything.  This also affects the generalized proof system as
    25  // well.
    26  type Proof struct {
    27  	Total    int64    `json:"total"`     // Total number of items.
    28  	Index    int64    `json:"index"`     // Index of item to prove.
    29  	LeafHash []byte   `json:"leaf_hash"` // Hash of item value.
    30  	Aunts    [][]byte `json:"aunts"`     // Hashes from leaf's sibling to a root's child.
    31  }
    32  
    33  // ProofsFromByteSlices computes inclusion proof for given items.
    34  // proofs[0] is the proof for items[0].
    35  func ProofsFromByteSlices(items [][]byte) (rootHash []byte, proofs []*Proof) {
    36  	trails, rootSPN := trailsFromByteSlices(items)
    37  	rootHash = rootSPN.Hash
    38  	proofs = make([]*Proof, len(items))
    39  	for i, trail := range trails {
    40  		proofs[i] = &Proof{
    41  			Total:    int64(len(items)),
    42  			Index:    int64(i),
    43  			LeafHash: trail.Hash,
    44  			Aunts:    trail.FlattenAunts(),
    45  		}
    46  	}
    47  	return
    48  }
    49  
    50  // Verify that the Proof proves the root hash.
    51  // Check sp.Index/sp.Total manually if needed
    52  func (sp *Proof) Verify(rootHash []byte, leaf []byte) error {
    53  	leafHash := leafHash(leaf)
    54  	if sp.Total < 0 {
    55  		return errors.New("proof total must be positive")
    56  	}
    57  	if sp.Index < 0 {
    58  		return errors.New("proof index cannot be negative")
    59  	}
    60  	if !bytes.Equal(sp.LeafHash, leafHash) {
    61  		return fmt.Errorf("invalid leaf hash: wanted %X got %X", leafHash, sp.LeafHash)
    62  	}
    63  	computedHash := sp.ComputeRootHash()
    64  	if !bytes.Equal(computedHash, rootHash) {
    65  		return fmt.Errorf("invalid root hash: wanted %X got %X", rootHash, computedHash)
    66  	}
    67  	return nil
    68  }
    69  
    70  // Compute the root hash given a leaf hash.  Does not verify the result.
    71  func (sp *Proof) ComputeRootHash() []byte {
    72  	return computeHashFromAunts(
    73  		sp.Index,
    74  		sp.Total,
    75  		sp.LeafHash,
    76  		sp.Aunts,
    77  	)
    78  }
    79  
    80  // String implements the stringer interface for Proof.
    81  // It is a wrapper around StringIndented.
    82  func (sp *Proof) String() string {
    83  	return sp.StringIndented("")
    84  }
    85  
    86  // StringIndented generates a canonical string representation of a Proof.
    87  func (sp *Proof) StringIndented(indent string) string {
    88  	return fmt.Sprintf(`Proof{
    89  %s  Aunts: %X
    90  %s}`,
    91  		indent, sp.Aunts,
    92  		indent)
    93  }
    94  
    95  // ValidateBasic performs basic validation.
    96  // NOTE: it expects the LeafHash and the elements of Aunts to be of size tmhash.Size,
    97  // and it expects at most MaxAunts elements in Aunts.
    98  func (sp *Proof) ValidateBasic() error {
    99  	if sp.Total < 0 {
   100  		return errors.New("negative Total")
   101  	}
   102  	if sp.Index < 0 {
   103  		return errors.New("negative Index")
   104  	}
   105  	if len(sp.LeafHash) != tmhash.Size {
   106  		return fmt.Errorf("expected LeafHash size to be %d, got %d", tmhash.Size, len(sp.LeafHash))
   107  	}
   108  	if len(sp.Aunts) > MaxAunts {
   109  		return fmt.Errorf("expected no more than %d aunts, got %d", MaxAunts, len(sp.Aunts))
   110  	}
   111  	for i, auntHash := range sp.Aunts {
   112  		if len(auntHash) != tmhash.Size {
   113  			return fmt.Errorf("expected Aunts#%d size to be %d, got %d", i, tmhash.Size, len(auntHash))
   114  		}
   115  	}
   116  	return nil
   117  }
   118  
   119  func (sp *Proof) ToProto() *tmcrypto.Proof {
   120  	if sp == nil {
   121  		return nil
   122  	}
   123  	pb := new(tmcrypto.Proof)
   124  
   125  	pb.Total = sp.Total
   126  	pb.Index = sp.Index
   127  	pb.LeafHash = sp.LeafHash
   128  	pb.Aunts = sp.Aunts
   129  
   130  	return pb
   131  }
   132  
   133  func ProofFromProto(pb *tmcrypto.Proof) (*Proof, error) {
   134  	if pb == nil {
   135  		return nil, errors.New("nil proof")
   136  	}
   137  
   138  	sp := new(Proof)
   139  
   140  	sp.Total = pb.Total
   141  	sp.Index = pb.Index
   142  	sp.LeafHash = pb.LeafHash
   143  	sp.Aunts = pb.Aunts
   144  
   145  	return sp, sp.ValidateBasic()
   146  }
   147  
   148  // Use the leafHash and innerHashes to get the root merkle hash.
