common: add randbytes() wrapper to override cryptographic entropy: $CLN_DEV_ENTROPY_SEED
What the developer wrote
Authored by Rusty Russell
common: add randbytes() wrapper to override cryptographic entropy: $CLN_DEV_ENTROPY_SEED
Only in developer mode, ofc.
Notes:
1. We have to move the initialization before the lightningd main trace_start,
since that uses pseudorand().
2. To make the results stable, we need to use per-caller values to randbytes().
Otherwise external timing changes the call order.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit adds a developer-only feature that lets programmers override the randomness source used by Core Lightning during testing, via an environment variable. It is explicitly gated behind 'developer mode' and is not intended for production use. The patch itself only updates test build files and adds missing stub functions so unit tests compile with the new wrapper. There is no indication it weakens real network security.
Verify that the new $CLN_DEV_ENTROPY_SEED override is strictly disabled in release/production builds and cannot be compiled in accidentally. Review the randbytes() wrapper implementation (not included in this diff) for proper gating. No urgent action is required for the build/test changes shown.
Security signals we found
New cryptographic-randomness override mechanism, but explicitly developer-mode only
Environment-variable seeding could reduce entropy if accidentally enabled in production
No production code changes visible in the diff
Commit message clearly frames feature as testing aid, not security fix or vulnerability
Evidence from the diff
The change introduces a randbytes() wrapper that can be seeded with $CLN_DEV_ENTROPY_SEED, but only in developer builds. The visible diff adjusts Makefiles to link common/randbytes.o into several unit tests and adds generated stub implementations (memleak_add_helper_, memleak_scan_htable, notleak_) in three test files so they continue to link. The commit message notes initialization ordering changes and per-caller stable seeds for reproducible tests. No production code paths are altered in the supplied diff.
Changed components
common/randbytes (new wrapper, not shown in diff)common/test/Makefilewire/test/Makefilecommon/test/run-htable.ccommon/test/run-route-infloop.conchaind/test/run-grind_feerate-bug.cInspect captured patch +29 / −0
diff --git a/common/test/Makefile b/common/test/Makefile
index fa4da33..71f9dc1 100644
--- a/common/test/Makefile
+++ b/common/test/Makefile
@@ -36,6 +36,7 @@ common/test/run-json: \
common/lease_rates.o \
common/node_id.o \
common/pseudorand.o \
+ common/randbytes.o \
common/wireaddr.o \
wire/fromwire.o \
wire/onion_wiregen.o \
@@ -49,6 +50,7 @@ common/test/run-route common/test/run-route-specific common/test/run-route-inflo
common/gossmap.o \
common/node_id.o \
common/pseudorand.o \
+ common/randbytes.o \
common/route.o \
common/gossip_store_wiregen.o \
wire/fromwire.o \
@@ -158,6 +160,7 @@ common/test/run-mkdatastorekey: \
common/pseudorand.o
common/test/run-htable: \
+ common/randbytes.o \
common/pseudorand.o
common/test/run-shutdown_scriptpubkey: wire/towire.o wire/fromwire.o
diff --git a/common/test/run-htable.c b/common/test/run-htable.c
index 267ad8c..32a2631 100644
--- a/common/test/run-htable.c
+++ b/common/test/run-htable.c
@@ -81,6 +81,15 @@ u8 fromwire_u8(const u8 **cursor UNNEEDED, size_t *max UNNEEDED)
/* Generated stub for fromwire_u8_array */
void fromwire_u8_array(const u8 **cursor UNNEEDED, size_t *max UNNEEDED, u8 *arr UNNEEDED, size_t num UNNEEDED)
{ fprintf(stderr, "fromwire_u8_array called!\n"); abort(); }
+/* Generated stub for memleak_add_helper_ */
