Add authentication to KumoProxy

[tommairs]

Currently KumoProxy relies on external firewall and router configuration to ensure authorized access. It has been suggested that adding authentication to the proxy would be valuable.

One possible option is to add username+password (basic auth), but other options may be possible.

This ticket is waiting for sponsorship.

[wez]

Note that we are limited to what SOCKS5 allows for auth, and further constrained by what is reasonable to hook up to rust.
https://docs.rs/socksv5/latest/socksv5/v5/enum.SocksV5AuthMethod.html shows possibilities, but the reality is that username and password is the easiest to wrangle. There would need to be some way to plug in an authentication database/validation in the proxy server. If we pulled in the kumomta basic auth approach to power this with lua that might be acceptable.

Note also that there is no inherent transport security in the SOCKS5 protocol, so this feature would also require TLS support in both the server and the client as a pre-requisite in order for it to be usable on an untrusted network, otherwise you're just leaking your credentials and you're no better off than not having auth.

I can see someone then potentially asking for mTLS on top of that.

[ufou]

Thanks for creating this issue, I was also looking at alternatives to KumoProxy and wondered if there was a reason not to use a third party socks proxy that already has auth? I note in the KumoMTA docs this:

While KumoMTA will work with any compliant SOCKS5 proxy server, we have built KumoProxy to serve as an integrated and supported proxy server specifically for use with KumoMTA.

I found 2 alternatives (not really wanting to use Haproxy):
https://github.com/serjs/socks5-server
https://github.com/quintusl/rust-socksd

Both of which support basic auth + ip restrictions, the rust version also supports https but no mention of TLS on socks (I have not digged into the code of either), so we might have to secure this via wireguard or similar anyway, at which point the need for auth becomes moot and KumoProxy is the correct choice as it is.

I sense that this issue could actually just be a call for a small documentation change detailing the reason for lack of auth in socks proxy, or as you say, ensure that KumoProxy does have auth with TLS?

Our use case was to have a remote site deployed with KumoMTA that would egress through a socks proxy at a site where we have static IP addresses but on thinking about it this would not work as we require bounce traffic and the remote site running KumoMTA does not have access to static IPs so we cannot point MX records there anyway.

[wez]

We don't currently support TLS or auth in our Socks5 client implementation, so this enhancement is for both the client and the proxy to develop both TLS and Socks5 authentication.

[vietcgi]

@tommairs @wez I took a stab at #451. Added TLS + RFC 1929 auth to KumoProxy.

Went with username/password since it's really the only practical option for SOCKS5. Config is just a TOML file with users. Also threw in mTLS support since you mentioned someone might ask for it. Used constant-time comparison for passwords and everything's backward compatible won't break existing setups. Tested it pretty thoroughly on Linux. Happy to tweak anything if needed.