grassrootseconomics/openethereum
8
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Revert "Validating Host headers in RPC requests" (#1663)

Browse Source
This commit is contained in:
Gav Wood
2016-07-19 13:15:25 +02:00
committed by GitHub
parent 6e79a36ef6
commit 3cc3dbef66
11 changed files with 60 additions and 176 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
parity/cli.rs
View File

@@ -36,7 +36,7 @@ Operating Options:
--mode MODE Set the operating mode. MODE can be one of:
active - Parity continuously syncs the chain.
passive - Parity syncs initially, then sleeps and
wakes regularly to resync.
wakes regularly to resync.
dark - Parity syncs only when an external interface
is active. [default: active].
--mode-timeout SECS Specify the number of seconds before inactivity
@@ -107,11 +107,6 @@ API and Console Options:
name. Possible name are web3, eth, net, personal,
ethcore, ethcore_set, traces.
[default: web3,eth,net,ethcore,personal,traces].
--jsonrpc-hosts HOSTS List of allowed Host header values. This option will
validate the Host header sent by the browser, it
is additional security against some attack
vectors. Special options: "all", "none",
[default: none].
--no-ipc Disable JSON-RPC over IPC service.
--ipc-path PATH Specify custom path for JSON-RPC over IPC service
@@ -123,8 +118,8 @@ API and Console Options:
--dapps-port PORT Specify the port portion of the Dapps server
[default: 8080].
--dapps-interface IP Specify the hostname portion of the Dapps
server, IP should be an interface's hostname / IP
or local (localhost) [default: local].
server, IP should be an interface's IP address, or
all (all interfaces) or local [default: local].
--dapps-user USERNAME Specify username for Dapps server. It will be
used in HTTP Basic Authentication Scheme.
If --dapps-pass is not specified you will be
@@ -146,11 +141,11 @@ Sealing/Mining Options:
own - reseal only on a new local transaction;
ext - reseal only on a new external transaction;
all - reseal on all new transactions [default: own].
--reseal-min-period MS Specify the minimum time between reseals from
--reseal-min-period MS Specify the minimum time between reseals from
incoming transactions. MS is time measured in
milliseconds [default: 2000].
--work-queue-size ITEMS Specify the number of historical work packages
which are kept cached lest a solution is found for
which are kept cached lest a solution is found for
them later. High values take more memory but result
in fewer unusable solutions [default: 20].
--tx-gas-limit GAS Apply a limit of GAS as the maximum amount of gas
@@ -316,7 +311,6 @@ pub struct Args {
pub flag_jsonrpc_interface: String,
pub flag_jsonrpc_port: u16,
pub flag_jsonrpc_cors: Option<String>,
pub flag_jsonrpc_hosts: String,
pub flag_jsonrpc_apis: String,
pub flag_no_ipc: bool,
pub flag_ipc_path: String,

