Merge pull request 'net: add Tor mode for outbound discovery' (#28) from tor-mode into main

7 files changed, 197 insertions, 7 deletions

diff --git a/README.md b/README.md
index c2fd6b8..978aba5 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,8 @@ Worth being precise, because the difference matters if you are relying on it.
 
 **The node still listens on 8433.** Nothing dials by IP any more, but the listener is still there, so anyone who already knows your address and can reach that port may connect directly. If that matters to you, firewall it.
 
-This is unlinkability between peers, not anonymity against a network observer. It is not Tor.
+This is unlinkability between peers, not anonymity against a network observer.
+For Tor routing, start the node with `-tor`; see [Tor mode](docs/tor.md).
 
 ---
 
@@ -319,6 +320,7 @@ Other options worth knowing:
 -datadir=PATH    # wallet and chain data elsewhere
 -port=N          # P2P listen port, default 8433
 -socks=HOST:PORT # SOCKS5 for outbound Nostr and .btf rendezvous dials
+-tor[=HOST:PORT] # Tor mode; default local Tor SOCKS5 proxy is 127.0.0.1:9050
 -debug           # verbose log; without it debug.log is nearly silent
 -help            # full list
 ```
@@ -332,6 +334,11 @@ dials through a local SOCKS5 proxy such as Tor. When it is set, the node skips
 plain HTTP external-IP probes instead of leaking a direct request outside the
 proxy. IPv6 proxy endpoints use brackets, for example `-socks=[::1]:9050`.
 
+`-tor` is a privacy shorthand for the usual local Tor SOCKS5 listener at
+`127.0.0.1:9050`. It routes outbound Nostr discovery and `.btf` rendezvous
+dials through Tor, refuses direct `.onion` resolution, and keeps external-IP
+probes disabled. Use `-tor=HOST:PORT` when Tor listens somewhere else.
+
 ### When something looks wrong
 
 **Menu > Diagnostics**, and the same report in `debug.log` every ten minutes:
diff --git a/docs/tor.md b/docs/tor.md
new file mode 100644
index 0000000..087c822
--- /dev/null
+++ b/docs/tor.md
@@ -0,0 +1,84 @@
+# Tor mode
+
+Bitflash can route outbound discovery traffic through a local Tor SOCKS5 proxy.
+This is transport plumbing only: it does not change consensus, wallet keys,
+mining, `.btf` addresses, or the encrypted rendezvous protocol.
+
+## Client mode
+
+Start Tor locally, then start Bitflash with:
+
+```bash
+bitflash -tor
+```
+
+`-tor` is shorthand for:
+
+```bash
+bitflash -socks=127.0.0.1:9050
+```
+
+If Tor listens somewhere else:
+
+```bash
+bitflash -tor=127.0.0.1:9150
+bitflash -tor=[::1]:9050
+```
+
+When Tor mode is enabled:
+
+- outbound Nostr relay dials use Tor;
+- outbound `.btf` rendezvous relay dials use Tor;
+- destination names are sent to Tor as SOCKS5 domain-name CONNECT requests, so
+  the local DNS resolver does not see them;
+- direct `.onion` dials are refused unless a SOCKS5/Tor proxy is enabled;
+- plain HTTP external-IP probes are skipped.
+
+## Onion rendezvous relay
+
+An operator can expose a Bitflash rendezvous relay as a Tor hidden service. The
+node does not create hidden services itself; Tor owns that configuration.
