update code to match protocol spec

backwards incompat change

include/llarp/aligned.hpp

@@ -68,6 +68,23 @@ namespace llarp
       return memcmp(l, other.l, sz) < 0;
     }
 
+    AlignedBuffer
+    operator^(const AlignedBuffer& other) const
+    {
+      AlignedBuffer< sz > ret;
+      for(size_t idx = 0; idx < sz / 8; ++idx)
+        ret.l[idx] = l[idx] ^ other.l[idx];
+      return ret;
+    }
+
+    AlignedBuffer&
+    operator^=(const AlignedBuffer& other)
+    {
+      for(size_t idx = 0; idx < sz / 8; ++idx)
+        l[idx] ^= other.l[idx];
+      return *this;
+    }
+
     size_t
     size() const
     {

include/llarp/path.hpp

@@ -126,6 +126,7 @@ namespace llarp
 
       TransitHopInfo info;
       SharedSecret pathKey;
+      ShortHash nonceXOR;
       llarp_time_t started = 0;
       // 10 minutes default
       llarp_time_t lifetime = DEFAULT_PATH_LIFETIME;
@@ -188,6 +189,8 @@ namespace llarp
       SecretKey commkey;
       /// shared secret at this hop
       SharedSecret shared;
+      /// hash of shared secret used for nonce mutation
+      ShortHash nonceXOR;
       /// next hop's router id
       RouterID upstream;
       /// nonce for key exchange

llarp/nodedb.cpp

@@ -450,8 +450,11 @@ llarp_nodedb_select_random_hop(struct llarp_nodedb *n, struct llarp_rc *prev,
       }
       if(memcmp(prev->pubkey, itr->second.pubkey, PUBKEYSIZE) == 0)
         continue;
-      llarp_rc_copy(result, &itr->second);
-      return;
+      if(itr->second.addrs && llarp_ai_list_size(itr->second.addrs))
+      {
+        llarp_rc_copy(result, &itr->second);
+        return;
+      }
     } while(true);
   }
   else

llarp/path.cpp

@@ -356,9 +356,11 @@ namespace llarp
     Path::HandleUpstream(llarp_buffer_t buf, const TunnelNonce& Y,
                          llarp_router* r)
     {
+      TunnelNonce n = Y;
       for(const auto& hop : hops)
       {
-        r->crypto.xchacha20(buf, hop.shared, Y);
+        r->crypto.xchacha20(buf, hop.shared, n);
+        n ^= hop.nonceXOR;
       }
       RelayUpstreamMessage* msg = new RelayUpstreamMessage;
       msg->X                    = buf;
@@ -382,9 +384,11 @@ namespace llarp
     Path::HandleDownstream(llarp_buffer_t buf, const TunnelNonce& Y,
                            llarp_router* r)
     {
+      TunnelNonce n = Y;
       for(const auto& hop : hops)
       {
-        r->crypto.xchacha20(buf, hop.shared, Y);
+        n ^= hop.nonceXOR;
+        r->crypto.xchacha20(buf, hop.shared, n);
       }
       return HandleRoutingMessage(buf, r);
     }

llarp/pathbuilder.cpp

@@ -2,6 +2,7 @@
 #include <llarp/path.hpp>
 
 #include <llarp/pathbuilder.hpp>
+#include "buffer.hpp"
 #include "router.hpp"
 
 namespace llarp
@@ -50,6 +51,8 @@ namespace llarp
         abort();
         return;
       }
+      // generate nonceXOR valueself->hop->pathKey
+      ctx->crypto->shorthash(hop.nonceXOR, llarp::Buffer(hop.shared));
       ++ctx->idx;
 
       bool isFarthestHop = ctx->idx == ctx->path->hops.size();

llarp/relay_commit.cpp

@@ -246,6 +246,9 @@ namespace llarp
         delete self;
         return;
       }
+      // generate hash of hop key for nonce mutation
+      self->context->Crypto()->shorthash(self->hop->nonceXOR,
+                                         llarp::Buffer(self->hop->pathKey));
       if(self->record.work
          && self->record.work->IsValid(self->context->Crypto()->shorthash))
       {

llarp/transit_hop.cpp

@@ -77,8 +77,7 @@ namespace llarp
     {
       RelayDownstreamMessage* msg = new RelayDownstreamMessage;
       msg->pathid                 = info.rxID;
-      msg->Y                      = Y;
-
+      msg->Y                      = Y ^ nonceXOR;
       r->crypto.xchacha20(buf, pathKey, Y);
       msg->X = buf;
       llarp::LogDebug("relay ", msg->X.size(), " bytes downstream from ",
@@ -99,7 +98,7 @@ namespace llarp
       {
         RelayUpstreamMessage* msg = new RelayUpstreamMessage;
         msg->pathid               = info.txID;
-        msg->Y                    = Y;
+        msg->Y                    = Y ^ nonceXOR;
 
         msg->X = buf;
         llarp::LogDebug("relay ", msg->X.size(), " bytes upstream from ",