dualopend: fix next_funding reconnect: error if both set it, tx_abort if only peer

Per BOLT #2: when both nodes set next_funding in channel_reestablish but txids differ,
MUST send error and fail the channel; when only the peer sets next_funding, MUST send
tx_abort instead. Track we_set_next_funding before tlvs is overwritten by the received
channel_reestablish so the distinction survives the receive.
Includes a regression test: reconnect two nodes with a corrupted inflight txid so both
set next_funding with mismatched values, and verify both sides call open_err_fatal.

Changelog-None

Author: nGoline

openingd/dualopend.c

@@ -3976,7 +3976,9 @@ static void do_reconnect_dance(struct state *state)
 	 *   - MUST set `next_funding_txid` to the txid of that interactive transaction.
 	 */
 	tlvs = tlv_channel_reestablish_tlvs_new(tmpctx);
-	if (!tx_state->remote_funding_sigs_rcvd) {
+	/* Track whether we set next_funding before tlvs is overwritten by received msg */
+	bool we_set_next_funding = !tx_state->remote_funding_sigs_rcvd;
+	if (we_set_next_funding) {
 		tlvs->next_funding = talz(tlvs, struct tlv_channel_reestablish_tlvs_next_funding);
 		tlvs->next_funding->next_funding_txid = tx_state->funding.txid;
 		tlvs->next_funding->retransmit_flags = 1; /* COMMITMENT_SIGNED */
@@ -4082,15 +4084,21 @@ static void do_reconnect_dance(struct state *state)
 				status_debug("Unable to send our sigs, our psbt isn't signed");
 			} else
 				status_debug("No commitment, not sending our sigs (reconnected)");
+		} else if (we_set_next_funding) {
+			/* BOLT #2: if it also sets `next_funding` in its own
+			 * `channel_reestablish`, but the values don't match:
+			 * - MUST send an `error` and fail the channel. */
+			open_err_fatal(state, "next_funding_txid %s doesn't match ours %s",
+				       fmt_bitcoin_txid(tmpctx,
+							&tlvs->next_funding->next_funding_txid),
+				       fmt_bitcoin_txid(tmpctx,
+							&tx_state->funding.txid));
 		} else {
-			peer_billboard(true, "Non-matching next_funding on reconnect. Aborting.");
 			open_abort(state, "Sent next_funding_txid %s doesn't match ours %s",
-
 				   fmt_bitcoin_txid(tmpctx,
 						    &tlvs->next_funding->next_funding_txid),
 				   fmt_bitcoin_txid(tmpctx,
 						    &tx_state->funding.txid));
-			return;
 		}
 	}
 

tests/test_opening.py

@@ -7,8 +7,10 @@
 from pyln.testing.utils import FUNDAMOUNT
 
 from pathlib import Path
+import os
 import pytest
 import re
+import threading
 import unittest
 import time
 
@@ -172,6 +174,59 @@ def test_v2_open_sigs_reconnect_2(node_factory, bitcoind):
     l2.daemon.wait_for_log(r'to CHANNELD_NORMAL')
 
 
+@unittest.skipIf(TEST_NETWORK != 'regtest', 'elementsd doesnt yet support PSBT features we need')
+@unittest.skipIf(os.getenv('TEST_DB_PROVIDER', 'sqlite3') != 'sqlite3', "sqlite3-specific DB manipulation")
+@pytest.mark.openchannel('v2')
+def test_v2_open_reconnect_next_funding_mismatch(node_factory, bitcoind):
+    """Both nodes set next_funding on reconnect but disagree on txid: error sent, channel fails."""
+    # l2 always sends tx_signatures first.  Disconnecting l2 just before it
+    # sends tx_signatures means neither node ever receives remote tx_sigs, so
+    # both end up in DUALOPEND_OPEN_COMMITTED with remote_funding_sigs_rcvd=False
+    # and will set next_funding in channel_reestablish.
+    broken = r'dualopend daemon died before signed PSBT returned|Owning subdaemon dualopend died'
+    l1, l2 = node_factory.get_nodes(2, opts=[
+        {'may_reconnect': True, 'dev-no-reconnect': None, 'broken_log': broken},
+        {'disconnect': ['-WIRE_TX_SIGNATURES'], 'may_reconnect': True,
+         'dev-no-reconnect': None, 'broken_log': broken}
+    ])
+
+    l1.rpc.connect(l2.info['id'], 'localhost', l2.port)
+    amount = 2**24
+    bitcoind.rpc.sendtoaddress(l1.rpc.newaddr()['p2tr'], amount / 10**8 + 0.01)
+    bitcoind.generate_block(1)
+    wait_for(lambda: len(l1.rpc.listfunds()['outputs']) > 0)
+
+    # -WIRE_TX_SIGNATURES causes fundchannel to block (it waits for reconnect
+    # that will never come due to dev-no-reconnect); run it in a daemon thread
+    # so the test can proceed.  l2.stop() below unblocks it via peer death.
+    def _fund():
+        try:
+            l1.rpc.fundchannel(l2.info['id'], 100000)
+        except Exception:
+            pass
+
+    threading.Thread(target=_fund, daemon=True).start()
+
+    # Both have exchanged commitment_signed (inflight in DB) but no tx_sigs yet.
+    # Use any() because the channel record may not exist yet when the thread starts.
+    wait_for(lambda: any(c['state'] == 'DUALOPEND_OPEN_COMMITTED'
+                         for c in l1.rpc.listpeerchannels()['channels']))
+    wait_for(lambda: any(c['state'] == 'DUALOPEND_OPEN_COMMITTED'
+                         for c in l2.rpc.listpeerchannels()['channels']))
+
+    # Corrupt l2's stored funding txid so it disagrees with l1's on reconnect.
+    l2.stop()
+    l2.db_manip("UPDATE channel_funding_inflights SET funding_tx_id = X'{}'".format('01' * 32))
+    l2.start()
+
+    # Reconnect: both will set next_funding in channel_reestablish but with
+    # different txids, triggering open_err_fatal on each side per BOLT #2.
+    l1.rpc.connect(l2.info['id'], 'localhost', l2.port)
+
+    l1.daemon.wait_for_log(r"next_funding_txid .* doesn't match ours")
+    l2.daemon.wait_for_log(r"next_funding_txid .* doesn't match ours")
+
+
 @unittest.skipIf(TEST_NETWORK != 'regtest', 'elementsd doesnt yet support PSBT features we need')
 @pytest.mark.openchannel('v2')
 def test_v2_open_sigs_reconnect_1(node_factory, bitcoind):