multi: add onion services support #1159

wpaulino · 2018-04-30T07:11:40Z

This PR continues the work from #796. Huge thanks to @Crypt-iQ for getting this started! I decided to create my own branch rather than rebasing theirs, but credit has been given to them in the relevant commits.

This PR introduces the following changes:

Adds support and tests for onion address serialization in channeldb and lnwire.
Updates the Tor-related flags with sane defaults.
Fixes an IP leak when doing the fallback SRV lookup.
Adds an initial implementation of a Tor Controller that supports authentication, creating v2 onion services, etc.
Allows the daemon to establish outbound connections to onion services.
Allows the daemon to listen for inbound connections by either automatically creating a v2 onion service or using a v3 onion service manually set up.
Updates the Tor documentation with the new relevant changes.

Fixes #186.

Roasbeef

Nice work! The addition of onion services will be a major boon to routing node operation due to the increased privacy, and also on the client end w.r.t completely handling NAT traversal.

I've yet to test this out locally, so this is an initial review pass. One thing I pointed out is that we'll need to ensure that we properly handle re-connecting back to inbound connections as it'll show the address of the proxy rather than the hidden service address.

Roasbeef · 2018-05-01T02:02:11Z

tor/README.md

+The tor package contains utility functions that allow for interacting with the
+Tor daemon. So far, supported functions include routing all traffic over Tor's
+exposed socks5 proxy and routing DNS queries over Tor (A, AAAA, SRV). In the
+future more features will be added: automatic setup of v2 hidden service


FWIW, this PR implements most of these features. Still going through the set of commits, so perhaps it's reconciled later in the branch history.

Roasbeef · 2018-05-01T02:04:14Z

tor/net.go

+	if network != "tcp" {
+		return nil, fmt.Errorf("cannot dial non-tcp network via Tor")
+	}
+	return Dial(address, p.SOCKSPort, p.StreamIsolation)


Do all these messages need to be public? Given that most callers will interact directly with the this ProxyNet struct?

On a second glance, I guess they're nice as it lets callers use specific functionality.

It's either we make them public or we have a constructor for ProxyNet specifying them, so it's pretty much the same thing. If we happen to add some private vars to ProxyNet then we can update it to use a constructor instead.

Roasbeef · 2018-05-01T02:04:49Z

tor/tor.go

+)
+
+const (
+	localhost = "127.0.0.1"


Do we also need to consider IPv6 localhost, or nah?

Fixed this so that callers can specify the host:port of the SOCKS proxy, rather than just the port. Within lnd, the default is still set to IPv4 localhost.

Roasbeef · 2018-05-01T02:09:05Z

tor/tor.go

+	// Tor will create a new circuit for each set of credentials.
+	var auth *proxy.Auth
+	if streamIsolation {
+		var b [16]byte


Nice, this gives us one less dependnacy!

(no need for btcsuite/go-socks anymore)

Roasbeef · 2018-05-01T02:12:47Z

tor/tor.go

+
+	// Once connected, we'll construct the SRV request for the host
+	// following the format _service._proto.name. as described in RFC #2782.
+	host := "_" + service + "._" + proto + "." + name + "."


I'll need to double check to ensure that this is compliant with the new DNS scheme, take not of this commit which recently modified the way we construct this query for regular UDP:

3001953#diff-54818b05d116eadc7f67517a3a6e4b33

ce85632#diff-54818b05d116eadc7f67517a3a6e4b33

Looks good to me. We could call LookupSRV("nodes", "tcp", "nodes.lightning.directory") and that would translate to _nodes._tcp.nodes.lightning.directory., which follows the changes in the commits above.

Roasbeef · 2018-05-01T03:38:50Z

tor/controller.go

+			return nil, errors.New("private key not found in reply")
+		}
+
+		err := ioutil.WriteFile(privateKeyFile, []byte(privateKey), 0600)


Given the comment above, perhaps we should encode this in the proper format, so we don't need to do any special decoding on start up.

See comment above.

Roasbeef · 2018-05-01T03:40:16Z

server.go

@@ -604,6 +657,10 @@ func (s *server) Stop() error {

 	close(s.quit)

+	if s.torController != nil {


Don't see where the controller was even started in the first place.

See 0fb2bd9#diff-34c6b408d72845d076d47126c29948d1R309.

This has now been moved to server.Start().