39
parity/configuration.rs
View File

@@ -424,22 +424,9 @@ impl Configuration {
self.args.flag_rpcapi.clone().unwrap_or(self.args.flag_jsonrpc_apis.clone())
}
pub fn rpc_cors(&self) -> Option<Vec<String>> {
pub fn rpc_cors(&self) -> Vec<String> {
let cors = self.args.flag_jsonrpc_cors.clone().or(self.args.flag_rpccorsdomain.clone());
cors.map(|c| c.split(',').map(|s| s.to_owned()).collect())
}
pub fn rpc_hosts(&self) -> Option<Vec<String>> {
let hosts = self.args.flag_jsonrpc_hosts.split(',').collect::<Vec<&str>>();
// look for special values
for h in &hosts {
match *h {
"none" => return Some(Vec::new()),
"all" => return None,
_ => {},
}
}
Some(hosts.into_iter().map(|h| h.into()).collect())
cors.map_or_else(Vec::new, |c| c.split(',').map(|s| s.to_owned()).collect())
}
fn geth_ipc_path(&self) -> String {
@@ -554,7 +541,8 @@ impl Configuration {
pub fn dapps_interface(&self) -> String {
match self.args.flag_dapps_interface.as_str() {
"local" => "localhost",
"all" => "0.0.0.0",
"local" => "127.0.0.1",
x => x,
}.into()
}
@@ -609,7 +597,7 @@ mod tests {
assert_eq!(net.rpc_enabled, true);
assert_eq!(net.rpc_interface, "all".to_owned());
assert_eq!(net.rpc_port, 8000);
assert_eq!(conf.rpc_cors(), Some(vec!["*".to_owned()]));
assert_eq!(conf.rpc_cors(), vec!["*".to_owned()]);
assert_eq!(conf.rpc_apis(), "web3,eth".to_owned());
}
@@ -631,22 +619,5 @@ mod tests {
assert(conf1);
assert(conf2);
}
#[test]
fn should_parse_rpc_hosts() {
// given
// when
let conf0 = parse(&["parity"]);
let conf1 = parse(&["parity", "--jsonrpc-hosts", "none"]);
let conf2 = parse(&["parity", "--jsonrpc-hosts", "all"]);
let conf3 = parse(&["parity", "--jsonrpc-hosts", "ethcore.io,something.io"]);
// then
assert_eq!(conf0.rpc_hosts(), Some(Vec::new()));
assert_eq!(conf1.rpc_hosts(), Some(Vec::new()));
assert_eq!(conf2.rpc_hosts(), None);
assert_eq!(conf3.rpc_hosts(), Some(vec!["ethcore.io".into(), "something.io".into()]));
}
}

1
parity/main.rs
View File

@@ -280,7 +280,6 @@ fn execute_client(conf: Configuration, spec: Spec, client_config: ClientConfig,
port: network_settings.rpc_port,
apis: conf.rpc_apis(),
cors: conf.rpc_cors(),
hosts: conf.rpc_hosts(),
}, &dependencies);
// setup ipc rpc

17
parity/rpc.rs
View File

@@ -32,8 +32,7 @@ pub struct HttpConfiguration {
pub interface: String,
pub port: u16,
pub apis: String,
pub cors: Option<Vec<String>>,
pub hosts: Option<Vec<String>>,
pub cors: Vec<String>,
}
pub struct IpcConfiguration {
@@ -67,7 +66,7 @@ pub fn new_http(conf: HttpConfiguration, deps: &Dependencies) -> Option<RpcServe
let url = format!("{}:{}", conf.interface, conf.port);
let addr = SocketAddr::from_str(&url).unwrap_or_else(|_| die!("{}: Invalid JSONRPC listen host/port given.", url));
Some(setup_http_rpc_server(deps, &addr, conf.cors, conf.hosts, apis))
Some(setup_http_rpc_server(deps, &addr, conf.cors, apis))
}
fn setup_rpc_server(apis: Vec<&str>, deps: &Dependencies) -> Server {
@@ -79,17 +78,21 @@ fn setup_rpc_server(apis: Vec<&str>, deps: &Dependencies) -> Server {
pub fn setup_http_rpc_server(
dependencies: &Dependencies,
url: &SocketAddr,
cors_domains: Option<Vec<String>>,
allowed_hosts: Option<Vec<String>>,
cors_domains: Vec<String>,
apis: Vec<&str>,
) -> RpcServer {
let server = setup_rpc_server(apis, dependencies);
let start_result = server.start_http(url, cors_domains);
let ph = dependencies.panic_handler.clone();
let start_result = server.start_http(url, cors_domains, allowed_hosts, ph);
match start_result {
Err(RpcServerError::IoError(err)) => die_with_io_error("RPC", err),
Err(e) => die!("RPC: {:?}", e),
Ok(server) => server,
Ok(server) => {
server.set_panic_handler(move || {
ph.notify_all("Panic in RPC thread.".to_owned());
});
server
},
}
}