Function process_onionpacket

common/sphinx.c:646–738

* Given an onionpacket msg extract the information for the current * node and unwrap the remainder so that the node can forward it. */

 * node and unwrap the remainder so that the node can forward it.
 */
struct route_step *process_onionpacket(
	const tal_t *ctx,
	const struct onionpacket *msg,
	const struct secret *shared_secret,
	const u8 *assocdata,
	const size_t assocdatalen
	)
{
	struct route_step *step = talz(ctx, struct route_step);
	struct hmac hmac;
	struct secret mu, rho;
	u8 blind[BLINDING_FACTOR_SIZE];
	u8 *paddedheader;
	size_t payload_size;
	bigsize_t shift_size;
	const u8 *cursor;
	size_t max;

	step->next = talz(step, struct onionpacket);
	step->next->version = msg->version;

	/* BOLT #4:
	 *   - Derive `mu` as $`HMAC256(\text{"mu"}, ss)`$
	 *     (see [Key Generation](#key-generation)).
	 *   - Derive the HMAC as $`HMAC256(mu, hop\_payloads || associated\_data)`$.
	 */
	subkey_from_hmac("mu", shared_secret, &mu);
	compute_packet_hmac(msg, assocdata, assocdatalen, &mu, &hmac);

	if (!hmac_eq(&msg->hmac, &hmac) || dev_fail_process_onionpacket) {
		/* Computed MAC does not match expected MAC, the message was modified. */
		return tal_free(step);
	}

	/* BOLT #4:
	 * - Derive `rho` as $`HMAC256(\text{"rho"}, ss)`$
	 *   (see [Key Generation](#key-generation)).
	 * - Derive `bytestream` of twice the length of `hop_payloads` using `rho`
	 *   (see [Pseudo Random Byte Stream](pseudo-random-byte-stream)).
	 * - Set `unwrapped_payloads` to the XOR of `hop_payloads` and `bytestream`.
	 */
	subkey_from_hmac("rho", shared_secret, &rho);

	//FIXME:store seen secrets to avoid replay attacks
	paddedheader = tal_arrz(step, u8, tal_bytelen(msg->routinginfo)*2);
	memcpy(paddedheader, msg->routinginfo, tal_bytelen(msg->routinginfo));
	xor_cipher_stream(paddedheader, &rho, tal_bytelen(paddedheader));

	compute_blinding_factor(&msg->ephemeralkey, shared_secret, blind);
	if (!blind_group_element(&step->next->ephemeralkey, &msg->ephemeralkey, blind))
		return tal_free(step);

	/* Now, try to pull data out. */
	cursor = paddedheader;
	max = tal_bytelen(msg->routinginfo);

	/* Any of these could fail, falling thru with cursor == NULL */
	payload_size = fromwire_bigsize(&cursor, &max);