+
+Example `torrc`:
+
+```text
+HiddenServiceDir /var/lib/tor/bitflash-rendezvous/
+HiddenServicePort 8434 127.0.0.1:8434
+```
+
+After restarting Tor, read the generated onion name:
+
+```bash
+sudo cat /var/lib/tor/bitflash-rendezvous/hostname
+```
+
+Then run the relay on localhost/VPS as usual and announce the onion endpoint from
+nodes that use Tor:
+
+```bash
+bitflash -tor -rvrelay=exampleexampleexampleexampleexampleexampleexampleexample.onion:8434
+bitflash -tor -announcerelay=exampleexampleexampleexampleexampleexampleexampleexample.onion:8434
+```
+
+For a pool operator that wants the pool descriptor to point at an onion
+rendezvous relay, use both:
+
+```bash
+bitflash -operator -tor \
+  -rvrelay=exampleexampleexampleexampleexampleexampleexampleexample.onion:8434 \
+  -announcerelay=exampleexampleexampleexampleexampleexampleexampleexample.onion:8434
+```
+
+## Full-node hidden service
+
+The legacy P2P listener still binds to port `8433`. You can expose it through
+Tor manually:
+
+```text
+HiddenServiceDir /var/lib/tor/bitflash-node/
+HiddenServicePort 8433 127.0.0.1:8433
+```
+
+Current automatic peer discovery is `.btf`/rendezvous based, not onion-address
+gossip. Treat direct full-node onion access as an operator/admin tool unless a
+future release adds first-class onion peer advertisements.
diff --git a/src/main_gui.cpp b/src/main_gui.cpp
index 90a6050..bef8503 100644
--- a/src/main_gui.cpp
+++ b/src/main_gui.cpp
@@ -138,6 +138,7 @@ static void PrintUsage()
     printf("Network:\n");
     printf("  /port=N                    (P2P listen port, default 8433)\n");
     printf("  /socks=HOST:PORT           (SOCKS5 proxy for outbound Nostr and .btf relay dials)\n");
+    printf("  /tor[=HOST:PORT]           (Tor mode; default SOCKS5 proxy is 127.0.0.1:9050)\n");
     printf("  /btfseed=ADDRESS:ENCHEX    (extra bootstrap peer, repeatable)\n");
     printf("\n");
     printf("Wallet:\n");
@@ -285,16 +286,35 @@ static void ParseStartupArguments(int argc, char* argv[])
     if (!announceRelay.empty())
         strBtfAnnounceRelay = announceRelay;
 
-    string socksProxy = argval2(argc, argv, "/socks", "-socks");
-    if (!socksProxy.empty())
+    bool fTorMode = arg(argc, argv, "/tor") || arg(argc, argv, "-tor");
+    if (fTorMode)
     {
+        string socksProxy = argval2(argc, argv, "/socks", "-socks");
+        if (!socksProxy.empty())
+            fprintf(stderr, "Warning: /tor takes precedence over /socks=%s\n",
+                    socksProxy.c_str());
+
+        string torProxy = argval2(argc, argv, "/tor", "-tor");
         string err;
-        if (!BtfSetSocks5Proxy(socksProxy, err))
-            fprintf(stderr, "Ignoring /socks=%s: %s\n", socksProxy.c_str(), err.c_str());
+        if (!BtfEnableTorProxy(torProxy, err))
+            fprintf(stderr, "Ignoring /tor=%s: %s\n", torProxy.c_str(), err.c_str());
         else
-            fprintf(stderr, "SOCKS5 proxy enabled for outbound discovery/relay dials: %s\n",
+            fprintf(stderr, "Tor mode enabled through SOCKS5 proxy %s\n",
                     BtfSocks5ProxyName().c_str());
     }
+    else
+    {
+        string socksProxy = argval2(argc, argv, "/socks", "-socks");
+        if (!socksProxy.empty())
+        {
+            string err;
+            if (!BtfSetSocks5Proxy(socksProxy, err))
+                fprintf(stderr, "Ignoring /socks=%s: %s\n", socksProxy.c_str(), err.c_str());
+            else
+                fprintf(stderr, "SOCKS5 proxy enabled for outbound discovery/relay dials: %s\n",
+                        BtfSocks5ProxyName().c_str());
+        }
+    }
 
     // /btfseed=ADDRESS:ENCHEX -- extra bootstrap peers, repeatable. Useful for
     // testing the seed path and for private networks that ship no compiled list.
