Improve Tor Handling — heartwood

Introduce a feature for supporting connections via Tor, and improve domain modelling around configuration of SOCKS proxying.

 name = "rad"
 path = "src/main.rs"
 [features]
 default = ["tor"]
 tor = ["radicle/tor"]
 [dependencies]
 anyhow = "1"
 chrono = { workspace = true, features = ["clock", "std"] }

         },
         "onion": {
           "description": "Onion address config.",
           "anyOf": [
             {
               "$ref": "#/$defs/AddressConfig"
             },
             {
               "type": "null"
             }
           ]
           "$ref": "#/$defs/AddressConfig"
         },
         "network": {
           "description": "Peer-to-peer network.",

           "required": [
             "mode"
           ]
         },
         {
           "description": "Drop connections to this address type.",
           "type": "object",
           "properties": {
             "mode": {
               "type": "string",
               "const": "drop"
             }
           },
           "required": [
             "mode"
           ]
         }
       ]
     },

 rust-version.workspace = true
 [features]
 default = ["backtrace", "systemd", "structured-logger", "socket2"]
 default = ["backtrace", "systemd", "structured-logger", "socket2", "tor"]
 systemd = ["dep:radicle-systemd"]
 test = ["radicle/test", "radicle-crypto/test", "radicle-crypto/cyphernet", "radicle-protocol/test", "qcheck", "snapbox"]
 tor = ["cyphernet/tor", "radicle/tor", "radicle-protocol/tor"]
 [dependencies]
 backtrace = { version = "0.3.75", optional = true }

 chrono = { workspace = true, features = ["clock"] }
 colored = { workspace = true }
 crossbeam-channel = { workspace = true }
 cyphernet = { workspace = true, features = ["tor", "dns", "ed25519", "p2p-ed25519", "noise-framework", "noise_sha2"] }
 cyphernet = { workspace = true, features = ["dns", "ed25519", "p2p-ed25519", "noise-framework", "noise_sha2"] }
 fastrand = { workspace = true }
 gix-packetline = { workspace = true, features = ["blocking-io"] }
 lexopt = { workspace = true }

 use radicle::crypto;
 use radicle::node::Link;
 use radicle::node::NodeId;
 #[cfg(feature = "tor")]
 use radicle::node::config::AddressConfig;
 use radicle::storage::WriteStorage;
 use radicle_protocol::deserializer::Deserializer;

         (HostName::Dns(_), Some(proxy)) => proxy.into(),
         (HostName::Dns(dns), None) => NetAddr::new(InetHost::Dns(dns.clone()), remote_addr.port),
         // For onion addresses, handle with care.
         #[cfg(feature = "tor")]
         (HostName::Tor(onion), proxy) => match config.onion {
             // In onion proxy mode, simply use the configured proxy address.
             // This takes precedence over any global proxy.
             Some(AddressConfig::Proxy { address }) => address.into(),
             AddressConfig::Proxy { address } => address.into(),
             // In "forward" mode, if a global proxy is set, we use that, otherwise
             // we treat `.onion` addresses as regular DNS names.
             Some(AddressConfig::Forward) => {
             AddressConfig::Forward => {
                 if let Some(proxy) = proxy {
                     proxy.into()
                 } else {

                 }
             }
             // If onion address support isn't configured, refuse to connect.
             None => {
             AddressConfig::Drop => {
                 return Err(io::Error::new(
                     io::ErrorKind::Unsupported,
                     "no configuration found for .onion addresses",

 [features]
 test = ["radicle/test", "radicle-crypto/test", "radicle-crypto/cyphernet", "qcheck"]
 tor = ["cypheraddr/tor", "radicle/tor"]
 [dependencies]
 bloomy = "1.2"
 bytes = { workspace = true }
 crossbeam-channel = { workspace = true }
 cypheraddr = { workspace = true, features = ["serde", "tor"] }
 cypheraddr = { workspace = true, features = ["serde"] }
 fastrand = { workspace = true }
 log = { workspace = true, features = ["std"] }
 nonempty = { workspace = true, features = ["serialize"] }

 use radicle::node::address;
 use radicle::node::address::Store as _;
 use radicle::node::address::{AddressBook, AddressType, KnownAddress};
 #[cfg(feature = "tor")]
 use radicle::node::config::AddressConfig;
 use radicle::node::config::{PeerConfig, RateLimit};
 use radicle::node::device::Device;
 use radicle::node::refs::Store as _;

     fn is_supported_address(&self, address: &Address) -> bool {
         match AddressType::from(address) {
             // Only consider onion addresses if configured.
             AddressType::Onion => self.config.onion.is_some(),
             #[cfg(feature = "tor")]
             AddressType::Onion => self.config.onion != AddressConfig::Drop,
             AddressType::Dns | AddressType::Ipv4 | AddressType::Ipv6 => true,
         }
     }

 use bytes::{Buf, BufMut};
 #[cfg(feature = "tor")]
 use cypheraddr::tor;
 use radicle::crypto::{PublicKey, Signature};

