wallet: add storage sanity check

4 files changed, 177 insertions, 0 deletions

diff --git a/src/main_gui.cpp b/src/main_gui.cpp
index 395cc0f..8763211 100644
--- a/src/main_gui.cpp
+++ b/src/main_gui.cpp
@@ -176,6 +176,8 @@ static void PrintUsage()
     printf("                              printing wallet values, then exit)\n");
     printf("  /walletstorageauditjson=FILE\n");
     printf("                              (write the same audit as deterministic JSON)\n");
+    printf("  /walletstoragecheck        (fail closed on inconsistent or unsafe\n");
+    printf("                              wallet.dat storage state)\n");
     printf("  /rescan                    (walk the chain for coins this wallet owns\n");
     printf("                              but never recorded, then exit)\n");
     printf("\n");
@@ -719,6 +721,13 @@ int main(int argc, char* argv[])
         return nRet;
     }
 
+    if (arg(argc,argv,"/walletstoragecheck") || arg(argc,argv,"-walletstoragecheck"))
+    {
+        int nRet = CmdWalletStorageCheck();
+        DBFlush(true);
+        return nRet;
+    }
+
     if (arg(argc,argv,"/newphrase") || arg(argc,argv,"-newphrase"))
     {
         int nRet = CmdNewPhrase();
diff --git a/src/selftest.cpp b/src/selftest.cpp
index 73c2935..5e5bab6 100644
--- a/src/selftest.cpp
+++ b/src/selftest.cpp
@@ -1329,6 +1329,19 @@ static int RunWalletPortabilitySelfTest()
                        FileContainsText(strOriginalStorageAudit, "malformed records:         0"),
                        "the storage audit recognizes a plaintext phrase wallet") ? 0 : 1;
 
+        string strOriginalStorageCheck = tmp + "/original-storage-check.txt";
+        vector<string> vOriginalStorageCheckArgs;
+        vOriginalStorageCheckArgs.push_back("-datadir=" + strOriginal);
+        vOriginalStorageCheckArgs.push_back("-nomanagedtor");
+        vOriginalStorageCheckArgs.push_back("-nogui");
+        vOriginalStorageCheckArgs.push_back("-walletstoragecheck");
+        int nOriginalStorageCheckRet =
+            RunBitflashChild(strExe, vOriginalStorageCheckArgs, NULL, &strOriginalStorageCheck);
+        nFail += Check(nOriginalStorageCheckRet == 0 &&
+                       FileContainsText(strOriginalStorageCheck, "storage sanity:            ok") &&
+                       FileContainsText(strOriginalStorageCheck, "plain HD seed:             complete"),
+                       "the storage sanity check accepts a plaintext phrase wallet") ? 0 : 1;
+
         string strOriginalStorageAuditJson = tmp + "/original-storage-audit.json";
         vector<string> vOriginalStorageAuditJsonArgs;
         vOriginalStorageAuditJsonArgs.push_back("-datadir=" + strOriginal);
@@ -1419,6 +1432,20 @@ static int RunWalletPortabilitySelfTest()
                        FileContainsText(strEncryptedStorageAudit, "malformed records:         0"),
                        "the storage audit recognizes an encrypted wallet") ? 0 : 1;
 
