Function bolt11_decode

common/bolt11.c:980–1062

Decodes and checks signature; returns NULL on error. */

/* Decodes and checks signature; returns NULL on error. */
struct bolt11 *bolt11_decode(const tal_t *ctx, const char *str,
			     const struct feature_set *our_features,
			     const char *description,
			     const struct chainparams *must_be_chain,
			     const char **fail)
{
	const u5 *sigdata;
	size_t data_len;
	u8 sig_and_recid[65];
	secp256k1_ecdsa_recoverable_signature sig;
	struct bolt11 *b11;
	struct sha256 hash;
	bool have_n;
	const char *err;

	b11 = bolt11_decode_nosig(ctx, str, our_features, description,
				  must_be_chain, &hash, &sigdata, &have_n,
				  fail);
	if (!b11)
		return NULL;

	/* BOLT #11:
	 *
	 * A writer...MUST set `signature` to a valid
	 * compact ECDSA signature over secp256k1 of the SHA-256 hash of:
	 * the human-readable part (as UTF-8 bytes) concatenated with the data part
	 * (excluding the signature), with 0 bits appended to pad to a byte boundary.
	 * The signature is encoded as 64 bytes (R || S), followed by a trailing 1-byte
	 * recovery id in {0,1,2,3}.
	 */
	data_len = tal_count(sigdata);
	err = pull_bits(NULL, &sigdata, &data_len, sig_and_recid, 520, false);
	if (err)
		return decode_fail(b11, fail, "can't read signature: %s",
				   err);

	assert(data_len == 0);

	if (!valid_recovery_id(sig_and_recid[64]))
		return decode_fail(b11, fail, "invalid recovery ID: %u",
				   sig_and_recid[64]);

	if (!secp256k1_ecdsa_recoverable_signature_parse_compact
	    (secp256k1_ctx, &sig, sig_and_recid, sig_and_recid[64]))
		return decode_fail(b11, fail, "signature invalid");

	secp256k1_ecdsa_recoverable_signature_convert(secp256k1_ctx,
						      &b11->sig, &sig);

	/* BOLT #11:
	 *
	 * A reader:
	 *   - MUST check that the `signature` is valid (see the `n` tagged field specified below).
	 */
	/* BOLT #11:
	 *
	 * A reader:
	 * ...