-
Notifications
You must be signed in to change notification settings - Fork 376
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Introduce MessageContext and use it to allow abandon failed payments #3085
Conversation
Codecov ReportAttention: Patch coverage is
❗ Your organization needs to install the Codecov GitHub app to enable full functionality. Additional details and impacted files@@ Coverage Diff @@
## main #3085 +/- ##
==========================================
+ Coverage 89.80% 90.27% +0.47%
==========================================
Files 121 121
Lines 99532 102381 +2849
Branches 99532 102381 +2849
==========================================
+ Hits 89382 92429 +3047
+ Misses 7498 7305 -193
+ Partials 2652 2647 -5 ☔ View full report in Codecov by Sentry. |
Unfortunately this seems to need a rebase already. |
There’s another variation of this PR that might help us achieve our goal using enums. You can check it out here: link to branch (check out the top three commits). This approach will help keep the Let me know which of the two approaches seems better. |
@valentinewallace @TheBlueMatt Would you mind checking out the two alternatives for including |
Hmm, yea, we need to figure out what we want to do with |
Presumably, the other TLVs would be
No, I believe we don't set it at all. Last we spoke about it, the thought was to reserve it for internal use. |
Yea, the "user stuffed data" variant would presumably have this?
I wonder if we should bother? Like, there's nothing special about the TLV the spec says should be the path_id, we can ignore it and no one will ever know. That would simplify the types here a bit. |
Probably fine to ignore it or just encode the |
Checking my understanding regarding When a recipient creates a blinded path to itself:
The final recipient (payment or message not specified, but message is then implied):
But then in the rational, the spec uses a payment example:
Later on in the BOLT under the "Onion Messages" section, the writer of
And then the reader:
Then in the rational:
Note how that section talks about reply paths. In LDK, we don't use
IIUC, we shouldn't include a I think that (plus any additional handler checks) would be sufficient to prevent de-anonymization discussed in the quoted rationale sections. @TheBlueMatt @valentinewallace Does that seem to check out? If so, we could drop the |
Is the attack there basically that someone can take an offer we generated, then request the invoice_request from every node in the network and see who responds (or equivalent for payments)? |
Really to any node within N hops of the introduction node in one of the offer paths. Though using the |
Hmm, okay, I think we're talking about different things, then. I think my above-described attack works though, right? Currently anyone can probe all public nodes and figure out if it is the node that issued an LDK offer, I think?
Right, though it seems like if you know the node's pubkey you could do it too? Seems like something we should fix in both cases. |
Yeah, I was just saying you could limit the search.
Correct. IIUC, the fix would result in an increased offer QR code size. |
Yep, that's my understanding. Sadly we kinda have to cause this is a big issue :). |
In any case, as it relates to this PR, ISTM we don't care too much about users using |
Not sure I understand the suggestion here. We want different variants for each LDK usage so we can tell if the path is used correctly. Having a single variant with a bunch of |
Right, we're on the same page, my only point is that it seems like we should have a single-level enum, whereas the previous suggestion was a two-level enum. |
I think the previous suggestion was a struct ( |
Ah, right, I was thinking we'd just go to a single top-level enum.
Or we could go the other way - have a top-level enum where the LDK-hidden variants contain a struct, that way the user-visible API is simpler. |
SGTM. Each variant will likely need to hold a struct in order have something to pass to each handler. But, yeah, those structs can be |
@TheBlueMatt FWIW, it might be simpler in the serialization code if we keep rust-lightning/lightning/src/onion_message/messenger.rs Lines 1703 to 1707 in 07f3380
|
Updated from pr3085.03 to pr3085.04 (diff): Addressed comments from @TheBlueMatt and @jkczyz Changes:
|
64496c4
to
3be2801
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pretty much LGTM other than a few last comments.
let secp_ctx = &self.secp_ctx; | ||
let expanded_key = &self.inbound_payment_key; | ||
|
||
let abandon_if_payment = |context| { | ||
match context { | ||
OffersContext::OutboundPayment { payment_id } => self.abandon_payment(payment_id), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We have to verify in InvoiceError
- users may set a payment_id
containing public(ish) data, and we can't let some third party fail all our outbound payments by providing InvoiceError
s.
