Skip to content

Commit 3884bc3

Browse files
rustyrussellrustyrussell
committed
devtool/blindedpath: primitive tool to make blinded onions.
e.g. $ PUBKEY1=0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518 $ PRIVKEY1=41bfd2660762506c9933ade59f1debf7e6495b10c14a92dbcd2d623da2507d3d $ PUBKEY2=022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59 $ PRIVKEY1=c4a813f81ffdca1da6864db81795ad2d320add274452cafa1fb2ac2d07d062bd # First line is blinding, second is contents and nodeids for onion. $ ./devtools/blindedpath create $PUBKEY1 $PUBKEY2 03f006a18d5653c4edf5391ff23a61f03ff83d237e880ee61187fa9f379a028e0a 0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518/350633c340f28bc69cbc86f568b7b9e99fa41eb581452d066fcd70dd53c43ace14d034eebfbe472a2b9901b11c268d2cc2034a77928a 0326f31ff78e584461420e5026fe72374af2ef853e65c47a3f2406348b7c6c0911/00 # Generate the onion $ /devtools/onion generate 0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518/350633c340f28bc69cbc86f568b7b9e99fa41eb581452d066fcd70dd53c43ace14d034eebfbe472a2b9901b11c268d2cc2034a77928a 0326f31ff78e584461420e5026fe72374af2ef853e65c47a3f2406348b7c6c0911/00 > /tmp/onion.dat # First node unwraps it, gives next blinding and onion $ ./devtools/blindedpath --first-node unwrap $PRIVKEY1 `cat /tmp/onion.dat` 03f006a18d5653c4edf5391ff23a61f03ff83d237e880ee61187fa9f379a028e0a Contents: 04210326f31ff78e584461420e5026fe72374af2ef853e65c47a3f2406348b7c6c0911 Next blinding: 021295ce94fcadc42c3e5187a12dd80122214c8f9da61635163cddb63282f1ee9b Next onion: 0003c8fa9d4997ebd049480db14f0a90db211ec2b9f062e569419ee2c2b528a2d7adc63aa9e7b74997c2c122c4c1923e2f4587fc62532965666dbe55a76aa1ea903cfe6c498c6b7e80c14609d3c0f98f86a30f94b0b8a405067ee3801aab03420922cdc847d6f2fc359655408047a8d7d7892a595f630cdf114d1cc0d1164dc8099378042cfba7a13711dff64000356aac29726a6039bf938b81cc0dcc7f65dc126ae58838c0446d6492b6381f0402a33318a9ae71486bcb4b58f66c9a056fca306668655c11f7d7d0cd447e4162100565369629ca8b705b2b999a40ad5493953cb70b35f382e6acdc04e5a933783f9c5859fb0beeaa9c54e5220f5de3b107813d33148501aebcf67e190d3dcf10553714d4de8a1643b519cd124da9a345e2da0d669954a10fce9c1e7795572fb2ac8fe6de4db856bdbd327f0c4ae3cb11f6e1422f663423ad57891d069bbc5bdc7613c742a2227d3789d9039dcdcbddc2703835002dd176004c56cc497d88deae2328ad1376877f4582c71a7fa1eba4ae4e6696782bd97d7b362f41e81335b47273a74c983c3bc80499069a08c6b7ffa32cc77f54a98d8bc2f80f38c370c98edd8f6d6f95c6bbf5c8040296f68560de3b50c3450de4fcceae41469bea6a24c83141c92956fa4c4087f11e9c26b282e9c3974fadc8f9bb9fb9c3fbd2ead0cf4ceaba452eb8791828a159ace7a2e1e8ff5c69704a821c6c898a3c38439149862f14b7ed34afb93640c3ae61b089011ef698c9e26dc16b8a5a8ec66fce702b7bdf04a21cf9a2ebff6b89b29904e7e3e6a98088c2848951c0d6915249a3e1199c2affe4635ac6ef3a16ddfefc5790435a14067b24d5ecd16a26d2f7dbd8065b8e5b86f73f878cf55ca0c9f12104d861d03ac5c4b3dcbd0e30ad7ba888ddcc2e89acb3c04be2ef4bce3ef8c8878fef5be65664f1ec288f91dbd1748e2e53bcbd7dc9cecd75a246992e76a844ab122c5e179f97531190c7d91586289410c9ddad33eb156ab7312c82e55f3d643f3c12468ce79f7221051da608dd17ceb235b7df89f3c4b9aa9448bf36206b2db7bb97f544d062d6aa1b1706376fb6e3e8ef1ac293b9adca478458e9e51845dc7b554c70a91e32c331962968f98db26faa5b10a39bc778b0aab5a9fd11fdbab7b456db286049e584b7e4d1c76d6c3c6249b567aa357982ceead2ad8d5113a866818997b24018059e93eb5cafd293942efec3cf4a43bf322cd444e8370dc2cf1f1164c5147b30a791e262acadc15c30f1e169af4bff5e6c098acf95534b0b59517e3168413134984d50c8242590c8729fe34190d20d7f88505747b919e0bf8b41ed4ec9146743339c6885dcb770dcac627a1570dc145f6f61a976d87d16473195d5f5ce39347ab040c34fe0888b498f0ba25686a9bae51f6e5973d15f10d1c7dbe5fbfa2c7fe05cdd52d8eca8150914b4cb2e75e52010bb4b9241160d7337