Support connecting to and being an onion service

[ZmnSCPxj]

Becoming onion service is good for privacy. And, it is easier for NAT configuration, as NAT configuration is not needed for onion service, which is always good.

[Saibato]

Had already done some work in this matter.
A Gateway is many days live and working in mainnet and from the onion node one sees only the ids . So all payments can only route through the exitpoint.
Do we realy need a connect feature to an onion address?
Maybe I am wrong, but would that not reveal the inner structure of the socks mesh behind the gateway?
Please correct me .
What I can imagine is a more an arp way for semi routing and a gateway flag for unknown paths but I think bolt now wants us to use dns seeds.

[ZmnSCPxj]

Yes, we need to be able to connect to an onion address. We should also be able to be hosted on an onion address.

https://github.com/lightningnetwork/lightning-rfc/blob/master/07-routing-gossip.md#the-node_announcement-message

[Saibato]

Ok I will cone up with something maybe its already done but not merged ...

[Saibato]

@ZmnSCPxj
Have to do a short forraign job so please dont wait for my PR can take a week ...

[ZmnSCPxj]

@Saibato, quite good, there are many other tasks, we can wait for your completion.

[ZmnSCPxj]

I study this a little. And it seems:

1. Tor recommend, to use Tor builtin SOCKS5 proxy.
2. SOCKS5 protocol, can provide hostname. And it looks similar to DNS.
3. Experimentation with curl, suggests Tor SOCKS5 proxy can understand .onion hostname.
4. So, to access an onion service, we need to have Tor installed and running. And if we want to connect to onion service, we convert onion address to .onion hostname and send by SOCKS5 proxy.

We could add, for example, --tor-proxy flag which provides either a port, or a hostname (and optional port). If provided, we use SOCKS5 proxy protocol to the provided port and hostname/port for all connection requests. This provides the first half "connecting to an onion service".

Of course, we cannot test this completely, without also being able to be an onion service.

[Saibato]

I have almost all ready for PR but must do an other job again.
I just put the most part of tor socks connect handle in gossipd. 100 lines of code not more.
If the connect name is .onion I open a normal socket and one to the socks proxy and after full connect I switch in io.c the fd to the tor fd works in regtest for now
did made funding pay and withdraw successfully
To make LN a service you only have to edit etc/tor/torrc. Ielightning_hiddenservice 9735 127.0.0.1 9735 then after restart the onion address is in var/lib/tor/ielightning_hiddenservice/hostname

The next step is to use the tor api to make it a full automatic service.

What we really need is a name part in the db with the onion address because tor is a most default times a proxy socket with ip port 127.0.0.1:9050

What could be helpfull is a node thats set up as onion thats not one of mine to make some test .

[Saibato]

@ZmnSCPxj
when you enable your node to be an onion service by editing torrc and start the tor service proxy by open your TOrBrowser then the poor mens hidden
Service LN Node is set up like this:

Assume your hidden service node is now at port 9735
with name xxxxxxxxxxxxxxxx.onion
or even on an different pc or hosted service at port 9735
then
first
coproc nc -x 127.0.0.1:9050 xxxxxxxxxxxxxxxx.onion 9735
and then
nc -n yourip -kl -p 12345 <&"${COPROC[0]}" >&"${COPROC[1]}"

cli/lightning-cli connect YOURNODEID@yourip:12345
e vola you are connected LN over tor to a hidden service with name xxxxxxxxxxxxxxxx.onion by using your own socket 12345 as gateway

one node is from now is for 1hour at odpzvneidqdf5hdq.onion:1235 (testnet)
so your line will be coproc nc -x 127.0.0.1:9050 odpzvneidqdf5hdq.onion:1235
maybe you like to connect?

So you dont have to wait for an PR and can instantly start your tests.

If we have a --torproxy option ie --torproxy=127.0.0.1:9050 the we also need a space to put the onionaddr.onion like a FQDN in DB we can not use the IP it will change for tor every 10 min and other tor like services do the same.
And because the only connect is in io.c which is deep in @rustyrussell 's space we must decide where the fd switch should take place i put it in ccan/ccan/io.c and depending on the onion name i dont connect but copy the torfd to the PeerID conn->fd.fd=torfd which i open at Try_connect in gossipd.

[Saibato]

node is now down i try to setup a new one tomorrow ^^

[ZmnSCPxj]

If we have a --torproxy option ie --torproxy=127.0.0.1:9050 the we also need a space to put the onionaddr.onion like a FQDN in DB we can not use the IP it will change for tor every 10 min and other tor like services do the same.

