lnwire+tlv+route: enforce TLV length validation and add tests #10249
Conversation
Summary of ChangesHello @erickcestari, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the robustness of the system's TLV (Type-Length-Value) decoding mechanisms. By introducing strict length validation across several critical components, including Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request strengthens TLV decoding by enforcing strict length validation across several components, which is a great improvement for the robustness and security of the P2P message parsing. The changes are logical and well-implemented. You've also added comprehensive tests to cover these new validation rules. My feedback is minor and focuses on improving the clarity and cleanliness of the new test code, such as removing a debug print statement and correcting some copy-pasted comments and variable names, to better align with the repository's style guide.
2625f3a to
483e1b2
Compare
- Updated feeDecoder to require TLV length == 8. - Prevents malformed Fee TLVs from being silently accepted.
483e1b2 to
e528641
Compare
|
@erickcestari, remember to re-request review from reviewers when ready |
| if v, ok := val.(*ShortChannelID); ok { | ||
| var scid uint64 | ||
| err := tlv.DUint64(r, &scid, buf, 8) | ||
| err := tlv.DUint64(r, &scid, buf, l) |
There was a problem hiding this comment.
Nit: maybe a brief comment noting that tlv.DUint64 enforce the tlv size of 8.
|
|
||
| // TestScidTypeDecodeInvalidLength ensures that decoding a ShortChannelID TLV | ||
| // with an invalid length (anything other than 8 bytes) fails with an error. | ||
| func TestScidTypeDecodeInvalidLength(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| aliasScid := ShortChannelID{ | ||
| BlockHeight: 1, TxIndex: 1, TxPosition: 1, | ||
| } | ||
|
|
||
| var extraData ExtraOpaqueData | ||
| require.NoError(t, extraData.PackRecords(&aliasScid)) | ||
|
|
||
| // Corrupt the TLV length field to simulate malformed input. | ||
| extraData[1] = 0xAA | ||
|
|
||
| var out ShortChannelID | ||
| _, err := extraData.ExtractRecords(&out) | ||
| require.Error(t, err) | ||
| } |
There was a problem hiding this comment.
The commit message for this changeset doesn’t match its diff—it seems to describe the next commit.
| extraData[1] = 8 + 1 | ||
|
|
||
| var out ShortChannelID | ||
| _, err := extraData.ExtractRecords(&out) | ||
| require.Error(t, err) | ||
|
|
||
| extraData[1] = 8 - 1 | ||
|
|
||
| _, err = extraData.ExtractRecords(&out) |
There was a problem hiding this comment.
Is there a reason to introduce the test in the previous commit and modify it in this one?
| return n | ||
| } | ||
|
|
||
| func TestMusig2Nonce(t *testing.T) { |
I was doing differential fuzzing on lightning P2P messages and noticed that
LNDdoesn't verifyif the length of SCID TLV is correct or not causing it to parse messages with wrong TLV encoding.
This PR strengthens TLV decoding across multiple components by enforcing strict length checks
and adding corresponding tests.
lnwire
ShortChannelID: decoder now validatesl == 8.Fee: decoder now validatesl == 8.Musig2Nonce: decoder now validatesl == musig2.PubNonceSize.SCID,Fee, andMusig2NonceTLVs.tlv
DBytes33: now enforcesl == 33.routing/route
Vertex: decoder now validatesl == VertexSize.Note: 10 commits for this might be too much for these changes. Let me know if I should squash into a multi commit.