Drop stale DNSSec resolution logic in `OffersMessageFlow`
What changed, and why it matters
This commit removes leftover, unused code that handled DNS-based human-readable name resolution inside the BOLT12 offers message flow. The project had already switched to an external crate for this job, and this change simply cleans up the stale internal pieces that were accidentally left behind. It is a maintenance/cleanup change, not a security fix for an active vulnerability.
Treat as routine cleanup. Reviewers should confirm that no other modules still reference the removed `hrn_resolver`, `pending_dns_onion_messages`, `enqueue_dns_onion_message`, or `release_pending_dns_messages` symbols, and that the `dnssec` feature still compiles without these items. No security response is indicated by the diff itself.
Security signals we found
Removal of stale/dead code paths
No new input parsing or network handling introduced
No memory-safety, cryptographic, or authorization changes visible in diff
Evidence from the diff
The patch deletes the remaining dnssec feature-gated code in lightning/src/offers/flow.rs: imports for DNSResolverContext, DNSResolverMessage, DNSSECQuery, and OMNameResolver; the hrn_resolver and pending_dns_onion_messages fields; their initialization; the new_best_block update call; the enqueue_dns_onion_message method; and release_pending_dns_messages. The commit message states this logic was superseded in 884158d by the bitcoin-payment-instructions crate and was only forgotten in OffersMessageFlow. No replacement logic is added; the code is just removed.
Changed components
lightning/src/offers/flow.rsOffersMessageFlow struct and methodsdnssec feature-gated code (removed)Inspect captured patch +0 / −65
diff --git a/lightning/src/offers/flow.rs b/lightning/src/offers/flow.rs
index c1c3ce2..79e2332 100644
--- a/lightning/src/offers/flow.rs
+++ b/lightning/src/offers/flow.rs
@@ -62,12 +62,6 @@ use crate::types::payment::{PaymentHash, PaymentSecret};
use crate::util::logger::Logger;
use crate::util::ser::Writeable;
-#[cfg(feature = "dnssec")]
-use {
- crate::blinded_path::message::DNSResolverContext,
- crate::onion_message::dns_resolution::{DNSResolverMessage, DNSSECQuery, OMNameResolver},
-};
-
/// A BOLT12 offers code and flow utility provider, which facilitates
/// BOLT12 builder generation and onion message handling.
///
@@ -94,11 +88,6 @@ pub struct OffersMessageFlow<MR: MessageRouter, L: Logger> {
pending_async_payments_messages: Mutex<Vec<(AsyncPaymentsMessage, MessageSendInstructions)>>,
async_receive_offer_cache: Mutex<AsyncReceiveOfferCache>,
- #[cfg(feature = "dnssec")]
- pub(crate) hrn_resolver: OMNameResolver,
- #[cfg(feature = "dnssec")]
- pending_dns_onion_messages: Mutex<Vec<(DNSResolverMessage, MessageSendInstructions)>>,
-
logger: L,
}
@@ -126,11 +115,6 @@ impl<MR: MessageRouter, L: Logger> OffersMessageFlow<MR, L> {
pending_offers_messages: Mutex::new(Vec::new()),
pending_async_payments_messages: Mutex::new(Vec::new()),
- #[cfg(feature = "dnssec")]
- hrn_resolver: OMNameResolver::new(current_timestamp, best_block.height),
- #[cfg(feature = "dnssec")]
- pending_dns_onion_messages: Mutex::new(Vec::new()),
-
async_receive_offer_cache: Mutex::new(AsyncReceiveOfferCache::new()),
logger,
@@ -220,12 +204,6 @@ impl<MR: MessageRouter, L: Logger> OffersMessageFlow<MR, L> {
break;
}
}
-
- #[cfg(feature = "dnssec")]
- {
- let updated_time = timestamp.load(Ordering::Acquire) as u32;
- self.hrn_resolver.new_best_block(_height, updated_time);
- }
}
}
@@ -1306,41 +1284,6 @@ impl<MR: MessageRouter, L: Logger> OffersMessageFlow<MR, L> {
)
}
- /// Enqueues the created [`DNSSECQuery`] to be sent to the counterparty.
- ///
- /// # Peers
- ///
- /// The user must provide a list of [`MessageForwardNode`] that will be used to generate
- /// valid reply paths for the counterparty to send back the corresponding response for
- /// the [`DNSSECQuery`] message.
- ///
- /// [`supports_onion_messages`]: crate::types::features::Features::supports_onion_messages
- #[cfg(feature = "dnssec")]
- pub fn enqueue_dns_onion_message(
- &self, message: DNSSECQuery, context: DNSResolverContext, dns_resolvers: Vec<Destination>,
- peers: Vec<MessageForwardNode>,
- ) -> Result<(), Bolt12SemanticError> {
- let reply_paths = self
- .create_blinded_paths(peers, MessageContext::DNSResolver(context))
- .map_err(|_| Bolt12SemanticError::MissingPaths)?;
-
- let message_params = dns_resolvers
- .iter()
- .flat_map(|destination| reply_paths.iter().map(move |path| (path, destination)))
- .take(OFFERS_MESSAGE_REQUEST_LIMIT);
- for (reply_path, destination) in message_params {
- self.pending_dns_onion_messages.lock().unwrap().push((
- DNSResolverMessage::DNSSECQuery(message.clone()),
- MessageSendInstructions::WithSpecifiedReplyPath {
- destination: destination.clone(),
- reply_path: reply_path.clone(),
- },
- ));
- }
-
- Ok(())
- }
-
/// Gets the enqueued [`OffersMessage`] with their corresponding [`MessageSendInstructions`].
pub fn release_pending_offers_messages(&self) -> Vec<(OffersMessage, MessageSendInstructions)> {
core::mem::take(&mut self.pending_offers_messages.lock().unwrap())
@@ -1353,14 +1296,6 @@ impl<MR: MessageRouter, L: Logger> OffersMessageFlow<MR, L> {
core::mem::take(&mut self.pending_async_payments_messages.lock().unwrap())
}
- /// Gets the enqueued [`DNSResolverMessage`] with their corresponding [`MessageSendInstructions`].
- #[cfg(feature = "dnssec")]
- pub fn release_pending_dns_messages(
- &self,
- ) -> Vec<(DNSResolverMessage, MessageSendInstructions)> {
- core::mem::take(&mut self.pending_dns_onion_messages.lock().unwrap())
- }
-
/// Retrieve an [`Offer`] for receiving async payments as an often-offline recipient. Will only
/// return an offer if [`Self::set_paths_to_static_invoice_server`] was called and we succeeded in
/// interactively building a [`StaticInvoice`] with the static invoice server.
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.