+        string strEncryptedStorageCheck = tmp + "/encrypted-storage-check.txt";
+        vector<string> vEncryptedStorageCheckArgs;
+        vEncryptedStorageCheckArgs.push_back("-datadir=" + strOriginal);
+        vEncryptedStorageCheckArgs.push_back("-nomanagedtor");
+        vEncryptedStorageCheckArgs.push_back("-nogui");
+        vEncryptedStorageCheckArgs.push_back("-walletstoragecheck");
+        int nEncryptedStorageCheckRet =
+            RunBitflashChild(strExe, vEncryptedStorageCheckArgs, NULL, &strEncryptedStorageCheck);
+        nFail += Check(nEncryptedStorageCheckRet == 0 &&
+                       FileContainsText(strEncryptedStorageCheck, "storage sanity:            ok") &&
+                       FileContainsText(strEncryptedStorageCheck, "plain private keys:        0") &&
+                       FileContainsText(strEncryptedStorageCheck, "encrypted HD seed:         complete"),
+                       "the storage sanity check accepts an encrypted wallet") ? 0 : 1;
+
         string strEncryptedStorageAuditJson = tmp + "/encrypted-storage-audit.json";
         vector<string> vEncryptedStorageAuditJsonArgs;
         vEncryptedStorageAuditJsonArgs.push_back("-datadir=" + strOriginal);
diff --git a/src/walletcmd.cpp b/src/walletcmd.cpp
index 6f8258d..265febe 100644
--- a/src/walletcmd.cpp
+++ b/src/walletcmd.cpp
@@ -13,6 +13,10 @@
 #include "bip32.h"
 #include "walletcmd.h"
 
+#ifndef _WIN32
+#include <dirent.h>
+#endif
+
 #undef printf
 
 // How far ahead to look for used addresses when restoring.
@@ -658,6 +662,139 @@ static bool WriteAuditTextFile(const std::string& strPath,
     return true;
 }
 
