Add the core functionality required to resolve Human Readable Names

ci/ci-tests.sh

@@ -56,6 +56,10 @@ for DIR in "${WORKSPACE_MEMBERS[@]}"; do
 	cargo doc -p "$DIR" --document-private-items
 done
 
+echo -e "\n\nChecking and testing lightning crate with dnssec feature"
+cargo test -p lightning --verbose --color always --features dnssec
+cargo check -p lightning --verbose --color always --features dnssec
+
 echo -e "\n\nChecking and testing Block Sync Clients with features"
 
 cargo test -p lightning-block-sync --verbose --color always --features rest-client

fuzz/src/onion_message.rs

@@ -11,6 +11,7 @@ use lightning::blinded_path::message::{
 use lightning::blinded_path::EmptyNodeIdLookUp;
 use lightning::ln::features::InitFeatures;
 use lightning::ln::msgs::{self, DecodeError, OnionMessageHandler};
+use lightning::ln::peer_handler::IgnoringMessageHandler;
 use lightning::ln::script::ShutdownScript;
 use lightning::offers::invoice::UnsignedBolt12Invoice;
 use lightning::offers::invoice_request::UnsignedInvoiceRequest;
@@ -56,6 +57,7 @@ pub fn do_test<L: Logger>(data: &[u8], logger: &L) {
  &message_router,
  &offers_msg_handler,
  &async_payments_msg_handler,
+ IgnoringMessageHandler {}, // TODO: Move to ChannelManager once it supports DNSSEC.
  &custom_msg_handler,
  );
 

lightning-background-processor/src/lib.rs

@@ -657,7 +657,7 @@ use futures_util::{dummy_waker, OptionalSelector, Selector, SelectorOutput};
 /// # type NetworkGraph = lightning::routing::gossip::NetworkGraph<Arc<Logger>>;
 /// # type P2PGossipSync<UL> = lightning::routing::gossip::P2PGossipSync<Arc<NetworkGraph>, Arc<UL>, Arc<Logger>>;
 /// # type ChannelManager<B, F, FE> = lightning::ln::channelmanager::SimpleArcChannelManager<ChainMonitor<B, F, FE>, B, FE, Logger>;
-/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
+/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
 /// # type Scorer = RwLock<lightning::routing::scoring::ProbabilisticScorer<Arc<NetworkGraph>, Arc<Logger>>>;
 /// # type PeerManager<B, F, FE, UL> = lightning::ln::peer_handler::SimpleArcPeerManager<SocketDescriptor, ChainMonitor<B, F, FE>, B, FE, Arc<UL>, Logger>;
 /// #
@@ -1202,6 +1202,7 @@ mod tests {
  IgnoringMessageHandler,
  Arc<ChannelManager>,
  IgnoringMessageHandler,
+ IgnoringMessageHandler,
 	>;
 
 	struct Node {
@@ -1604,6 +1605,7 @@ mod tests {
  IgnoringMessageHandler {},
  manager.clone(),
  IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  ));
  let wallet = Arc::new(TestWallet {});
  let sweeper = Arc::new(OutputSweeper::new(

lightning/Cargo.toml

@@ -12,7 +12,7 @@ Still missing tons of error-handling. See GitHub issues for suggested projects i
 edition = "2021"
 
 [package.metadata.docs.rs]
-features = ["std"]
+features = ["std", "dnssec"]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [features]
@@ -31,6 +31,8 @@ unsafe_revoked_tx_signing = []
 
 std = []
 
+dnssec = ["dnssec-prover/validation"]
+
 # Generates low-r bitcoin signatures, which saves 1 byte in 50% of the cases
 grind_signatures = []
 
@@ -43,8 +45,10 @@ lightning-invoice = { version = "0.32.0", path = "../lightning-invoice", default
 bech32 = { version = "0.9.1", default-features = false }
 bitcoin = { version = "0.32.2", default-features = false, features = ["secp-recovery"] }
 
+dnssec-prover = { version = "0.6", default-features = false }
 hashbrown = { version = "0.13", default-features = false }
 possiblyrandom = { version = "0.2", path = "../possiblyrandom", default-features = false }
+
 regex = { version = "1.5.6", optional = true }
 backtrace = { version = "0.3", optional = true }
 

lightning/src/blinded_path/message.rs

@@ -284,6 +284,11 @@ pub enum MessageContext {
 	///
 	/// [`AsyncPaymentsMessage`]: crate::onion_message::async_payments::AsyncPaymentsMessage
 	AsyncPayments(AsyncPaymentsContext),
+	/// Represents a context for a blinded path used in a reply path when requesting a DNSSEC proof
+	/// in a [`DNSResolverMessage`].
+	///
+	/// [`DNSResolverMessage`]: crate::onion_message::dns_resolution::DNSResolverMessage
+	DNSResolver(DNSResolverContext),
 	/// Context specific to a [`CustomOnionMessageHandler::CustomMessage`].
 	///
 	/// [`CustomOnionMessageHandler::CustomMessage`]: crate::onion_message::messenger::CustomOnionMessageHandler::CustomMessage
@@ -402,6 +407,7 @@ impl_writeable_tlv_based_enum!(MessageContext,
 	{0, Offers} => (),
 	{1, Custom} => (),
 	{2, AsyncPayments} => (),
+	{3, DNSResolver} => (),
 );
 
 impl_writeable_tlv_based_enum!(OffersContext,
@@ -428,6 +434,24 @@ impl_writeable_tlv_based_enum!(AsyncPaymentsContext,
 	},
 );
 
+/// Contains a simple nonce for use in a blinded path's context.
+///
+/// Such a context is required when receiving a [`DNSSECProof`] message.
+///
+/// [`DNSSECProof`]: crate::onion_message::dns_resolution::DNSSECProof
+#[derive(Clone, Debug, Hash, PartialEq, Eq)]
+pub struct DNSResolverContext {
+	/// A nonce which uniquely describes a DNS resolution.
+	///
+	/// When we receive a DNSSEC proof message, we should check that it was sent over the blinded
+	/// path we included in the request by comparing a stored nonce with this one.
+	pub nonce: [u8; 16],
+}
+
+impl_writeable_tlv_based!(DNSResolverContext, {
+	(0, nonce, required),
+});
+
 /// Construct blinded onion message hops for the given `intermediate_nodes` and `recipient_node_id`.
 pub(super) fn blinded_hops<T: secp256k1::Signing + secp256k1::Verification>(
 	secp_ctx: &Secp256k1<T>, intermediate_nodes: &[MessageForwardNode],

lightning/src/ln/functional_test_utils.rs

@@ -415,6 +415,7 @@ type TestOnionMessenger<'chan_man, 'node_cfg, 'chan_mon_cfg> = OnionMessenger<
 	&'node_cfg test_utils::TestMessageRouter<'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
+	IgnoringMessageHandler, // TODO: Swap for ChannelManager (when built with the "dnssec" feature)
 	IgnoringMessageHandler,
 >;
 
@@ -3283,6 +3284,7 @@ pub fn create_network<'a, 'b: 'a, 'c: 'b>(node_count: usize, cfgs: &'b Vec<NodeC
  let onion_messenger = OnionMessenger::new(
  dedicated_entropy, cfgs[i].keys_manager, cfgs[i].logger, &chan_mgrs[i],
  &cfgs[i].message_router, &chan_mgrs[i], &chan_mgrs[i], IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  );
  let gossip_sync = P2PGossipSync::new(cfgs[i].network_graph.as_ref(), None, cfgs[i].logger);
  let wallet_source = Arc::new(test_utils::TestWalletSource::new(SecretKey::from_slice(&[i as u8 + 1; 32]).unwrap()));

lightning/src/ln/offers_tests.rs

@@ -212,9 +212,7 @@ fn extract_invoice_request<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -231,9 +229,7 @@ fn extract_invoice<'a, 'b, 'c>(node: &Node<'a, 'b, 'c>, message: &OnionMessage)
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -252,9 +248,7 @@ fn extract_invoice_error<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => error,
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message: {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),

lightning/src/ln/peer_handler.rs

@@ -18,7 +18,7 @@
 use bitcoin::constants::ChainHash;
 use bitcoin::secp256k1::{self, Secp256k1, SecretKey, PublicKey};
 
-use crate::blinded_path::message::{AsyncPaymentsContext, OffersContext};
+use crate::blinded_path::message::{AsyncPaymentsContext, DNSResolverContext, OffersContext};
 use crate::sign::{NodeSigner, Recipient};
 use crate::events::{MessageSendEvent, MessageSendEventsProvider};
 use crate::ln::types::ChannelId;
@@ -30,6 +30,7 @@ use crate::ln::peer_channel_encryptor::{PeerChannelEncryptor, NextNoiseStep, Mes
 use crate::ln::wire;
 use crate::ln::wire::{Encode, Type};
 use crate::onion_message::async_payments::{AsyncPaymentsMessageHandler, HeldHtlcAvailable, ReleaseHeldHtlc};
+use crate::onion_message::dns_resolution::{DNSResolverMessageHandler, DNSResolverMessage, DNSSECProof, DNSSECQuery};
 use crate::onion_message::messenger::{CustomOnionMessageHandler, Responder, ResponseInstruction, MessageSendInstructions};
 use crate::onion_message::offers::{OffersMessage, OffersMessageHandler};
 use crate::onion_message::packet::OnionMessageContents;
@@ -154,6 +155,14 @@ impl AsyncPaymentsMessageHandler for IgnoringMessageHandler {
 	}
 	fn release_held_htlc(&self, _message: ReleaseHeldHtlc, _context: AsyncPaymentsContext) {}
 }
+impl DNSResolverMessageHandler for IgnoringMessageHandler {
+	fn handle_dnssec_query(
+ &self, _message: DNSSECQuery, _responder: Option<Responder>,
+	) -> Option<(DNSResolverMessage, ResponseInstruction)> {
+ None
+	}
+	fn handle_dnssec_proof(&self, _message: DNSSECProof, _context: DNSResolverContext) {}
+}
 impl CustomOnionMessageHandler for IgnoringMessageHandler {
 	type CustomMessage = Infallible;
 	fn handle_custom_message(&self, _message: Infallible, _context: Option<Vec<u8>>, _responder: Option<Responder>) -> Option<(Infallible, ResponseInstruction)> {

ci/ci-tests.sh

@@ -56,6 +56,10 @@ for DIR in "${WORKSPACE_MEMBERS[@]}"; do
 	cargo doc -p "$DIR" --document-private-items
 done
 
