rust-lightning

Check metadata length for bolt11 invoices

Check that the metadata when creating a bolt11 invoice is below
the bolt11 limit of 639 bytes for tagged fields.

Fix stable clippy string repeat lint

Use str::repeat in DebugMsg tests to satisfy current stable clippy.

Drop duplicate Hasher import

Simplify ChannelUnavailable APIError handling with let-else

Refactor the nested match statement used during error construction into
a more idiomatic let-else construct (stabilised in Rust 1.65). The
previous implementation required verbose, nested matching to navigate
around borrow checker limitations.

By leveraging let-else alongside chaining unwrap_err on handle_error
Result, we achieve the same teardown logic (dropping state locks)
and error mapping with significantly less boilerplate and nesting.

Format possiblyrandom cfg attributes

Run rustfmt on the possiblyrandom crate so its cfg attributes match
the current formatting rules.

Fix string slicing in TXT record validation

Rust's panicy string slicing behavior has always been a sharp edge
and here it finally caught up with us. Ensure we don't slice into
a string provided in an onion message until we're sure the index
is a character boundary.

Reported by Jordan Mecom of Block's Security Team

Get real rand in `possiblyrandom` on supported platforms w/o feat

It turns out that conditionally-enabling a dependency via `target`
in `Cargo.toml` does not enable the corresponding dependency
`feature` when compiling the code. As a result, only when building
`possiblyrandom` with an explicit `getrandom` feature did we ever
actually return random values.

This fixes this by matching the `target` cfg in `Cargo.toml` to the
cfg in `lib.rs`.

Reported by Project Loupe

Truncate logged peer message strings

Counterparty-provided strings in network messages (Error, Warning,
TxAbort) were logged without length limits, allowing a malicious peer
to bloat log files. Some logging sites also lacked the same
sanitization used for other untrusted strings.

Add a `DebugMsg` struct and `log_msg!` macro that consistently
truncate messages to 512 characters while preserving `PrintableString`
sanitization. Replace all bare `msg.data` and ad hoc
`PrintableString(&msg.data)` usages at the 7 relevant logging sites
in `peer_handler.rs` and `channel.rs`.

Co-Authored-By: HAL 9000

Reject pre-epoch `LSPSDateTime` at parse time

`LSPSDateTime::is_past` coerced `chrono`'s `i64` timestamp into a
`u64` via `try_into().expect(...)`. Because `LSPSDateTime` is parsed
from peer-controlled RFC 3339 strings (which can be pre-1970 and so
yield negative timestamps), this could be triggered remotely: an
attacker-supplied `valid_until` / `expires_at` field of e.g.
`"1900-01-01T00:00:00Z"` would parse successfully, land in LSPS state
before any HMAC / promise check, and panic the LSP thread on the next
`prune_pending_requests` sweep. Concretely reachable today via LSPS2
`opening_fee_params.valid_until` (in the buy request) and the LSPS1
expiry fields.

Make `LSPSDateTime::from_str` reject pre-epoch datetimes, and route
serde deserialization through it: `#[serde(transparent)]` was
delegating Deserialize directly to `chrono`'s impl and bypassing our
parser, so peer JSON had to be guarded separately. With both paths
funnelled through one parser, no `LSPSDateTime` value with a negative
inner timestamp can be constructed and `is_past` is safe by
construction.

Co-Authored-By: HAL 9000

Return optional recovered BOLT11 payee keys

Recovering a BOLT11 payee key can fail even when an invoice includes a
valid n field. Return the recovery result as an option and document
get_payee_pub_key as the canonical accessor.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Use BOLT11 invoice payee keys for payment params

Payment parameters should use the canonical payee key from BOLT11
invoices. When an invoice includes an n field, using that key avoids
attempting signature recovery that may legitimately be unavailable.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Reject RGS snapshots that leave our graph absurdly-sized

If an RGS server sends snapshots that are absurdly-sized, they can
bloat a client's network graph, eventually leading to an OOM. While
we generally consider RGS servers to be semi-trusted (at least in
the sense that they can often simply not respond and leave a client
unable to find paths) we should still avoid allowing them to OOM a
client.

Thus, here, we naively start ignoring new channels from an RGS
server if they leave our graph 10x larger than we expect. This at
least avoids the OOM even if we end up not being able to make
payments.

Reported by Jordan Mecom of Block's Security Team

Avoid over-allocating when reading corrupted lengths for `HashMap`s

Luckily this was only used in `ChannelManager` and scorer
deserialization, though we anticipate occasionally fetching the
second from an only semi-trusted source.

Fail held HTLCs on LSPS2 abandon

Drain queued intercepted HTLCs before removing pending LSPS2
JIT channel state in channel_open_abandoned. Add a real
interception regression test that verifies the held HTLC is no
longer pending after the abandon call.

Remove now-redundant PaymentParameters params

In the last commit, we made Route::route_params required instead of an Option.
After this change, we can modify a few methods that took a Route in addition to
a separate PaymentParameters argument, since the pay params can always be
retrieved from the Route now.

Require Route::route_params

This field has always been set since 0.0.117. Since we're making it required
here, routes created/serialized prior to 0.0.117 will fail to deserialize on
0.4.

Rustfmt send_payment_with_route

About to modify this method slightly, so opportunistically format it now.

Fix invalid dummy pubkey in send_to_route

If a caller of send_payment_with_route provided a route with either no paths,
or where the first path had 0 hops, the method would panic due to attempting to
unwrap a dummy pubkey that was initialized with 32 bytes instead of the
required 33.

Reported by Project Loupe.

Add pending changelog entry for PR 4656

Correct deserialization of `u16::MAX` byte-Features

This shouldn't really matter in practice, but it aligns the
serialization and deserialization logic.

Reported by Project Loupe.

Refuse to set features at index higher than `u16::MAX` bytes

These aren't serialize-able and clearly bogus.

Reported by Project Loupe

Don't panic when a composite sub-handler returns `Ok(None)`

A handler built with `composite_custom_message_handler!` routes an incoming
message type to the sub-handler whose pattern matches it and assumed the
sub-handler would always decode it. But per the `CustomMessageReader`
contract a sub-handler returns `Ok(None)` for a type it doesn't recognize,
and a sub-handler's pattern -- a range in particular -- can be broader than
the types it actually decodes.

Since the message type comes from peer input, this let a remote peer panic
the message-processing thread with a single custom message whose type falls
in a sub-handler's pattern but isn't decoded by it. Report such a message as
unknown instead, matching how `wire::do_read` handles an undecoded custom
message.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add LSPS2 replay regression coverage

Persisting LSPS2 service state can race with replayed intercepted HTLC
events after restart. Cover replaying the same intercepted HTLC after
restoring peer state so duplicate queueing is caught.

Co-Authored-By: HAL 9000

Prune closed LSPS2 terminal channel state

Terminal JIT channel state is only useful while the forwarded channel
still exists. Drop completed LSPS2 mappings once the channel is gone so
persisted service state does not retain stale entries indefinitely.

Co-Authored-By: HAL 9000

Treat replayed LSPS2 HTLCs idempotently

Replayed intercepted HTLC events should not duplicate queued payments or
panic after restart. Ignore already-queued intercept IDs so persisted
queues remain stable across event replay.

Co-Authored-By: HAL 9000