grassrootseconomics/openethereum
8
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Validating Host headers in RPC requests (#1658)

Browse Source 
* Validating Host headers in RPC requests

* Fixing convention [ci skip]

* Remove extra indent.

[ci:skip]
This commit is contained in:
Tomasz Drwięga
2016-07-19 12:53:58 +02:00
committed by Gav Wood
parent 615fca5dc5
commit 6e79a36ef6
11 changed files with 176 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
parity/cli.rs
View File

@@ -36,7 +36,7 @@ Operating Options:
--mode MODE Set the operating mode. MODE can be one of:
active - Parity continuously syncs the chain.
passive - Parity syncs initially, then sleeps and
wakes regularly to resync.
wakes regularly to resync.
dark - Parity syncs only when an external interface
is active. [default: active].
--mode-timeout SECS Specify the number of seconds before inactivity
@@ -107,6 +107,11 @@ API and Console Options:
name. Possible name are web3, eth, net, personal,
ethcore, ethcore_set, traces.
[default: web3,eth,net,ethcore,personal,traces].
--jsonrpc-hosts HOSTS List of allowed Host header values. This option will
validate the Host header sent by the browser, it
is additional security against some attack
vectors. Special options: "all", "none",
[default: none].
--no-ipc Disable JSON-RPC over IPC service.
--ipc-path PATH Specify custom path for JSON-RPC over IPC service
@@ -118,8 +123,8 @@ API and Console Options:
--dapps-port PORT Specify the port portion of the Dapps server
[default: 8080].
--dapps-interface IP Specify the hostname portion of the Dapps
server, IP should be an interface's IP address, or
all (all interfaces) or local [default: local].
server, IP should be an interface's hostname / IP
or local (localhost) [default: local].
--dapps-user USERNAME Specify username for Dapps server. It will be
used in HTTP Basic Authentication Scheme.
If --dapps-pass is not specified you will be
@@ -141,11 +146,11 @@ Sealing/Mining Options:
own - reseal only on a new local transaction;
ext - reseal only on a new external transaction;
all - reseal on all new transactions [default: own].
--reseal-min-period MS Specify the minimum time between reseals from
--reseal-min-period MS Specify the minimum time between reseals from
incoming transactions. MS is time measured in
milliseconds [default: 2000].
--work-queue-size ITEMS Specify the number of historical work packages
which are kept cached lest a solution is found for
which are kept cached lest a solution is found for
them later. High values take more memory but result
in fewer unusable solutions [default: 20].
--tx-gas-limit GAS Apply a limit of GAS as the maximum amount of gas
@@ -311,6 +316,7 @@ pub struct Args {
pub flag_jsonrpc_interface: String,
pub flag_jsonrpc_port: u16,
pub flag_jsonrpc_cors: Option<String>,
pub flag_jsonrpc_hosts: String,
pub flag_jsonrpc_apis: String,
pub flag_no_ipc: bool,
pub flag_ipc_path: String,