+echo -e "\n\nChecking and testing lightning crate with dnssec feature"
+cargo test -p lightning --verbose --color always --features dnssec
+cargo check -p lightning --verbose --color always --features dnssec
+
 echo -e "\n\nChecking and testing Block Sync Clients with features"
 
 cargo test -p lightning-block-sync --verbose --color always --features rest-client

fuzz/src/onion_message.rs

@@ -11,6 +11,7 @@ use lightning::blinded_path::message::{
 use lightning::blinded_path::EmptyNodeIdLookUp;
 use lightning::ln::features::InitFeatures;
 use lightning::ln::msgs::{self, DecodeError, OnionMessageHandler};
+use lightning::ln::peer_handler::IgnoringMessageHandler;
 use lightning::ln::script::ShutdownScript;
 use lightning::offers::invoice::UnsignedBolt12Invoice;
 use lightning::offers::invoice_request::UnsignedInvoiceRequest;
@@ -56,6 +57,7 @@ pub fn do_test<L: Logger>(data: &[u8], logger: &L) {
  &message_router,
  &offers_msg_handler,
  &async_payments_msg_handler,
+ IgnoringMessageHandler {}, // TODO: Move to ChannelManager once it supports DNSSEC.
  &custom_msg_handler,
  );
 

lightning-background-processor/src/lib.rs

@@ -657,7 +657,7 @@ use futures_util::{dummy_waker, OptionalSelector, Selector, SelectorOutput};
 /// # type NetworkGraph = lightning::routing::gossip::NetworkGraph<Arc<Logger>>;
 /// # type P2PGossipSync<UL> = lightning::routing::gossip::P2PGossipSync<Arc<NetworkGraph>, Arc<UL>, Arc<Logger>>;
 /// # type ChannelManager<B, F, FE> = lightning::ln::channelmanager::SimpleArcChannelManager<ChainMonitor<B, F, FE>, B, FE, Logger>;
-/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
+/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
 /// # type Scorer = RwLock<lightning::routing::scoring::ProbabilisticScorer<Arc<NetworkGraph>, Arc<Logger>>>;
 /// # type PeerManager<B, F, FE, UL> = lightning::ln::peer_handler::SimpleArcPeerManager<SocketDescriptor, ChainMonitor<B, F, FE>, B, FE, Arc<UL>, Logger>;
 /// #
@@ -1202,6 +1202,7 @@ mod tests {
  IgnoringMessageHandler,
  Arc<ChannelManager>,
  IgnoringMessageHandler,
+ IgnoringMessageHandler,
 	>;
 
 	struct Node {
@@ -1604,6 +1605,7 @@ mod tests {
  IgnoringMessageHandler {},
  manager.clone(),
  IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  ));
  let wallet = Arc::new(TestWallet {});
  let sweeper = Arc::new(OutputSweeper::new(

lightning/Cargo.toml

@@ -12,7 +12,7 @@ Still missing tons of error-handling. See GitHub issues for suggested projects i
 edition = "2021"
 
 [package.metadata.docs.rs]
-features = ["std"]
+features = ["std", "dnssec"]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [features]
@@ -31,6 +31,8 @@ unsafe_revoked_tx_signing = []
 
 std = []
 
+dnssec = ["dnssec-prover/validation"]
+
 # Generates low-r bitcoin signatures, which saves 1 byte in 50% of the cases
 grind_signatures = []
 
@@ -43,8 +45,10 @@ lightning-invoice = { version = "0.32.0", path = "../lightning-invoice", default
 bech32 = { version = "0.9.1", default-features = false }
 bitcoin = { version = "0.32.2", default-features = false, features = ["secp-recovery"] }
 
+dnssec-prover = { version = "0.6", default-features = false }
 hashbrown = { version = "0.13", default-features = false }
 possiblyrandom = { version = "0.2", path = "../possiblyrandom", default-features = false }
+
 regex = { version = "1.5.6", optional = true }
 backtrace = { version = "0.3", optional = true }
 

lightning/src/blinded_path/message.rs

@@ -284,6 +284,11 @@ pub enum MessageContext {
 	///
 	/// [`AsyncPaymentsMessage`]: crate::onion_message::async_payments::AsyncPaymentsMessage
 	AsyncPayments(AsyncPaymentsContext),
+	/// Represents a context for a blinded path used in a reply path when requesting a DNSSEC proof
+	/// in a [`DNSResolverMessage`].
+	///
+	/// [`DNSResolverMessage`]: crate::onion_message::dns_resolution::DNSResolverMessage
+	DNSResolver(DNSResolverContext),
 	/// Context specific to a [`CustomOnionMessageHandler::CustomMessage`].
 	///
 	/// [`CustomOnionMessageHandler::CustomMessage`]: crate::onion_message::messenger::CustomOnionMessageHandler::CustomMessage
@@ -402,6 +407,7 @@ impl_writeable_tlv_based_enum!(MessageContext,
 	{0, Offers} => (),
 	{1, Custom} => (),
 	{2, AsyncPayments} => (),
+	{3, DNSResolver} => (),
 );
 
 impl_writeable_tlv_based_enum!(OffersContext,
@@ -428,6 +434,24 @@ impl_writeable_tlv_based_enum!(AsyncPaymentsContext,
 	},
 );
 
+/// Contains a simple nonce for use in a blinded path's context.
+///
+/// Such a context is required when receiving a [`DNSSECProof`] message.
+///
+/// [`DNSSECProof`]: crate::onion_message::dns_resolution::DNSSECProof
+#[derive(Clone, Debug, Hash, PartialEq, Eq)]
+pub struct DNSResolverContext {
+	/// A nonce which uniquely describes a DNS resolution.
+	///
+	/// When we receive a DNSSEC proof message, we should check that it was sent over the blinded
+	/// path we included in the request by comparing a stored nonce with this one.
+	pub nonce: [u8; 16],
+}
+
+impl_writeable_tlv_based!(DNSResolverContext, {
+	(0, nonce, required),
+});
+
 /// Construct blinded onion message hops for the given `intermediate_nodes` and `recipient_node_id`.
 pub(super) fn blinded_hops<T: secp256k1::Signing + secp256k1::Verification>(
 	secp_ctx: &Secp256k1<T>, intermediate_nodes: &[MessageForwardNode],

lightning/src/ln/functional_test_utils.rs

@@ -415,6 +415,7 @@ type TestOnionMessenger<'chan_man, 'node_cfg, 'chan_mon_cfg> = OnionMessenger<
 	&'node_cfg test_utils::TestMessageRouter<'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
+	IgnoringMessageHandler, // TODO: Swap for ChannelManager (when built with the "dnssec" feature)
 	IgnoringMessageHandler,
 >;
 
@@ -3283,6 +3284,7 @@ pub fn create_network<'a, 'b: 'a, 'c: 'b>(node_count: usize, cfgs: &'b Vec<NodeC
  let onion_messenger = OnionMessenger::new(
  dedicated_entropy, cfgs[i].keys_manager, cfgs[i].logger, &chan_mgrs[i],
  &cfgs[i].message_router, &chan_mgrs[i], &chan_mgrs[i], IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  );
  let gossip_sync = P2PGossipSync::new(cfgs[i].network_graph.as_ref(), None, cfgs[i].logger);
  let wallet_source = Arc::new(test_utils::TestWalletSource::new(SecretKey::from_slice(&[i as u8 + 1; 32]).unwrap()));

lightning/src/ln/offers_tests.rs

@@ -212,9 +212,7 @@ fn extract_invoice_request<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -231,9 +229,7 @@ fn extract_invoice<'a, 'b, 'c>(node: &Node<'a, 'b, 'c>, message: &OnionMessage)
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -252,9 +248,7 @@ fn extract_invoice_error<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => error,
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message: {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),

lightning/src/ln/peer_handler.rs

@@ -18,7 +18,7 @@
 use bitcoin::constants::ChainHash;
 use bitcoin::secp256k1::{self, Secp256k1, SecretKey, PublicKey};
 
-use crate::blinded_path::message::{AsyncPaymentsContext, OffersContext};
+use crate::blinded_path::message::{AsyncPaymentsContext, DNSResolverContext, OffersContext};
 use crate::sign::{NodeSigner, Recipient};
 use crate::events::{MessageSendEvent, MessageSendEventsProvider};
 use crate::ln::types::ChannelId;
@@ -30,6 +30,7 @@ use crate::ln::peer_channel_encryptor::{PeerChannelEncryptor, NextNoiseStep, Mes
 use crate::ln::wire;
 use crate::ln::wire::{Encode, Type};
 use crate::onion_message::async_payments::{AsyncPaymentsMessageHandler, HeldHtlcAvailable, ReleaseHeldHtlc};
+use crate::onion_message::dns_resolution::{DNSResolverMessageHandler, DNSResolverMessage, DNSSECProof, DNSSECQuery};
 use crate::onion_message::messenger::{CustomOnionMessageHandler, Responder, ResponseInstruction, MessageSendInstructions};
 use crate::onion_message::offers::{OffersMessage, OffersMessageHandler};
 use crate::onion_message::packet::OnionMessageContents;
@@ -154,6 +155,14 @@ impl AsyncPaymentsMessageHandler for IgnoringMessageHandler {
 	}
 	fn release_held_htlc(&self, _message: ReleaseHeldHtlc, _context: AsyncPaymentsContext) {}
 }
+impl DNSResolverMessageHandler for IgnoringMessageHandler {
+	fn handle_dnssec_query(
+ &self, _message: DNSSECQuery, _responder: Option<Responder>,
+	) -> Option<(DNSResolverMessage, ResponseInstruction)> {
+ None
+	}
+	fn handle_dnssec_proof(&self, _message: DNSSECProof, _context: DNSResolverContext) {}
+}
 impl CustomOnionMessageHandler for IgnoringMessageHandler {
 	type CustomMessage = Infallible;
 	fn handle_custom_message(&self, _message: Infallible, _context: Option<Vec<u8>>, _responder: Option<Responder>) -> Option<(Infallible, ResponseInstruction)> {

ci/ci-tests.sh

@@ -56,6 +56,10 @@ for DIR in "${WORKSPACE_MEMBERS[@]}"; do
 	cargo doc -p "$DIR" --document-private-items
 done
 
