channel control: don't allow peer to cancel channel

restrict fundchannel_cancel usage to only the opener side

Changelog-Changed: Only the opener of a fundchannel can cancel the channel open with fundchannel_cancel

lightningd/channel_control.c

@@ -726,6 +726,11 @@ struct command_result *cancel_channel_before_broadcast(struct command *cmd,
 					    buffer + cidtok->start);
 	}
 
+	if (cancel_channel->funder == REMOTE)
+		return command_fail(cmd, LIGHTNINGD,
+				    "Cannot cancel channel that was "
+				    "initiated by peer");
+
 	/* Check if we broadcast the transaction. (We store the transaction type into DB
 	 * before broadcast). */
 	enum wallet_tx_type type;

tests/test_connection.py

@@ -1030,7 +1030,12 @@ def test_funding_external_wallet_corners(node_factory, bitcoind):
 
     # Be sure fundchannel_complete is successful
     assert l1.rpc.fundchannel_complete(l2.info['id'], prep['txid'], txout)['commitments_secured']
-    # Canceld channel after fundchannel_complete
+
+    # Peer shouldn't be able to cancel channel
+    with pytest.raises(RpcError, match=r'Cannot cancel channel that was initiated by peer'):
+        l2.rpc.fundchannel_cancel(l1.info['id'])
+
+    # We can cancel channel after fundchannel_complete
     assert l1.rpc.fundchannel_cancel(l2.info['id'])['cancelled']
 
     # l2 won't give up, since it considers error "soft".