config+lnd+cert: add --tlsdisableautofill to prevent information leaks.

This adds in a new boolean flag that when set, prevents LND from writing the system hostname and network interface IPs to the TLS certificate. This will ensure privacy for those that don't want private IP addresses to be exposed on a public facing LND node.

cert/selfsigned_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/lightningnetwork/lnd/cert"
+	"github.com/stretchr/testify/require"
 )
 
 var (
@@ -26,7 +27,7 @@ func TestIsOutdatedCert(t *testing.T) {
 	// Generate TLS files with two extra IPs and domains.
 	err = cert.GenCertPair(
 		"lnd autogenerated cert", certPath, keyPath, extraIPs[:2],
-		extraDomains[:2], cert.DefaultAutogenValidity,
+		extraDomains[:2], false, cert.DefaultAutogenValidity,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -48,7 +49,7 @@ func TestIsOutdatedCert(t *testing.T) {
 			// above.
 			outdated, err := cert.IsOutdated(
 				parsedCert, extraIPs[:numIPs],
-				extraDomains[:numDomains],
+				extraDomains[:numDomains], false,
 			)
 			if err != nil {
 				t.Fatal(err)
@@ -81,7 +82,7 @@ func TestIsOutdatedPermutation(t *testing.T) {
 	// Generate TLS files from the IPs and domains.
 	err = cert.GenCertPair(
 		"lnd autogenerated cert", certPath, keyPath, extraIPs[:],
-		extraDomains[:], cert.DefaultAutogenValidity,
+		extraDomains[:], false, cert.DefaultAutogenValidity,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -102,7 +103,7 @@ func TestIsOutdatedPermutation(t *testing.T) {
 		dupDNS[i] = extraDomains[i/2]
 	}
 
-	outdated, err := cert.IsOutdated(parsedCert, dupIPs, dupDNS)
+	outdated, err := cert.IsOutdated(parsedCert, dupIPs, dupDNS, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -123,7 +124,7 @@ func TestIsOutdatedPermutation(t *testing.T) {
 		revDNS[i] = extraDomains[len(extraDomains)-1-i]
 	}
 
-	outdated, err = cert.IsOutdated(parsedCert, revIPs, revDNS)
+	outdated, err = cert.IsOutdated(parsedCert, revIPs, revDNS, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -133,3 +134,59 @@ func TestIsOutdatedPermutation(t *testing.T) {
 			"considered outdated")
 	}
 }
+
+// TestTLSDisableAutofill checks that setting the --tlsdisableautofill flag
+// does not add interface ip addresses or hostnames to the cert.
+func TestTLSDisableAutofill(t *testing.T) {
+	tempDir, err := ioutil.TempDir("", "certtest")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	certPath := tempDir + "/tls.cert"
+	keyPath := tempDir + "/tls.key"
+
+	// Generate TLS files with two extra IPs and domains and no interface IPs.
+	err = cert.GenCertPair(
+		"lnd autogenerated cert", certPath, keyPath, extraIPs[:2],
+		extraDomains[:2], true, cert.DefaultAutogenValidity,
+	)
+	require.NoError(
+		t, err,
+		"unable to generate tls certificate pair",
+	)
+
+	_, parsedCert, err := cert.LoadCert(
+		certPath, keyPath,
+	)
+	require.NoError(
+		t, err,
+		"unable to load tls certificate pair",
+	)
+
+	// Check if the TLS cert is outdated while still preventing
+	// interface IPs from being used. Should not be outdated
+	shouldNotBeOutdated, err := cert.IsOutdated(
+		parsedCert, extraIPs[:2],
+		extraDomains[:2], true,
+	)
+	require.NoError(t, err)
+
+	require.Equal(
+		t, false, shouldNotBeOutdated,
+		"TLS Certificate was marked as outdated when it should not be",
+	)
+
+	// Check if the TLS cert is outdated while allowing for
+	// interface IPs to be used. Should report as outdated.
+	shouldBeOutdated, err := cert.IsOutdated(
+		parsedCert, extraIPs[:2],
+		extraDomains[:2], false,
+	)
+	require.NoError(t, err)
+
+	require.Equal(
+		t, true, shouldBeOutdated,
+		"TLS Certificate was not marked as outdated when it should be",
+	)
+}