Add Socks Proxy (for Tor/i2pd/Kovri) Support to Wallets

[vtnerd]

Allows wallets to connect to daemon over tor/i2pd/kovri. If proxy usage is enabled, the daemon address must be onion/i2p based or use --daemon-cert-file. The idea is to prevent root CA shadiness over these networks in addition to the authenticated/unencrypted problems. A root CA can be combined with an onion/i2p address (the former can definitely be signed by a few CAs) by using --daemon-address https://xyz.onion. Additionally, --daemon-address https://... and --daemon-cert-file will work with ipv4 or ICANN hostnames.

Will have to coordinate with @moneromooo-monero for the SSL changes. The first commit (for p2p tor/socks) will be rebased away once its merged.

[vtnerd]

Pushed some tests and rebased against the parent Tor PR.

[ghost]

I think the restriction on domain names / CA is a bit too strict, or even irrelevant. It's always possible to ask the socks5 server to resolve the domain on behalf of the user, and assuming the socks5 server is doing the right thing, the user is just as safe as using an IP. I also might want to use a different socks5 server other then tor/i2p.

Is it possible to decouple the commit into smaller ones for educational purpose?

[vtnerd]

I think the restriction on domain names / CA is a bit too strict, or even irrelevant. It's always possible to ask the socks5 server to resolve the domain on behalf of the user, and assuming the socks5 server is doing the right thing, the user is just as safe as using an IP. I also might want to use a different socks5 server other then tor/i2p.

The socks server is always doing the domain resolution. If a user wants to use a socks proxy in some other context, they can download the certificate of the CA for that site and specify with --daemon-cert-file. This is a bit restrictive, but allowing all root CAs on outbound proxy connections seemed risky without some nudging.

Is it possible to decouple the commit into smaller ones for educational purpose?

There are already two commits - one from the PR for p2p+tor, and a second for socks rpc. Did you want this broken down further?

[ghost]

Thanks for the explanation @vtnerd. I see now that the default is to not trust root CA, then this seems to be the best practice.

Yes, I was hoping the commits can be broken down further more, if possible?

[jtgrassie]

@fuwa0529

Yes, I was hoping the commits can be broken down further more, if possible?

Why? The 2 commits are very logical units of work.

[ghost]

@jtgrassie Maybe because I don't understand it, and was a bit frustrated about myself. But if you think these are of reasonable size, then sure I'll stop complaining.

[moneromooo-monero]

Is this scheduling an event for essentially never ?

[fluffypony]

@vtnerd as soon as #4852 is rebased and merged I'll let you know, and this can be rebased and merged!

[MaxXor]

It is merged.

[fluffypony]

@vtnerd please rebase

[fluffypony]

@vtnerd still waiting on a rebase :)

[jtgrassie]

Minor request, can we change "(tor, i2pd, kovri, etc.)" to simply "tor/i2p"? This keeps implementation names out.

[vtnerd]

Will update shortly.

[jtgrassie]

Thanks

[jtgrassie]

Same as above comment.

[vtnerd]

@vtnerd still waiting on a rebase :)

Yeah, I got caught working on the SSL PR. This has reverted prior changes for SSL, and is rebased to mainline. @moneromooo-monero may want to review shortly since it technically has changed, although the "new" changes are primarily just reverting changes that were previously made.

[vtnerd]

Ok, finally rebased entirely (hopefully) with @jtgrassie changes.

[fluffypony]

Reviewed