Roasbeef · 2018-05-01T03:41:09Z

config.go

+	defaultTorDNS                = "soa.nodes.lightning.directory:53"
+	defaultTorSOCKSPort          = 9050
+	defaultTorControlPort        = 9051
+	defaultTorPrivateKeyFilename = "onion_private_key"


May want to prefix this with v2 (the variable name), and also the file name since a future version might let the user specify their own private key when we extend to also support auto v3 over the control port.

Roasbeef · 2018-05-01T03:41:47Z

config.go

+	ControlPort     int    `long:"controlport" description:"The port that Tor is listening on for Tor control connections -- NOTE port must be between 1024 and 65535"`
+	V2              bool   `long:"v2" description:"Automatically set up a v2 onion service to listen for inbound connections"`
+	V3              bool   `long:"v3" description:"Use a v3 onion service to listen for inbound connections"`
+	PrivateKeyPath  string `long:"privatekeypath" description:"The path to the private key of the onion service being created"`


Similar comment here w.r.t to v2 prefix.

Roasbeef · 2018-05-01T03:41:50Z

config.go

@@ -84,6 +86,8 @@ var (

 	defaultBitcoindDir  = btcutil.AppDataDir("bitcoin", false)
 	defaultLitecoindDir = btcutil.AppDataDir("litecoin", false)
+
+	defaultTorPrivateKeyPath = filepath.Join(defaultLndDir, defaultTorPrivateKeyFilename)


Similar comment here w.r.t to v2 prefix.

halseth

I don't have much to pick on for this PR! Mostly LGTM, and I have also tested this together with @wpaulino, working as advertised!

I dig how easy it is to set up lnd for Tor, new world order where lnd is over Tor by default incoming 😈

halseth · 2018-05-07T08:09:56Z

tor/net.go

+
+// Dial uses the Tor Dial function in order to establish connections through
+// Tor. Since Tor only supports TCP connections, only TCP networks are allowed.
+func (p *ProxyNet) Dial(network, address string) (net.Conn, error) {


Why not move this to tor.go, and just put the connection logic in here (instead of making these wrap the calls to Dial(..) etc)?

My guess is in order to provide calls like the net package does without the need of a ProxyNet struct.

Still don't see why you would need that, if the calls are only done only for ProxyNet anyway.

halseth · 2018-05-07T09:23:54Z

tor/controller.go

+	// Once retrieved, we'll ensure these values are of proper length when
+	// decoded.
+	serverHash, exists := replyParams["SERVERHASH"]
+	if !exists {


style nit: usually ok is used

halseth · 2018-05-07T09:24:51Z

tor/controller.go

+	}
+	decodedServerHash, err := hex.DecodeString(serverHash)
+	if err != nil {
+		return err


Should append to the error which string decoding is failing.

halseth · 2018-05-07T09:25:09Z

tor/controller.go

+	}
+	decodedServerNonce, err := hex.DecodeString(serverNonce)
+	if err != nil {
+		return err


halseth · 2018-05-07T09:29:46Z

tor/controller.go

+func computeHMAC256(key, message []byte) []byte {
+	mac := hmac.New(sha256.New, key)
+	mac.Write(message)
+	return mac.Sum(nil)


would the last to lines be equivalent to just doing return mac.Sum(message)?

Sum prepends the message to the current hash. w/o any calls to Write, it would return message || H_K(nil)

https://play.golang.org/p/KQYa-UoarMS

halseth · 2018-05-07T10:16:45Z

config.go

+			Control: defaultTorControl,
+			// TODO: change this to v3 once we're able to
+			// automatically set them up.
+			V2:               true,


not sure if it's obvious that this will be true by default. Looks like the default is not shown in lnd -h

in testing, i found that this causes a collision when trying to run v3, i get this error:
either tor.v2 or tor.v3 can be set, but not both
I had to set tor.v2=0 and tor.v3=1 to get around it

halseth · 2018-05-07T10:20:46Z

server.go

+	// future, this will be expanded to do so.
+	if cfg.Tor.Active && cfg.Tor.V2 {
+		s.torController = tor.NewController(cfg.Tor.Control)
+		if err := s.torController.Start(); err != nil {


Maybe this can be moved to the server's Start method?

halseth · 2018-05-07T10:25:11Z

docs/configuring_tor.md

-
-## 2. Outbound Connections Only
+protocol traffic_ is tunneled over Tor. Users must ensure that when also running
+a backend node, that it is also proxying all traffic over Tor. If using the


I think we should keep the "Bitcoin full-node" jargon here, as "backend node" might not be known to as many.