+echo -e "\n\nChecking and testing lightning crate with dnssec feature"
+cargo test -p lightning --verbose --color always --features dnssec
+cargo check -p lightning --verbose --color always --features dnssec
+
 echo -e "\n\nChecking and testing Block Sync Clients with features"
 
 cargo test -p lightning-block-sync --verbose --color always --features rest-client

fuzz/src/onion_message.rs

@@ -11,6 +11,7 @@ use lightning::blinded_path::message::{
 use lightning::blinded_path::EmptyNodeIdLookUp;
 use lightning::ln::features::InitFeatures;
 use lightning::ln::msgs::{self, DecodeError, OnionMessageHandler};
+use lightning::ln::peer_handler::IgnoringMessageHandler;
 use lightning::ln::script::ShutdownScript;
 use lightning::offers::invoice::UnsignedBolt12Invoice;
 use lightning::offers::invoice_request::UnsignedInvoiceRequest;
@@ -56,6 +57,7 @@ pub fn do_test<L: Logger>(data: &[u8], logger: &L) {
  &message_router,
  &offers_msg_handler,
  &async_payments_msg_handler,
+ IgnoringMessageHandler {}, // TODO: Move to ChannelManager once it supports DNSSEC.
  &custom_msg_handler,
  );
 

lightning-background-processor/src/lib.rs

@@ -657,7 +657,7 @@ use futures_util::{dummy_waker, OptionalSelector, Selector, SelectorOutput};
 /// # type NetworkGraph = lightning::routing::gossip::NetworkGraph<Arc<Logger>>;
 /// # type P2PGossipSync<UL> = lightning::routing::gossip::P2PGossipSync<Arc<NetworkGraph>, Arc<UL>, Arc<Logger>>;
 /// # type ChannelManager<B, F, FE> = lightning::ln::channelmanager::SimpleArcChannelManager<ChainMonitor<B, F, FE>, B, FE, Logger>;
-/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
+/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
 /// # type Scorer = RwLock<lightning::routing::scoring::ProbabilisticScorer<Arc<NetworkGraph>, Arc<Logger>>>;
 /// # type PeerManager<B, F, FE, UL> = lightning::ln::peer_handler::SimpleArcPeerManager<SocketDescriptor, ChainMonitor<B, F, FE>, B, FE, Arc<UL>, Logger>;
 /// #
@@ -1202,6 +1202,7 @@ mod tests {
  IgnoringMessageHandler,
  Arc<ChannelManager>,
  IgnoringMessageHandler,
+ IgnoringMessageHandler,
 	>;
 
 	struct Node {
@@ -1604,6 +1605,7 @@ mod tests {
  IgnoringMessageHandler {},
  manager.clone(),
  IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  ));
  let wallet = Arc::new(TestWallet {});
  let sweeper = Arc::new(OutputSweeper::new(

lightning/Cargo.toml

@@ -12,7 +12,7 @@ Still missing tons of error-handling. See GitHub issues for suggested projects i
 edition = "2021"
 
 [package.metadata.docs.rs]
-features = ["std"]
+features = ["std", "dnssec"]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [features]
@@ -31,6 +31,8 @@ unsafe_revoked_tx_signing = []
 
 std = []
 
+dnssec = ["dnssec-prover/validation"]
+
 # Generates low-r bitcoin signatures, which saves 1 byte in 50% of the cases
 grind_signatures = []
 
@@ -43,8 +45,10 @@ lightning-invoice = { version = "0.32.0", path = "../lightning-invoice", default
 bech32 = { version = "0.9.1", default-features = false }
 bitcoin = { version = "0.32.2", default-features = false, features = ["secp-recovery"] }
 
+dnssec-prover = { version = "0.6", default-features = false }
 hashbrown = { version = "0.13", default-features = false }
 possiblyrandom = { version = "0.2", path = "../possiblyrandom", default-features = false }
+
 regex = { version = "1.5.6", optional = true }
 backtrace = { version = "0.3", optional = true }
 

lightning/src/blinded_path/message.rs

@@ -284,6 +284,11 @@ pub enum MessageContext {
 	///
 	/// [`AsyncPaymentsMessage`]: crate::onion_message::async_payments::AsyncPaymentsMessage
 	AsyncPayments(AsyncPaymentsContext),
+	/// Represents a context for a blinded path used in a reply path when requesting a DNSSEC proof
+	/// in a [`DNSResolverMessage`].
+	///
+	/// [`DNSResolverMessage`]: crate::onion_message::dns_resolution::DNSResolverMessage
+	DNSResolver(DNSResolverContext),
 	/// Context specific to a [`CustomOnionMessageHandler::CustomMessage`].
 	///
 	/// [`CustomOnionMessageHandler::CustomMessage`]: crate::onion_message::messenger::CustomOnionMessageHandler::CustomMessage
@@ -402,6 +407,7 @@ impl_writeable_tlv_based_enum!(MessageContext,
 	{0, Offers} => (),
 	{1, Custom} => (),
 	{2, AsyncPayments} => (),
+	{3, DNSResolver} => (),
 );
 
 impl_writeable_tlv_based_enum!(OffersContext,
@@ -428,6 +434,24 @@ impl_writeable_tlv_based_enum!(AsyncPaymentsContext,
 	},
 );
 
+/// Contains a simple nonce for use in a blinded path's context.
+///
+/// Such a context is required when receiving a [`DNSSECProof`] message.
+///
+/// [`DNSSECProof`]: crate::onion_message::dns_resolution::DNSSECProof
+#[derive(Clone, Debug, Hash, PartialEq, Eq)]
+pub struct DNSResolverContext {
+	/// A nonce which uniquely describes a DNS resolution.
+	///
+	/// When we receive a DNSSEC proof message, we should check that it was sent over the blinded
+	/// path we included in the request by comparing a stored nonce with this one.
+	pub nonce: [u8; 16],
+}
+
+impl_writeable_tlv_based!(DNSResolverContext, {
+	(0, nonce, required),
+});
+
 /// Construct blinded onion message hops for the given `intermediate_nodes` and `recipient_node_id`.
 pub(super) fn blinded_hops<T: secp256k1::Signing + secp256k1::Verification>(
 	secp_ctx: &Secp256k1<T>, intermediate_nodes: &[MessageForwardNode],

lightning/src/ln/functional_test_utils.rs

@@ -415,6 +415,7 @@ type TestOnionMessenger<'chan_man, 'node_cfg, 'chan_mon_cfg> = OnionMessenger<
 	&'node_cfg test_utils::TestMessageRouter<'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
+	IgnoringMessageHandler, // TODO: Swap for ChannelManager (when built with the "dnssec" feature)
 	IgnoringMessageHandler,
 >;
 
@@ -3283,6 +3284,7 @@ pub fn create_network<'a, 'b: 'a, 'c: 'b>(node_count: usize, cfgs: &'b Vec<NodeC
  let onion_messenger = OnionMessenger::new(
  dedicated_entropy, cfgs[i].keys_manager, cfgs[i].logger, &chan_mgrs[i],
  &cfgs[i].message_router, &chan_mgrs[i], &chan_mgrs[i], IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  );
  let gossip_sync = P2PGossipSync::new(cfgs[i].network_graph.as_ref(), None, cfgs[i].logger);
  let wallet_source = Arc::new(test_utils::TestWalletSource::new(SecretKey::from_slice(&[i as u8 + 1; 32]).unwrap()));

lightning/src/ln/offers_tests.rs

@@ -212,9 +212,7 @@ fn extract_invoice_request<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -231,9 +229,7 @@ fn extract_invoice<'a, 'b, 'c>(node: &Node<'a, 'b, 'c>, message: &OnionMessage)
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -252,9 +248,7 @@ fn extract_invoice_error<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => error,
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message: {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),

lightning/src/ln/peer_handler.rs

@@ -18,7 +18,7 @@
 use bitcoin::constants::ChainHash;
 use bitcoin::secp256k1::{self, Secp256k1, SecretKey, PublicKey};
 
-use crate::blinded_path::message::{AsyncPaymentsContext, OffersContext};
+use crate::blinded_path::message::{AsyncPaymentsContext, DNSResolverContext, OffersContext};
 use crate::sign::{NodeSigner, Recipient};
 use crate::events::{MessageSendEvent, MessageSendEventsProvider};
 use crate::ln::types::ChannelId;
@@ -30,6 +30,7 @@ use crate::ln::peer_channel_encryptor::{PeerChannelEncryptor, NextNoiseStep, Mes
 use crate::ln::wire;
 use crate::ln::wire::{Encode, Type};
 use crate::onion_message::async_payments::{AsyncPaymentsMessageHandler, HeldHtlcAvailable, ReleaseHeldHtlc};
+use crate::onion_message::dns_resolution::{DNSResolverMessageHandler, DNSResolverMessage, DNSSECProof, DNSSECQuery};
 use crate::onion_message::messenger::{CustomOnionMessageHandler, Responder, ResponseInstruction, MessageSendInstructions};
 use crate::onion_message::offers::{OffersMessage, OffersMessageHandler};
 use crate::onion_message::packet::OnionMessageContents;
@@ -154,6 +155,14 @@ impl AsyncPaymentsMessageHandler for IgnoringMessageHandler {
 	}
 	fn release_held_htlc(&self, _message: ReleaseHeldHtlc, _context: AsyncPaymentsContext) {}
 }
+impl DNSResolverMessageHandler for IgnoringMessageHandler {
+	fn handle_dnssec_query(
+ &self, _message: DNSSECQuery, _responder: Option<Responder>,
+	) -> Option<(DNSResolverMessage, ResponseInstruction)> {
+ None
+	}
+	fn handle_dnssec_proof(&self, _message: DNSSECProof, _context: DNSResolverContext) {}
+}
 impl CustomOnionMessageHandler for IgnoringMessageHandler {
 	type CustomMessage = Infallible;
 	fn handle_custom_message(&self, _message: Infallible, _context: Option<Vec<u8>>, _responder: Option<Responder>) -> Option<(Infallible, ResponseInstruction)> {

ci/ci-tests.sh

@@ -56,6 +56,10 @@ for DIR in "${WORKSPACE_MEMBERS[@]}"; do
 	cargo doc -p "$DIR" --document-private-items
 done
 
