lsp_plugin: remove feature flag temporarily to ...
What the developer wrote
Authored by Peter Neuroth
lsp_plugin: remove feature flag temporarily to ...
please `connect` tests. We need to fix this in the future. Connectd
should not tell peers about features of disabled plugins.
We need to ensure that connectd only starts once the plugins have
returned from init.
Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>
What changed, and why it matters
This commit temporarily stops an experimental Lightning Service Provider (LSP) plugin from advertising a specific protocol feature to other nodes. The change is described by the developer as a short-term workaround to make automated tests pass, not as a security fix. It removes the public announcement of a feature bit while leaving the rest of the plugin's code in place, with a note that the underlying startup-order problem should be fixed later.
No immediate security action required. Treat as normal development cleanup. If tracking technical debt, monitor the referenced FIXME about connectd startup ordering and plugin feature advertisement.
Security signals we found
No security-relevant language in commit title or message
Change is framed as test-fixing workaround, not as a vulnerability patch
Feature bit is optional per LSPS specification, so disabling it is protocol-compliant
No input validation, cryptography, authorization, or memory-safety changes
FIXME comment indicates known technical debt, not a security defect
Evidence from the diff
The patch comments out two .featurebits() registrations in plugins/lsps-plugin/src/service.rs that previously announced LSP_FEATURE_BIT in both Node and Init feature bit sets. The commit message explains this is a temporary measure because connectd currently reports plugin features even when the plugin is disabled, and tests expect those feature bits not to appear. The plugin’s hooks (custommsg, htlc_accepted) and options remain enabled. No vulnerability, exploit, or security boundary violation is described in the commit or diff.
Changed components
plugins/lsps-plugin/src/service.rsLSPS plugin feature bit advertisementInspect captured patch +13 / −9
diff --git a/plugins/lsps-plugin/src/service.rs b/plugins/lsps-plugin/src/service.rs
index 60607754..03f3f7e6 100644
--- a/plugins/lsps-plugin/src/service.rs
+++ b/plugins/lsps-plugin/src/service.rs
@@ -10,7 +10,7 @@ use cln_lsps::lsps2::cln::{HtlcAcceptedRequest, HtlcAcceptedResponse};
use cln_lsps::lsps2::handler::{ClnApiRpc, HtlcAcceptedHookHandler};
use cln_lsps::lsps2::model::{Lsps2BuyRequest, Lsps2GetInfoRequest};
use cln_lsps::util::wrap_payload_with_peer_id;
-use cln_lsps::{lsps0, lsps2, util, LSP_FEATURE_BIT};
+use cln_lsps::{lsps0, lsps2};
use cln_plugin::Plugin;
use cln_rpc::notifications::CustomMsgNotification;
use cln_rpc::primitives::PublicKey;
@@ -30,14 +30,18 @@ async fn main() -> Result<(), anyhow::Error> {
if let Some(plugin) = cln_plugin::Builder::new(tokio::io::stdin(), tokio::io::stdout())
.option(lsps2::OPTION_ENABLED)
.option(lsps2::OPTION_PROMISE_SECRET)
- .featurebits(
- cln_plugin::FeatureBitsKind::Node,
- util::feature_bit_to_hex(LSP_FEATURE_BIT),
- )
- .featurebits(
- cln_plugin::FeatureBitsKind::Init,
- util::feature_bit_to_hex(LSP_FEATURE_BIT),
- )
+ // FIXME: Temporarily disabled lsp feature to please test cases, this is
+ // ok as the feature is optional per spec.
+ // We need to ensure that `connectd` only starts after all plugins have
+ // been initialized.
+ // .featurebits(
+ // cln_plugin::FeatureBitsKind::Node,
+ // util::feature_bit_to_hex(LSP_FEATURE_BIT),
+ // )
+ // .featurebits(
+ // cln_plugin::FeatureBitsKind::Init,
+ // util::feature_bit_to_hex(LSP_FEATURE_BIT),
+ // )
.hook("custommsg", on_custommsg)
.hook("htlc_accepted", on_htlc_accepted)
.configure()
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.