cfromknecht

Looking good! I've tested both v2 and v3 and both work :)

cfromknecht · 2018-05-10T22:45:16Z

tor/net.go

+
+// RegularNet is an implementation of the Net interface that defines behaviour
+// for regular network connections.
+type RegularNet struct{}


naming suggestion: ClearNet? :)

cfromknecht · 2018-05-10T22:48:21Z

tor/controller.go

+func computeHMAC256(key, message []byte) []byte {
+	mac := hmac.New(sha256.New, key)
+	mac.Write(message)
+	return mac.Sum(nil)


https://play.golang.org/p/KQYa-UoarMS

cfromknecht · 2018-05-10T22:53:52Z

tor/net.go

+// ResolveTCPAddr uses the Tor ResolveTCPAddr function in order to resolve TCP
+// addresses over Tor.
+func (p *ProxyNet) ResolveTCPAddr(network, address string) (*net.TCPAddr, error) {
+	if network != "tcp" {


should this check include "tcp4" and "tcp6"?

Yep! Fixed.

cfromknecht · 2018-05-10T23:01:07Z

tor/tor.go

+
+	// Once connected, we'll construct the SRV request for the host
+	// following the format _service._proto.name. as described in RFC #2782.
+	host := "_" + service + "._" + proto + "." + name + "."


Would string formatting be clearer here?

cfromknecht · 2018-05-10T23:46:20Z

config.go

+			Control: defaultTorControl,
+			// TODO: change this to v3 once we're able to
+			// automatically set them up.
+			V2:               true,


in testing, i found that this causes a collision when trying to run v3, i get this error:
either tor.v2 or tor.v3 can be set, but not both
I had to set tor.v2=0 and tor.v3=1 to get around it

cfromknecht · 2018-05-11T00:08:52Z

docs/configuring_tor.md

+```
+
+Once v3 onion service support is stable, `lnd` will be updated to also
+automatically set up v3 onion services.


These docs are great! :) I might suggest adding a sample torrc for v3 nodes as well, it may not be immediately obvious for everyone wrt. what needs to change from the sample v2 torrc given above.

Docs added :)

cfromknecht · 2018-05-11T00:23:12Z

docs/configuring_tor.md

+      --tor.active                                            Allow outbound and inbound connections to be routed through Tor
+      --tor.socks=                                            The port that Tor's exposed SOCKS5 proxy is listening on -- NOTE port must be between 1024 and 65535 (default: 9050)
+      --tor.dns=                                              The DNS server as IP:PORT that Tor will use for SRV queries - NOTE must have TCP resolution enabled (default: soa.nodes.lightning.directory:53)
+      --tor.streamisolation                                   Enable Tor stream isolation by randomizing user credentials for each connection.


What does everyone think of defaulting to using streamisolation, and instead have a no-streamisolation option?

Roasbeef · 2018-06-01T23:09:03Z

Needs a rebase to address conflict after the latest merge.

Roasbeef

LGTM 🕺🏾

cfromknecht · 2018-06-02T00:06:48Z

Just clarifying, current default is still no-streamisolation correct?

Roasbeef · 2018-06-02T00:07:23Z

Yep, it has performance implications as you'll incur the overhead of a new circuit for each stream.

Roasbeef · 2018-06-02T00:07:47Z

Also there're diff forms of isolation: per user, per connection, etc. We can revisit this in the future though, no reason to block this PR from inclusion.

Roasbeef · 2018-06-02T00:27:33Z

config.go

+		cfg.Tor.Control, strconv.Itoa(defaultTorControlPort),
+	)
+	switch {
+	case !cfg.Tor.V2 && !cfg.Tor.V3:


At this point, if either of them are active, we should ensure that lnd is only listening on local host.

IMO it shouldn't be assumed that if the user wants to use tor for outbound connections, then they also want to use it for inbound connections. So if v2 and v3 aren't set, then we should also disable listening for the p2p interface all together.

Roasbeef · 2018-06-02T00:28:48Z

server.go

@@ -860,6 +913,46 @@ func (s *server) peerBootstrapper(numTargetPeers uint32,
 	}
 }

+func (s *server) initTorController() error {


Missing godoc comment.

Roasbeef · 2018-06-02T00:31:14Z

config.go

+		cfg.Tor.Control, strconv.Itoa(defaultTorControlPort),
+	)
+	switch {
+	case !cfg.Tor.V2 && !cfg.Tor.V3:


IMO it shouldn't be assumed that if the user wants to use tor for outbound connections, then they also want to use it for inbound connections. So if v2 and v3 aren't set, then we should also disable listening for the p2p interface all together.