f47bbebd3bea58ddcf320a0464c34dbfd3d3ea7ffaee966c36064b2cc77babbf4613a7d5d65b3931dc42f91ed902207c57509a46738d31671c439d052c16db5ce3e613c5b37f77e574e9a847ebab20159130f33186557d16ddd1d765e7a9adedb253b755128e1af58da9e8b0fe6ed5834ddf1537c0ee78cd9803ee06031c3c1331d405a94a54f06d1147b26d0788179320d882f57ee9c63ab7a76fb9572eb813fe55369b5061b0a242b07a72095754a9d5699534a46829398204e76f1eda1d65e98fab1e8f3cf7c85257c8e2da0546fed215c3db38d231a637fd7a4e6f10b786d15534137489c662a0f289da824ca8dfef335bdcc623d636d231e002cc32febbe6683046ee54702dbeb55a70911505844c79c0be4630cf49456fba55aec9218d3ba449540370d407fc653007fdf59b4711d1da3c2e569eec4de8cee7b05d248ad0 # Feed that onion and blinding to second node $ ./devtools/blindedpath unwrap $PRIVKEY2 0003c8fa9d4997ebd049480db14f0a90db211ec2b9f062e569419ee2c2b528a2d7adc63aa9e7b74997c2c122c4c1923e2f4587fc62532965666dbe55a76aa1ea903cfe6c498c6b7e80c14609d3c0f98f86a30f94b0b8a405067ee3801aab03420922cdc847d6f2fc359655408047a8d7d7892a595f630cdf114d1cc0d1164dc8099378042cfba7a13711dff64000356aac29726a6039bf938b81cc0dcc7f65dc126ae58838c0446d6492b6381f0402a33318a9ae71486bcb4b58f66c9a056fca306668655c11f7d7d0cd447e4162100565369629ca8b705b2b999a40ad5493953cb70b35f382e6acdc04e5a933783f9c5859fb0beeaa9c54e5220f5de3b107813d33148501aebcf67e190d3dcf10553714d4de8a1643b519cd124da9a345e2da0d669954a10fce9c1e7795572fb2ac8fe6de4db856bdbd327f0c4ae3cb11f6e1422f663423ad57891d069bbc5bdc7613c742a2227d3789d9039dcdcbddc2703835002dd176004c56cc497d88deae2328ad1376877f4582c71a7fa1eba4ae4e6696782bd97d7b362f41e81335b47273a74c983c3bc80499069a08c6b7ffa32cc77f54a98d8bc2f80f38c370c98edd8f6d6f95c6bbf5c8040296f68560de3b50c3450de4fcceae41469bea6a24c83141c92956fa4c4087f11e9c26b282e9c3974fadc8f9bb9fb9c3fbd2ead0cf4ceaba452eb8791828a159ace7a2e1e8ff5c69704a821c6c898a3c38439149862f14b7ed34afb93640c3ae61b089011ef698c9e26dc16b8a5a8ec66fce702b7bdf04a21cf9a2ebff6b89b29904e7e3e6a98088c2848951c0d6915249a3e1199c2affe4635ac6ef3a16ddfefc5790435a14067b24d5ecd16a26d2f7dbd8065b8e5b86f73f878cf55ca0c9f12104d861d03ac5c4b3dcbd0e30ad7ba888ddcc2e89acb3c04be2ef4bce3ef8c8878fef5be65664f1ec288f91dbd1748e2e53bcbd7dc9cecd75a246992e76a844ab122c5e179f97531190c7d91586289410c9ddad33eb156ab7312c82e55f3d643f3c12468ce79f7221051da608dd17ceb235b7df89f3c4b9aa9448bf36206b2db7bb97f544d062d6aa1b1706376fb6e3e8ef1ac293b9adca478458e9e51845dc7b554c70a91e32c331962968f98db26faa5b10a39bc778b0aab5a9fd11fdbab7b456db286049e584b7e4d1c76d6c3c6249b567aa357982ceead2ad8d5113a866818997b24018059e93eb5cafd293942efec3cf4a43bf322cd444e8370dc2cf1f1164c5147b30a791e262acadc15c30f1e169af4bff5e6c098acf95534b0b59517e3168413134984d50c8242590c8729fe34190d20d7f88505747b919e0bf8b41ed4ec9146743339c6885dcb770dcac627a1570dc145f6f61a976d87d16473195d5f5ce39347ab040c34fe0888b498f0ba25686a9bae51f6e5973d15f10d1c7dbe5fbfa2c7fe05cdd52d8eca8150914b4cb2e75e52010bb4b9241160d7337f47bbebd3bea58ddcf320a0464c34dbfd3d3ea7ffaee966c36064b2cc77babbf4613a7d5d65b3931dc42f91ed902207c57509a46738d31671c439d052c16db5ce3e613c5b37f77e574e9a847ebab20159130f33186557d16ddd1d765e7a9adedb253b755128e1af58da9e8b0fe6ed5834ddf1537c0ee78cd9803ee06031c3c1331d405a94a54f06d1147b26d0788179320d882f57ee9c63ab7a76fb9572eb813fe55369b5061b0a242b07a72095754a9d5699534a46829398204e76f1eda1d65e98fab1e8f3cf7c85257c8e2da0546fed215c3db38d231a637fd7a4e6f10b786d15534137489c662a0f289da824ca8dfef335bdcc623d636d231e002cc32febbe6683046ee54702dbeb55a70911505844c79c0be4630cf49456fba55aec9218d3ba449540370d407fc653007fdf59b4711d1da3c2e569eec4de8cee7b05d248ad0 021295ce94fcadc42c3e5187a12dd80122214c8f9da61635163cddb63282f1ee9b Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
1 parent 79535e2 commit 3884bc3

