pytest: test what happens if we *explicitly* ask for a zeroconf channel.
What the developer wrote
Authored by Rusty Russell
pytest: test what happens if we *explicitly* ask for a zeroconf channel.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit only adds a new automated test to Core Lightning. The test checks that when a user explicitly requests a zero-confirmation (zeroconf) channel from a node that does not allow it, the node returns a clear refusal message. It then checks that adding the requester to an allowlist permits the channel. There is no code change to the actual lightning node behavior—only a test is added.
No security action needed. This is a regression/behavioral test addition. Reviewers may optionally confirm the test accurately reflects the intended zeroconf refusal behavior, but no patch or mitigation is required.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff adds a single pytest function, test_zeroconf_refusal, to tests/test_opening.py. It verifies that fundchannel with a zeroconf channel_type ([12, 50], optionally plus [22]) raises an RpcError with the message ‘You required zeroconf, but you’re not on our allowlist’ when the peer is not on the allowlist. After starting a selective allowlist plugin (zeroconf-selective.py) that permits l1, the same fundchannel call succeeds. This is purely test coverage; no production code is modified.
Changed components
tests/test_opening.pyInspect captured patch +20 / −0
diff --git a/tests/test_opening.py b/tests/test_opening.py
index fd5bf2a9..f218d2ea 100644
--- a/tests/test_opening.py
+++ b/tests/test_opening.py
@@ -1836,6 +1836,26 @@ def test_zeroconf_forward(node_factory, bitcoind):
l3.rpc.pay(inv)
+def test_zeroconf_refusal(bitcoind, node_factory, chainparams):
+ """If we're not going to give you zeroconf, we should tell you!"""
+ l1, l2 = node_factory.get_nodes(2)
+ l1.fundwallet(10**6)
+ l1.connect(l2)
+
+ # option_static_remotekey, option_zeroconf
+ ctype = [12, 50]
+ # No anchors for elements
+ if not chainparams['elements']:
+ ctype += [22]
+ with pytest.raises(RpcError, match="You required zeroconf, but you're not on our allowlist"):
+ l1.rpc.fundchannel(l2.info['id'], 'all', channel_type=ctype)
+
+ # OK, let's add ourselves to allow list.
+ plugin_path = str(Path(__file__).parent / "plugins" / "zeroconf-selective.py")
+ l2.rpc.plugin_start(plugin_path, zeroconf_allow=l1.info['id'])
+ l1.rpc.fundchannel(l2.info['id'], 'all', channel_type=ctype)
+
+
@pytest.mark.openchannel('v1')
def test_buy_liquidity_ad_no_v2(node_factory, bitcoind):
""" Test that you can't actually request amt for a
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.