I believe this is necessary; the LN protocol also requires support for Tor hidden services: https://github.com/lightningnetwork/lightning-rfc/blob/master/07-routing-gossip.md#the-node_announcement-message (see address descriptor types)

Also quoted in our code here:

lightning/common/wireaddr.h

Lines 9 to 23 in c4590b6

	/* BOLT #7:
	*
	* The following `address descriptor` types are defined:
	*
	* * `0`: padding. data = none (length 0).
	* * `1`: ipv4. data = `[4:ipv4_addr][2:port]` (length 6)
	* * `2`: ipv6. data = `[16:ipv6_addr][2:port]` (length 18)
	* * `3`: tor v2 onion service. data = `[10:onion_addr][2:port]` (length 12)
	* * Version 2 onion service addresses. Encodes an 80-bit truncated `SHA-1` hash
	* of a 1024-bit `RSA` public key for the onion service.
	* * `4`: tor v3 onion service. data `[35:onion_addr][2:port]` (length 37)
	* * Version 3 ([prop224](https://gitweb.torproject.org/torspec.git/tree/proposals/224-rend-spec-ng.txt))
	* onion service addresses. Encodes: `[32:32_byte_ed25519_pubkey] || [2:checksum] || [1:version]`.
	* where `checksum = sha3(".onion checksum" | pubkey || version)[:2]`
	*/

So we need to modify the struct wireaddr in common/wireaddr.h and modify corresponding .c file greatly:

lightning/common/wireaddr.h

Lines 25 to 38 in c4590b6

	enum wire_addr_type {
	ADDR_TYPE_PADDING = 0,
	ADDR_TYPE_IPV4 = 1,
	ADDR_TYPE_IPV6 = 2,
	};
	/* FIXME(cdecker) Extend this once we have defined how TOR addresses
	* should look like */
	struct wireaddr {
	enum wire_addr_type type;
	u8 addrlen;
	u8 addr[16];
	u16 port;
	};

(the FIXME(cdecker) suggests we should also summon @cdecker here)

And because the only connect is in io.c which is deep in @rustyrussell 's space we must decide where the fd switch should take place i put it in ccan/ccan/io.c and depending on the onion name i dont connect but copy the torfd to the PeerID conn->fd.fd=torfd which i open at Try_connect in gossipd.

Oh, maybe this is difficulty point. It is best, we do not modify ccan/ code specially for lightning.

If modification is general, we can make pull request to ccan project https://github.com/rustyrussell/ccan (or rather by mail ccan@lists.ozlabs.org) and then update our copy. But if only for lightning, we should consider other technique to modify our code only.

Perhaps we can make a wrapper for the io_connect which checks our settings if there is a TOR proxy. If there is, we should use the TOR proxy for all outgoing (io_connect) case... maybe.

[Saibato]

i modified and used in wireaddr.h

#define TOR_V2_ADDRLEN 10;
#define TOR_V3_ADDRLEN 35;

enum wire_addr_type {
ADDR_TYPE_PADDING = 0,
ADDR_TYPE_IPV4 = 1,
ADDR_TYPE_IPV6 = 2,
ADDR_TYPE_TOR_V2 = 3,
ADDR_TYPE_TOR_V3 = 4;

};

/* FIXME(cdecker) Extend this once we have defined how TOR addresses

• should look like */
  struct wireaddr {
  enum wire_addr_type type;
  u8 addrlen;
  u8 addr[16];
  u8 tor_addr[35];
  u16 port;
  };

also fmt_wireaddr in wireaddr.c must change i added

char tor_addrstr[TOR_V3_ADDRLEN];

i used many lines from the BSD socks version of nc
is a quit good starting point for the socks proxy part

The public key addr from the human readable tor-onion_addr part must be stored in struct wireaddr and then encoded again to relay it to the onion proxy

most time i just add a tor_ prefix to the existing addr code
when io.c is no option then the socket switch must take place later to replace conn->fd.fd with the connected to socket
but where?

So my quick and dirty connect and reconnect works but to make good quality code i still struggle.

[Saibato]

can it work just with
struct wireaddr {
enum wire_addr_type type;
u8 addrlen;
u8 addr[35];
u16 port;
}; ???

i have removed all the tor_ prefixes and the seletor is the type in the addr struct

[Saibato]

wrapper for the io_connect is a good idea it can work if we feed it with a dummy socket and modify the conn at return. Ill try this tomorrow ... over and out