+echo -e "\n\nChecking and testing lightning crate with dnssec feature"
+cargo test -p lightning --verbose --color always --features dnssec
+cargo check -p lightning --verbose --color always --features dnssec
+
 echo -e "\n\nChecking and testing Block Sync Clients with features"
 
 cargo test -p lightning-block-sync --verbose --color always --features rest-client

fuzz/src/onion_message.rs

@@ -11,6 +11,7 @@ use lightning::blinded_path::message::{
 use lightning::blinded_path::EmptyNodeIdLookUp;
 use lightning::ln::features::InitFeatures;
 use lightning::ln::msgs::{self, DecodeError, OnionMessageHandler};
+use lightning::ln::peer_handler::IgnoringMessageHandler;
 use lightning::ln::script::ShutdownScript;
 use lightning::offers::invoice::UnsignedBolt12Invoice;
 use lightning::offers::invoice_request::UnsignedInvoiceRequest;
@@ -56,6 +57,7 @@ pub fn do_test<L: Logger>(data: &[u8], logger: &L) {
  &message_router,
  &offers_msg_handler,
  &async_payments_msg_handler,
+ IgnoringMessageHandler {}, // TODO: Move to ChannelManager once it supports DNSSEC.
  &custom_msg_handler,
  );
 

lightning-background-processor/src/lib.rs

@@ -657,7 +657,7 @@ use futures_util::{dummy_waker, OptionalSelector, Selector, SelectorOutput};
 /// # type NetworkGraph = lightning::routing::gossip::NetworkGraph<Arc<Logger>>;
 /// # type P2PGossipSync<UL> = lightning::routing::gossip::P2PGossipSync<Arc<NetworkGraph>, Arc<UL>, Arc<Logger>>;
 /// # type ChannelManager<B, F, FE> = lightning::ln::channelmanager::SimpleArcChannelManager<ChainMonitor<B, F, FE>, B, FE, Logger>;
-/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
+/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
 /// # type Scorer = RwLock<lightning::routing::scoring::ProbabilisticScorer<Arc<NetworkGraph>, Arc<Logger>>>;
 /// # type PeerManager<B, F, FE, UL> = lightning::ln::peer_handler::SimpleArcPeerManager<SocketDescriptor, ChainMonitor<B, F, FE>, B, FE, Arc<UL>, Logger>;
 /// #
@@ -1202,6 +1202,7 @@ mod tests {
  IgnoringMessageHandler,
  Arc<ChannelManager>,
  IgnoringMessageHandler,
+ IgnoringMessageHandler,
 	>;
 
 	struct Node {
@@ -1604,6 +1605,7 @@ mod tests {
  IgnoringMessageHandler {},
  manager.clone(),
  IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  ));
  let wallet = Arc::new(TestWallet {});
  let sweeper = Arc::new(OutputSweeper::new(

lightning/Cargo.toml

@@ -12,7 +12,7 @@ Still missing tons of error-handling. See GitHub issues for suggested projects i
 edition = "2021"
 
 [package.metadata.docs.rs]
-features = ["std"]
+features = ["std", "dnssec"]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [features]
@@ -31,6 +31,8 @@ unsafe_revoked_tx_signing = []
 
 std = []
 
+dnssec = ["dnssec-prover/validation"]
+
 # Generates low-r bitcoin signatures, which saves 1 byte in 50% of the cases
 grind_signatures = []
 
@@ -43,8 +45,10 @@ lightning-invoice = { version = "0.32.0", path = "../lightning-invoice", default
 bech32 = { version = "0.9.1", default-features = false }
 bitcoin = { version = "0.32.2", default-features = false, features = ["secp-recovery"] }
 
+dnssec-prover = { version = "0.6", default-features = false }
 hashbrown = { version = "0.13", default-features = false }
 possiblyrandom = { version = "0.2", path = "../possiblyrandom", default-features = false }
+
 regex = { version = "1.5.6", optional = true }
 backtrace = { version = "0.3", optional = true }
 

lightning/src/blinded_path/message.rs

@@ -284,6 +284,11 @@ pub enum MessageContext {
 	///
 	/// [`AsyncPaymentsMessage`]: crate::onion_message::async_payments::AsyncPaymentsMessage
 	AsyncPayments(AsyncPaymentsContext),
+	/// Represents a context for a blinded path used in a reply path when requesting a DNSSEC proof
+	/// in a [`DNSResolverMessage`].
+	///
+	/// [`DNSResolverMessage`]: crate::onion_message::dns_resolution::DNSResolverMessage
+	DNSResolver(DNSResolverContext),
 	/// Context specific to a [`CustomOnionMessageHandler::CustomMessage`].
 	///
 	/// [`CustomOnionMessageHandler::CustomMessage`]: crate::onion_message::messenger::CustomOnionMessageHandler::CustomMessage
@@ -402,6 +407,7 @@ impl_writeable_tlv_based_enum!(MessageContext,
 	{0, Offers} => (),
 	{1, Custom} => (),
 	{2, AsyncPayments} => (),
+	{3, DNSResolver} => (),
 );
 
 impl_writeable_tlv_based_enum!(OffersContext,
@@ -428,6 +434,24 @@ impl_writeable_tlv_based_enum!(AsyncPaymentsContext,
 	},
 );
 
+/// Contains a simple nonce for use in a blinded path's context.
+///
+/// Such a context is required when receiving a [`DNSSECProof`] message.
+///
+/// [`DNSSECProof`]: crate::onion_message::dns_resolution::DNSSECProof
+#[derive(Clone, Debug, Hash, PartialEq, Eq)]
+pub struct DNSResolverContext {
+	/// A nonce which uniquely describes a DNS resolution.
+	///
+	/// When we receive a DNSSEC proof message, we should check that it was sent over the blinded
+	/// path we included in the request by comparing a stored nonce with this one.
+	pub nonce: [u8; 16],
+}
+
+impl_writeable_tlv_based!(DNSResolverContext, {
+	(0, nonce, required),
+});
+
 /// Construct blinded onion message hops for the given `intermediate_nodes` and `recipient_node_id`.
 pub(super) fn blinded_hops<T: secp256k1::Signing + secp256k1::Verification>(
 	secp_ctx: &Secp256k1<T>, intermediate_nodes: &[MessageForwardNode],

lightning/src/ln/functional_test_utils.rs

@@ -415,6 +415,7 @@ type TestOnionMessenger<'chan_man, 'node_cfg, 'chan_mon_cfg> = OnionMessenger<
 	&'node_cfg test_utils::TestMessageRouter<'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
+	IgnoringMessageHandler, // TODO: Swap for ChannelManager (when built with the "dnssec" feature)
 	IgnoringMessageHandler,
 >;
 
@@ -3283,6 +3284,7 @@ pub fn create_network<'a, 'b: 'a, 'c: 'b>(node_count: usize, cfgs: &'b Vec<NodeC
  let onion_messenger = OnionMessenger::new(
  dedicated_entropy, cfgs[i].keys_manager, cfgs[i].logger, &chan_mgrs[i],
  &cfgs[i].message_router, &chan_mgrs[i], &chan_mgrs[i], IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  );
  let gossip_sync = P2PGossipSync::new(cfgs[i].network_graph.as_ref(), None, cfgs[i].logger);
  let wallet_source = Arc::new(test_utils::TestWalletSource::new(SecretKey::from_slice(&[i as u8 + 1; 32]).unwrap()));

lightning/src/ln/offers_tests.rs

@@ -212,9 +212,7 @@ fn extract_invoice_request<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -231,9 +229,7 @@ fn extract_invoice<'a, 'b, 'c>(node: &Node<'a, 'b, 'c>, message: &OnionMessage)
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -252,9 +248,7 @@ fn extract_invoice_error<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => error,
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message: {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),

lightning/src/ln/peer_handler.rs

@@ -18,7 +18,7 @@
 use bitcoin::constants::ChainHash;
 use bitcoin::secp256k1::{self, Secp256k1, SecretKey, PublicKey};
 
-use crate::blinded_path::message::{AsyncPaymentsContext, OffersContext};
+use crate::blinded_path::message::{AsyncPaymentsContext, DNSResolverContext, OffersContext};
 use crate::sign::{NodeSigner, Recipient};
 use crate::events::{MessageSendEvent, MessageSendEventsProvider};
 use crate::ln::types::ChannelId;
@@ -30,6 +30,7 @@ use crate::ln::peer_channel_encryptor::{PeerChannelEncryptor, NextNoiseStep, Mes
 use crate::ln::wire;
 use crate::ln::wire::{Encode, Type};
 use crate::onion_message::async_payments::{AsyncPaymentsMessageHandler, HeldHtlcAvailable, ReleaseHeldHtlc};
+use crate::onion_message::dns_resolution::{DNSResolverMessageHandler, DNSResolverMessage, DNSSECProof, DNSSECQuery};
 use crate::onion_message::messenger::{CustomOnionMessageHandler, Responder, ResponseInstruction, MessageSendInstructions};
 use crate::onion_message::offers::{OffersMessage, OffersMessageHandler};
 use crate::onion_message::packet::OnionMessageContents;
@@ -154,6 +155,14 @@ impl AsyncPaymentsMessageHandler for IgnoringMessageHandler {
 	}
 	fn release_held_htlc(&self, _message: ReleaseHeldHtlc, _context: AsyncPaymentsContext) {}
 }
+impl DNSResolverMessageHandler for IgnoringMessageHandler {
+	fn handle_dnssec_query(
+ &self, _message: DNSSECQuery, _responder: Option<Responder>,
+	) -> Option<(DNSResolverMessage, ResponseInstruction)> {
+ None
+	}
+	fn handle_dnssec_proof(&self, _message: DNSSECProof, _context: DNSResolverContext) {}
+}
 impl CustomOnionMessageHandler for IgnoringMessageHandler {
 	type CustomMessage = Infallible;
 	fn handle_custom_message(&self, _message: Infallible, _context: Option<Vec<u8>>, _responder: Option<Responder>) -> Option<(Infallible, ResponseInstruction)> {

ci/ci-tests.sh

@@ -56,6 +56,10 @@ for DIR in "${WORKSPACE_MEMBERS[@]}"; do
 	cargo doc -p "$DIR" --document-private-items
 done
 
