lightningd: add dev-uniform-padding flag to lightningd
What changed, and why it matters
This commit adds a new hidden developer-only command-line flag called --dev-uniform-padding. When enabled, it tells the daemon to pad outgoing peer messages to fixed 1460-byte chunks as a defense against traffic analysis. The change only wires the flag through the daemon; the actual padding logic is not present in this commit. There is no security vulnerability here.
No action required. This is a benign feature-flag addition. If reviewing the eventual padding implementation, verify that padding does not leak message boundaries, does not break protocol framing, and handles memory/DoS limits safely.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch introduces a new boolean developer option dev_uniform_padding in lightningd and connectd, registers it with clnopt_noarg under OPT_DEV, and passes it via the connectd init wire message. The commit message and comments describe the intended purpose as padding outgoing messages to uniform 1460-byte segments for traffic-analysis defense. No implementation of the padding behavior is included in the diff, and no existing code paths are modified in a way that would introduce a bug or weakness.
Changed components
lightningd option parsingconnectd init wire protocoldeveloper-only CLI flagsInspect captured patch +18 / −4
diff --git a/connectd/connectd.c b/connectd/connectd.c
index 14dbb36b..eb488ec2 100644
--- a/connectd/connectd.c
+++ b/connectd/connectd.c
@@ -1689,8 +1689,9 @@ static void connect_init(struct daemon *daemon, const u8 *msg)
&dev_throttle_gossip,
&daemon->dev_no_reconnect,
&daemon->dev_fast_reconnect,
- &dev_limit_connections_inflight,
- &daemon->dev_keep_nagle)) {
+ &dev_limit_connections_inflight,
+ &daemon->dev_keep_nagle,
+ &daemon->dev_uniform_padding)) {
/* This is a helper which prints the type expected and the actual
* message, then exits (it should never be called!). */
master_badmsg(WIRE_CONNECTD_INIT, msg);
@@ -2565,6 +2566,7 @@ int main(int argc, char *argv[])
daemon->dev_exhausted_fds = false;
daemon->dev_lightningd_is_slow = false;
daemon->dev_keep_nagle = false;
+ daemon->dev_uniform_padding = false;
/* We generally allow 1MB per second per peer, except for dev testing */
daemon->gossip_stream_limit = 1000000;
daemon->scid_htable = new_htable(daemon, scid_htable);
diff --git a/connectd/connectd.h b/connectd/connectd.h
index ea012f6a..7616a185 100644
--- a/connectd/connectd.h
+++ b/connectd/connectd.h
@@ -309,6 +309,9 @@ struct daemon {
/* Allow localhost to be considered "public", only with --developer */
bool dev_allow_localhost;
+ /* Pad outgoing messages to uniform 1460-byte segments (traffic analysis defence) */
+ bool dev_uniform_padding;
+
/* How much to gossip allow a peer every 60 seconds (bytes) */
size_t gossip_stream_limit;
diff --git a/lightningd/connect_control.c b/lightningd/connect_control.c
index e95a04db..f13ac32b 100644
--- a/lightningd/connect_control.c
+++ b/lightningd/connect_control.c
@@ -726,8 +726,9 @@ int connectd_init(struct lightningd *ld)
ld->dev_throttle_gossip,
!ld->reconnect,
ld->dev_fast_reconnect,
- ld->dev_limit_connections_inflight,
- ld->dev_keep_nagle);
+ ld->dev_limit_connections_inflight,
+ ld->dev_keep_nagle,
+ ld->dev_uniform_padding);
subd_req(ld->connectd, ld->connectd, take(msg), -1, 0,
connect_init_done, NULL);
diff --git a/lightningd/lightningd.c b/lightningd/lightningd.c
index 0241b992..3a669e1b 100644
--- a/lightningd/lightningd.c
+++ b/lightningd/lightningd.c
@@ -150,6 +150,7 @@ static struct lightningd *new_lightningd(const tal_t *ctx)
ld->dev_strict_forwarding = false;
ld->dev_limit_connections_inflight = false;
ld->dev_keep_nagle = false;
+ ld->dev_uniform_padding = false;
/*~ We try to ensure enough fds for twice the number of channels
* we start with. We have a developer option to change that factor
diff --git a/lightningd/lightningd.h b/lightningd/lightningd.h
index 9edba38d..3a00f9f3 100644
--- a/lightningd/lightningd.h
+++ b/lightningd/lightningd.h
@@ -369,6 +369,9 @@ struct lightningd {
/* Tell connectd we don't want TCP_NODELAY */
bool dev_keep_nagle;
+ /* Pad outgoing messages to uniform 1460-byte segments (traffic analysis defence) */
+ bool dev_uniform_padding;
+
/* tor support */
struct wireaddr *proxyaddr;
bool always_use_proxy;
diff --git a/lightningd/options.c b/lightningd/options.c
index d9ef8e44..88148f3e 100644
--- a/lightningd/options.c
+++ b/lightningd/options.c
@@ -952,6 +952,10 @@ static void dev_register_opts(struct lightningd *ld)
opt_set_bool,
&ld->dev_keep_nagle,
"Tell connectd not to set TCP_NODELAY.");
+ clnopt_noarg("--dev-uniform-padding", OPT_DEV,
+ opt_set_bool,
+ &ld->dev_uniform_padding,
+ "Pad all outgoing peer messages to uniform 1460-byte segments");
/* This is handled directly in daemon_developer_mode(), so we ignore it here */
clnopt_noarg("--dev-debug-self", OPT_DEV,
opt_ignore,
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.