net: SOCKS5 --proxy for P2P outbound - #641
Open
rearden-grok[bot] wants to merge 10 commits into
Open
rearden-grok[bot] wants to merge 10 commits into
rearden-grok[bot] wants to merge 10 commits into
Conversation
8 tasks
rearden-grok
Bot
force-pushed
the
net/socks-proxy
branch
from
September 19, 2026 17:39
36d3a91 to
0699a74
Compare
8 tasks
rearden-grok
Bot
force-pushed
the
net/socks-proxy
branch
2 times, most recently
from
September 20, 2026 21:14
94f50dc to
7d7d0bd
Compare
Hand-rolled client so P2P outbound can tunnel via system Tor. Test records ATYP=1 and echoes a byte through the tunnel. No live Tor. Co-authored-by: Cursor <cursoragent@cursor.com>
ATYP=3 sends the hostname bytes so seed lookup can use remote DNS through the proxy. One CONNECT encoder covers IPv4, IPv6, and domain. Co-authored-by: Cursor <cursoragent@cursor.com>
ProxyCreds::fresh and dial_isolated mint a new RFC 1929 username per call so Tor can isolate circuits. Fake proxy records the bytes. Co-authored-by: Cursor <cursoragent@cursor.com>
spawn_peer, tip-follow, and feelers share one Dialer. A fake SOCKS splice plus BIP324 handshake proves CONNECT is used; Direct is unchanged. Co-authored-by: Cursor <cursoragent@cursor.com>
Operator SOCKS is a ListenOpts dialer passed into P2P start and IBD, so outbound never bypasses the proxy when one is configured. Co-authored-by: Cursor <cursoragent@cursor.com>
SOCKS does remote DNS; ToSocketAddrs on seed hostnames would leak queries off-proxy. --proxy-randomize stays on unless explicitly off. Co-authored-by: Cursor <cursoragent@cursor.com>
Home-node Tor SOCKS is a module option and OPERATOR flag, not extraArgs. proxyRandomize stays on so Tor isolates circuits unless the operator turns it off. Co-authored-by: Cursor <cursoragent@cursor.com>
Catch-up and retry already start through P2PNode; cloning that dialer keeps SOCKS on the IBD path without growing run_ibd_or_skip's arity. Co-authored-by: Cursor <cursoragent@cursor.com>
Coverage CRAP flagged the unused Dialer domain path. The SOCKS encoder was already tested; this drives the production Dialer match arms. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
rearden-grok
Bot
force-pushed
the
net/socks-proxy
branch
from
September 20, 2026 21:37
7d7d0bd to
48c1288
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Plan
docs/personal-node-plans/00-socks-proxy.md: every P2P outbound dial goes through a SOCKS5 CONNECT when--proxyis set.Summary
Dialer::{Direct,Socks}) is the only outbound TCP path (IBD spawn, tip-follow, feeler).--proxy/--onion/--proxy-randomize(default on) CLI + snake conf; empty/invalid proxy is a start error.--proxy, DNS/fixed seeds are notToSocketAddrslocally (use--connect/peers). Isolation creds are fresh per peer unless--proxy-randomize=0.services.rbitcoin.proxy/onionProxy/proxyRandomize(notextraArgs). Eval pins argv. Noservices.torin the fixture.First of the stacked home-node plans (00–09). Fake SOCKS only — no live Tor.
Test plan
cargo test -p rbitcoin-net --lib socks5_/outbound_dial_uses_proxy_when_set/dns_seeds_not_resolved_locally_when_proxycargo test -p rbitcoin-node --lib proxy_/proxy_randomize_defaults_on/dns_seeds_not_resolved_locally_when_proxycargo clippy --workspace --all-targets -- -D warningscargo deny check/./scripts/ast-grep.sh/cargo fmt --all -- --checknix build .#checks.x86_64-linux.nixos-module-eval --no-link./scripts/ci-os-smoke.shfmt,deny,clippy,ast-grep,test,windows,macos,coverage,nixos-module-eval)Made with Cursor