+echo -e "\n\nChecking and testing lightning crate with dnssec feature"
+cargo test -p lightning --verbose --color always --features dnssec
+cargo check -p lightning --verbose --color always --features dnssec
+
 echo -e "\n\nChecking and testing Block Sync Clients with features"
 
 cargo test -p lightning-block-sync --verbose --color always --features rest-client

fuzz/src/onion_message.rs

@@ -11,6 +11,7 @@ use lightning::blinded_path::message::{
 use lightning::blinded_path::EmptyNodeIdLookUp;
 use lightning::ln::features::InitFeatures;
 use lightning::ln::msgs::{self, DecodeError, OnionMessageHandler};
+use lightning::ln::peer_handler::IgnoringMessageHandler;
 use lightning::ln::script::ShutdownScript;
 use lightning::offers::invoice::UnsignedBolt12Invoice;
 use lightning::offers::invoice_request::UnsignedInvoiceRequest;
@@ -56,6 +57,7 @@ pub fn do_test<L: Logger>(data: &[u8], logger: &L) {
  &message_router,
  &offers_msg_handler,
  &async_payments_msg_handler,
+ IgnoringMessageHandler {}, // TODO: Move to ChannelManager once it supports DNSSEC.
  &custom_msg_handler,
  );
 

lightning-background-processor/src/lib.rs

@@ -657,7 +657,7 @@ use futures_util::{dummy_waker, OptionalSelector, Selector, SelectorOutput};
 /// # type NetworkGraph = lightning::routing::gossip::NetworkGraph<Arc<Logger>>;
 /// # type P2PGossipSync<UL> = lightning::routing::gossip::P2PGossipSync<Arc<NetworkGraph>, Arc<UL>, Arc<Logger>>;
 /// # type ChannelManager<B, F, FE> = lightning::ln::channelmanager::SimpleArcChannelManager<ChainMonitor<B, F, FE>, B, FE, Logger>;
-/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
+/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
 /// # type Scorer = RwLock<lightning::routing::scoring::ProbabilisticScorer<Arc<NetworkGraph>, Arc<Logger>>>;
 /// # type PeerManager<B, F, FE, UL> = lightning::ln::peer_handler::SimpleArcPeerManager<SocketDescriptor, ChainMonitor<B, F, FE>, B, FE, Arc<UL>, Logger>;
 /// #
@@ -1202,6 +1202,7 @@ mod tests {
  IgnoringMessageHandler,
  Arc<ChannelManager>,
  IgnoringMessageHandler,
+ IgnoringMessageHandler,
 	>;
 
 	struct Node {
@@ -1604,6 +1605,7 @@ mod tests {
  IgnoringMessageHandler {},
  manager.clone(),
  IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  ));
  let wallet = Arc::new(TestWallet {});
  let sweeper = Arc::new(OutputSweeper::new(

lightning/Cargo.toml

@@ -12,7 +12,7 @@ Still missing tons of error-handling. See GitHub issues for suggested projects i
 edition = "2021"
 
 [package.metadata.docs.rs]
-features = ["std"]
+features = ["std", "dnssec"]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [features]
@@ -31,6 +31,8 @@ unsafe_revoked_tx_signing = []
 
 std = []
 
+dnssec = ["dnssec-prover/validation"]
+
 # Generates low-r bitcoin signatures, which saves 1 byte in 50% of the cases
 grind_signatures = []
 
@@ -43,8 +45,10 @@ lightning-invoice = { version = "0.32.0", path = "../lightning-invoice", default
 bech32 = { version = "0.9.1", default-features = false }
 bitcoin = { version = "0.32.2", default-features = false, features = ["secp-recovery"] }
 
+dnssec-prover = { version = "0.6", default-features = false }
 hashbrown = { version = "0.13", default-features = false }
 possiblyrandom = { version = "0.2", path = "../possiblyrandom", default-features = false }
+
 regex = { version = "1.5.6", optional = true }
 backtrace = { version = "0.3", optional = true }
 

lightning/src/blinded_path/message.rs

@@ -284,6 +284,11 @@ pub enum MessageContext {
 	///
 	/// [`AsyncPaymentsMessage`]: crate::onion_message::async_payments::AsyncPaymentsMessage
 	AsyncPayments(AsyncPaymentsContext),
+	/// Represents a context for a blinded path used in a reply path when requesting a DNSSEC proof
+	/// in a [`DNSResolverMessage`].
+	///
+	/// [`DNSResolverMessage`]: crate::onion_message::dns_resolution::DNSResolverMessage
+	DNSResolver(DNSResolverContext),
 	/// Context specific to a [`CustomOnionMessageHandler::CustomMessage`].
 	///
 	/// [`CustomOnionMessageHandler::CustomMessage`]: crate::onion_message::messenger::CustomOnionMessageHandler::CustomMessage
@@ -402,6 +407,7 @@ impl_writeable_tlv_based_enum!(MessageContext,
 	{0, Offers} => (),
 	{1, Custom} => (),
 	{2, AsyncPayments} => (),
+	{3, DNSResolver} => (),
 );
 
 impl_writeable_tlv_based_enum!(OffersContext,
@@ -428,6 +434,24 @@ impl_writeable_tlv_based_enum!(AsyncPaymentsContext,
 	},
 );
 
+/// Contains a simple nonce for use in a blinded path's context.
+///
+/// Such a context is required when receiving a [`DNSSECProof`] message.
+///
+/// [`DNSSECProof`]: crate::onion_message::dns_resolution::DNSSECProof
+#[derive(Clone, Debug, Hash, PartialEq, Eq)]
+pub struct DNSResolverContext {
+	/// A nonce which uniquely describes a DNS resolution.
+	///
+	/// When we receive a DNSSEC proof message, we should check that it was sent over the blinded
+	/// path we included in the request by comparing a stored nonce with this one.
+	pub nonce: [u8; 16],
+}
+
+impl_writeable_tlv_based!(DNSResolverContext, {
+	(0, nonce, required),
+});
+
 /// Construct blinded onion message hops for the given `intermediate_nodes` and `recipient_node_id`.
 pub(super) fn blinded_hops<T: secp256k1::Signing + secp256k1::Verification>(
 	secp_ctx: &Secp256k1<T>, intermediate_nodes: &[MessageForwardNode],

lightning/src/ln/functional_test_utils.rs

@@ -415,6 +415,7 @@ type TestOnionMessenger<'chan_man, 'node_cfg, 'chan_mon_cfg> = OnionMessenger<
 	&'node_cfg test_utils::TestMessageRouter<'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
+	IgnoringMessageHandler, // TODO: Swap for ChannelManager (when built with the "dnssec" feature)
 	IgnoringMessageHandler,
 >;
 
@@ -3283,6 +3284,7 @@ pub fn create_network<'a, 'b: 'a, 'c: 'b>(node_count: usize, cfgs: &'b Vec<NodeC
  let onion_messenger = OnionMessenger::new(
  dedicated_entropy, cfgs[i].keys_manager, cfgs[i].logger, &chan_mgrs[i],
  &cfgs[i].message_router, &chan_mgrs[i], &chan_mgrs[i], IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  );
  let gossip_sync = P2PGossipSync::new(cfgs[i].network_graph.as_ref(), None, cfgs[i].logger);
  let wallet_source = Arc::new(test_utils::TestWalletSource::new(SecretKey::from_slice(&[i as u8 + 1; 32]).unwrap()));

lightning/src/ln/offers_tests.rs

@@ -212,9 +212,7 @@ fn extract_invoice_request<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -231,9 +229,7 @@ fn extract_invoice<'a, 'b, 'c>(node: &Node<'a, 'b, 'c>, message: &OnionMessage)
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -252,9 +248,7 @@ fn extract_invoice_error<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => error,
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message: {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),

lightning/src/ln/peer_handler.rs

@@ -18,7 +18,7 @@
 use bitcoin::constants::ChainHash;
 use bitcoin::secp256k1::{self, Secp256k1, SecretKey, PublicKey};
 
-use crate::blinded_path::message::{AsyncPaymentsContext, OffersContext};
+use crate::blinded_path::message::{AsyncPaymentsContext, DNSResolverContext, OffersContext};
 use crate::sign::{NodeSigner, Recipient};
 use crate::events::{MessageSendEvent, MessageSendEventsProvider};
 use crate::ln::types::ChannelId;
@@ -30,6 +30,7 @@ use crate::ln::peer_channel_encryptor::{PeerChannelEncryptor, NextNoiseStep, Mes
 use crate::ln::wire;
 use crate::ln::wire::{Encode, Type};
 use crate::onion_message::async_payments::{AsyncPaymentsMessageHandler, HeldHtlcAvailable, ReleaseHeldHtlc};
+use crate::onion_message::dns_resolution::{DNSResolverMessageHandler, DNSResolverMessage, DNSSECProof, DNSSECQuery};
 use crate::onion_message::messenger::{CustomOnionMessageHandler, Responder, ResponseInstruction, MessageSendInstructions};
 use crate::onion_message::offers::{OffersMessage, OffersMessageHandler};
 use crate::onion_message::packet::OnionMessageContents;
@@ -154,6 +155,14 @@ impl AsyncPaymentsMessageHandler for IgnoringMessageHandler {
 	}
 	fn release_held_htlc(&self, _message: ReleaseHeldHtlc, _context: AsyncPaymentsContext) {}
 }
+impl DNSResolverMessageHandler for IgnoringMessageHandler {
+	fn handle_dnssec_query(
+ &self, _message: DNSSECQuery, _responder: Option<Responder>,
+	) -> Option<(DNSResolverMessage, ResponseInstruction)> {
+ None
+	}
+	fn handle_dnssec_proof(&self, _message: DNSSECProof, _context: DNSResolverContext) {}
+}
 impl CustomOnionMessageHandler for IgnoringMessageHandler {
 	type CustomMessage = Infallible;
 	fn handle_custom_message(&self, _message: Infallible, _context: Option<Vec<u8>>, _responder: Option<Responder>) -> Option<(Infallible, ResponseInstruction)> {

ci/ci-tests.sh

@@ -56,6 +56,10 @@ for DIR in "${WORKSPACE_MEMBERS[@]}"; do
 	cargo doc -p "$DIR" --document-private-items
 done
 
