lncfg: add neutrino header import source config fields
What the developer wrote
Authored by Olaoluwa Osuntokun
lncfg: add neutrino header import source config fields
Add BlockHeadersSource and FilterHeadersSource fields to the Neutrino
config struct. These accept either local file paths or HTTP(S) URLs
pointing to pre-built header files for fast initial sync.
Add a Validate method that ensures both sources are specified together
or both are empty.
What changed, and why it matters
This commit adds new configuration options to LND's Neutrino (light client) settings that let users import pre-built blockchain header files from a local file or a web URL to speed up initial synchronization. It also adds a simple validation rule requiring both block headers and filter headers sources to be set together, or both left empty. There is no direct evidence in the commit that this introduces a security vulnerability.
Review the follow-up commits that implement the actual header import/download logic. Ensure that remote URL downloads use TLS certificate validation, enforce HTTPS for remote sources, validate file paths to prevent directory traversal, authenticate or checksum downloaded header files, and treat imported headers as untrusted until cryptographically verified against the chain's proof-of-work. This configuration commit alone does not appear to introduce an exploitable issue, but it enables functionality that can be risky if implemented insecurely.
Security signals we found
New configuration fields accept HTTP(S) URLs and local file paths, which could become attack surface if the downstream import implementation does not validate schemes, restrict protocols, or sanitize paths.
Validation only checks pairwise presence of the two options, not the safety, origin, or integrity of the referenced sources.
No security claims, incident references, or researcher attribution are present in the commit or supplied materials.
Evidence from the diff
The change extends the Neutrino config struct in lncfg/neutrino.go with two new string fields: BlockHeadersSource and FilterHeadersSource. These accept either local file paths or HTTP(S) URLs for importing pre-built block/filter headers for fast initial sync. A Validate() method is added that returns an error if exactly one of the two sources is set (they must be both set or both empty). The commit does not include the actual import/download logic, TLS/certificate handling, path sanitization, or URL validation. It is purely a configuration plumbing change.
Changed components
lncfg/neutrino.goNeutrino configuration structNeutrino.Validate() methodInspect captured patch +21 / −1
diff --git a/lncfg/neutrino.go b/lncfg/neutrino.go
index d0f508e..62c8b24 100644
--- a/lncfg/neutrino.go
+++ b/lncfg/neutrino.go
@@ -1,6 +1,9 @@
package lncfg
-import "time"
+import (
+ "fmt"
+ "time"
+)
// Neutrino holds the configuration options for the daemon's connection to
// neutrino.
@@ -18,4 +21,21 @@ type Neutrino struct {
ValidateChannels bool `long:"validatechannels" description:"Validate every channel in the graph during sync by downloading the containing block. This is the inverse of routing.assumechanvalid, meaning that for Neutrino the validation is turned off by default for massively increased graph sync performance. This speedup comes at the risk of using an unvalidated view of the network for routing. Overwrites the value of routing.assumechanvalid if Neutrino is used. (default: false)"`
BroadcastTimeout time.Duration `long:"broadcasttimeout" description:"The amount of time to wait before giving up on a transaction broadcast attempt."`
PersistFilters bool `long:"persistfilters" description:"Whether compact filters fetched from the P2P network should be persisted to disk."`
+
+ BlockHeadersSource string `long:"blockheaderssource" description:"Source for importing block headers on startup for fast initial sync. Can be a local file path or HTTP(S) URL (e.g., https://block-dn.org/headers/import/800000). When set, neutrino imports headers from this source before P2P sync."`
+ FilterHeadersSource string `long:"filterheaderssource" description:"Source for importing filter headers on startup for fast initial sync. Can be a local file path or HTTP(S) URL (e.g., https://block-dn.org/filter-headers/import/800000). Must be set together with blockheaderssource."`
+}
+
+// Validate checks the neutrino configuration for consistency.
+func (n *Neutrino) Validate() error {
+ blockSet := n.BlockHeadersSource != ""
+ filterSet := n.FilterHeadersSource != ""
+
+ if blockSet != filterSet {
+ return fmt.Errorf("both neutrino.blockheaderssource and " +
+ "neutrino.filterheaderssource must be specified " +
+ "together for headers import")
+ }
+
+ return nil
}
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.