rfq: add price oracle certificate verification

[jtobin]

Adds certificate verification for TLS communication with price oracles, mostly following the suggestions proposed in #1278. Adds configuration options for skipping certificate verification, distrusting the operating system's root CA list, and using a custom certificate.

Resolves #1278.

[coveralls]

Pull Request Test Coverage Report for Build 20063273326

Details

• 78 of 90 (86.67%) changed or added relevant lines in 5 files are covered.
• 66 unchanged lines in 17 files lost coverage.
• Overall coverage increased (+0.01%) to 56.773%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
rfq/tls.go	26	28	92.86%
tapcfg/server.go	3	6	50.0%
tapcfg/config.go	26	33	78.79%

Files with Coverage Reduction	New Missed Lines	%
commitment/tap.go	1	85.65%
fn/context_guard.go	1	91.94%
asset/group_key.go	2	72.15%
tapdb/addrs.go	2	76.56%
tapdb/universe.go	2	81.27%
tapgarden/custodian.go	2	76.83%
universe_rpc_diff.go	2	76.0%
universe/syncer.go	2	85.93%
proof/verifier.go	3	85.57%
tapgarden/planter.go	3	80.26%

Totals
Change from base Build 20053123061:	0.01%
Covered Lines:	65407
Relevant Lines:	115207

---

💛 - Coveralls

[jtobin]

(Changed this from draft; I think the litd tests are failing for an unrelated reason.)

[jtobin]

(As pointed out by @ZZiigguurraatt, to be more precise: TLS support already existed for price oracles, but certificate verification was skipped entirely.)

[ffranr]

There are other cases where we need more precise control over TLS behavior. For example:

taproot-assets/proof/courier.go

Lines 309 to 320 in a17a67a

	// serverDialOpts returns the set of server options needed to connect to the
	// server using a TLS connection.
	func serverDialOpts() ([]grpc.DialOption, error) {
	var opts []grpc.DialOption
	// Skip TLS certificate verification.
	tlsConfig := tls.Config{InsecureSkipVerify: true}
	transportCredentials := credentials.NewTLS(&tlsConfig)
	opts = append(opts, grpc.WithTransportCredentials(transportCredentials))
	return opts, nil
	}

With that in mind, I wonder if we could define a more general, reusable solution in something like the new rfq/tls.go file, especially given the need for configuration and the importance of which package owns this logic.

[ffranr]

I'm not sure I see the purpose of invalidCertificate here. It doesn't look like the test actually exercises its invalidity.

More broadly, do we need certificate examples in our unit tests at all? It seems like we're testing the behavior of the underlying TLS/certificate library rather than the logic we're adding on top of it.

[jtobin]

I don't think these tests are super important, but they perform a decent sanity check of the configureTransportCredentials function -- basically, that it uses the supplied config to interact with the underlying libraries in the way that I expect. The tests are cheap, so why not, sort of.

I debated deleting the invalid certificate case, but wound up deciding to return an error in configureTransportCredentials when no valid custom certificates could be found anyway, so now the invalid certificate case exercises the invalidity of the certificate. 😄

[jtobin]

With that in mind, I wonder if we could define a more general, reusable solution in something like the new rfq/tls.go file, especially given the need for configuration and the importance of which package owns this logic.

I looked into this and agree that it's probably worth centralizing our TLS handling, but I'd consider it out of scope for this change set, which does resolve a concrete issue as-is. Maybe we can open a broader "refactor TLS handling" issue for that?

I get the following hits for "crypto/tls" imports, as a rough metric:

$ ack -l "crypto/tls" --ignore-dir=itest --ignore-dir=docs
cmd/commands/conn.go
proof/courier.go
internal/test/grpc.go
universe_rpc_registrar.go
tapcfg/config.go
rfq/tls.go
authmailbox/client.go
universe/proof_download_test.go

[jtobin]

The LiT itest failure should be resolved by lightninglabs/lightning-terminal#1190.

[lightninglabs-deploy]

@ffranr: review reminder