     Alias(#[from] node::AliasError),
     #[error("invalid user agent string: {err}")]
     InvalidUserAgent { err: String },
     #[cfg(feature = "tor")]
     #[error("invalid onion address: {0}")]
     OnionAddr(#[from] tor::OnionAddrDecodeError),
     #[error("invalid timestamp: {actual_millis} millis")]

     }
 }
 #[cfg(feature = "tor")]
 impl Encode for cypheraddr::tor::OnionAddrV3 {
     fn encode(&self, buf: &mut impl BufMut) {
         self.into_raw_bytes().encode(buf)

     }
 }
 #[cfg(feature = "tor")]
 impl Decode for tor::OnionAddrV3 {
     fn decode(buf: &mut impl Buf) -> Result<Self, Error> {
         let bytes: [u8; tor::ONION_V3_RAW_LEN] = Decode::decode(buf)?;

 use bytes::Buf;
 use bytes::BufMut;
 use cypheraddr::{HostName, NetAddr, tor};
 #[cfg(feature = "tor")]
 use cypheraddr::tor;
 use cypheraddr::{HostName, NetAddr};
 use radicle::crypto::Signature;
 use radicle::git::Oid;
 use radicle::identity::RepoId;

     Ipv4 = 1,
     Ipv6 = 2,
     Dns = 3,
     #[cfg(feature = "tor")]
     Onion = 4,
 }

             HostName::Ip(net::IpAddr::V4(_)) => AddressType::Ipv4,
             HostName::Ip(net::IpAddr::V6(_)) => AddressType::Ipv6,
             HostName::Dns(_) => AddressType::Dns,
             #[cfg(feature = "tor")]
             HostName::Tor(_) => AddressType::Onion,
             _ => todo!(), // FIXME(cloudhead): Maxim will remove `non-exhaustive`
         }

 => Ok(AddressType::Ipv4),
 => Ok(AddressType::Ipv6),
 => Ok(AddressType::Dns),
             #[cfg(feature = "tor")]
 => Ok(AddressType::Onion),
             _ => Err(other),
         }

                 u8::from(AddressType::Dns).encode(buf);
                 dns.encode(buf);
             }
             #[cfg(feature = "tor")]
             HostName::Tor(addr) => {
                 u8::from(AddressType::Onion).encode(buf);
                 addr.encode(buf);

   "radicle-localtime/schemars",
   "dep:schemars"
 ]
 tor = ["cyphernet/tor"]
 [dependencies]
 amplify = { workspace = true, features = ["std"] }

 chrono = { workspace = true, features = ["clock"], optional = true }
 colored = { workspace = true, optional = true }
 crossbeam-channel = { workspace = true }
 cyphernet = { workspace = true, features = ["tor", "dns", "p2p-ed25519"] }
 cyphernet = { workspace = true, features = ["dns", "p2p-ed25519"] }
 dunce = { workspace = true }
 fast-glob = { version = "0.3.2" }
 fastrand = { workspace = true, features = ["std"] }

     }
     /// Returns `true` if the [`HostName`] is a Tor onion address.
     #[cfg(feature = "tor")]
     pub fn is_onion(&self) -> bool {
         match self.0.host {
             HostName::Tor(_) => true,

             HostName::Ip(IpAddr::V4(ip)) => ip.to_string(),
             HostName::Ip(IpAddr::V6(ip)) => format!("[{ip}]"),
             HostName::Dns(dns) => dns.clone(),
             #[cfg(feature = "tor")]
             HostName::Tor(onion) => {
                 let onion = onion.to_string();
                 let start = onion.chars().take(8).collect::<String>();

