display a warning if the user use --proxy and hidden service and not … #3249

Saibato · 2019-11-08T12:18:53Z

…disables dns

As @bitcoin-software reported the default behavior is in UX therms
not what the users expects if --proxy is configured. Users tent to associate
with the term proxy, that all traffic is routed trough the proxy.

We should warn the user also in the logs and on startup, if he not selects also --use-always-proxy=true
and --disable-dns, when having defined and used also a hidden service.

The default behavior is that ipv4/6 FQDN will be resolved locally,
since we use tor socks5 proxy for onion address with the socks4a improvement,
the user could and should let Tor do the dns.

Changelog-Changed: Warn the users that he had configed a possible tor dns/ip leak

darosior · 2019-11-08T20:13:46Z

--use-always-proxy=true and --disable-dns

What do you think of disabling DNS if --use-always-proxy=true ?

darosior · 2019-11-08T20:15:39Z

lightningd/options.c

+
+	if (ld->proxyaddr && (!ld->use_proxy_always || ld->config.use_dns)) {
+		if (tal_count(ld->proposed_wireaddr) != 0
+	    && some_tor_addresses(ld->proposed_wireaddr)) {


Indentation :-)

What do you think of disabling DNS if --use-always-proxy=true ?

actually doing the follow PR right now

`if (!daemon->use_proxy_always)
if (broken_resolver(daemon)) {
or so ...

Then all is according to the docu of the flag`

darosior · 2019-11-08T21:17:07Z

lightningd/options.c

+
+	if (ld->proxyaddr && (!ld->use_proxy_always || ld->config.use_dns)) {
+		if (tal_count(ld->proposed_wireaddr) != 0 && some_tor_addresses(ld->proposed_wireaddr)) {
+				log_unusual(ld->log, "WARNING: Your Tor proxy setup with use of hidden service address"


Suggested change

log_unusual(ld->log, "WARNING: Your Tor proxy setup with use of hidden service address"

log_unusual(ld->log, "WARNING: Your Tor proxy setup with use of hidden service address"

darosior

ACK a954dee

gorazdko

Warning and changelog text could be grammatically correct. Possible improvements:

WARNING: Your Tor proxy setup with hidden service address, --always-use-proxy=true and --disable-dns is not recommended. You have configured a possible dns leak of your hidden service. Please enable both options, we hope you know what you are doing!
Changelog-Changed: Warn users about a possible Tor dns/ip leak

But im not a native english speaker either. Meybe they could jump in...

gorazdko · 2019-11-09T18:36:12Z

lightningd/options.c

+	if (ld->proxyaddr && (!ld->use_proxy_always || ld->config.use_dns)) {
+		if (tal_count(ld->proposed_wireaddr) != 0 && some_tor_addresses(ld->proposed_wireaddr)) {
+			log_unusual(ld->log, "WARNING: Your Tor proxy setup with use of hidden service address"
+						" and --allways-use-proxy=%s and --disable-dns=%s"


spelling: --always-use-proxy, --disable-dns (without argument)

WARNING: Your Tor setup use a hidden service address --always-use-proxy=false and --disable-dns not set is not recommended, please set --always-use-proxy=true and use --disable-dns, we hope you know what you are doing!
c-lightning try to help you and detected that you have configured a possible dns leak of your hidden service

Thanks, much more understandable.

WARNING: Your Tor setup uses a hidden service address with --always-use-proxy=false and without --disable-dns which is not recommended. Please set --always-use-proxy=true and use --disable-dns, we hope you know what you are doing!
c-lightning is trying to help you because it detected that you have configured a possible dns leak of your hidden service.

Thank you too, you caught one, but now its enough for me, since I fear that ends in tautologies.
Some say I am as polite and hansom as a satoshi, but I clearly differ when there is no real progress, then I tent to get rude and bossy.

Here is the bossy unfair mean and I feel a shame for exscript of the original draft of this PR and some hints for the next party, where some caught the front row tick tick tok

Cybermen have tagged your system for upgrade by low r value and the doctor is out of town ...

There was no ill intent in my posts. We can leave it as it is.

keep CALM, You are clearly welcome and even now there is one mistype, if you insist, I will change the p to P to make you happy

i dont insist on anything - its your call. And this PR does not affect my feelings whatsoever.

@bitcoin-software

…disables dns @bitcoin-software reported the default behavior is in UX therms not what the users expects if --proxy is configured. Users tent to associate with the term proxy, that all traffic is routed trough the proxy. We should warn the user, if he not selects also --use-always-proxy=true and disable-dns, when having defined and used also a hidden-service. The default behavior is that ipv4/6 FQDN will be resolved locally, since we use tor socks5 proxy for onion address with the socks4a improvement we could and should let Tor do the dns. Changelog-Changed: Warn users if they about to config a possible dns leak Signed-off-by: Saibato <[email protected]>

rustyrussell · 2019-11-11T04:38:02Z

Hmm, if this change is desired, we should go further:

Deprecate --always-use-proxy.
Add --proxy-tor-only.
Change default to be always-use-proxy.

That's pretty clear, I think? Personally, I want my node to be able to reach nodes on Tor, but I don't need most traffic over it.

Saibato · 2019-11-11T08:22:03Z

That's pretty clear, I think? Personally, I want my node to be able to reach nodes on Tor, but I don't need most traffic over it.