+echo -e "\n\nChecking and testing lightning crate with dnssec feature"
+cargo test -p lightning --verbose --color always --features dnssec
+cargo check -p lightning --verbose --color always --features dnssec
+
 echo -e "\n\nChecking and testing Block Sync Clients with features"
 
 cargo test -p lightning-block-sync --verbose --color always --features rest-client

fuzz/src/onion_message.rs

@@ -11,6 +11,7 @@ use lightning::blinded_path::message::{
 use lightning::blinded_path::EmptyNodeIdLookUp;
 use lightning::ln::features::InitFeatures;
 use lightning::ln::msgs::{self, DecodeError, OnionMessageHandler};
+use lightning::ln::peer_handler::IgnoringMessageHandler;
 use lightning::ln::script::ShutdownScript;
 use lightning::offers::invoice::UnsignedBolt12Invoice;
 use lightning::offers::invoice_request::UnsignedInvoiceRequest;
@@ -56,6 +57,7 @@ pub fn do_test<L: Logger>(data: &[u8], logger: &L) {
  &message_router,
  &offers_msg_handler,
  &async_payments_msg_handler,
+ IgnoringMessageHandler {}, // TODO: Move to ChannelManager once it supports DNSSEC.
  &custom_msg_handler,
  );
 

lightning-background-processor/src/lib.rs

@@ -657,7 +657,7 @@ use futures_util::{dummy_waker, OptionalSelector, Selector, SelectorOutput};
 /// # type NetworkGraph = lightning::routing::gossip::NetworkGraph<Arc<Logger>>;
 /// # type P2PGossipSync<UL> = lightning::routing::gossip::P2PGossipSync<Arc<NetworkGraph>, Arc<UL>, Arc<Logger>>;
 /// # type ChannelManager<B, F, FE> = lightning::ln::channelmanager::SimpleArcChannelManager<ChainMonitor<B, F, FE>, B, FE, Logger>;
-/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
+/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
 /// # type Scorer = RwLock<lightning::routing::scoring::ProbabilisticScorer<Arc<NetworkGraph>, Arc<Logger>>>;
 /// # type PeerManager<B, F, FE, UL> = lightning::ln::peer_handler::SimpleArcPeerManager<SocketDescriptor, ChainMonitor<B, F, FE>, B, FE, Arc<UL>, Logger>;
 /// #
@@ -1202,6 +1202,7 @@ mod tests {
  IgnoringMessageHandler,
  Arc<ChannelManager>,
  IgnoringMessageHandler,
+ IgnoringMessageHandler,
 	>;
 
 	struct Node {
@@ -1604,6 +1605,7 @@ mod tests {
  IgnoringMessageHandler {},
  manager.clone(),
  IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  ));
  let wallet = Arc::new(TestWallet {});
  let sweeper = Arc::new(OutputSweeper::new(

lightning/Cargo.toml

@@ -12,7 +12,7 @@ Still missing tons of error-handling. See GitHub issues for suggested projects i
 edition = "2021"
 
 [package.metadata.docs.rs]
-features = ["std"]
+features = ["std", "dnssec"]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [features]
@@ -31,6 +31,8 @@ unsafe_revoked_tx_signing = []
 
 std = []
 
+dnssec = ["dnssec-prover/validation"]
+
 # Generates low-r bitcoin signatures, which saves 1 byte in 50% of the cases
 grind_signatures = []
 
@@ -43,8 +45,10 @@ lightning-invoice = { version = "0.32.0", path = "../lightning-invoice", default
 bech32 = { version = "0.9.1", default-features = false }
 bitcoin = { version = "0.32.2", default-features = false, features = ["secp-recovery"] }
 
+dnssec-prover = { version = "0.6", default-features = false }
 hashbrown = { version = "0.13", default-features = false }
 possiblyrandom = { version = "0.2", path = "../possiblyrandom", default-features = false }
+
 regex = { version = "1.5.6", optional = true }
 backtrace = { version = "0.3", optional = true }
 

lightning/src/blinded_path/message.rs

@@ -284,6 +284,11 @@ pub enum MessageContext {
 	///
 	/// [`AsyncPaymentsMessage`]: crate::onion_message::async_payments::AsyncPaymentsMessage
 	AsyncPayments(AsyncPaymentsContext),
+	/// Represents a context for a blinded path used in a reply path when requesting a DNSSEC proof
+	/// in a [`DNSResolverMessage`].
+	///
+	/// [`DNSResolverMessage`]: crate::onion_message::dns_resolution::DNSResolverMessage
+	DNSResolver(DNSResolverContext),
 	/// Context specific to a [`CustomOnionMessageHandler::CustomMessage`].
 	///
 	/// [`CustomOnionMessageHandler::CustomMessage`]: crate::onion_message::messenger::CustomOnionMessageHandler::CustomMessage
@@ -402,6 +407,7 @@ impl_writeable_tlv_based_enum!(MessageContext,
 	{0, Offers} => (),
 	{1, Custom} => (),
 	{2, AsyncPayments} => (),
+	{3, DNSResolver} => (),
 );
 
 impl_writeable_tlv_based_enum!(OffersContext,
@@ -428,6 +434,24 @@ impl_writeable_tlv_based_enum!(AsyncPaymentsContext,
 	},
 );
 
+/// Contains a simple nonce for use in a blinded path's context.
+///
+/// Such a context is required when receiving a [`DNSSECProof`] message.
+///
+/// [`DNSSECProof`]: crate::onion_message::dns_resolution::DNSSECProof
+#[derive(Clone, Debug, Hash, PartialEq, Eq)]
+pub struct DNSResolverContext {
+	/// A nonce which uniquely describes a DNS resolution.
+	///
+	/// When we receive a DNSSEC proof message, we should check that it was sent over the blinded
+	/// path we included in the request by comparing a stored nonce with this one.
+	pub nonce: [u8; 16],
+}
+
+impl_writeable_tlv_based!(DNSResolverContext, {
+	(0, nonce, required),
+});
+
 /// Construct blinded onion message hops for the given `intermediate_nodes` and `recipient_node_id`.
 pub(super) fn blinded_hops<T: secp256k1::Signing + secp256k1::Verification>(
 	secp_ctx: &Secp256k1<T>, intermediate_nodes: &[MessageForwardNode],

lightning/src/ln/functional_test_utils.rs

@@ -415,6 +415,7 @@ type TestOnionMessenger<'chan_man, 'node_cfg, 'chan_mon_cfg> = OnionMessenger<
 	&'node_cfg test_utils::TestMessageRouter<'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
+	IgnoringMessageHandler, // TODO: Swap for ChannelManager (when built with the "dnssec" feature)
 	IgnoringMessageHandler,
 >;
 
@@ -3283,6 +3284,7 @@ pub fn create_network<'a, 'b: 'a, 'c: 'b>(node_count: usize, cfgs: &'b Vec<NodeC
  let onion_messenger = OnionMessenger::new(
  dedicated_entropy, cfgs[i].keys_manager, cfgs[i].logger, &chan_mgrs[i],
  &cfgs[i].message_router, &chan_mgrs[i], &chan_mgrs[i], IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  );
  let gossip_sync = P2PGossipSync::new(cfgs[i].network_graph.as_ref(), None, cfgs[i].logger);
  let wallet_source = Arc::new(test_utils::TestWalletSource::new(SecretKey::from_slice(&[i as u8 + 1; 32]).unwrap()));

lightning/src/ln/offers_tests.rs

@@ -212,9 +212,7 @@ fn extract_invoice_request<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -231,9 +229,7 @@ fn extract_invoice<'a, 'b, 'c>(node: &Node<'a, 'b, 'c>, message: &OnionMessage)
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -252,9 +248,7 @@ fn extract_invoice_error<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => error,
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message: {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),

lightning/src/ln/peer_handler.rs

@@ -18,7 +18,7 @@
 use bitcoin::constants::ChainHash;
 use bitcoin::secp256k1::{self, Secp256k1, SecretKey, PublicKey};
 
-use crate::blinded_path::message::{AsyncPaymentsContext, OffersContext};
+use crate::blinded_path::message::{AsyncPaymentsContext, DNSResolverContext, OffersContext};
 use crate::sign::{NodeSigner, Recipient};
 use crate::events::{MessageSendEvent, MessageSendEventsProvider};
 use crate::ln::types::ChannelId;
@@ -30,6 +30,7 @@ use crate::ln::peer_channel_encryptor::{PeerChannelEncryptor, NextNoiseStep, Mes
 use crate::ln::wire;
 use crate::ln::wire::{Encode, Type};
 use crate::onion_message::async_payments::{AsyncPaymentsMessageHandler, HeldHtlcAvailable, ReleaseHeldHtlc};
+use crate::onion_message::dns_resolution::{DNSResolverMessageHandler, DNSResolverMessage, DNSSECProof, DNSSECQuery};
 use crate::onion_message::messenger::{CustomOnionMessageHandler, Responder, ResponseInstruction, MessageSendInstructions};
 use crate::onion_message::offers::{OffersMessage, OffersMessageHandler};
 use crate::onion_message::packet::OnionMessageContents;
@@ -154,6 +155,14 @@ impl AsyncPaymentsMessageHandler for IgnoringMessageHandler {
 	}
 	fn release_held_htlc(&self, _message: ReleaseHeldHtlc, _context: AsyncPaymentsContext) {}
 }
+impl DNSResolverMessageHandler for IgnoringMessageHandler {
+	fn handle_dnssec_query(
+ &self, _message: DNSSECQuery, _responder: Option<Responder>,
+	) -> Option<(DNSResolverMessage, ResponseInstruction)> {
+ None
+	}
+	fn handle_dnssec_proof(&self, _message: DNSSECProof, _context: DNSResolverContext) {}
+}
 impl CustomOnionMessageHandler for IgnoringMessageHandler {
 	type CustomMessage = Infallible;
 	fn handle_custom_message(&self, _message: Infallible, _context: Option<Vec<u8>>, _responder: Option<Responder>) -> Option<(Infallible, ResponseInstruction)> {

ci/ci-tests.sh

@@ -56,6 +56,10 @@ for DIR in "${WORKSPACE_MEMBERS[@]}"; do
 	cargo doc -p "$DIR" --document-private-items
 done
 