diff --git a/src/proxy.cpp b/src/proxy.cpp
index d7dc324..7d30911 100644
--- a/src/proxy.cpp
+++ b/src/proxy.cpp
@@ -9,8 +9,10 @@
 
 static CCriticalSection cs_socks5;
 static bool g_fSocks5Proxy = false;
+static bool g_fTorProxy = false;
 static std::string g_socks5Host;
 static unsigned short g_socks5Port = 0;
+static const char* DEFAULT_TOR_SOCKS5_PROXY = "127.0.0.1:9050";
 
 static void SetSocketTimeout(SOCKET s, int nTimeoutSecs)
 {
@@ -67,6 +69,24 @@ static bool ValidProxyIpv6HostChar(char c)
     return isxdigit((unsigned char)c) || c == ':' || c == '.';
 }
 
+static std::string LowerProxyHost(std::string host)
+{
+    if (!host.empty() && host[host.size() - 1] == '.')
+        host.erase(host.size() - 1);
+    for (size_t i = 0; i < host.size(); i++)
+        host[i] = (char)tolower((unsigned char)host[i]);
+    return host;
+}
+
+bool BtfIsTorOnionHost(const std::string& host)
+{
+    std::string lower = LowerProxyHost(host);
+    static const char* suffix = ".onion";
+    size_t suffixLen = strlen(suffix);
+    return lower.size() > suffixLen &&
+           lower.compare(lower.size() - suffixLen, suffixLen, suffix) == 0;
+}
+
 static bool ParsePort(const std::string& port, unsigned short& portOut,
                       std::string& errOut)
 {
@@ -176,7 +196,8 @@ bool BtfParseSocks5Proxy(const std::string& spec, std::string& hostOut,
     return true;
 }
 
-bool BtfSetSocks5Proxy(const std::string& spec, std::string& errOut)
+static bool SetSocks5Proxy(const std::string& spec, bool fTorMode,
+                           std::string& errOut)
 {
     std::string host;
     unsigned short port = 0;
@@ -187,15 +208,27 @@ bool BtfSetSocks5Proxy(const std::string& spec, std::string& errOut)
         g_socks5Host = host;
         g_socks5Port = port;
         g_fSocks5Proxy = true;
+        g_fTorProxy = fTorMode;
     }
     return true;
 }
 
+bool BtfSetSocks5Proxy(const std::string& spec, std::string& errOut)
+{
+    return SetSocks5Proxy(spec, false, errOut);
+}
+
+bool BtfEnableTorProxy(const std::string& spec, std::string& errOut)
+{
+    return SetSocks5Proxy(spec.empty() ? DEFAULT_TOR_SOCKS5_PROXY : spec, true, errOut);
+}
+
 void BtfClearSocks5Proxy()
 {
     CRITICAL_BLOCK(cs_socks5)
     {
         g_fSocks5Proxy = false;
+        g_fTorProxy = false;
         g_socks5Host.clear();
         g_socks5Port = 0;
     }
@@ -208,6 +241,13 @@ bool BtfSocks5ProxyEnabled()
     return false;
 }
 
+bool BtfTorProxyEnabled()
+{
+    CRITICAL_BLOCK(cs_socks5)
+        return g_fSocks5Proxy && g_fTorProxy;
+    return false;
+}
+
 std::string BtfSocks5ProxyName()
 {
     CRITICAL_BLOCK(cs_socks5)
@@ -315,7 +355,15 @@ SOCKET BtfConnectSocket(const std::string& destHost, unsigned short destPort,
     }
 
     if (!fProxy)
+    {
+        if (BtfIsTorOnionHost(destHost))
+        {
+            error("Refusing direct .onion connection to %s:%u; use /tor or /socks\n",
+                  destHost.c_str(), (unsigned)destPort);
+            return INVALID_SOCKET;
+        }
         return ConnectDirect(destHost, destPort, nSockSite, nTimeoutSecs);
+    }
 
     SOCKET s = ConnectDirect(proxyHost, proxyPort, nSockSite, nTimeoutSecs);
     if (s == INVALID_SOCKET)
diff --git a/src/proxy.h b/src/proxy.h
index b5e69c8..6429cf2 100644
--- a/src/proxy.h
+++ b/src/proxy.h
@@ -21,8 +21,11 @@
