| 740 | unsigned dev_onion_reply_length = 256; |
| 741 | |
| 742 | struct onionreply *create_onionreply(const tal_t *ctx, |
| 743 | const struct secret *shared_secret, |
| 744 | const u8 *failure_msg) |
| 745 | { |
| 746 | size_t msglen = tal_count(failure_msg); |
| 747 | size_t padlen; |
| 748 | struct onionreply *reply = tal(ctx, struct onionreply); |
| 749 | u8 *payload = tal_arr(ctx, u8, 0); |
| 750 | struct secret key; |
| 751 | struct hmac hmac; |
| 752 | |
| 753 | /* BOLT #4: |
| 754 | * The _erring node_: |
| 755 | * - MUST set `pad` such that the `failure_len` plus `pad_len` |
| 756 | * is at least 256. |
| 757 | * - SHOULD set `pad` such that the `failure_len` plus `pad_len` is equal |
| 758 | * to 256. Deviating from this may cause older nodes to be unable to parse |
| 759 | * the return message. |
| 760 | */ |
| 761 | const u16 onion_reply_size = dev_onion_reply_length; |
| 762 | |
| 763 | /* We never do this currently, but could in future! */ |
| 764 | if (msglen > onion_reply_size) |
| 765 | padlen = 0; |
| 766 | else |
| 767 | padlen = onion_reply_size - msglen; |
| 768 | |
| 769 | /* BOLT #4: |
| 770 | * |
| 771 | * The node generating the error message builds a _return |
| 772 | * packet_ consisting of the following fields: |
| 773 | * |
| 774 | * 1. data: |
| 775 | * * [`32*byte`:`hmac`] |
| 776 | * * [`u16`:`failure_len`] |
| 777 | * * [`failure_len*byte`:`failuremsg`] |
| 778 | * * [`u16`:`pad_len`] |
| 779 | * * [`pad_len*byte`:`pad`] |
| 780 | */ |
| 781 | towire_u16(&payload, msglen); |
| 782 | towire(&payload, failure_msg, msglen); |
| 783 | towire_u16(&payload, padlen); |
| 784 | towire_pad(&payload, padlen); |
| 785 | |
| 786 | /* Two bytes for each length: failure_len and pad_len */ |
| 787 | assert(tal_count(payload) == onion_reply_size + 4); |
| 788 | |
| 789 | /* BOLT #4: |
| 790 | * |
| 791 | * Where `hmac` is an HMAC authenticating the remainder of the packet, |
| 792 | * with a key generated using the above process, with key type `um` |
| 793 | */ |
| 794 | subkey_from_hmac("um", shared_secret, &key); |
| 795 | |
| 796 | compute_hmac(&key, payload, tal_count(payload), NULL, 0, &hmac); |
| 797 | reply->contents = tal_arr(reply, u8, 0), |
| 798 | towire_hmac(&reply->contents, &hmac); |
| 799 | |