Backports to beta (#2068)

* Fix several RPCs (#1926) * Fix up pending receipts details. * Add support for additional params and registry over RPC. * Fix tests. * Add test, additional fix. Fixes #1932. * Fix up tests. * Fix test. * Fix test. * DB WAL size limit (#1935) * Limit WAL size * Check pruning by db modification date (#1924) * Cache address hash (#1943) * ECIES without MAC (#1948) * Use random IV for ECIES AES * ECIES encrypt/decrypt for a single message * Derive IV from shared secret * Apply settings to column families * fixed #1933 (#1979) * Fixed neighbours collection (#1996) * dapps-hosts configuration * Disabled counter check * always process trie death row on commit, add more tracing * fixed transaction addresses mapping, fixes #1971 * simplified iterator * v1.3.1 * v1.3.1
2016-09-11 14:04:17 +02:00
parent 1ccc90108c
commit 2a82fa0a47
43 changed files with 732 additions and 181 deletions
--- a/parity/cli.rs
+++ b/parity/cli.rs
@@ -132,6 +132,11 @@ API and Console Options:
  --dapps-interface IP     Specify the hostname portion of the Dapps
                           server, IP should be an interface's IP address,
                           or local [default: local].
+  --dapps-hosts HOSTS      List of allowed Host header values. This option will
+                           validate the Host header sent by the browser, it
+                           is additional security against some attack
+                           vectors. Special options: "all", "none",
+                           [default: none].
  --dapps-user USERNAME    Specify username for Dapps server. It will be
                           used in HTTP Basic Authentication Scheme.
                           If --dapps-pass is not specified you will be
@@ -343,6 +348,7 @@ pub struct Args {
 	pub flag_no_dapps: bool,
 	pub flag_dapps_port: u16,
 	pub flag_dapps_interface: String,
+	pub flag_dapps_hosts: String,
 	pub flag_dapps_user: Option<String>,
 	pub flag_dapps_pass: Option<String>,
 	pub flag_dapps_path: String,
--- a/parity/configuration.rs
+++ b/parity/configuration.rs
@@ -355,6 +355,7 @@ impl Configuration {
 			enabled: self.dapps_enabled(),
 			interface: self.dapps_interface(),
 			port: self.args.flag_dapps_port,
+			hosts: self.dapps_hosts(),
 			user: self.args.flag_dapps_user.clone(),
 			pass: self.args.flag_dapps_pass.clone(),
 			dapps_path: self.directories().dapps,
@@ -474,6 +475,16 @@ impl Configuration {
 		Some(hosts)
 	}

+	fn dapps_hosts(&self) -> Option<Vec<String>> {
+		match self.args.flag_dapps_hosts.as_ref() {
+			"none" => return Some(Vec::new()),
+			"all" => return None,
+			_ => {}
+		}
+		let hosts = self.args.flag_dapps_hosts.split(',').map(|h| h.into()).collect();
+		Some(hosts)
+	}
+
 	fn ipc_config(&self) -> Result<IpcConfiguration, String> {
 		let conf = IpcConfiguration {
 			enabled: !(self.args.flag_ipcdisable || self.args.flag_ipc_off || self.args.flag_no_ipc),
@@ -832,6 +843,23 @@ mod tests {
 		assert_eq!(conf3.rpc_hosts(), Some(vec!["ethcore.io".into(), "something.io".into()]));
 	}

+	#[test]
+	fn should_parse_dapps_hosts() {
+		// given
+
+		// when
+		let conf0 = parse(&["parity"]);
+		let conf1 = parse(&["parity", "--dapps-hosts", "none"]);
+		let conf2 = parse(&["parity", "--dapps-hosts", "all"]);
+		let conf3 = parse(&["parity", "--dapps-hosts", "ethcore.io,something.io"]);
+
+		// then
+		assert_eq!(conf0.dapps_hosts(), Some(Vec::new()));
+		assert_eq!(conf1.dapps_hosts(), Some(Vec::new()));
+		assert_eq!(conf2.dapps_hosts(), None);
+		assert_eq!(conf3.dapps_hosts(), Some(vec!["ethcore.io".into(), "something.io".into()]));
+	}
+
 	#[test]
 	fn should_disable_signer_in_geth_compat() {
 		// given
--- a/parity/dapps.rs
+++ b/parity/dapps.rs
@@ -15,7 +15,6 @@
 // along with Parity.  If not, see <http://www.gnu.org/licenses/>.