+echo -e "\n\nChecking and testing lightning crate with dnssec feature"
+cargo test -p lightning --verbose --color always --features dnssec
+cargo check -p lightning --verbose --color always --features dnssec
+
 echo -e "\n\nChecking and testing Block Sync Clients with features"
 
 cargo test -p lightning-block-sync --verbose --color always --features rest-client

fuzz/src/onion_message.rs

@@ -11,6 +11,7 @@ use lightning::blinded_path::message::{
 use lightning::blinded_path::EmptyNodeIdLookUp;
 use lightning::ln::features::InitFeatures;
 use lightning::ln::msgs::{self, DecodeError, OnionMessageHandler};
+use lightning::ln::peer_handler::IgnoringMessageHandler;
 use lightning::ln::script::ShutdownScript;
 use lightning::offers::invoice::UnsignedBolt12Invoice;
 use lightning::offers::invoice_request::UnsignedInvoiceRequest;
@@ -56,6 +57,7 @@ pub fn do_test<L: Logger>(data: &[u8], logger: &L) {
  &message_router,
  &offers_msg_handler,
  &async_payments_msg_handler,
+ IgnoringMessageHandler {}, // TODO: Move to ChannelManager once it supports DNSSEC.
  &custom_msg_handler,
  );
 

lightning-background-processor/src/lib.rs

@@ -657,7 +657,7 @@ use futures_util::{dummy_waker, OptionalSelector, Selector, SelectorOutput};
 /// # type NetworkGraph = lightning::routing::gossip::NetworkGraph<Arc<Logger>>;
 /// # type P2PGossipSync<UL> = lightning::routing::gossip::P2PGossipSync<Arc<NetworkGraph>, Arc<UL>, Arc<Logger>>;
 /// # type ChannelManager<B, F, FE> = lightning::ln::channelmanager::SimpleArcChannelManager<ChainMonitor<B, F, FE>, B, FE, Logger>;
-/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
+/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
 /// # type Scorer = RwLock<lightning::routing::scoring::ProbabilisticScorer<Arc<NetworkGraph>, Arc<Logger>>>;
 /// # type PeerManager<B, F, FE, UL> = lightning::ln::peer_handler::SimpleArcPeerManager<SocketDescriptor, ChainMonitor<B, F, FE>, B, FE, Arc<UL>, Logger>;
 /// #
@@ -1202,6 +1202,7 @@ mod tests {
  IgnoringMessageHandler,
  Arc<ChannelManager>,
  IgnoringMessageHandler,
+ IgnoringMessageHandler,
 	>;
 
 	struct Node {
@@ -1604,6 +1605,7 @@ mod tests {
  IgnoringMessageHandler {},
  manager.clone(),
  IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  ));
  let wallet = Arc::new(TestWallet {});
  let sweeper = Arc::new(OutputSweeper::new(

lightning/Cargo.toml

@@ -12,7 +12,7 @@ Still missing tons of error-handling. See GitHub issues for suggested projects i
 edition = "2021"
 
 [package.metadata.docs.rs]
-features = ["std"]
+features = ["std", "dnssec"]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [features]
@@ -31,6 +31,8 @@ unsafe_revoked_tx_signing = []
 
 std = []
 
+dnssec = ["dnssec-prover/validation"]
+
 # Generates low-r bitcoin signatures, which saves 1 byte in 50% of the cases
 grind_signatures = []
 
@@ -43,8 +45,10 @@ lightning-invoice = { version = "0.32.0", path = "../lightning-invoice", default
 bech32 = { version = "0.9.1", default-features = false }
 bitcoin = { version = "0.32.2", default-features = false, features = ["secp-recovery"] }
 
+dnssec-prover = { version = "0.6", default-features = false }
 hashbrown = { version = "0.13", default-features = false }
 possiblyrandom = { version = "0.2", path = "../possiblyrandom", default-features = false }
+
 regex = { version = "1.5.6", optional = true }
 backtrace = { version = "0.3", optional = true }
 

lightning/src/blinded_path/message.rs

@@ -284,6 +284,11 @@ pub enum MessageContext {
 	///
 	/// [`AsyncPaymentsMessage`]: crate::onion_message::async_payments::AsyncPaymentsMessage
 	AsyncPayments(AsyncPaymentsContext),
+	/// Represents a context for a blinded path used in a reply path when requesting a DNSSEC proof
+	/// in a [`DNSResolverMessage`].
+	///
+	/// [`DNSResolverMessage`]: crate::onion_message::dns_resolution::DNSResolverMessage
+	DNSResolver(DNSResolverContext),
 	/// Context specific to a [`CustomOnionMessageHandler::CustomMessage`].
 	///
 	/// [`CustomOnionMessageHandler::CustomMessage`]: crate::onion_message::messenger::CustomOnionMessageHandler::CustomMessage
@@ -402,6 +407,7 @@ impl_writeable_tlv_based_enum!(MessageContext,
 	{0, Offers} => (),
 	{1, Custom} => (),
 	{2, AsyncPayments} => (),
+	{3, DNSResolver} => (),
 );
 
 impl_writeable_tlv_based_enum!(OffersContext,
@@ -428,6 +434,24 @@ impl_writeable_tlv_based_enum!(AsyncPaymentsContext,
 	},
 );
 
+/// Contains a simple nonce for use in a blinded path's context.
+///
+/// Such a context is required when receiving a [`DNSSECProof`] message.
+///
+/// [`DNSSECProof`]: crate::onion_message::dns_resolution::DNSSECProof
+#[derive(Clone, Debug, Hash, PartialEq, Eq)]
+pub struct DNSResolverContext {
+	/// A nonce which uniquely describes a DNS resolution.
+	///
+	/// When we receive a DNSSEC proof message, we should check that it was sent over the blinded
+	/// path we included in the request by comparing a stored nonce with this one.
+	pub nonce: [u8; 16],
+}
+
+impl_writeable_tlv_based!(DNSResolverContext, {
+	(0, nonce, required),
+});
+
 /// Construct blinded onion message hops for the given `intermediate_nodes` and `recipient_node_id`.
 pub(super) fn blinded_hops<T: secp256k1::Signing + secp256k1::Verification>(
 	secp_ctx: &Secp256k1<T>, intermediate_nodes: &[MessageForwardNode],

lightning/src/ln/functional_test_utils.rs

@@ -415,6 +415,7 @@ type TestOnionMessenger<'chan_man, 'node_cfg, 'chan_mon_cfg> = OnionMessenger<
 	&'node_cfg test_utils::TestMessageRouter<'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
+	IgnoringMessageHandler, // TODO: Swap for ChannelManager (when built with the "dnssec" feature)
 	IgnoringMessageHandler,
 >;
 
@@ -3283,6 +3284,7 @@ pub fn create_network<'a, 'b: 'a, 'c: 'b>(node_count: usize, cfgs: &'b Vec<NodeC
  let onion_messenger = OnionMessenger::new(
  dedicated_entropy, cfgs[i].keys_manager, cfgs[i].logger, &chan_mgrs[i],
  &cfgs[i].message_router, &chan_mgrs[i], &chan_mgrs[i], IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  );
  let gossip_sync = P2PGossipSync::new(cfgs[i].network_graph.as_ref(), None, cfgs[i].logger);
  let wallet_source = Arc::new(test_utils::TestWalletSource::new(SecretKey::from_slice(&[i as u8 + 1; 32]).unwrap()));

lightning/src/ln/offers_tests.rs

@@ -212,9 +212,7 @@ fn extract_invoice_request<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -231,9 +229,7 @@ fn extract_invoice<'a, 'b, 'c>(node: &Node<'a, 'b, 'c>, message: &OnionMessage)
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -252,9 +248,7 @@ fn extract_invoice_error<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => error,
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message: {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),

lightning/src/ln/peer_handler.rs

@@ -18,7 +18,7 @@
 use bitcoin::constants::ChainHash;
 use bitcoin::secp256k1::{self, Secp256k1, SecretKey, PublicKey};
 
-use crate::blinded_path::message::{AsyncPaymentsContext, OffersContext};
+use crate::blinded_path::message::{AsyncPaymentsContext, DNSResolverContext, OffersContext};
 use crate::sign::{NodeSigner, Recipient};
 use crate::events::{MessageSendEvent, MessageSendEventsProvider};
 use crate::ln::types::ChannelId;
@@ -30,6 +30,7 @@ use crate::ln::peer_channel_encryptor::{PeerChannelEncryptor, NextNoiseStep, Mes
 use crate::ln::wire;
 use crate::ln::wire::{Encode, Type};
 use crate::onion_message::async_payments::{AsyncPaymentsMessageHandler, HeldHtlcAvailable, ReleaseHeldHtlc};
+use crate::onion_message::dns_resolution::{DNSResolverMessageHandler, DNSResolverMessage, DNSSECProof, DNSSECQuery};
 use crate::onion_message::messenger::{CustomOnionMessageHandler, Responder, ResponseInstruction, MessageSendInstructions};
 use crate::onion_message::offers::{OffersMessage, OffersMessageHandler};
 use crate::onion_message::packet::OnionMessageContents;
@@ -154,6 +155,14 @@ impl AsyncPaymentsMessageHandler for IgnoringMessageHandler {
 	}
 	fn release_held_htlc(&self, _message: ReleaseHeldHtlc, _context: AsyncPaymentsContext) {}
 }
+impl DNSResolverMessageHandler for IgnoringMessageHandler {
+	fn handle_dnssec_query(
+ &self, _message: DNSSECQuery, _responder: Option<Responder>,
+	) -> Option<(DNSResolverMessage, ResponseInstruction)> {
+ None
+	}
+	fn handle_dnssec_proof(&self, _message: DNSSECProof, _context: DNSResolverContext) {}
+}
 impl CustomOnionMessageHandler for IgnoringMessageHandler {
 	type CustomMessage = Infallible;
 	fn handle_custom_message(&self, _message: Infallible, _context: Option<Vec<u8>>, _responder: Option<Responder>) -> Option<(Infallible, ResponseInstruction)> {

ci/ci-tests.sh

@@ -56,6 +56,10 @@ for DIR in "${WORKSPACE_MEMBERS[@]}"; do
 	cargo doc -p "$DIR" --document-private-items
 done
 