   149  // If the length of the innerHashes slice isn't exactly correct, the result is nil.
   150  // Recursive impl.
   151  func computeHashFromAunts(index, total int64, leafHash []byte, innerHashes [][]byte) []byte {
   152  	if index >= total || index < 0 || total <= 0 {
   153  		return nil
   154  	}
   155  	switch total {
   156  	case 0:
   157  		panic("Cannot call computeHashFromAunts() with 0 total")
   158  	case 1:
   159  		if len(innerHashes) != 0 {
   160  			return nil
   161  		}
   162  		return leafHash
   163  	default:
   164  		if len(innerHashes) == 0 {
   165  			return nil
   166  		}
   167  		numLeft := getSplitPoint(total)
   168  		if index < numLeft {
   169  			leftHash := computeHashFromAunts(index, numLeft, leafHash, innerHashes[:len(innerHashes)-1])
   170  			if leftHash == nil {
   171  				return nil
   172  			}
   173  			return innerHash(leftHash, innerHashes[len(innerHashes)-1])
   174  		}
   175  		rightHash := computeHashFromAunts(index-numLeft, total-numLeft, leafHash, innerHashes[:len(innerHashes)-1])
   176  		if rightHash == nil {
   177  			return nil
   178  		}
   179  		return innerHash(innerHashes[len(innerHashes)-1], rightHash)
   180  	}
   181  }
   182  
   183  // ProofNode is a helper structure to construct merkle proof.
   184  // The node and the tree is thrown away afterwards.
   185  // Exactly one of node.Left and node.Right is nil, unless node is the root, in which case both are nil.
   186  // node.Parent.Hash = hash(node.Hash, node.Right.Hash) or
   187  // hash(node.Left.Hash, node.Hash), depending on whether node is a left/right child.
   188  type ProofNode struct {
   189  	Hash   []byte
   190  	Parent *ProofNode
   191  	Left   *ProofNode // Left sibling  (only one of Left,Right is set)
   192  	Right  *ProofNode // Right sibling (only one of Left,Right is set)
   193  }
   194  
   195  // FlattenAunts will return the inner hashes for the item corresponding to the leaf,
   196  // starting from a leaf ProofNode.
   197  func (spn *ProofNode) FlattenAunts() [][]byte {
   198  	// Nonrecursive impl.
   199  	innerHashes := [][]byte{}
   200  	for spn != nil {
   201  		switch {
   202  		case spn.Left != nil:
   203  			innerHashes = append(innerHashes, spn.Left.Hash)
   204  		case spn.Right != nil:
   205  			innerHashes = append(innerHashes, spn.Right.Hash)
   206  		default:
   207  			break
   208  		}
   209  		spn = spn.Parent
   210  	}
   211  	return innerHashes
   212  }
   213  
   214  // trails[0].Hash is the leaf hash for items[0].
   215  // trails[i].Parent.Parent....Parent == root for all i.
   216  func trailsFromByteSlices(items [][]byte) (trails []*ProofNode, root *ProofNode) {
   217  	// Recursive impl.
   218  	switch len(items) {
   219  	case 0:
   220  		return []*ProofNode{}, &ProofNode{emptyHash(), nil, nil, nil}
   221  	case 1:
   222  		trail := &ProofNode{leafHash(items[0]), nil, nil, nil}
   223  		return []*ProofNode{trail}, trail
   224  	default:
   225  		k := getSplitPoint(int64(len(items)))
   226  		lefts, leftRoot := trailsFromByteSlices(items[:k])
   227  		rights, rightRoot := trailsFromByteSlices(items[k:])
   228  		rootHash := innerHash(leftRoot.Hash, rightRoot.Hash)
   229  		root := &ProofNode{rootHash, nil, nil, nil}
   230  		leftRoot.Parent = root
   231  		leftRoot.Right = rightRoot
   232  		rightRoot.Parent = root
   233  		rightRoot.Left = leftRoot
   234  		return append(lefts, rights...), root
   235  	}
   236  }