bolt4

commit 554dfdbdacc2d80e7a8d66bcebcfecef017cd7ba
parent c8c6467cc48353cf21b4d42434bf129380dc5a88
Author: Jared Tobin <jared@jtobin.io>
Date:   Sat, 10 Oct 2026 13:18:23 +0400

lib: fix filler stream offset in construct

The filler for hop i must be XORed with rho_i stream bytes starting
at 1300 minus the length of the previous filler; it always started at
1300, which is only right for the first iteration. Onions for routes
of three or more hops were therefore unprocessable.

Diffstat:
M
lib/Lightning/Protocol/BOLT4/Construct.hs
 | 
6
+++++-

1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/lib/Lightning/Protocol/BOLT4/Construct.hs b/lib/Lightning/Protocol/BOLT4/Construct.hs
@@ -135,6 +135,10 @@ computeAllSecrets !initSec !initPub = go initSec initPub 0 []
       go newEphSec newEphPub (idx + 1) (ss : acc) rest
 
 -- | Generate filler bytes.
+--
+-- At each hop the filler, extended by that hop's shift size, is XORed
+-- with the hop's rho stream starting at 1300 minus the length of the
+-- filler before extension.
 generateFiller :: [SharedSecret] -> [Int] -> BS.ByteString
 generateFiller !secrets !sizes = go BS.empty secrets sizes
   where
@@ -143,7 +147,7 @@ generateFiller !secrets !sizes = go BS.empty secrets sizes
       let !extended = filler <> BS.replicate sz 0
           !rhoKey = deriveRho ss
           !stream = generateStream rhoKey (2 * hopPayloadsSize)
-          !streamOffset = hopPayloadsSize
+          !streamOffset = hopPayloadsSize - BS.length filler
           !streamPart = BS.take (BS.length extended)
                           (BS.drop streamOffset stream)
           !newFiller = xorBytes extended streamPart