+echo -e "\n\nChecking and testing lightning crate with dnssec feature"
+cargo test -p lightning --verbose --color always --features dnssec
+cargo check -p lightning --verbose --color always --features dnssec
+
 echo -e "\n\nChecking and testing Block Sync Clients with features"
 
 cargo test -p lightning-block-sync --verbose --color always --features rest-client

fuzz/src/onion_message.rs

@@ -11,6 +11,7 @@ use lightning::blinded_path::message::{
 use lightning::blinded_path::EmptyNodeIdLookUp;
 use lightning::ln::features::InitFeatures;
 use lightning::ln::msgs::{self, DecodeError, OnionMessageHandler};
+use lightning::ln::peer_handler::IgnoringMessageHandler;
 use lightning::ln::script::ShutdownScript;
 use lightning::offers::invoice::UnsignedBolt12Invoice;
 use lightning::offers::invoice_request::UnsignedInvoiceRequest;
@@ -56,6 +57,7 @@ pub fn do_test<L: Logger>(data: &[u8], logger: &L) {
  &message_router,
  &offers_msg_handler,
  &async_payments_msg_handler,
+ IgnoringMessageHandler {}, // TODO: Move to ChannelManager once it supports DNSSEC.
  &custom_msg_handler,
  );
 

lightning-background-processor/src/lib.rs

@@ -657,7 +657,7 @@ use futures_util::{dummy_waker, OptionalSelector, Selector, SelectorOutput};
 /// # type NetworkGraph = lightning::routing::gossip::NetworkGraph<Arc<Logger>>;
 /// # type P2PGossipSync<UL> = lightning::routing::gossip::P2PGossipSync<Arc<NetworkGraph>, Arc<UL>, Arc<Logger>>;
 /// # type ChannelManager<B, F, FE> = lightning::ln::channelmanager::SimpleArcChannelManager<ChainMonitor<B, F, FE>, B, FE, Logger>;
-/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
+/// # type OnionMessenger<B, F, FE> = lightning::onion_message::messenger::OnionMessenger<Arc<lightning::sign::KeysManager>, Arc<lightning::sign::KeysManager>, Arc<Logger>, Arc<ChannelManager<B, F, FE>>, Arc<lightning::onion_message::messenger::DefaultMessageRouter<Arc<NetworkGraph>, Arc<Logger>, Arc<lightning::sign::KeysManager>>>, Arc<ChannelManager<B, F, FE>>, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler, lightning::ln::peer_handler::IgnoringMessageHandler>;
 /// # type Scorer = RwLock<lightning::routing::scoring::ProbabilisticScorer<Arc<NetworkGraph>, Arc<Logger>>>;
 /// # type PeerManager<B, F, FE, UL> = lightning::ln::peer_handler::SimpleArcPeerManager<SocketDescriptor, ChainMonitor<B, F, FE>, B, FE, Arc<UL>, Logger>;
 /// #
@@ -1202,6 +1202,7 @@ mod tests {
  IgnoringMessageHandler,
  Arc<ChannelManager>,
  IgnoringMessageHandler,
+ IgnoringMessageHandler,
 	>;
 
 	struct Node {
@@ -1604,6 +1605,7 @@ mod tests {
  IgnoringMessageHandler {},
  manager.clone(),
  IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  ));
  let wallet = Arc::new(TestWallet {});
  let sweeper = Arc::new(OutputSweeper::new(

lightning/Cargo.toml

@@ -12,7 +12,7 @@ Still missing tons of error-handling. See GitHub issues for suggested projects i
 edition = "2021"
 
 [package.metadata.docs.rs]
-features = ["std"]
+features = ["std", "dnssec"]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [features]
@@ -31,6 +31,8 @@ unsafe_revoked_tx_signing = []
 
 std = []
 
+dnssec = ["dnssec-prover/validation"]
+
 # Generates low-r bitcoin signatures, which saves 1 byte in 50% of the cases
 grind_signatures = []
 
@@ -43,8 +45,10 @@ lightning-invoice = { version = "0.32.0", path = "../lightning-invoice", default
 bech32 = { version = "0.9.1", default-features = false }
 bitcoin = { version = "0.32.2", default-features = false, features = ["secp-recovery"] }
 
+dnssec-prover = { version = "0.6", default-features = false }
 hashbrown = { version = "0.13", default-features = false }
 possiblyrandom = { version = "0.2", path = "../possiblyrandom", default-features = false }
+
 regex = { version = "1.5.6", optional = true }
 backtrace = { version = "0.3", optional = true }
 

lightning/src/blinded_path/message.rs

@@ -284,6 +284,11 @@ pub enum MessageContext {
 	///
 	/// [`AsyncPaymentsMessage`]: crate::onion_message::async_payments::AsyncPaymentsMessage
 	AsyncPayments(AsyncPaymentsContext),
+	/// Represents a context for a blinded path used in a reply path when requesting a DNSSEC proof
+	/// in a [`DNSResolverMessage`].
+	///
+	/// [`DNSResolverMessage`]: crate::onion_message::dns_resolution::DNSResolverMessage
+	DNSResolver(DNSResolverContext),
 	/// Context specific to a [`CustomOnionMessageHandler::CustomMessage`].
 	///
 	/// [`CustomOnionMessageHandler::CustomMessage`]: crate::onion_message::messenger::CustomOnionMessageHandler::CustomMessage
@@ -402,6 +407,7 @@ impl_writeable_tlv_based_enum!(MessageContext,
 	{0, Offers} => (),
 	{1, Custom} => (),
 	{2, AsyncPayments} => (),
+	{3, DNSResolver} => (),
 );
 
 impl_writeable_tlv_based_enum!(OffersContext,
@@ -428,6 +434,24 @@ impl_writeable_tlv_based_enum!(AsyncPaymentsContext,
 	},
 );
 
+/// Contains a simple nonce for use in a blinded path's context.
+///
+/// Such a context is required when receiving a [`DNSSECProof`] message.
+///
+/// [`DNSSECProof`]: crate::onion_message::dns_resolution::DNSSECProof
+#[derive(Clone, Debug, Hash, PartialEq, Eq)]
+pub struct DNSResolverContext {
+	/// A nonce which uniquely describes a DNS resolution.
+	///
+	/// When we receive a DNSSEC proof message, we should check that it was sent over the blinded
+	/// path we included in the request by comparing a stored nonce with this one.
+	pub nonce: [u8; 16],
+}
+
+impl_writeable_tlv_based!(DNSResolverContext, {
+	(0, nonce, required),
+});
+
 /// Construct blinded onion message hops for the given `intermediate_nodes` and `recipient_node_id`.
 pub(super) fn blinded_hops<T: secp256k1::Signing + secp256k1::Verification>(
 	secp_ctx: &Secp256k1<T>, intermediate_nodes: &[MessageForwardNode],

lightning/src/ln/functional_test_utils.rs

@@ -415,6 +415,7 @@ type TestOnionMessenger<'chan_man, 'node_cfg, 'chan_mon_cfg> = OnionMessenger<
 	&'node_cfg test_utils::TestMessageRouter<'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
 	&'chan_man TestChannelManager<'node_cfg, 'chan_mon_cfg>,
+	IgnoringMessageHandler, // TODO: Swap for ChannelManager (when built with the "dnssec" feature)
 	IgnoringMessageHandler,
 >;
 
@@ -3283,6 +3284,7 @@ pub fn create_network<'a, 'b: 'a, 'c: 'b>(node_count: usize, cfgs: &'b Vec<NodeC
  let onion_messenger = OnionMessenger::new(
  dedicated_entropy, cfgs[i].keys_manager, cfgs[i].logger, &chan_mgrs[i],
  &cfgs[i].message_router, &chan_mgrs[i], &chan_mgrs[i], IgnoringMessageHandler {},
+ IgnoringMessageHandler {},
  );
  let gossip_sync = P2PGossipSync::new(cfgs[i].network_graph.as_ref(), None, cfgs[i].logger);
  let wallet_source = Arc::new(test_utils::TestWalletSource::new(SecretKey::from_slice(&[i as u8 + 1; 32]).unwrap()));

lightning/src/ln/offers_tests.rs

@@ -212,9 +212,7 @@ fn extract_invoice_request<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -231,9 +229,7 @@ fn extract_invoice<'a, 'b, 'c>(node: &Node<'a, 'b, 'c>, message: &OnionMessage)
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected static invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => panic!("Unexpected invoice_error: {:?}", error),
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),
@@ -252,9 +248,7 @@ fn extract_invoice_error<'a, 'b, 'c>(
  OffersMessage::StaticInvoice(invoice) => panic!("Unexpected invoice: {:?}", invoice),
  OffersMessage::InvoiceError(error) => error,
  },
- #[cfg(async_payments)]
- ParsedOnionMessageContents::AsyncPayments(message) => panic!("Unexpected async payments message: {:?}", message),
- ParsedOnionMessageContents::Custom(message) => panic!("Unexpected custom message: {:?}", message),
+ _ => panic!("Unexpected message: {:?}", message),
  },
  Ok(PeeledOnion::Forward(_, _)) => panic!("Unexpected onion message forward"),
  Err(e) => panic!("Failed to process onion message {:?}", e),

lightning/src/ln/peer_handler.rs

@@ -18,7 +18,7 @@
 use bitcoin::constants::ChainHash;
 use bitcoin::secp256k1::{self, Secp256k1, SecretKey, PublicKey};
 
-use crate::blinded_path::message::{AsyncPaymentsContext, OffersContext};
+use crate::blinded_path::message::{AsyncPaymentsContext, DNSResolverContext, OffersContext};
 use crate::sign::{NodeSigner, Recipient};
 use crate::events::{MessageSendEvent, MessageSendEventsProvider};
 use crate::ln::types::ChannelId;
@@ -30,6 +30,7 @@ use crate::ln::peer_channel_encryptor::{PeerChannelEncryptor, NextNoiseStep, Mes
 use crate::ln::wire;
 use crate::ln::wire::{Encode, Type};
 use crate::onion_message::async_payments::{AsyncPaymentsMessageHandler, HeldHtlcAvailable, ReleaseHeldHtlc};
+use crate::onion_message::dns_resolution::{DNSResolverMessageHandler, DNSResolverMessage, DNSSECProof, DNSSECQuery};
 use crate::onion_message::messenger::{CustomOnionMessageHandler, Responder, ResponseInstruction, MessageSendInstructions};
 use crate::onion_message::offers::{OffersMessage, OffersMessageHandler};
 use crate::onion_message::packet::OnionMessageContents;
@@ -154,6 +155,14 @@ impl AsyncPaymentsMessageHandler for IgnoringMessageHandler {
 	}
 	fn release_held_htlc(&self, _message: ReleaseHeldHtlc, _context: AsyncPaymentsContext) {}
 }
+impl DNSResolverMessageHandler for IgnoringMessageHandler {
+	fn handle_dnssec_query(
+ &self, _message: DNSSECQuery, _responder: Option<Responder>,
+	) -> Option<(DNSResolverMessage, ResponseInstruction)> {
+ None
+	}
+	fn handle_dnssec_proof(&self, _message: DNSSECProof, _context: DNSResolverContext) {}
+}
 impl CustomOnionMessageHandler for IgnoringMessageHandler {
 	type CustomMessage = Infallible;
 	fn handle_custom_message(&self, _message: Infallible, _context: Option<Vec<u8>>, _responder: Option<Responder>) -> Option<(Infallible, ResponseInstruction)> {