 use std::sync::Arc;
-use std::net::SocketAddr;
 use io::PanicHandler;
 use rpc_apis;
 use helpers::replace_home;
@@ -30,6 +29,7 @@ pub struct Configuration {
 	pub enabled: bool,
 	pub interface: String,
 	pub port: u16,
+	pub hosts: Option<Vec<String>>,
 	pub user: Option<String>,
 	pub pass: Option<String>,
 	pub dapps_path: String,
@@ -41,6 +41,7 @@ impl Default for Configuration {
 			enabled: true,
 			interface: "127.0.0.1".into(),
 			port: 8080,
+			hosts: Some(Vec::new()),
 			user: None,
 			pass: None,
 			dapps_path: replace_home("$HOME/.parity/dapps"),
@@ -72,48 +73,67 @@ pub fn new(configuration: Configuration, deps: Dependencies) -> Result<Option<We
 		(username.to_owned(), password)
 	});

-	Ok(Some(try!(setup_dapps_server(deps, configuration.dapps_path, &addr, auth))))
+	Ok(Some(try!(setup_dapps_server(deps, configuration.dapps_path, &addr, configuration.hosts, auth))))
 }

+pub use self::server::setup_dapps_server;
+
 #[cfg(not(feature = "dapps"))]
-pub fn setup_dapps_server(
-	_deps: Dependencies,
-	_dapps_path: String,
-	_url: &SocketAddr,
-	_auth: Option<(String, String)>,
-) -> Result<WebappServer, String> {
-	Err("Your Parity version has been compiled without WebApps support.".into())
-}
+mod server {
+	use super::Dependencies;
+	use std::net::SocketAddr;

-#[cfg(feature = "dapps")]
-pub fn setup_dapps_server(
-	deps: Dependencies,
-	dapps_path: String,
-	url: &SocketAddr,
-	auth: Option<(String, String)>
-) -> Result<WebappServer, String> {
-	use ethcore_dapps as dapps;
-
-	let server = dapps::ServerBuilder::new(dapps_path);
-	let server = rpc_apis::setup_rpc(server, deps.apis.clone(), rpc_apis::ApiSet::UnsafeContext);
-	let start_result = match auth {
-		None => {
-			server.start_unsecure_http(url)
-		},
-		Some((username, password)) => {
-			server.start_basic_auth_http(url, &username, &password)
-		},
-	};
-
-	match start_result {
-		Err(dapps::ServerError::IoError(err)) => Err(format!("WebApps io error: {}", err)),
-		Err(e) => Err(format!("WebApps error: {:?}", e)),
-		Ok(server) => {
-			server.set_panic_handler(move || {
-				deps.panic_handler.notify_all("Panic in WebApp thread.".to_owned());
-			});
-			Ok(server)
-		},
+	pub struct WebappServer;
+	pub fn setup_dapps_server(
+		_deps: Dependencies,
+		_dapps_path: String,
+		_url: &SocketAddr,
+		_allowed_hosts: Option<Vec<String>>,
+		_auth: Option<(String, String)>,
+	) -> Result<WebappServer, String> {
+		Err("Your Parity version has been compiled without WebApps support.".into())
+	}
+}
+
+#[cfg(feature = "dapps")]
+mod server {
+	use super::Dependencies;
+	use std::net::SocketAddr;
+
+	use rpc_apis;
+
+	pub use ethcore_dapps::Server as WebappServer;
+
+	pub fn setup_dapps_server(
+		deps: Dependencies,
+		dapps_path: String,
+		url: &SocketAddr,
+		allowed_hosts: Option<Vec<String>>,
+		auth: Option<(String, String)>
+	) -> Result<WebappServer, String> {
+		use ethcore_dapps as dapps;
+
+		let server = dapps::ServerBuilder::new(dapps_path);
+		let server = rpc_apis::setup_rpc(server, deps.apis.clone(), rpc_apis::ApiSet::UnsafeContext);
+		let start_result = match auth {
+			None => {
+				server.start_unsecured_http(url, allowed_hosts)
+			},
+			Some((username, password)) => {
+				server.start_basic_auth_http(url, allowed_hosts, &username, &password)
+			},
+		};
+
+		match start_result {
+			Err(dapps::ServerError::IoError(err)) => Err(format!("WebApps io error: {}", err)),
+			Err(e) => Err(format!("WebApps error: {:?}", e)),
+			Ok(server) => {
+				server.set_panic_handler(move || {
+					deps.panic_handler.notify_all("Panic in WebApp thread.".to_owned());
+				});
+				Ok(server)
+			},
+		}
 	}
 }