watchtower: prevent removal of last tower addr

This addresses a potential panic when a tower has one of its candidate
sessions chosen, but its only reachable address was removed by a
user-initiated RPC before the fact.

watchtower/wtclient/candidate_iterator.go

@@ -19,7 +19,7 @@ type TowerCandidateIterator interface {
 	// iterator. An optional address can be provided to indicate a stale
 	// tower address to remove it. If it isn't provided, then the tower is
 	// completely removed from the iterator.
-	RemoveCandidate(wtdb.TowerID, net.Addr)
+	RemoveCandidate(wtdb.TowerID, net.Addr) error
 
 	// IsActive determines whether a given tower is exists within the
 	// iterator.
@@ -131,19 +131,26 @@ func (t *towerListIterator) AddCandidate(candidate *wtdb.Tower) {
 // optional address can be provided to indicate a stale tower address to remove
 // it. If it isn't provided, then the tower is completely removed from the
 // iterator.
-func (t *towerListIterator) RemoveCandidate(candidate wtdb.TowerID, addr net.Addr) {
+func (t *towerListIterator) RemoveCandidate(candidate wtdb.TowerID,
+	addr net.Addr) error {
+
 	t.mu.Lock()
 	defer t.mu.Unlock()
 
 	tower, ok := t.candidates[candidate]
 	if !ok {
-		return
+		return nil
 	}
 	if addr != nil {
 		tower.RemoveAddress(addr)
+		if len(tower.Addresses) == 0 {
+			return wtdb.ErrLastTowerAddr
+		}
 	} else {
 		delete(t.candidates, candidate)
 	}
+
+	return nil
 }
 
 // IsActive determines whether a given tower is exists within the iterator.

watchtower/wtclient/client.go

@@ -1124,7 +1124,10 @@ func (c *TowerClient) handleStaleTower(msg *staleTowerMsg) error {
 	if err := c.cfg.DB.RemoveTower(msg.pubKey, msg.addr); err != nil {
 		return err
 	}
-	c.candidateTowers.RemoveCandidate(tower.ID, msg.addr)
+	err = c.candidateTowers.RemoveCandidate(tower.ID, msg.addr)
+	if err != nil {
+		return err
+	}
 
 	// If an address was provided, then we're only meant to remove the
 	// address from the tower, so there's nothing left for us to do.