fixup: force usage of the stream isolation parameter

Author: tankyleo

lightning-net-tokio/src/lib.rs

@@ -474,16 +474,20 @@ where
 	}
 }
 
-/// Same as [`connect_outbound`], using a SOCKS5 proxy
-pub async fn socks5_connect_outbound<PM: Deref + 'static + Send + Sync + Clone>(
+/// Same as [`connect_outbound`], using a Tor SOCKS5 proxy. The stream isolation parameter is a
+/// username-password tuple which will be passed to the Tor SOCKS5 proxy during connection
+/// establishment. See https://spec.torproject.org/socks-extensions.html for further details.
+pub async fn tor_socks5_connect_outbound<PM: Deref + 'static + Send + Sync + Clone>(
 	peer_manager: PM, their_node_id: PublicKey, socks5_proxy_addr: SocketAddr, addr: SocketAddress,
-	user_pass: Option<(&str, &str)>,
+	stream_isolation_parameter: (&str, &str),
 ) -> Option<impl std::future::Future<Output = ()>>
 where
 	PM::Target: APeerManager<Descriptor = SocketDescriptor>,
 {
 	let connect_fut = async {
-		socks5_connect(socks5_proxy_addr, addr, user_pass).await.map(|s| s.into_std().unwrap())
+		tor_socks5_connect(socks5_proxy_addr, addr, stream_isolation_parameter)
+			.await
+			.map(|s| s.into_std().unwrap())
 	};
 	if let Ok(Ok(stream)) =
 		time::timeout(Duration::from_secs(SOCKS5_CONNECT_OUTBOUND_TIMEOUT), connect_fut).await
@@ -494,8 +498,8 @@ where
 	}
 }
 
-async fn socks5_connect(
-	socks5_proxy_addr: SocketAddr, addr: SocketAddress, user_pass: Option<(&str, &str)>,
+async fn tor_socks5_connect(
+	socks5_proxy_addr: SocketAddr, addr: SocketAddress, stream_isolation_parameter: (&str, &str),
 ) -> Result<TcpStream, ()> {
 	use std::io::{Cursor, Write};
 	use tokio::io::AsyncReadExt;
@@ -507,7 +511,6 @@ async fn socks5_connect(
 	// Constants defined in RFC 1928 and RFC 1929
 	const VERSION: u8 = 5;
 	const NMETHODS: u8 = 1;
-	const NO_AUTH: u8 = 0;
 	const USERNAME_PASSWORD_AUTH: u8 = 2;
 	const METHOD_SELECT_REPLY_LEN: usize = 2;
 	const USERNAME_PASSWORD_VERSION: u8 = 1;
@@ -526,40 +529,38 @@ async fn socks5_connect(
 	const SOCKS5_REQUEST_MAX_LEN: usize = 1 /* VER */ + 1 /* CMD */ + 1 /* RSV */ + 1 /* ATYP */
 		+ 1 /* HOSTNAME len */ + HOSTNAME_MAX_LEN /* HOSTNAME */ + 2 /* PORT */;
 
-	let selected_auth = if user_pass.is_some() { USERNAME_PASSWORD_AUTH } else { NO_AUTH };
-	let method_selection_request = [VERSION, NMETHODS, selected_auth];
+	let (username, password) = stream_isolation_parameter;
+	if username.len() > USERNAME_MAX_LEN || password.len() > PASSWORD_MAX_LEN {
+		return Err(());
+	}
+
+	let method_selection_request = [VERSION, NMETHODS, USERNAME_PASSWORD_AUTH];
 	let mut tcp_stream = TcpStream::connect(&socks5_proxy_addr).await.map_err(|_| ())?;
 	tokio::io::AsyncWriteExt::write_all(&mut tcp_stream, &method_selection_request)
 		.await
 		.map_err(|_| ())?;
 
 	let mut method_selection_reply = [0u8; METHOD_SELECT_REPLY_LEN];
 	tcp_stream.read_exact(&mut method_selection_reply).await.map_err(|_| ())?;
-	if method_selection_reply != [VERSION, selected_auth] {
+	if method_selection_reply != [VERSION, USERNAME_PASSWORD_AUTH] {
 		return Err(());
 	}
 
-	if let Some((username, password)) = user_pass {
-		if username.len() > USERNAME_MAX_LEN || password.len() > PASSWORD_MAX_LEN {
-			return Err(());
-		}
-
-		let mut username_password_request = [0u8; USERNAME_PASSWORD_REQUEST_MAX_LEN];
-		let mut writer = Cursor::new(&mut username_password_request[..]);
-		writer.write_all(&[USERNAME_PASSWORD_VERSION, username.len() as u8]).map_err(|_| ())?;
-		writer.write_all(username.as_bytes()).map_err(|_| ())?;
-		writer.write_all(&[password.len() as u8]).map_err(|_| ())?;
-		writer.write_all(password.as_bytes()).map_err(|_| ())?;
-		let pos = writer.position() as usize;
-		tokio::io::AsyncWriteExt::write_all(&mut tcp_stream, &username_password_request[..pos])
-			.await
-			.map_err(|_| ())?;
+	let mut username_password_request = [0u8; USERNAME_PASSWORD_REQUEST_MAX_LEN];
+	let mut writer = Cursor::new(&mut username_password_request[..]);
+	writer.write_all(&[USERNAME_PASSWORD_VERSION, username.len() as u8]).map_err(|_| ())?;
+	writer.write_all(username.as_bytes()).map_err(|_| ())?;
+	writer.write_all(&[password.len() as u8]).map_err(|_| ())?;
+	writer.write_all(password.as_bytes()).map_err(|_| ())?;
+	let pos = writer.position() as usize;
+	tokio::io::AsyncWriteExt::write_all(&mut tcp_stream, &username_password_request[..pos])
+		.await
+		.map_err(|_| ())?;
 