File tree

2 files changed

+321
-0
lines changed

2 files changed

+321
-0
lines changed

‎devtools/Makefile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
DEVTOOLS_SRC := devtools/gen_print_wire.c devtools/gen_print_onion_wire.c devtools/print_wire.c
22
DEVTOOLS_OBJS := $(DEVTOOLS_SRC:.c=.o)
33
DEVTOOLS := devtools/bolt11-cli devtools/decodemsg devtools/onion devtools/dump-gossipstore devtools/gossipwith devtools/create-gossipstore devtools/mkcommit devtools/mkfunding devtools/mkclose devtools/mkgossip devtools/mkencoded devtools/checkchannels devtools/mkquery devtools/lightning-checkmessage
4+
ifeq ($(EXPERIMENTAL_FEATURES),1)
5+
DEVTOOLS += devtools/blindedpath
6+
endif
7+
48
DEVTOOLS_TOOL_SRC := $(DEVTOOLS:=.c)
59
DEVTOOLS_TOOL_OBJS := $(DEVTOOLS_TOOL_SRC:.c=.o)
610

@@ -66,6 +70,8 @@ devtools/onion.c: ccan/config.h
6670

6771
devtools/onion: $(DEVTOOLS_OBJS) $(DEVTOOLS_COMMON_OBJS) $(JSMN_OBJS) $(CCAN_OBJS) $(BITCOIN_OBJS) wire/fromwire.o wire/towire.o devtools/onion.o common/sphinx.o
6872

73+
devtools/blindedpath: $(DEVTOOLS_OBJS) $(DEVTOOLS_COMMON_OBJS) $(JSMN_OBJS) $(CCAN_OBJS) $(BITCOIN_OBJS) wire/fromwire.o wire/towire.o devtools/blindedpath.o common/sphinx.o
74+
6975
devtools/gossipwith: $(DEVTOOLS_OBJS) $(DEVTOOLS_COMMON_OBJS) $(JSMN_OBJS) $(CCAN_OBJS) $(BITCOIN_OBJS) wire/fromwire.o wire/towire.o wire/gen_peer_wire.o devtools/gossipwith.o common/cryptomsg.o common/cryptomsg.o common/crypto_sync.o
7076

7177
$(DEVTOOLS_OBJS) $(DEVTOOLS_TOOL_OBJS): wire/wire.h devtools/gen_print_wire.h devtools/gen_print_onion_wire.h