Roasbeef · 2018-06-05T03:30:11Z

config.go

 	case cfg.Tor.V2 && cfg.Tor.V3:
 		return nil, errors.New("either tor.v2 or tor.v3 can be set, " +
 			"but not both")
+	case cfg.DisableListen && (cfg.Tor.V2 || cfg.Tor.V3):


Should be a check right below this to disable listening (automatically) if tor is set, but v2 and v3 aren't.

Roasbeef · 2018-06-05T03:38:14Z

config.go

@@ -434,6 +434,12 @@ func loadConfig() (*config, error) {
 	case cfg.DisableListen && (cfg.Tor.V2 || cfg.Tor.V3):
 		return nil, errors.New("listening must be enabled when " +
 			"enabling inbound connections over Tor")
+	case !cfg.Tor.V2 || !cfg.Tor.V3:


Should be more like:

case cfg.Tor && (!cfg.Tor.V2 || !cfg.Tor.V3):

Otherwise would always do this.

In this commit, we clean up the tor package to better follow the Effective Go guidelines. Most of the changes revolve around naming, where we'd have things like `torsvc.TorDial`. This was simplified to `tor.Dial` along with many others.

Co-Authored-By: Eugene <crypt-iq@users.noreply.github.com>

…esses

Co-Authored-By: Eugene <crypt-iq@users.noreply.github.com>

In this commit, we update the set of Tor flags to use sane defaults when not specified. We also include some new flags related to the recent onion services changes. This allows users to easily get set up on Tor by only specifying the tor.active flag. If needed, the defaults can still be overridden.

In this commit, we allow `lnd` to properly parse onion addresses in order to advertise them to the network when set through the `--externalip` flag. Co-Authored-By: Eugene <crypt-iq@users.noreply.github.com>

In this commit, we now allow connections to onion addresses due to recently adding support to properly parse them. Co-Authored-By: Eugene <crypt-iq@users.noreply.github.com>

In this commit, we fix a bug where a fallback SRV lookup would leak information if `lnd` was set to route connections over Tor. We solve this by using the network-specific functions rather than the standard ones found in the `net` package.

In this commit, we allow the daemon to use the recently introduced Tor Controller implementation. This will automatically create a v2 onion service at startup in order to listen for inbound connections over Tor. Co-Authored-By: Eugene <crypt-iq@users.noreply.github.com>

In this commit, we update the way we reestablish inbound connections if we lose connectivity to a node we have an open channel with. Rather than fetching the node's advertised port, we'll fetch one of their advertised addresses instead. This ensure that if the remote node is running behind a proxy, we do not see the proxy's address.

In this commit, we go through the codebase looking for TCP address assumptions and modifying them to include the recently introduced onion addresses. This enables us to fully support onion addresses within the daemon.

Roasbeef

LGTM ☄️

bobberb · 2018-06-06T04:34:53Z

regarding lnd/pull/1159/commits/2e0484be19e1a146895489b1f25cdfce8b23f589 - now we can set our domain names and subdomains as the target?

thank you @wpaulino

Roasbeef added this to the 0.5 milestone May 1, 2018

Roasbeef requested changes May 1, 2018

View reviewed changes

meshcollider added onion routing privacy General label for issues/PRs related to the privacy implications of using the software p2p Code related to the peer-to-peer behaviour labels May 1, 2018

Roasbeef mentioned this pull request May 2, 2018

multi: hidden service support for lnd #796

Closed

wpaulino force-pushed the onion-service-support branch from a5fa007 to 01161a1 Compare May 2, 2018 07:14

halseth reviewed May 7, 2018

View reviewed changes

cfromknecht suggested changes May 11, 2018

View reviewed changes

wpaulino force-pushed the onion-service-support branch from 8095722 to 4333c49 Compare May 11, 2018 04:16

wpaulino force-pushed the onion-service-support branch 2 times, most recently from bdcbf49 to bb5cc04 Compare May 31, 2018 00:45

wpaulino force-pushed the onion-service-support branch from bb5cc04 to c02efa4 Compare June 1, 2018 23:11