+void memleak_add_helper_(const tal_t *p UNNEEDED, void (*cb)(struct htable *memtable UNNEEDED,
+ const tal_t *)){ }
+/* Generated stub for memleak_scan_htable */
+void memleak_scan_htable(struct htable *memtable UNNEEDED, const struct htable *ht UNNEEDED)
+{ fprintf(stderr, "memleak_scan_htable called!\n"); abort(); }
+/* Generated stub for notleak_ */
+void *notleak_(void *ptr UNNEEDED, bool plus_children UNNEEDED)
+{ fprintf(stderr, "notleak_ called!\n"); abort(); }
/* Generated stub for towire */
void towire(u8 **pptr UNNEEDED, const void *data UNNEEDED, size_t len UNNEEDED)
{ fprintf(stderr, "towire called!\n"); abort(); }
diff --git a/common/test/run-route-infloop.c b/common/test/run-route-infloop.c
index 7556fd2..4e4ee30 100644
--- a/common/test/run-route-infloop.c
+++ b/common/test/run-route-infloop.c
@@ -32,6 +32,15 @@ bool fromwire_tlv(const u8 **cursor UNNEEDED, size_t *max UNNEEDED,
void *record UNNEEDED, struct tlv_field **fields UNNEEDED,
const u64 *extra_types UNNEEDED, size_t *err_off UNNEEDED, u64 *err_type UNNEEDED)
{ fprintf(stderr, "fromwire_tlv called!\n"); abort(); }
+/* Generated stub for memleak_add_helper_ */
+void memleak_add_helper_(const tal_t *p UNNEEDED, void (*cb)(struct htable *memtable UNNEEDED,
+ const tal_t *)){ }
+/* Generated stub for memleak_scan_htable */
+void memleak_scan_htable(struct htable *memtable UNNEEDED, const struct htable *ht UNNEEDED)
+{ fprintf(stderr, "memleak_scan_htable called!\n"); abort(); }
+/* Generated stub for notleak_ */
+void *notleak_(void *ptr UNNEEDED, bool plus_children UNNEEDED)
+{ fprintf(stderr, "notleak_ called!\n"); abort(); }
/* Generated stub for sciddir_or_pubkey_from_node_id */
bool sciddir_or_pubkey_from_node_id(struct sciddir_or_pubkey *sciddpk UNNEEDED,
const struct node_id *node_id UNNEEDED)
diff --git a/onchaind/test/run-grind_feerate-bug.c b/onchaind/test/run-grind_feerate-bug.c
index 4854902..a389a49 100644
--- a/onchaind/test/run-grind_feerate-bug.c
+++ b/onchaind/test/run-grind_feerate-bug.c
@@ -88,9 +88,15 @@ struct bitcoin_tx *htlc_success_tx(const tal_t *ctx UNNEEDED,
/* Generated stub for master_badmsg */
void master_badmsg(u32 type_expected UNNEEDED, const u8 *msg)
{ fprintf(stderr, "master_badmsg called!\n"); abort(); }
+/* Generated stub for memleak_add_helper_ */
+void memleak_add_helper_(const tal_t *p UNNEEDED, void (*cb)(struct htable *memtable UNNEEDED,
+ const tal_t *)){ }
/* Generated stub for memleak_ptr */
bool memleak_ptr(struct htable *memtable UNNEEDED, const void *p UNNEEDED)
{ fprintf(stderr, "memleak_ptr called!\n"); abort(); }
+/* Generated stub for memleak_scan_htable */
+void memleak_scan_htable(struct htable *memtable UNNEEDED, const struct htable *ht UNNEEDED)
+{ fprintf(stderr, "memleak_scan_htable called!\n"); abort(); }
/* Generated stub for memleak_scan_obj */
void memleak_scan_obj(struct htable *memtable UNNEEDED, const void *obj UNNEEDED)
{ fprintf(stderr, "memleak_scan_obj called!\n"); abort(); }
diff --git a/wire/test/Makefile b/wire/test/Makefile
index 276cab6..ad3720a 100644
--- a/wire/test/Makefile
+++ b/wire/test/Makefile
@@ -17,6 +17,7 @@ WIRE_TEST_COMMON_OBJS := \
common/utils.o \
common/wireaddr.o
+# run-tlvstream.c and run-peer-wire.c provide their own mocks for randbytes_ and randbytes_overridden
# run-tlvstream.c needs to reach into bitcoin/pubkey for SUPERVERBOSE
$(WIRE_TEST_PROGRAMS): $(WIRE_TEST_COMMON_OBJS) $(filter-out bitcoin/pubkey.o bitcoin/chainparams.o,$(BITCOIN_OBJS))
@@ -25,3 +26,4 @@ $(WIRE_TEST_OBJS): $(WIRE_HEADERS) $(WIRE_SRC) $(WIRE_PRINT_SRC) wire/test/Makef
wire-tests: $(WIRE_TEST_PROGRAMS:%=unittest/%)
wire/test/run-peer-wire: wire/peer_wiregen.o common/bigsize.o
+
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.