-		let mut username_password_reply = [0u8; USERNAME_PASSWORD_REPLY_LEN];
-		tcp_stream.read_exact(&mut username_password_reply).await.map_err(|_| ())?;
-		if username_password_reply != [USERNAME_PASSWORD_VERSION, SUCCESS] {
-			return Err(());
-		}
+	let mut username_password_reply = [0u8; USERNAME_PASSWORD_REPLY_LEN];
+	tcp_stream.read_exact(&mut username_password_reply).await.map_err(|_| ())?;
+	if username_password_reply != [USERNAME_PASSWORD_VERSION, SUCCESS] {
+		return Err(());
 	}
 
 	let mut socks5_request = [0u8; SOCKS5_REQUEST_MAX_LEN];
@@ -755,7 +756,7 @@ impl Hash for SocketDescriptor {
 #[cfg(test)]
 mod tests {
 	#[cfg(tor_socks5)]
-	use super::socks5_connect;
+	use super::tor_socks5_connect;
 
 	use bitcoin::constants::ChainHash;
 	use bitcoin::secp256k1::{PublicKey, Secp256k1, SecretKey};
@@ -1095,32 +1096,30 @@ mod tests {
 
 	#[cfg(tor_socks5)]
 	#[tokio::test]
-	async fn test_socks5_connect() {
+	async fn test_tor_socks5_connect() {
 		// Set TOR_SOCKS5_PROXY=127.0.0.1:9050
 		let socks5_proxy_addr: SocketAddr = std::env!("TOR_SOCKS5_PROXY").parse().unwrap();
 
 		// Success cases
 
-		for (addr_str, user_pass) in [
+		for (addr_str, stream_isolation_parameter) in [
 			// google.com
-			("142.250.189.196:80", None),
+			("142.250.189.196:80", ("<torS0X>0", "")),
 			// google.com
-			("[2607:f8b0:4005:813::2004]:80", None),
+			("[2607:f8b0:4005:813::2004]:80", ("<torS0X>0", "123")),
 			// torproject.org
-			("torproject.org:80", None),
+			("torproject.org:80", ("<torS0X>1abc", "")),
 			// torproject.org
-			("2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion:80", None),
-			// Same vectors as above, with a username and password
-			("142.250.189.196:80", Some(("<torS0X>0", ""))),
-			("[2607:f8b0:4005:813::2004]:80", Some(("<torS0X>0", "123"))),
-			("torproject.org:80", Some(("<torS0X>1abc", ""))),
 			(
 				"2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion:80",
-				Some(("<torS0X>1abc", "123")),
+				("<torS0X>1abc", "123"),
 			),
 		] {
 			let addr: SocketAddress = addr_str.parse().unwrap();
-			let tcp_stream = socks5_connect(socks5_proxy_addr, addr, user_pass).await.unwrap();
+			let tcp_stream =
+				tor_socks5_connect(socks5_proxy_addr, addr, stream_isolation_parameter)
+					.await
+					.unwrap();
 			assert_eq!(
 				tcp_stream.try_read(&mut [0u8; 1]).unwrap_err().kind(),
 				std::io::ErrorKind::WouldBlock
@@ -1129,22 +1128,17 @@ mod tests {
 
 		// Failure cases
 
-		for (addr_str, user_pass) in [
+		for (addr_str, stream_isolation_parameter) in [
 			// google.com, with some invalid port
-			("142.250.189.196:1234", None),
+			("142.250.189.196:1234", ("<torS0X>0", "")),
 			// google.com, with some invalid port
-			("[2607:f8b0:4005:813::2004]:1234", None),
+			("[2607:f8b0:4005:813::2004]:1234", ("<torS0X>0", "123")),
 			// torproject.org, with some invalid port
-			("torproject.org:1234", None),
+			("torproject.org:1234", ("<torS0X>1abc", "")),
 			// torproject.org, with a typo
-			("3gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion:80", None),
-			// Same vectors as above, with a username and password
-			("142.250.189.196:1234", Some(("<torS0X>0", ""))),
-			("[2607:f8b0:4005:813::2004]:1234", Some(("<torS0X>0", "123"))),
-			("torproject.org:1234", Some(("<torS0X>1abc", ""))),
 			(
 				"3gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion:80",
-				Some(("<torS0X>1abc", "123")),
+				("<torS0X>1abc", "123"),
 			),
 			/* TODO: Uncomment when format types 30 and 31 land in tor stable, see https://spec.torproject.org/socks-extensions.html,
 			   these are invalid usernames according to those standards.
@@ -1155,7 +1149,9 @@ mod tests {
 			*/
 		] {
 			let addr: SocketAddress = addr_str.parse().unwrap();
-			assert!(socks5_connect(socks5_proxy_addr, addr, user_pass).await.is_err());
+			assert!(tor_socks5_connect(socks5_proxy_addr, addr, stream_isolation_parameter)
+				.await
+				.is_err());
 		}
 	}
 }