Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds Tor support to cln-plugin #96

Merged
merged 3 commits into from
Aug 29, 2022
Merged

Conversation

sr-gi
Copy link
Member

@sr-gi sr-gi commented Aug 18, 2022

Check if the tower address is an onion address and proxies it through Tor if so.

This assumes Tor is running on the backend, which is the same assumption used by CoreLN AFAICT https://lightning.readthedocs.io/TOR.html

Close #92 #93

@sr-gi
Copy link
Member Author

sr-gi commented Aug 18, 2022

@CMDRZOD feel free to give this a go, it should fix your issue with connecting to the tower via Tor

@sr-gi
Copy link
Member Author

sr-gi commented Aug 18, 2022

Also tagging you @tee8z since you wrote the original piece of code. Can you give it a try?

@tee8z
Copy link
Contributor

tee8z commented Aug 18, 2022

I gave this PR branch a test, seems I am getting "connection refused" when I try to connect from the plugin but a Tor call works with tor-sock from command line so the watchtower is accessible from the onion address. Attached is what I saw when testing (let me know if you see something weird in the logs, and I can also gives this another try later to make sure it wasn't something I configured incorrectly).

tower-logs
torsock-works png
lightning-cli
plugin-logs

@sr-gi
Copy link
Member Author

sr-gi commented Aug 19, 2022

@tee8z actually got this same error but fixed it (locally at least) before pushing the last rebase 🤔

Are you testing this with both the client and the tower on the same host? What does your setup look like?

Copy link
Collaborator

@mariocynicys mariocynicys left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some comments, but LGTM otherwise.
tACK
image

}
})
let client = if endpoint.contains(".onion:") {
let proxy = reqwest::Proxy::http("socks5h://127.0.0.1:9050")
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can't we ask cln to give us the SOCKS proxy host and port instead?
Or maybe provide them as options with 127.0.0.1:9050 as the default.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm working on it with the second approach, but it becomes a bit more complex.

Thought about asking cln, but that'd mean that if cln is using Tor the plugin always will, and if it is not, the plugin would never. I think we may want to give the user the option to pick any combination.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in dcbcee3. Not completely convinced it is the most elegant way though.

watchtower-plugin/src/net/http.rs Outdated Show resolved Hide resolved
@mariocynicys
Copy link
Collaborator

mariocynicys commented Aug 20, 2022

@tee8z Are you sure you rebuilt the cln plugin before running lighningd?
You might be running an older version of cln plugin.

@sr-gi sr-gi force-pushed the cln-tor-support branch 3 times, most recently from a6be333 to dcbcee3 Compare August 23, 2022 12:14
@sr-gi
Copy link
Member Author

sr-gi commented Aug 23, 2022

Fixed the related comments. I'm still curious about the error @tee8z was facing. Would love to learn more about it given I cannot reproduce it. I used to face the exact same issue, which was coming from the proxy not being able to resolve DNS. I fixed it by replacing socks5 for socks5h in

let proxy = reqwest::Proxy::http(format!("socks5h://{}", proxy))

@sr-gi sr-gi added Seeking Code Review review me pls cln-plugin Stuff related to watchtower-plugin labels Aug 23, 2022
@sr-gi
Copy link
Member Author

sr-gi commented Aug 23, 2022

Looks like there are two tests failing, given we used to flag malformed urls as Unexpected errors instead of Connection. Will need to either repurpose or remove those tests.

@mariocynicys
Copy link
Collaborator

Looks like there are two tests failing, given we used to flag malformed urls as Unexpected errors instead of Connection. Will need to either repurpose or remove those tests.

Dunno what cases now trigger the Unexpected path. I think we can remove them if no testable path possible.

Copy link
Collaborator

@mariocynicys mariocynicys left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
One thing I did think of though, is to have 127.0.0.1:9050 be the default proxy (we won't have Nones in this case). But actually both techniques are perfectly fine.

@sr-gi
Copy link
Member Author

sr-gi commented Aug 24, 2022

LGTM. One thing I did think of though, is to have 127.0.0.1:9050 be the default proxy (we won't have Nones in this case). But actually both techniques are perfectly fine.

The default should be to have no proxy at all, shouldn't it? Otherwise, you'd be trying to redirect your traffic to an inexistent proxy.

@sr-gi
Copy link
Member Author

sr-gi commented Aug 24, 2022

This needs rebasing all commits into a single one. Will wait for @tee8z review before doing so and potentially merging.

@sr-gi sr-gi added this to the v.0.1.2 milestone Aug 24, 2022
@tee8z
Copy link
Contributor

tee8z commented Aug 24, 2022

I'm sure this is something with my setup, but I'm still struggling to get the plugin to work with Tor, new error message though!
From my testing I can see that:

  • I have tor running and able to call through it to an external address via socks5
  • I have lightningd running and it's registering with Tor (showing a Tor address)
  • This is all running over signet (shouldn't change anything?)
  • The tower is running and showing a Tor address to connect with

I'm going to keep trying to get this over the coming days, but don't let me hold up merging this in as it's probably specific to my environment.

ksnip_20220824-100955
lightningd-running
conf-setup
tower-setup
socks5-working

@sr-gi
Copy link
Member Author

sr-gi commented Aug 24, 2022

@tee8z I added a standalone option for the plugin Tor connection so it can be configured to run on/off Tor independetly of whether the daemon is using Tor or not.

Try replacing proxy = ... for watchtower-proxy = ...

@tee8z
Copy link
Contributor

tee8z commented Aug 24, 2022

Changing the setting to watchtower-proxy and clearing any local data for the tower made it work! Thank you for the helpful direction, otherwise code LGTM!
it-worked

Copy link
Contributor

@tee8z tee8z left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sr-gi
Copy link
Member Author

sr-gi commented Aug 26, 2022

Nice! I think I'm going to improve this a bit and use cln native options instead of adding a custom one. I'm waiting to confirm what's the logic behind cln's proxy and always-use-proxy so I can adapt this accordingly.

@sr-gi
Copy link
Member Author

sr-gi commented Aug 29, 2022

Nice! I think I'm going to improve this a bit and use cln native options instead of adding a custom one. I'm waiting to confirm what's the logic behind cln's proxy and always-use-proxy so I can adapt this accordingly.

Ok, nvm, this will need to be added in a follow-up given the native cln options cannot be accessed from the cln-plugin rust crate atm AFAICT.

I'm documenting the improvements that we can land after the next cln-plugin in release #102

@sr-gi sr-gi merged commit f2e99fa into talaia-labs:master Aug 29, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cln-plugin Stuff related to watchtower-plugin
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Unable to connect to watchtowers through TOR
3 participants