Me too, AFAICS the new logo of Tor is "Take back the internet with Tor" , c-ln's Tor implementation is unique in LN space ( gretz and thx to MIT and hobbit ), since we have this true quiet mode ( if we want ). If Tor is the default and all have a this semi unique Tor address bound to node id fine, most traffic from node to node will be intern relayed and never leave Tor.
Exitspoints are on the other hand a single point of failure.

I agree to reach Ip address directly should never be removed, we could add a random jitter between the hopps and the first exit to ip that should be enough, to not called out as doxy app.

In so far, this PR must not be applied, if we are crystal clear in documentation and defaults, what we try to do here.

We are in early stages and most users up till now don't need this warning, since they are mostly deep techie and know.
C-ln will probably be a major transport layer and at some point default will be the norm, so ...

For historical purpose, I personally would like the discussion here and not in semi hidden telegram or signal channels, since such channeled unopen discussion modes are often the begin of control structures applied.

I like your suggestion of --proxy-tor-only and to change the defaults of proxy, how about --add --tor= soly for tor socks ?. And have --proxy for general socks4/5 proxy ?

I push a WIP --proxy-tor-only and to change the defaults, today that could trigger this discussion further.
And one for --random-jitter for all packets might be better work than use of dandelon , but that almost yields in research space. Sigh..
Please feel free to speed me out and take the lead in this, since that matter is also your home turf.

Saibato · 2019-11-16T09:20:26Z

With #3251 👍 merged and #3254 on it"s way I close this now, to defer priority to other issue. This is now low prio and I don't want to be part of pr inflation and review lag, since attention defers can also be a kind of vector programing ... thx for review, I close this now

cdecker · 2019-11-17T11:18:00Z

With #3251 merged and #3254 on it"s way I close this now, to defer priority to other issue. This is now low prio and I don't want to be part of pr inflation and review lag, since attention defers can also be a kind of vector programing ... thx for review, I close this now

Not at all, thanks for the PR, and feel free to reopen later or file an issue to track progress 👍

Saibato changed the title ~~display a warning is the user use --proxy and hidden service and not …~~ display a warning if the user use --proxy and hidden service and not … Nov 8, 2019

Saibato force-pushed the warn-proxy branch 3 times, most recently from 1be1379 to b4d1b98 Compare November 8, 2019 16:50

Saibato mentioned this pull request Nov 8, 2019

proxy setting is not affecting connection to clearnet address #3239

Closed

Saibato force-pushed the warn-proxy branch from b4d1b98 to 2ab82a5 Compare November 8, 2019 18:01

Saibato marked this pull request as ready for review November 8, 2019 19:56

darosior approved these changes Nov 8, 2019

View reviewed changes

Saibato force-pushed the warn-proxy branch from 2ab82a5 to 5599734 Compare November 8, 2019 21:07

darosior reviewed Nov 8, 2019

View reviewed changes

Saibato force-pushed the warn-proxy branch from 5599734 to a954dee Compare November 8, 2019 21:26

darosior approved these changes Nov 9, 2019

View reviewed changes

gorazdko reviewed Nov 9, 2019

View reviewed changes

Saibato force-pushed the warn-proxy branch from a954dee to ea63ac4 Compare November 9, 2019 22:27

Saibato closed this Nov 16, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

display a warning if the user use --proxy and hidden service and not … #3249

display a warning if the user use --proxy and hidden service and not … #3249

Saibato commented Nov 8, 2019 •

edited

Loading

darosior commented Nov 8, 2019

darosior Nov 8, 2019

Saibato Nov 8, 2019 •

edited

Loading

darosior Nov 8, 2019

Saibato Nov 8, 2019

darosior left a comment

gorazdko left a comment

gorazdko Nov 9, 2019

Saibato Nov 9, 2019

gorazdko Nov 10, 2019 •

edited

Loading

Saibato Nov 10, 2019 •

edited

Loading

gorazdko Nov 10, 2019

Saibato Nov 10, 2019

gorazdko Nov 10, 2019

rustyrussell commented Nov 11, 2019

Saibato commented Nov 11, 2019 •

edited

Loading

Saibato commented Nov 16, 2019

cdecker commented Nov 17, 2019

	log_unusual(ld->log, "WARNING: Your Tor proxy setup with use of hidden service address"
	log_unusual(ld->log, "WARNING: Your Tor proxy setup with use of hidden service address"

display a warning if the user use --proxy and hidden service and not … #3249

display a warning if the user use --proxy and hidden service and not … #3249

Conversation

Saibato commented Nov 8, 2019 • edited Loading

darosior commented Nov 8, 2019

Choose a reason for hiding this comment

Saibato Nov 8, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

darosior left a comment

Choose a reason for hiding this comment

gorazdko left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gorazdko Nov 10, 2019 • edited Loading

Choose a reason for hiding this comment

Saibato Nov 10, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rustyrussell commented Nov 11, 2019

Saibato commented Nov 11, 2019 • edited Loading

Saibato commented Nov 16, 2019

cdecker commented Nov 17, 2019

Saibato commented Nov 8, 2019 •

edited

Loading

Saibato Nov 8, 2019 •

edited

Loading

gorazdko Nov 10, 2019 •

edited

Loading

Saibato Nov 10, 2019 •

edited

Loading

Saibato commented Nov 11, 2019 •

edited

Loading