* Given an onionpacket msg extract the information for the current * node and unwrap the remainder so that the node can forward it. */
| 600 | * node and unwrap the remainder so that the node can forward it. |
| 601 | */ |
| 602 | struct route_step *process_onionpacket( |
| 603 | const tal_t *ctx, |
| 604 | const struct onionpacket *msg, |
| 605 | const struct secret *shared_secret, |
| 606 | const u8 *assocdata, |
| 607 | const size_t assocdatalen, |
| 608 | bool has_realm |
| 609 | ) |
| 610 | { |
| 611 | struct route_step *step = talz(ctx, struct route_step); |
| 612 | struct hmac hmac; |
| 613 | struct keyset keys; |
| 614 | u8 blind[BLINDING_FACTOR_SIZE]; |
| 615 | u8 *paddedheader; |
| 616 | size_t payload_size; |
| 617 | bigsize_t shift_size; |
| 618 | const u8 *cursor; |
| 619 | size_t max; |
| 620 | |
| 621 | step->next = talz(step, struct onionpacket); |
| 622 | step->next->version = msg->version; |
| 623 | generate_key_set(shared_secret, &keys); |
| 624 | |
| 625 | compute_packet_hmac(msg, assocdata, assocdatalen, &keys.mu, &hmac); |
| 626 | |
| 627 | if (!hmac_eq(&msg->hmac, &hmac) |
| 628 | || IFDEV(dev_fail_process_onionpacket, false)) { |
| 629 | /* Computed MAC does not match expected MAC, the message was modified. */ |
| 630 | return tal_free(step); |
| 631 | } |
| 632 | |
| 633 | //FIXME:store seen secrets to avoid replay attacks |
| 634 | paddedheader = tal_arrz(step, u8, tal_bytelen(msg->routinginfo)*2); |
| 635 | memcpy(paddedheader, msg->routinginfo, tal_bytelen(msg->routinginfo)); |
| 636 | xor_cipher_stream(paddedheader, &keys.rho, tal_bytelen(paddedheader)); |
| 637 | |
| 638 | compute_blinding_factor(&msg->ephemeralkey, shared_secret, blind); |
| 639 | if (!blind_group_element(&step->next->ephemeralkey, &msg->ephemeralkey, blind)) |
| 640 | return tal_free(step); |
| 641 | |
| 642 | /* Now, try to pull data out. */ |
| 643 | cursor = paddedheader; |
| 644 | max = tal_bytelen(msg->routinginfo); |
| 645 | |
| 646 | /* Any of these could fail, falling thru with cursor == NULL */ |
| 647 | payload_size = fromwire_bigsize(&cursor, &max); |
| 648 | /* FIXME: raw_payload *includes* the length, which is redundant and |
| 649 | * means we can't just ust fromwire_tal_arrn. */ |
| 650 | fromwire_pad(&cursor, &max, payload_size); |
| 651 | if (cursor != NULL) |
| 652 | step->raw_payload = tal_dup_arr(step, u8, paddedheader, |
| 653 | cursor - paddedheader, 0); |
| 654 | fromwire_hmac(&cursor, &max, &step->next->hmac); |
| 655 | |
| 656 | /* BOLT-remove-legacy-onion #4: |
| 657 | * Since no `payload` TLV value can ever be shorter than 2 bytes, `length` values of 0 and 1 are |
| 658 | * reserved. (`0` indicated a legacy format no longer supported, and `1` is reserved for future |
| 659 | * use). */ |