39
parity/configuration.rs
View File

@@ -424,9 +424,22 @@ impl Configuration {
self.args.flag_rpcapi.clone().unwrap_or(self.args.flag_jsonrpc_apis.clone())
}
pub fn rpc_cors(&self) -> Vec<String> {
pub fn rpc_cors(&self) -> Option<Vec<String>> {
let cors = self.args.flag_jsonrpc_cors.clone().or(self.args.flag_rpccorsdomain.clone());
cors.map_or_else(Vec::new, |c| c.split(',').map(|s| s.to_owned()).collect())
cors.map(|c| c.split(',').map(|s| s.to_owned()).collect())
}
pub fn rpc_hosts(&self) -> Option<Vec<String>> {
let hosts = self.args.flag_jsonrpc_hosts.split(',').collect::<Vec<&str>>();
// look for special values
for h in &hosts {
match *h {
"none" => return Some(Vec::new()),
"all" => return None,
_ => {},
}
}
Some(hosts.into_iter().map(|h| h.into()).collect())
}
fn geth_ipc_path(&self) -> String {
@@ -541,8 +554,7 @@ impl Configuration {
pub fn dapps_interface(&self) -> String {
match self.args.flag_dapps_interface.as_str() {
"all" => "0.0.0.0",
"local" => "127.0.0.1",
"local" => "localhost",
x => x,
}.into()
}
@@ -597,7 +609,7 @@ mod tests {
assert_eq!(net.rpc_enabled, true);
assert_eq!(net.rpc_interface, "all".to_owned());
assert_eq!(net.rpc_port, 8000);
assert_eq!(conf.rpc_cors(), vec!["*".to_owned()]);
assert_eq!(conf.rpc_cors(), Some(vec!["*".to_owned()]));
assert_eq!(conf.rpc_apis(), "web3,eth".to_owned());
}
@@ -619,5 +631,22 @@ mod tests {
assert(conf1);
assert(conf2);
}
#[test]
fn should_parse_rpc_hosts() {
// given
// when
let conf0 = parse(&["parity"]);
let conf1 = parse(&["parity", "--jsonrpc-hosts", "none"]);
let conf2 = parse(&["parity", "--jsonrpc-hosts", "all"]);
let conf3 = parse(&["parity", "--jsonrpc-hosts", "ethcore.io,something.io"]);
// then
assert_eq!(conf0.rpc_hosts(), Some(Vec::new()));
assert_eq!(conf1.rpc_hosts(), Some(Vec::new()));
assert_eq!(conf2.rpc_hosts(), None);
assert_eq!(conf3.rpc_hosts(), Some(vec!["ethcore.io".into(), "something.io".into()]));
}
}

1
parity/main.rs
View File

@@ -280,6 +280,7 @@ fn execute_client(conf: Configuration, spec: Spec, client_config: ClientConfig,
port: network_settings.rpc_port,
apis: conf.rpc_apis(),
cors: conf.rpc_cors(),
hosts: conf.rpc_hosts(),
}, &dependencies);
// setup ipc rpc

17
parity/rpc.rs
View File

@@ -32,7 +32,8 @@ pub struct HttpConfiguration {
pub interface: String,
pub port: u16,
pub apis: String,
pub cors: Vec<String>,
pub cors: Option<Vec<String>>,
pub hosts: Option<Vec<String>>,
}
pub struct IpcConfiguration {
@@ -66,7 +67,7 @@ pub fn new_http(conf: HttpConfiguration, deps: &Dependencies) -> Option<RpcServe
let url = format!("{}:{}", conf.interface, conf.port);
let addr = SocketAddr::from_str(&url).unwrap_or_else(|_| die!("{}: Invalid JSONRPC listen host/port given.", url));
Some(setup_http_rpc_server(deps, &addr, conf.cors, apis))
Some(setup_http_rpc_server(deps, &addr, conf.cors, conf.hosts, apis))
}
fn setup_rpc_server(apis: Vec<&str>, deps: &Dependencies) -> Server {
@@ -78,21 +79,17 @@ fn setup_rpc_server(apis: Vec<&str>, deps: &Dependencies) -> Server {
pub fn setup_http_rpc_server(
dependencies: &Dependencies,
url: &SocketAddr,
cors_domains: Vec<String>,
cors_domains: Option<Vec<String>>,
allowed_hosts: Option<Vec<String>>,
apis: Vec<&str>,
) -> RpcServer {
let server = setup_rpc_server(apis, dependencies);
let start_result = server.start_http(url, cors_domains);
let ph = dependencies.panic_handler.clone();
let start_result = server.start_http(url, cors_domains, allowed_hosts, ph);
match start_result {
Err(RpcServerError::IoError(err)) => die_with_io_error("RPC", err),
Err(e) => die!("RPC: {:?}", e),
Ok(server) => {
server.set_panic_handler(move || {
ph.notify_all("Panic in RPC thread.".to_owned());
});
server
},
Ok(server) => server,
}
}