Reject unknown TLVs in blinded payment payloads#4546
Reject unknown TLVs in blinded payment payloads#4546officialasishkumar wants to merge 3 commits intolightningdevkit:mainfrom
Conversation
Tighten blinded payload decoding so unexpected odd TLVs and custom TLVs are rejected instead of silently ignored. This applies both to the encrypted blinded TLV streams and to the outer blinded onion payload reader, matching BOLT 4's stricter allowlist behavior for blinded paths. Update the blinded payment tests to expect recipient rejection of non-compliant custom TLVs and keep the max-path-length coverage focused on sender-side sizing logic. Add focused codec tests for the unknown-TLV decode paths.
|
I've assigned @wpaulino as a reviewer! |
|
I've completed a thorough re-review of all files and hunks in this PR. I verified:
No issues found. |
lightning/src/ln/msgs.rs
Outdated
| if msg_type < 1 << 16 { | ||
| if msg_type % 2 == 1 { | ||
| has_unknown_odd_tlvs = true; | ||
| return Ok(true); |
There was a problem hiding this comment.
nit you can drop this line (similar below), returning Ok(false) universally is fine.
There was a problem hiding this comment.
Done, dropped the return Ok(true) lines in both places and now returning Ok(false) universally.
| _init_tlv_field_var!(features, (option, encoding: (BlindedHopFeatures, WithoutLength))); | ||
| _init_tlv_field_var!(payment_secret, option); | ||
| _init_tlv_field_var!(payment_context, option); | ||
| _init_tlv_field_var!(is_dummy, option); |
There was a problem hiding this comment.
Please add a new macro for this rather than breaking it out.
There was a problem hiding this comment.
Added _init_and_read_tlv_stream_with_custom_tlv_decode macro in ser_macros.rs that combines _init_tlv_field_var + decode_tlv_stream_with_custom_tlv_decode, following the same pattern as _init_and_read_tlv_stream. Both BlindedPaymentTlvs and BlindedTrampolineTlvs now use it.
…de macro Add a new _init_and_read_tlv_stream_with_custom_tlv_decode macro that combines _init_tlv_field_var and decode_tlv_stream_with_custom_tlv_decode, mirroring how _init_and_read_tlv_stream combines init with decode_tlv_stream. This avoids manually breaking out field var initialization from the TLV stream decoding in BlindedPaymentTlvs and BlindedTrampolineTlvs. Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
4 participants
Fixes #4442.
Blinded payment payload decoding still applied the normal odd/even TLV handling, which let unexpected outer custom TLVs and unknown encrypted blinded TLVs slip through on blinded paths. This tightens both layers so blinded payloads now reject non-allowlisted TLVs instead of silently ignoring them.
The test updates keep the behavioral coverage aligned with the new decoding rules: the blinded payment flow now expects the recipient to reject custom TLVs on a blinded path, and the max-path-length tests stay focused on sender-side sizing logic.
Testing: