connectd: remove DNS seeds entirely.
What the developer wrote
Authored by Rusty Russell
connectd: remove DNS seeds entirely.
For 25.05 (0a94f3b5706cd06e69ca120f1b77da8562cd2453) we removed DNS lookups,
but we left them for the corner case where a proxy is used. darosior points
out that his is no longer functional, which brought my attention to this
vestigial corner case.
Changelog-None: we said we'd removed them earlier!
Reported-by: darosior
Closes: https://github.com/ElementsProject/lightning/pull/8968
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit removes leftover code that let Core Lightning nodes look up peer addresses through two public DNS seed services when using a proxy. The project had already announced it was removing DNS seeds in an earlier version, but a small corner case was missed. This change finishes that removal. It is a cleanup/privacy-hardening change rather than a fix for an active security bug.
Treat as a defensive hardening/privacy cleanup. Review whether any documentation, tests, or configuration options still mention DNS seeds or the removed seeds. No urgent security patch is required, but users relying on proxy-only connectivity should ensure they have alternative ways to obtain peer addresses (e.g., gossip, explicit --addr, or manual connection).
Security signals we found
Removal of hard-coded third-party DNS seed dependencies
Reduction of network metadata leakage when using a proxy
Completes previously announced DNS-seed removal
No cryptographic, memory-safety, or remote-exploitation signals in the diff
Evidence from the diff
The patch deletes the seednames() helper and the logic in try_connect_peer() that, when no addresses were known and a proxy was configured, generated BOLT #10 DNS seed hostnames from a node_id and added them as unresolved wire addresses. The two hard-coded seeds (cdecker’s lseed.bitcoinstats.com and darosior’s lseed.darosior.ninja) are no longer referenced. This completes the DNS-seed removal started in commit 0a94f3b5706cd06e69ca120f1b77da8562cd2453.
Changed components
connectd/connectd.cDNS seed resolution path for proxied outbound peer connectionsInspect captured patch +0 / −41
diff --git a/connectd/connectd.c b/connectd/connectd.c
index 16a3c9e5..6685c471 100644
--- a/connectd/connectd.c
+++ b/connectd/connectd.c
@@ -1829,30 +1829,6 @@ static void connect_activate(struct daemon *daemon, const u8 *msg)
take(towire_connectd_activate_reply(NULL, errmsg)));
}
-/* BOLT #10:
- *
- * The DNS seed:
- * ...
- * - upon receiving a _node_ query:
- * - MUST select the record matching the `node_id`, if any, AND return all
- * addresses associated with that node.
- */
-static const char **seednames(const tal_t *ctx, const struct node_id *id)
-{
- char bech32[100];
- u5 *data = tal_arr(ctx, u5, 0);
- const char **seednames = tal_arr(ctx, const char *, 0);
-
- bech32_push_bits(&data, id->k, ARRAY_SIZE(id->k)*8);
- bech32_encode(bech32, "ln", data, tal_count(data), sizeof(bech32),
- BECH32_ENCODING_BECH32);
- /* This is cdecker's seed */
- tal_arr_expand(&seednames, tal_fmt(seednames, "%s.lseed.bitcoinstats.com", bech32));
- /* This is darosior's seed */
- tal_arr_expand(&seednames, tal_fmt(seednames, "%s.lseed.darosior.ninja", bech32));
- return seednames;
-}
-
static bool addr_in(const struct wireaddr_internal *needle,
const struct wireaddr_internal haystack[])
{
@@ -1869,7 +1845,6 @@ static void try_connect_peer(struct daemon *daemon,
struct wireaddr_internal *addrs TAKES,
const char *reason TAKES)
{
- bool use_proxy = daemon->always_use_proxy;
struct connecting *connect;
struct peer *peer;
@@ -1897,22 +1872,6 @@ static void try_connect_peer(struct daemon *daemon,
return;
}
- if (tal_count(addrs) == 0) {
- /* Don't resolve via DNS seed if we're supposed to use proxy. */
- if (use_proxy) {
- /* You're allowed to use names with proxies; in fact it's
- * a good idea. */
- struct wireaddr_internal unresolved;
- const char **hostnames = seednames(tmpctx, id);
- for (size_t i = 0; i < tal_count(hostnames); i++) {
- wireaddr_from_unresolved(&unresolved,
- hostnames[i],
- chainparams_get_ln_port(chainparams));
- tal_arr_expand(&addrs, unresolved);
- }
- }
- }
-
/* Still no address? Fail immediately. Important ones get
* retried; an address may get gossiped. */
if (tal_count(addrs) == 0) {
Why this scored 32/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.