Fix long route failure attribution #3709
Conversation
An out of bound error could occur when attribution data was provided by the downstream hop for an exceptionally long route. The fix limits the verification of attribution data hmacs up to hop 20. If the sender chooses to use a longer route, failures in the final part of the route won't be attributable.
|
👋 Thanks for assigning @TheBlueMatt as a reviewer! |
|
👋 The first review has been submitted! Do you think this PR is ready for a second reviewer? If so, click here to assign a second reviewer. |
|
Well not completely trivial although the code change seems to be. I had to look twice at the fix myself. But hopefully the comments explain it well enough. |
|
Well the test is quite compelling :) |
| @@ -1144,6 +1144,10 @@ where | |||
| .expect("Route we used spontaneously grew invalid keys in the middle of it?"); | |||
| } | |||
|
|
|||
| // In the best case, paths can be up to 27 hops. But attribution data can only be conveyed back to the sender from | |||
| // the first 20 hops. Determine the number of hops to be used for attribution data. | |||
| let attributable_hop_count = usize::min(path.hops.len(), MAX_HOPS); | |||
There was a problem hiding this comment.
Still find myself wishing that the caller didn't need to concern itself with this level of detail about attributable faliures, but don't see an obvious way to improve it.
There was a problem hiding this comment.
At the point of interpreting the failure message, there isn't much we can do about it. But one open question is whether we should limit pathfinding to 20 hops instead of 27 in pathfinding, so that we're sure every failure is attributable?
There was a problem hiding this comment.
I doubt it's worth it. In the rare case that we are sending more than 20 hops it's probably because someone is doing something insane where they have a many-hop route hint, in which case it's not useful to get attribution data beyond the first handful.
An out of bound error could occur when attribution data was provided by the downstream hop for an exceptionally long route. The fix limits the verification of attribution data hmacs up to hop 20. If the sender chooses to use a longer route, failures in the final part of the route won't be attributable.
Fixes #3708