Repository navigation
Fail closed on manager read errors - #1032
Conversation
Only a missing ChannelManager should create a fresh node. Propagate other storage errors so transient failures cannot replace live channel state with an empty manager. Fixes lightningdevkit#1026 Co-Authored-By: HAL 9000
|
I've assigned @TheBlueMatt as a reviewer! |
| if let Ok(reader) = channel_manager_bytes_res { | ||
| let channel_manager_bytes = match channel_manager_bytes_res { | ||
| Ok(reader) => Some(reader), | ||
| Err(e) if e.kind() == lightning::io::ErrorKind::NotFound => None, |
There was a problem hiding this comment.
Hmm, okay. I don't love reintroducing the assumption that the ErrorKind is "correct", but at worst we just refuse to start and the developer fixes their KVStore cause it should be obvious during development. Also I dunno how else to fix this so 🤷♂️
There was a problem hiding this comment.
Yeah, well, NotFound is at least part of the KVStore API contract.
There was a problem hiding this comment.
No we removed that when we fixed MonitorUpdatingPersister to no longer rely on it.
There was a problem hiding this comment.
No we removed that when we fixed MonitorUpdatingPersister to no longer rely on it.
Uh, but that's actually bad, as we do lean on it in LDK Node in several places. NotFound is always a special value for KVStores, irrespective of whether MonitorUpdatingPersister now returns it or not. We should re-add it then.
ldk-node 0.7.0 marks an in-flight outbound payment Failed when an inbound HTLC uses the same payment hash. cdk-ldk-node reports that status as a failed melt. A melt requester who holds the HTLC of their own invoice and keysends the same hash to the mint could thus release the melt proofs and then settle the HTLC. ldk-node 0.7.1 fixes these bugs: - an inbound HTLC that reuses an outbound payment hash no longer fails the outbound payment (lightningdevkit/ldk-node#1157); - a late PaymentFailed no longer overwrites a succeeded payment (lightningdevkit/ldk-node#1065); - a ChannelManager read error stops the build instead of starting a fresh node (lightningdevkit/ldk-node#1032). lightning 0.2.8 (with lightning-liquidity, lightning-transaction-sync and lightning-persister 0.2.8, and lightning-invoice 0.34.2) fixes: - a malicious BOLT11 route hint that removes channels from the graph (lightningdevkit/rust-lightning#5503); - an MPP startup panic after a channel monitor is archived (#5528); - a ChannelManager that fails to load after several payments to one hash (#5541); - anchor commitments held back when the fee-bump input cannot be funded (4825c089e); - 64-byte transactions skipped in Esplora sync (#5559). Only these six packages change in Cargo.lock and Cargo.lock.msrv. cargo update also re-resolved unrelated multi-version range dependencies, so those edges keep their earlier versions. The other LDK crates are already at their latest compatible releases. The workspace floors now require the fixed versions, so a regenerated lock cannot select the vulnerable ones. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WDmqYFNSovaSho9M89aXC9
Only a missing ChannelManager should create a fresh node. Propagate other storage errors so transient failures cannot replace live channel state with an empty manager.
Fixes #1026