‎devtools/blindedpath.c‎

Lines changed: 315 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,315 @@
1+
#include "config.h"
2+
#include <assert.h>
3+
#include <bitcoin/privkey.h>
4+
#include <ccan/err/err.h>
5+
#include <ccan/mem/mem.h>
6+
#include <ccan/opt/opt.h>
7+
#include <ccan/str/hex/hex.h>
8+
#include <ccan/tal/tal.h>
9+
#include <common/hmac.h>
10+
#include <common/sphinx.h>
11+
#include <common/type_to_string.h>
12+
#include <common/utils.h>
13+
#include <common/version.h>
14+
#include <secp256k1.h>
15+
#include <secp256k1_ecdh.h>
16+
#include <sodium/crypto_auth_hmacsha256.h>
17+
#include <sodium/crypto_aead_chacha20poly1305.h>
18+
#include <stdio.h>
19+
#include <string.h>
20+
#include <unistd.h>
21+
22+
/* Tal wrappers for opt. */
23+
static void *opt_allocfn(size_t size)
24+
{
25+
return tal_arr_label(NULL, char, size, TAL_LABEL("opt_allocfn", ""));
26+
}
27+
28+
static void *tal_reallocfn(void *ptr, size_t size)
29+
{
30+
if (!ptr)
31+
return opt_allocfn(size);
32+
tal_resize_(&ptr, 1, size, false);
33+
return ptr;
34+
}
35+
36+
static void tal_freefn(void *ptr)
37+
{
38+
tal_free(ptr);
39+
}
40+
41+
/* E(i-1) = H(E(i) || ss(i)) * E(i) */
42+
static struct sha256 hash_e_and_ss(const struct pubkey *e,
43+
const struct secret *ss)
44+
{
45+
u8 der[PUBKEY_CMPR_LEN];
46+
struct sha256_ctx shactx;
47+
struct sha256 h;
48+
49+
pubkey_to_der(der, e);
50+
sha256_init(&shactx);
51+
sha256_update(&shactx, der, sizeof(der));
52+
sha256_update(&shactx, ss->data, sizeof(ss->data));
53+
sha256_done(&shactx, &h);
54+
55+
return h;
56+
}
57+
58+
/* E(i-1) = H(E(i) || ss(i)) * E(i) */
59+
static struct pubkey next_pubkey(const struct pubkey *pk,
60+
const struct sha256 *h)
61+
{
62+
struct pubkey ret;
63+
64+
ret = *pk;
65+
if (secp256k1_ec_pubkey_tweak_mul(secp256k1_ctx, &ret.pubkey, h->u.u8)
66+
!= 1)
67+
abort();
68+
69+
return ret;
70+
}
71+
72+
/* e(i+1) = H(E(i) || ss(i)) * e(i) */
73+
static struct privkey next_privkey(const struct privkey *e,
74+
const struct sha256 *h)
75+
{
76+
struct privkey ret;
77+
78+
ret = *e;
79+
if (secp256k1_ec_privkey_tweak_mul(secp256k1_ctx, ret.secret.data,
80+
h->u.u8) != 1)
81+
abort();
82+
83+
return ret;
84+
}
85+
86+
int main(int argc, char **argv)
87+
{
88+
bool first = false;
89+
90+
setup_locale();
91+
92+
secp256k1_ctx = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY |
93+
SECP256K1_CONTEXT_SIGN);
94+
95+
opt_set_alloc(opt_allocfn, tal_reallocfn, tal_freefn);
96+
opt_register_noarg("--help|-h", opt_usage_and_exit,
97+
"\n\n\tcreate <nodeid>[/<scid>]...\n"
98+
"\tunwrap <privkey> <onion> <blinding>\n",
99+
"Show this message");
100+
opt_register_noarg("--first-node", opt_set_bool, &first,
101+
"Don't try to tweak key to unwrap onion");
102+
opt_register_version();
103+
104+
opt_parse(&argc, argv, opt_log_stderr_exit);
105+
setup_tmpctx();
106+
107+
if (argc < 2)
108+
errx(1, "You must specify create or unwrap");
109+
if (streq(argv[1], "create")) {
110+
struct privkey e;
111+
struct pubkey *pk_e, *b, *nodes;
112+
struct secret *rho;
113+
size_t num = argc - 2;
114+
115+
if (argc < 3)
116+
errx(1, "create requires at least one nodeid");
117+
118+
/* P(i) */
119+
