net/hosts: Verify pluggable transport address correctness.

Cargo.lock

@@ -1618,6 +1618,7 @@ dependencies = [
  "structopt-toml",
  "thiserror",
  "toml 0.7.5",
+ "tor-hscrypto",
  "url",
  "wasmer",
  "wasmer-compiler-singlepass",

Cargo.toml

@@ -78,6 +78,7 @@ socket2 = {version = "0.5.3", optional = true, features = ["all"]}
 
 # Pluggable Transports
 arti-client = {version = "0.9.1", default-features = false, features = ["async-std", "rustls", "onion-service-client"], optional = true}
+tor-hscrypto = {version = "0.2.1", optional = true}
 # TODO: nym ( Read this to figure out impl https://github.com/ChainSafe/rust-libp2p-nym )
 
 # TLS cert utilities
@@ -150,7 +151,7 @@ prettytable-rs = "0.10.0"
 # -----BEGIN LIBRARY FEATURES-----
 [features]
 p2p-transport-tcp = []
-p2p-transport-tor = ["arti-client"]
+p2p-transport-tor = ["arti-client", "tor-hscrypto"]
 p2p-transport-nym = []
 
 async-runtime = [
@@ -339,5 +340,6 @@ required-features = ["zk"]
 
 [patch.crates-io]
 arti-client = {git="https://gitlab.torproject.org/tpo/core/arti", rev="08d1155cb92568176d8b54b85ec5437dff112e01"}
+tor-hscrypto = {git="https://gitlab.torproject.org/tpo/core/arti", rev="08d1155cb92568176d8b54b85ec5437dff112e01"}
 halo2_proofs = {git="https://github.com/parazyd/halo2", branch="v3"}
 halo2_gadgets = {git="https://github.com/parazyd/halo2", branch="v3"}

src/net/hosts.rs

@@ -115,10 +115,37 @@ impl Hosts {
                 }
             }
 
-            // TODO: Should find a way to test the hosts are live without DNS leaks.
-            // Historically there is some code for this in cb73861bc13d3d5b43a6af931f29ce937e6fe681
-            // We could try to instantiate a channel and perform a handshake,
-            // although this seems kinda "heavy". Open to suggestions :)
+            #[cfg(not(feature = "p2p-transport-tor"))]
+            // If Tor is not enabled, we won't store the addrs as we have
+            // no means to validate them.
+            if addr.scheme() == "tor" || addr.scheme() == "tor+tls" {
+                continue
+            }
+
+            #[cfg(not(feature = "p2p-transport-nym"))]
+            // Same for Nym
+            if addr.scheme() == "nym" || addr.scheme() == "nym+tls" {
+                continue
+            }
+
+            match addr.scheme() {
+                // Validate that the address is an actual onion.
+                #[cfg(feature = "p2p-transport-tor")]
+                "tor" | "tor+tls" => {
+                    use std::str::FromStr;
+                    if tor_hscrypto::pk::HsId::from_str(host_str).is_err() {
+                        continue
+                    }
+                }
+
+                #[cfg(feature = "p2p-transport-nym")]
+                "nym" | "nym+tls" => {}
+
+                #[cfg(feature = "p2p-transport-tcp")]
+                "tcp" | "tcp+tls" => {}
+
+                _ => continue,
+            }
 
             ret.push(_addr.clone());
         }