btfaddr: reject descriptors whose onion endpoint is not signed

Upstream 1.2.19 signs the onion endpoint only under the optional sig3, and
VerifyDescriptor treated sig3 failure as 'drop the onion, accept the rest'.
Any relay could therefore strip an onion endpoint down to a rendezvous-only
descriptor (or, under /oniononly, cut the peer off) by deleting one field.

Now an onion field must arrive with a valid sig3 over the V3 digest or the
whole descriptor is rejected. Honest 1.2.19 writers always emit both fields,
so interop is preserved. The full two-field strip still verifies -- it is
indistinguishable from a peer that never had an onion -- and needs the onion
bound into the primary sig, which only upstream can do without breaking every
1.2.18/1.2.19 verifier; reported as an upstream protocol defect.

test_btfaddr flips the two upstream checks that enshrined the soft drop and
adds unsigned-onion and full-strip cases.

1 files changed, 15 insertions, 4 deletions

diff --git a/src/test_btfaddr.cpp b/src/test_btfaddr.cpp
index 8de426e..9d33d63 100644
--- a/src/test_btfaddr.cpp
+++ b/src/test_btfaddr.cpp
@@ -133,12 +133,23 @@ int main()
         std::string d3 = btf::SignDescriptor(ctx, sk, ENC_HEX, "node-1", 5, ONION);
         json j3 = json::parse(d3);
         j3["onion"] = "bcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcde.onion:8433";
-        CHECK(btf::VerifyDescriptor(ctx, j3.dump(), pk, o) && o.onion.empty(),
-              "tampered onion ignored rather than trusted");
+        CHECK(!btf::VerifyDescriptor(ctx, j3.dump(), pk, o),
+              "tampered onion rejects the descriptor");
         json j4 = json::parse(d3);
         j4["sig3"] = std::string(128, '0');
-        CHECK(btf::VerifyDescriptor(ctx, j4.dump(), pk, o) && o.onion.empty(),
-              "bad onion signature ignored rather than trusted");
+        CHECK(!btf::VerifyDescriptor(ctx, j4.dump(), pk, o),
+              "bad onion signature rejects the descriptor");
+        json j5 = json::parse(d3);
+        j5.erase("sig3");
+        CHECK(!btf::VerifyDescriptor(ctx, j5.dump(), pk, o),
+              "unsigned onion rejects the descriptor");
+        // Removing both fields still verifies: the result is indistinguishable
+        // from a peer that never had an onion endpoint. That residual strip
+        // needs the onion bound into the primary sig, an upstream change.
+        json j6 = json::parse(d3);
+        j6.erase("onion"); j6.erase("sig3");
+        CHECK(btf::VerifyDescriptor(ctx, j6.dump(), pk, o) && o.onion.empty(),
+              "full strip indistinguishable from no-onion (documented residual)");
     }
 
     printf("full_resolve_chain_from_address\n");