Add LSPS5 DOS protections.

lightning-liquidity/src/lsps1/service.rs

@@ -174,6 +174,15 @@ where
 		&self.config
 	}
 
+	pub(crate) fn has_active_requests(&self, counterparty_node_id: &PublicKey) -> bool {
+		let outer_state_lock = self.per_peer_state.read().unwrap();
+		outer_state_lock.get(counterparty_node_id).map_or(false, |inner| {
+			let peer_state = inner.lock().unwrap();
+			!(peer_state.pending_requests.is_empty()
+				&& peer_state.outbound_channels_by_order_id.is_empty())
+		})
+	}
+
 	fn handle_get_info_request(
 		&self, request_id: LSPSRequestId, counterparty_node_id: &PublicKey,
 	) -> Result<(), LightningError> {

lightning-liquidity/src/lsps2/service.rs

@@ -572,6 +572,23 @@ where
 		&self.config
 	}
 
+	/// Returns whether the peer has any opening or open JIT channels.
+	pub(crate) fn has_opening_or_open_jit_channel(&self, counterparty_node_id: &PublicKey) -> bool {
+		let outer_state_lock = self.per_peer_state.read().unwrap();
+		outer_state_lock.get(counterparty_node_id).map_or(false, |inner| {
+			let peer_state = inner.lock().unwrap();
+			peer_state.outbound_channels_by_intercept_scid.values().any(|chan| {
+				matches!(
+					chan.state,
+					OutboundJITChannelState::PendingChannelOpen { .. }
+						| OutboundJITChannelState::PendingPaymentForward { .. }
+						| OutboundJITChannelState::PendingPayment { .. }
+						| OutboundJITChannelState::PaymentForwarded { .. }
+				)
+			})
+		})
+	}
+
 	/// Used by LSP to inform a client requesting a JIT Channel the token they used is invalid.
 	///
 	/// Should be called in response to receiving a [`LSPS2ServiceEvent::GetInfo`] event.

lightning-liquidity/src/lsps5/service.rs

@@ -150,6 +150,19 @@ where
 		}
 	}
 
+	/// Returns whether a request from the given client should be accepted.
+	///
+	/// Prior activity includes an existing open channel, an active LSPS1 flow,
+	/// or an LSPS2 flow that has an opening or open JIT channel.
+	pub(crate) fn can_accept_request(
+		&self, client_id: &PublicKey, lsps2_has_opening_or_open_jit_channel: bool,
+		lsps1_has_activity: bool,
+	) -> bool {
+		self.client_has_open_channel(client_id)
+			|| lsps2_has_opening_or_open_jit_channel
+			|| lsps1_has_activity
+	}
+
 	fn check_prune_stale_webhooks(&self) {
 		let now =
 			LSPSDateTime::new_from_duration_since_epoch(self.time_provider.duration_since_epoch());

lightning-liquidity/src/manager.rs

@@ -559,6 +559,32 @@ where
 			LSPSMessage::LSPS5(msg @ LSPS5Message::Request(..)) => {
 				match &self.lsps5_service_handler {
 					Some(lsps5_service_handler) => {
+						let lsps2_has_opening_or_open_jit_channel = self
+							.lsps2_service_handler
+							.as_ref()
+							.map_or(false, |h| h.has_opening_or_open_jit_channel(sender_node_id));
+						#[cfg(lsps1_service)]
+						let lsps1_has_active_requests = self
+							.lsps1_service_handler
+							.as_ref()
+							.map_or(false, |h| h.has_active_requests(sender_node_id));
+						#[cfg(not(lsps1_service))]
+						let lsps1_has_active_requests = false;
+
+						if !lsps5_service_handler.can_accept_request(
+							sender_node_id,
+							lsps2_has_opening_or_open_jit_channel,
+							lsps1_has_active_requests,
+						) {
+							return Err(LightningError {
+                                    err: format!(
+                                        "Rejecting LSPS5 request from {:?} without prior activity (requires open channel or active LSPS1 or LSPS2 flow)",
+                                        sender_node_id
+                                    ),
+                                    action: ErrorAction::IgnoreAndLog(Level::Debug),
+                                });
+						}
+
 						lsps5_service_handler.handle_message(msg, sender_node_id)?;
 					},
 					None => {