                 "ipv4" => Ok(AddressType::Ipv4),
                 "ipv6" => Ok(AddressType::Ipv6),
                 "dns" => Ok(AddressType::Dns),
                 #[cfg(feature = "tor")]
                 "onion" => Ok(AddressType::Onion),
                 _ => Err(err),
             },

             Self::Ipv4 => "ipv4".bind(stmt, i),
             Self::Ipv6 => "ipv6".bind(stmt, i),
             Self::Dns => "dns".bind(stmt, i),
             #[cfg(feature = "tor")]
             Self::Onion => "onion".bind(stmt, i),
         }
     }

 pub mod seeds {
     use std::{str::FromStr, sync::LazyLock};
     use cyphernet::addr::{HostName, NetAddr, tor::OnionAddrV3};
     #[cfg(feature = "tor")]
     use cyphernet::addr::tor::OnionAddrV3;
     use cyphernet::addr::{HostName, NetAddr};
     use super::{ConnectAddress, NodeId, PeerAddr};

             NodeId::from_str("z6MkrLMMsiPWUcNPHcRajuMi9mDfYckSoJyPwwnknocNYPm7").unwrap(),
             vec![
                 HostName::Dns("iris.radicle.xyz".to_owned()),
                 #[cfg(feature = "tor")]
                 #[allow(clippy::unwrap_used)] // Value is manually verified.
                 OnionAddrV3::from_str(
                     "irisradizskwweumpydlj4oammoshkxxjur3ztcmo7cou5emc6s5lfid.onion",

 }
 /// Proxy configuration.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[derive(Debug, Copy, Clone, Default, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase", tag = "mode")]
 #[cfg_attr(feature = "schemars", derive(schemars::JsonSchema))]
 #[cfg(feature = "tor")]
 pub enum AddressConfig {
     /// Proxy connections to this address type.
     Proxy {

     /// Forward address to the next layer. Either this is the global proxy,
     /// or the operating system, via DNS.
     Forward,
     /// Drop connections to this address type.
     #[default]
     Drop,
 }
 /// Default seeding policy. Applies when no repository policies for the given repo are found.

     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub proxy: Option<net::SocketAddr>,
     /// Onion address config.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub onion: Option<AddressConfig>,
     #[cfg(feature = "tor")]
     #[serde(
         default,
         skip_serializing_if = "crate::serde_ext::is_default",
         deserialize_with = "crate::serde_ext::null_to_default"
     )]
     pub onion: AddressConfig,
     /// Peer-to-peer network.
     #[serde(default)]
     pub network: Network,

             external_addresses: vec![],
             network: Network::default(),
             proxy: None,
             onion: None,
             #[cfg(feature = "tor")]
             onion: AddressConfig::Drop,
             relay: Relay::default(),
             limits: Limits::default(),
             workers: Workers::default(),

             crate::storage::refs::FeatureLevel::Parent
         );
     }
     #[cfg(feature = "tor")]
     #[test]
     fn onion_absent() {
         let actual: super::Config = serde_json::from_value(json!({
             "alias": "radicle",
         }))
         .unwrap();
         assert_eq!(super::AddressConfig::Drop, actual.onion);
     }
     #[cfg(feature = "tor")]
     #[test]
     fn onion_null() {
         // Backwards compatibility: Prior versions allowed to set `onion` to `null`,
         // which should be treated the same as the default, i.e. `Drop`.
         let actual: super::Config = serde_json::from_value(json!({
             "alias": "radicle",
             "onion": null,
         }))
         .unwrap();
         assert_eq!(super::AddressConfig::Drop, actual.onion);
     }
 }

     let v: serde_json::Value = serde::Deserialize::deserialize(deserializer)?;
     Ok(T::deserialize(v).unwrap_or_default())
 }
 /// Deserialize a value, but if it is `null`, return the default value.
 pub(crate) fn null_to_default<'de, D, T>(deserializer: D) -> Result<T, D::Error>
 where
     T: serde::Deserialize<'de> + Default,
     D: serde::Deserializer<'de>,
 {
     use serde::Deserialize as _;
     Ok(Option::deserialize(deserializer)?.unwrap_or_default())
 }

 use std::{iter, net};
 use crypto::PublicKey;
 use cyphernet::EcPk;
 use cyphernet::addr::tor::OnionAddrV3;
 #[cfg(feature = "tor")]
 use cyphernet::{EcPk, addr::tor::OnionAddrV3};
 use qcheck::Arbitrary;
 use crate::identity::doc::Visibility;