nodes = tal_arr(tmpctx, struct pubkey, num);
120+
/* E(i) */
121+
pk_e = tal_arr(tmpctx, struct pubkey, num);
122+
/* B(i) */
123+
b = tal_arr(tmpctx, struct pubkey, num);
124+
/* rho(i) */
125+
rho = tal_arr(tmpctx, struct secret, num);
126+
127+
/* Randomness, chosen with a fair dice roll! */
128+
memset(&e, 6, sizeof(e));
129+
if (!pubkey_from_privkey(&e, &pk_e[0]))
130+
abort();
131+
132+
for (size_t i = 0; i < num; i++) {
133+
struct secret ss;
134+
struct secret hmac;
135+
struct sha256 h;
136+
137+
if (!pubkey_from_hexstr(argv[2+i],
138+
strcspn(argv[2+i], "/"),
139+
&nodes[i]))
140+
errx(1, "%s not a valid pubkey", argv[2+i]);
141+
142+
if (secp256k1_ecdh(secp256k1_ctx, ss.data,
143+
&nodes[i].pubkey, e.secret.data, NULL, NULL) != 1)
144+
abort();
145+
146+
subkey_from_hmac("blinded_node_id", &ss, &hmac);
147+
b[i] = nodes[i];
148+
if (i != 0) {
149+
if (secp256k1_ec_pubkey_tweak_mul(secp256k1_ctx,
150+
&b[i].pubkey, hmac.data) != 1)
151+
abort();
152+
}
153+
subkey_from_hmac("rho", &ss, &rho[i]);
154+
h = hash_e_and_ss(&pk_e[i], &ss);
155+
if (i != num-1)
156+
pk_e[i+1] = next_pubkey(&pk_e[i], &h);
157+
e = next_privkey(&e, &h);
158+
}
159+
160+
/* Print initial blinding factor */
161+
printf("Blinding: %s\n",
162+
type_to_string(tmpctx, struct pubkey, &pk_e[0]));
163+
164+
for (size_t i = 0; i < num - 1; i++) {
165+
u8 *p;
166+
u8 buf[BIGSIZE_MAX_LEN];
167+
const unsigned char npub[crypto_aead_chacha20poly1305_ietf_NPUBBYTES] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
168+
struct tlv_onionmsg_payload *inner, *outer;
169+
int ret;
170+
171+
/* Inner is encrypted */
172+
inner = tlv_onionmsg_payload_new(tmpctx);
173+
/* FIXME: Use /scid for encblob if specified */
174+
inner->next_node_id = tal(inner, struct tlv_onionmsg_payload_next_node_id);
175+
inner->next_node_id->node_id = nodes[i+1];
176+
p = tal_arr(tmpctx, u8, 0);
177+
towire_encmsg_tlvs(&p, inner);
178+
179+
outer = tlv_onionmsg_payload_new(tmpctx);
180+
outer->enctlv = tal(outer, struct tlv_onionmsg_payload_enctlv);
181+
outer->enctlv->enctlv = tal_arr(tmpctx, u8, tal_count(p)
182+
+ crypto_aead_chacha20poly1305_ietf_ABYTES);
183+
ret = crypto_aead_chacha20poly1305_ietf_encrypt(outer->enctlv->enctlv, NULL,
184+
p,
185+
tal_bytelen(p),
186+
NULL, 0,
187+
NULL, npub,
188+
rho[i].data);
189+
assert(ret == 0);
190+
191+
p = tal_arr(tmpctx, u8, 0);
192+
towire_onionmsg_payload(&p, outer);
193+
ret = bigsize_put(buf, tal_bytelen(p));
194+
195+
/* devtools/onion wants length explicitly prepended */
196+
printf("%s/%.*s%s ",
197+
type_to_string(tmpctx, struct pubkey, &b[i]),
198+
ret * 2,
199+
tal_hexstr(tmpctx, buf, ret),
200+
tal_hex(tmpctx, p));
201+
}
202+
/* No payload for last node */
203+
printf("%s/00\n",
204+
type_to_string(tmpctx, struct pubkey, &b[num-1]));
205+
} else if (streq(argv[1], "unwrap")) {
206+
struct privkey privkey;
207+
struct pubkey blinding;
208+
u8 onion[TOTAL_PACKET_SIZE], *dec;
209+
struct onionpacket op;
210+
struct secret ss, onion_ss;
211+
struct secret hmac, rho;
212+
struct route_step *rs;
213+
const u8 *cursor;
214+
struct tlv_onionmsg_payload *outer;
215+
size_t max, len;
216+
struct pubkey res;
217+
struct sha256 h;
218+
int ret;