Roasbeef approved these changes Jun 2, 2018

View reviewed changes

Roasbeef reviewed Jun 2, 2018

View reviewed changes

Roasbeef requested changes Jun 2, 2018

View reviewed changes

Roasbeef reviewed Jun 5, 2018

View reviewed changes

wpaulino and others added 7 commits June 4, 2018 20:41

build: update inputs-digest due to removed btcsuite/go-socks dep

eded682

tor: add onion address implementation

a073974

Co-Authored-By: Eugene <crypt-iq@users.noreply.github.com>

lnwire: implement serialization of onion addresses

850f9fb

Co-Authored-By: Eugene <crypt-iq@users.noreply.github.com>

lnwire: extend tests to randomly generate all types of supported addr…

e5987a1

…esses

channeldb: implement serialization of onion addresses

3738e68

Co-Authored-By: Eugene <crypt-iq@users.noreply.github.com>

channeldb: add address serialization tests

5f1d252

wpaulino and others added 8 commits June 4, 2018 20:41

server: add support to advertise onion addresses

3669a40

In this commit, we allow `lnd` to properly parse onion addresses in order to advertise them to the network when set through the `--externalip` flag. Co-Authored-By: Eugene <crypt-iq@users.noreply.github.com>

rpcserver: add support to connect to onion addresses

d6d0c26

In this commit, we now allow connections to onion addresses due to recently adding support to properly parse them. Co-Authored-By: Eugene <crypt-iq@users.noreply.github.com>

docs: update documentation for inbound connections

5b58d24

wpaulino force-pushed the onion-service-support branch from 8481519 to 2e0484b Compare June 5, 2018 03:42

Roasbeef approved these changes Jun 5, 2018

View reviewed changes

Roasbeef merged commit d98d452 into lightningnetwork:master Jun 5, 2018

wpaulino deleted the onion-service-support branch June 5, 2018 04:57

wpaulino mentioned this pull request Jun 27, 2018

lnd with a reverse proxy #1039

Closed

jguchte mentioned this pull request Dec 22, 2018

lnd crashes after onchain transaction #2362

Closed

mcdonald-sr mentioned this pull request Dec 26, 2018

Can't accept incoming connection: EOF #2375

Closed

thrasher- mentioned this pull request Jan 2, 2019

[ERR] SRVR: unable to create server: no active channels exist #2396

Closed

becausetheypayme mentioned this pull request Jan 2, 2019

Faucet.lightning.community "unable to open channel" when trying to fund new node #2401

Closed

fluidvoice mentioned this pull request Jan 9, 2019

LND will not open channel with c-lightning #2443

Closed

hakonamatata mentioned this pull request Jan 16, 2019

Failed to process consensus server notification, "synced_to_chain": false, all channles inactive #2484

Closed

fluidvoice mentioned this pull request Jan 17, 2019

SRVR: unable to create server: can't create router: ReadVarBytes: sig is larger than the max allowed size #2016

Closed

corbelantoine mentioned this pull request Jan 21, 2019

Invoice payment stuck #2524

Closed

thrasher- mentioned this pull request Jan 27, 2019

SRVR: unable to start server: unexpected EOF #2545

Closed

pandeykumar mentioned this pull request Mar 6, 2019

24 word mnemonic generated is not BIP39 compliant #2735

Closed

Cees2daBees mentioned this pull request Mar 20, 2019

Invoice not paid, but local balance deducted, remote balance stayed the same #2807

Closed

davidcaseria mentioned this pull request Apr 5, 2019

Allow CPFP or RBF on stuck force closing transaxtion #2899

Closed

Cees2daBees mentioned this pull request Apr 12, 2019

Force closed pending channelpoint, waiting over a week for limbo balance #2948

Closed

martinatime mentioned this pull request Apr 19, 2019

lnd fails to start #2980

Closed

jguchte mentioned this pull request Nov 12, 2019

LND crashes at startup CHDB: Unable to apply migration #9 #3714

Closed

Cees2daBees mentioned this pull request Jul 20, 2020

LND not starting after power failure #4477

Closed

		@@ -604,6 +657,10 @@ func (s *server) Stop() error {

		close(s.quit)

		if s.torController != nil {

multi: add onion services support #1159

multi: add onion services support #1159

Conversation

wpaulino commented Apr 30, 2018

Roasbeef left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

halseth left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

halseth Jun 1, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cfromknecht left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Roasbeef commented Jun 1, 2018

Roasbeef left a comment

Choose a reason for hiding this comment

cfromknecht commented Jun 2, 2018

Roasbeef commented Jun 2, 2018

Roasbeef commented Jun 2, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Roasbeef left a comment

Choose a reason for hiding this comment

bobberb commented Jun 6, 2018

halseth Jun 1, 2018 •

edited

Loading