gossipd: don't need hsm fd any more.
What changed, and why it matters
This is a routine cleanup patch. The gossipd subdaemon used to need a secure connection to the wallet's signing daemon (hsmd) to sign network gossip messages, but that work was moved elsewhere in version 24.02. The patch removes the now-unused connection and updates stale comments. There is no security bug being fixed here.
No security action needed. Reviewers may optionally verify that gossip message signing is still handled by another daemon (as the commit message states, since v24.02) and that no other code still expects HSM_FD in gossipd.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit removes the HSM_FD file descriptor and ecdh_hsmd_setup() call from gossipd, and stops lightningd from passing an hsmd file descriptor when spawning gossipd. It also renumbers the remaining CONNECTD_FD/CONNECTD2_FD constants and refreshes the daemon’s top-of-file comment. The change is purely subtractive/cleanup: no new code paths, no privilege changes, and no bug fixes are introduced.
Changed components
gossipd/gossipd.cgossipd/gossipd.hlightningd/gossip_control.cInspect captured patch +12 / −20
diff --git a/gossipd/gossipd.c b/gossipd/gossipd.c
index 15bd4a46..e6730d18 100644
--- a/gossipd/gossipd.c
+++ b/gossipd/gossipd.c
@@ -1,11 +1,12 @@
/*~ Welcome to the gossip daemon: keeper of maps!
*
- * This is the last "global" daemon; it has three purposes.
+ * This is the last "global" daemon; it has one main purpose: to
+ * maintain the append-only gossip_store file for other daemons and
+ * plugins to read the global network map.
*
- * 1. To determine routes for payments when lightningd asks.
- * 2. The second purpose is to receive gossip from peers (via their
- * per-peer daemons) and send it out to them.
- * 3. Talk to `connectd` to to answer address queries for nodes.
+ * To do this, it gets gossip messages forwarded from connectd, makes
+ * gossip queries to peers, and can ask connect out to random peers to
+ * get more gossip.
*
* The gossip protocol itself is fairly simple, but has some twists which
* add complexity to this daemon.
@@ -14,7 +15,6 @@
#include <ccan/tal/str/str.h>
#include <common/clock_time.h>
#include <common/daemon_conn.h>
-#include <common/ecdh_hsmd.h>
#include <common/memleak.h>
#include <common/status.h>
#include <common/subdaemon.h>
@@ -591,9 +591,6 @@ int main(int argc, char *argv[])
daemon->deferred_txouts = tal_arr(daemon, struct short_channel_id, 0);
daemon->current_blockheight = 0; /* i.e. unknown */
- /* Tell the ecdh() function how to talk to hsmd */
- ecdh_hsmd_setup(HSM_FD, status_failed);
-
/* Note the use of time_mono() here. That's a monotonic clock, which
* is really useful: it can only be used to measure relative events
* (there's no correspondence to time-since-Ken-grew-a-beard or
@@ -620,8 +617,9 @@ int main(int argc, char *argv[])
}
}
-/*~ Note that the actual routing stuff is in routing.c; you might want to
- * check that out later.
+/*~ Note that the production of the gossip_store file is in gossmap_manage.c
+ * and gossip_store.c, and the (highly optimized!) read side is in
+ * common/gossmap.c; you might want to check those out later.
*
* But that's the last of the global daemons. We now move on to the first of
* the per-peer daemons: openingd/openingd.c.
diff --git a/gossipd/gossipd.h b/gossipd/gossipd.h
index d558f58f..93d79373 100644
--- a/gossipd/gossipd.h
+++ b/gossipd/gossipd.h
@@ -8,11 +8,8 @@
#include <lightningd/options.h>
#include <wire/peer_wire.h>
-/* We talk to `hsmd` to sign our gossip messages with the node key */
-#define HSM_FD 3
-/* connectd asks us for help finding nodes, and gossip fds for new peers */
-#define CONNECTD_FD 4
-#define CONNECTD2_FD 5
+/* connectd forwards gossip messages to us. */
+#define CONNECTD_FD 3
struct chan;
struct peer;
diff --git a/lightningd/gossip_control.c b/lightningd/gossip_control.c
index 7ecf0a53..a43d967c 100644
--- a/lightningd/gossip_control.c
+++ b/lightningd/gossip_control.c
@@ -302,14 +302,11 @@ static void gossipd_init_done(struct subd *gossipd,
void gossip_init(struct lightningd *ld, int connectd_fd)
{
u8 *msg;
- int hsmfd;
void *ret;
- hsmfd = hsm_get_global_fd(ld, HSM_PERM_ECDH|HSM_PERM_SIGN_GOSSIP);
-
ld->gossip = new_global_subd(ld, "lightning_gossipd",
gossipd_wire_name, gossip_msg,
- take(&hsmfd), take(&connectd_fd), NULL);
+ take(&connectd_fd), NULL);
if (!ld->gossip)
err(1, "Could not subdaemon gossip");
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.