219+
const unsigned char npub[crypto_aead_chacha20poly1305_ietf_NPUBBYTES] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
220+
221+
if (argc != 5)
222+
errx(1, "unwrap requires privkey, onion and blinding");
223+
224+
if (!hex_decode(argv[2], strlen(argv[2]), &privkey,
225+
sizeof(privkey)))
226+
errx(1, "Invalid private key hex '%s'", argv[2]);
227+
228+
if (!hex_decode(argv[3], strlen(argv[3]), onion,
229+
sizeof(onion)))
230+
errx(1, "Invalid onion %s", argv[3]);
231+
232+
if (!pubkey_from_hexstr(argv[4], strlen(argv[4]), &blinding))
233+
errx(1, "Invalid blinding %s", argv[4]);
234+
235+
if (parse_onionpacket(onion, sizeof(onion), &op) != 0)
236+
errx(1, "Unparsable onion");
237+
238+
/* ss(r) = H(k(r) * E(r)) */
239+
if (secp256k1_ecdh(secp256k1_ctx, ss.data, &blinding.pubkey,
240+
privkey.secret.data, NULL, NULL) != 1)
241+
abort();
242+
243+
subkey_from_hmac("rho", &ss, &rho);
244+
245+
/* b(i) = HMAC256("blinded_node_id", ss(i)) * k(i) */
246+
subkey_from_hmac("blinded_node_id", &ss, &hmac);
247+
248+
/* We instead tweak the *ephemeral* key from the onion
249+
* and use our raw privkey: this models how lightningd
250+
* will do it, since hsmd knows only how to ECDH with
251+
* our real key */
252+
if (!first) {
253+
if (secp256k1_ec_pubkey_tweak_mul(secp256k1_ctx,
254+
&op.ephemeralkey.pubkey,
255+
hmac.data) != 1)
256+
abort();
257+
}
258+
259+
if (secp256k1_ecdh(secp256k1_ctx, onion_ss.data,
260+
&op.ephemeralkey.pubkey,
261+
privkey.secret.data, NULL, NULL) != 1)
262+
abort();
263+
264+
rs = process_onionpacket(tmpctx, &op, &onion_ss, NULL, 0, false);
265+
if (!rs)
266+
errx(1, "Could not process onionpacket");
267+
268+
cursor = rs->raw_payload;
269+
max = tal_bytelen(cursor);
270+
len = fromwire_bigsize(&cursor, &max);
271+
272+
/* Always true since we're non-legacy */
273+
assert(len == max);
274+
outer = tlv_onionmsg_payload_new(tmpctx);
275+
if (!fromwire_onionmsg_payload(&cursor, &max, outer))
276+
errx(1, "Invalid payload %s",
277+
tal_hex(tmpctx, rs->raw_payload));
278+
279+
if (rs->nextcase == ONION_END) {
280+
printf("TERMINAL\n");
281+
return 0;
282+
}
283+
284+
/* Look for enctlv */
285+
if (!outer->enctlv)
286+
errx(1, "No enctlv field");
287+
288+
if (tal_bytelen(outer->enctlv->enctlv)
289+
< crypto_aead_chacha20poly1305_ietf_ABYTES)
290+
errx(1, "enctlv field too short");
291+
292+
dec = tal_arr(tmpctx, u8,
293+
tal_bytelen(outer->enctlv->enctlv)
294+
- crypto_aead_chacha20poly1305_ietf_ABYTES);
295+
ret = crypto_aead_chacha20poly1305_ietf_decrypt(dec, NULL,
296+
NULL,
297+
outer->enctlv->enctlv,
298+
tal_bytelen(outer->enctlv->enctlv),
299+
NULL, 0,
300+
npub,
301+
rho.data);
302+
if (ret != 0)
303+
errx(1, "Failed to decrypt enctlv field");
304+
305+
printf("Contents: %s\n", tal_hex(tmpctx, dec));
306+
307+
/* E(i-1) = H(E(i) || ss(i)) * E(i) */
308+
h = hash_e_and_ss(&blinding, &ss);
309+
res = next_pubkey(&blinding, &h);
310+
printf("Next blinding: %s\n",
311+
type_to_string(tmpctx, struct pubkey, &res));
312+
printf("Next onion: %s\n", tal_hex(tmpctx, serialize_onionpacket(tmpctx, rs->next)));
313+
} else
314+
errx(1, "Either create or unwrap!");
315+
}

0 commit comments

Comments
 (0)