Will be replaced by lightningdevkit#3085.
Will be replaced by lightningdevkit#3085.
Updated from pr3085.16 to pr3085.17 (diff):
|
CI is sad because |
1. The path_id will be removed from the codebase in the following commits.
1. New Enum for Enhanced Data Handling: - Introduced the `MessageContext` enum, which allows the node to include additional context data along with the `reply_path` sent to the counterparty. - The node anticipates receiving this data back for further processing. 2. Variants in MessageContext: - The `MessageContext` enum includes two variants: "Offers" and "Context" - One of the variants, `Offers`, holds the `payment_id` of the associated Outbound BOLT12 Payment. 3. Future Usage: - This enum will be utilized in a subsequent commit to abandon outbound payments that have failed to complete for various reasons.
1. Handling Offers Data: - Updated `handle_message` to accept `OffersContext` data as an input field. - If it is present, it will be utilized by the handler to abandon outbound payments that have failed for any reason. 2. Consistency in Custom Message Handling: - Updated `handle_custom_message` to accept optional custom data. for consistency. - Note: `custom_data` will remain unused in this PR.
…t field - Enabled `create_blinded_paths` to accept `MessageContext` TLVs as an input field. - `MessageContext` is intended to be sent along with the `reply_path` to the counterparty. - Added `MessageContext` in the `create_blinded_paths` flow, optionally appending it within the `reply_path`. - Updated tests to verify the new feature.
Updated from pr3085.19 to pr3085.20 (diff):
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please update the PR title and summary to reflect name changes.
/// This data is encrypted by the recipient and remains invisible to anyone else. | ||
/// It is included in the [`BlindedPath`], making it accessible again to the recipient | ||
/// whenever the [`BlindedPath`] is used. | ||
/// The recipient can authenticate the message and utilize it for further processing |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit
/// The recipient can authenticate the message and utilize it for further processing | |
/// The recipient can use this data to authenticate the message or for further processing |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll update this in #3139 since I'm touching this.
let secp_ctx = &self.secp_ctx; | ||
let expanded_key = &self.inbound_payment_key; | ||
|
||
let abandon_if_payment = |context| { | ||
match context { | ||
OffersContext::OutboundPayment { payment_id } => self.abandon_payment(payment_id), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I believe the intended spec would be that we have some ability to verify the blinded path itself, which implies maybe a MAC in the blinded path :(
let secp_ctx = &self.secp_ctx; | ||
let expanded_key = &self.inbound_payment_key; | ||
|
||
let abandon_if_payment = |context| { | ||
match context { | ||
OffersContext::OutboundPayment { payment_id } => self.abandon_payment(payment_id), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Seems weird that this will call through and use PaymentFailureReason::UserAbandoned
. ISTM we could just call pending_outbound_payments.abandon_payment
manually with a better failure reason. We can do that in a followup/#3139 though.
Resolves #2837
Resolves #3124
Summary
This PR introduces a new field,
MessageContext
, in theReceiveTlvs
struct. The key changes are as follows:MessageContext
:reply_path
, which they expect to receive back from the counterparty along with their response.OffersContext
inMessageContext
:OffersContext
enum introduces a variant containing the Outbound Payment'sPaymentId
field that can be utilized byOffersMessage
.create_blinded_path
flow:MessageContext
into thecreate_blinded_path
process.pay_for_offer
andcreate_refund_builder
functions to passPaymentId
along with the generatedreply_path
and path respectively.These improvements aim to allow passing additional information with the create
reply_path
and managing outbound payment failures more robustly.Note:
This PR builds on #2996