+static bool DirectoryHasFileWithPrefixLocal(const std::string& strDir,
+                                            const std::string& strPrefix)
+{
+#ifdef _WIN32
+    std::string pattern = strDir + "/*";
+    WIN32_FIND_DATAA findData;
+    HANDLE hFind = FindFirstFileA(pattern.c_str(), &findData);
+    if (hFind == INVALID_HANDLE_VALUE)
+        return false;
+    bool fFound = false;
+    do
+    {
+        if ((findData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) == 0)
+        {
+            std::string name = findData.cFileName;
+            if (name.compare(0, strPrefix.size(), strPrefix) == 0)
+            {
+                fFound = true;
+                break;
+            }
+        }
+    }
+    while (FindNextFileA(hFind, &findData));
+    FindClose(hFind);
+    return fFound;
+#else
+    DIR* dir = opendir(strDir.c_str());
+    if (!dir)
+        return false;
+    bool fFound = false;
+    struct dirent* ent;
+    while ((ent = readdir(dir)) != NULL)
+    {
+        std::string name = ent->d_name;
+        if (name.compare(0, strPrefix.size(), strPrefix) == 0)
+        {
+            fFound = true;
+            break;
+        }
+    }
+    closedir(dir);
+    return fFound;
+#endif
+}
+
+static void AddWalletStorageFailure(std::vector<std::string>& vFailures,
+                                    const std::string& strFailure)
+{
+    vFailures.push_back(strFailure);
+}
+
+static void BuildWalletStorageSanityFailures(const WalletStorageAuditCounts& counts,
+                                             std::vector<std::string>& vFailures)
+{
+    bool fPlainHD = counts.nPlainHDMaster > 0 || counts.nPlainHDChainCode > 0;
+    bool fCryptedHD = counts.nCryptedHDMaster > 0 || counts.nCryptedHDChainCode > 0;
+    bool fEncryptedRecords = counts.nEncryptedKeys > 0 ||
+                             counts.nMasterKeys > 0 ||
+                             fCryptedHD;
+
+    if (counts.nMalformed > 0)
+        AddWalletStorageFailure(vFailures, "wallet.dat contains malformed records");
+    if (counts.nUnknown > 0)
+        AddWalletStorageFailure(vFailures, "wallet.dat contains unknown records");
+    if ((counts.nPlainHDMaster > 0) != (counts.nPlainHDChainCode > 0))
+        AddWalletStorageFailure(vFailures, "plain HD seed is incomplete");
+    if ((counts.nCryptedHDMaster > 0) != (counts.nCryptedHDChainCode > 0))
+        AddWalletStorageFailure(vFailures, "encrypted HD seed is incomplete");
+    if (fPlainHD && fCryptedHD)
+        AddWalletStorageFailure(vFailures, "wallet.dat contains both plain and encrypted HD seed records");
+    if (counts.nDefaultKey > 1)
+        AddWalletStorageFailure(vFailures, "wallet.dat contains more than one default public key record");
+    if (counts.nWalletMinVersion > 1)
+        AddWalletStorageFailure(vFailures, "wallet.dat contains more than one minimum-version record");
+
+    if (fEncryptedRecords)
+    {
+        if (counts.nPlainKeys > 0)
+            AddWalletStorageFailure(vFailures, "encrypted wallet still contains plain private key records");
+        if (fPlainHD)
+            AddWalletStorageFailure(vFailures, "encrypted wallet still contains plain HD seed records");
+        if (counts.nMasterKeys == 0)
+            AddWalletStorageFailure(vFailures, "encrypted wallet has no encryption master key record");
+        if (counts.nWalletMinVersion == 0)
+            AddWalletStorageFailure(vFailures, "encrypted wallet has no minimum-version record");
+        if (DirectoryHasFileWithPrefixLocal(GetAppDir() + "/database", "log."))
+            AddWalletStorageFailure(vFailures, "Berkeley DB log files are still present for an encrypted wallet");
+    }
+}
+
+int CmdWalletStorageCheck()
+{
+    AttachTerminal();
+
+    WalletStorageAuditCounts counts;
+    std::string strError;
+    if (!ReadWalletStorageCounts(counts, strError))
+    {
+        fprintf(stderr, "Cannot check wallet storage: %s\n", strError.c_str());
+        return 1;
+    }
+
+    std::vector<std::string> vFailures;
+    BuildWalletStorageSanityFailures(counts, vFailures);
+
+    printf("Wallet storage sanity check\n");
+    printf("  records total:             %u\n", counts.nTotal);
+    printf("  encrypted records:         %s\n",
+           (counts.nEncryptedKeys || counts.nMasterKeys ||
+            counts.nCryptedHDMaster || counts.nCryptedHDChainCode) ? "yes" : "no");
+    printf("  plain private keys:        %u\n", counts.nPlainKeys);
+    printf("  encrypted private keys:    %u\n", counts.nEncryptedKeys);
+    printf("  plain HD seed:             %s\n",
+           HDSeedStorageState(counts.nPlainHDMaster,
+                              counts.nPlainHDChainCode).c_str());
+    printf("  encrypted HD seed:         %s\n",
+           HDSeedStorageState(counts.nCryptedHDMaster,
+                              counts.nCryptedHDChainCode).c_str());
+    if (vFailures.empty())
+    {
+        printf("  storage sanity:            ok\n");
+        fflush(stdout);
+        return 0;
+    }
+
+    printf("  storage sanity:            failed\n");
+    for (std::vector<std::string>::const_iterator it = vFailures.begin();
+         it != vFailures.end(); ++it)
+        printf("  failure:                   %s\n", it->c_str());
+    fflush(stdout);
+    return 2;
+}
+
 int CmdWalletStorageAudit(const std::string& strJsonOut)
 {
     AttachTerminal();
diff --git a/src/walletcmd.h b/src/walletcmd.h
index c6342a6..6077669 100644
--- a/src/walletcmd.h
+++ b/src/walletcmd.h
@@ -66,6 +66,10 @@ int CmdRecoveryAudit();
 // addresses, transaction ids, labels, or other wallet values.
 int CmdWalletStorageAudit(const std::string& strJsonOut = "");
 
+// Diagnostic: fail closed when wallet.dat contains an internally inconsistent
+// or migration-unsafe mix of storage records.
+int CmdWalletStorageCheck();
+
 // Rewrite wallet.dat so private keys and the HD seed are encrypted with the
 // given passphrase. Returns 0 on success and exits without starting the node.
 int CmdEncryptWallet(const std::string& strPassphrase);