 bool BtfParseSocks5Proxy(const std::string& spec, std::string& hostOut,
                          unsigned short& portOut, std::string& errOut);
 bool BtfSetSocks5Proxy(const std::string& spec, std::string& errOut);
+bool BtfEnableTorProxy(const std::string& spec, std::string& errOut);
 void BtfClearSocks5Proxy();
 bool BtfSocks5ProxyEnabled();
+bool BtfTorProxyEnabled();
+bool BtfIsTorOnionHost(const std::string& host);
 std::string BtfSocks5ProxyName();
 
 SOCKET BtfConnectSocket(const std::string& destHost, unsigned short destPort,
diff --git a/src/readme.txt b/src/readme.txt
index 1fa77df..794fe20 100644
--- a/src/readme.txt
+++ b/src/readme.txt
@@ -46,6 +46,9 @@ Command-line options (in addition to the original ones)
                  route outbound Nostr and .btf rendezvous dials through a
                  SOCKS5 proxy, e.g. /socks=127.0.0.1:9050 for local Tor
                  or /socks=[::1]:9050 for an IPv6 loopback proxy
+  /tor[=HOST:PORT]
+                 Tor mode for outbound Nostr and .btf rendezvous dials;
+                 defaults to the local Tor SOCKS5 proxy at 127.0.0.1:9050
   /solomine      mine without requiring a connected peer (local testing)
   /operator      operator mode (run pool server)
   /participant=ADDR
diff --git a/src/selftest.cpp b/src/selftest.cpp
index aa4e528..cca5335 100644
--- a/src/selftest.cpp
+++ b/src/selftest.cpp
@@ -1474,6 +1474,11 @@ static int RunSocks5ProxySelfTest()
                    "rejects overflowing port") ? 0 : 1;
     nFail += Check(!BtfParseSocks5Proxy("user:pass@localhost:9050", host, port, err),
                    "rejects unsupported authenticated proxy syntax") ? 0 : 1;
+    nFail += Check(BtfIsTorOnionHost("abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcd.onion") &&
+                   BtfIsTorOnionHost("Relay.Example.ONION.") &&
+                   !BtfIsTorOnionHost("relay.example") &&
+                   !BtfIsTorOnionHost(".onion"),
+                   "detects .onion hosts without accepting lookalikes") ? 0 : 1;
 
     BtfClearSocks5Proxy();
     nFail += Check(!BtfSocks5ProxyEnabled(), "starts disabled after clear") ? 0 : 1;
@@ -1490,6 +1495,26 @@ static int RunSocks5ProxySelfTest()
                    "enables bracketed IPv6 proxy endpoint") ? 0 : 1;
     BtfClearSocks5Proxy();
 
+    nFail += Check(BtfEnableTorProxy("", err) &&
+                   BtfSocks5ProxyEnabled() &&
+                   BtfTorProxyEnabled() &&
+                   BtfSocks5ProxyName() == "127.0.0.1:9050",
+                   "enables Tor mode on the default local SOCKS5 endpoint") ? 0 : 1;
+    BtfClearSocks5Proxy();
+
+    nFail += Check(BtfEnableTorProxy("[::1]:9050", err) &&
+                   BtfSocks5ProxyEnabled() &&
+                   BtfTorProxyEnabled() &&
+                   BtfSocks5ProxyName() == "[::1]:9050",
+                   "enables Tor mode on a custom IPv6 endpoint") ? 0 : 1;
+    BtfClearSocks5Proxy();
+
+    nFail += Check(BtfSetSocks5Proxy("127.0.0.1:9051", err) &&
+                   BtfSocks5ProxyEnabled() &&
+                   !BtfTorProxyEnabled(),
+                   "plain SOCKS5 mode is distinct from Tor mode") ? 0 : 1;
+    BtfClearSocks5Proxy();
+
     std::string handshakeErr;
     bool fHandshakeOk = RunSocks5HandshakeProbe(handshakeErr);
     nFail += Check(fHandshakeOk, handshakeErr.empty() ?