Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow disabling RPC server TLS for localhost only. #192

Merged
merged 1 commit into from
Jan 2, 2015

Conversation

davecgh
Copy link
Member

@davecgh davecgh commented Dec 21, 2014

This pull request introduces a new flag, --notls, which can be used to disable TLS for the RPC server. However, the flag can only be used when the RPC server is bound to localhost interfaces. This is intended to prevent the situation where someone decides they want to expose the RPC server to the web for remote management/access, but forgot they have TLS disabled.

Here is an example of the functionality:

Disallowed

$ ./btcd --notls --rpclisten=whateverdomain.com
loadConfig: the --notls option may not be used when binding to non localhost addresses: whateverdomain.com:8334
Use btcd -h to show usage

$ ./btcd --notls --rpclisten=whateverdomain.com:12345
loadConfig: the --notls option may not be used when binding to non localhost addresses: whateverdomain.com:12345
Use btcd -h to show usage

$ ./btcd --notls --rpclisten=1.2.3.4
loadConfig: the --notls option may not be used when binding to non localhost addresses: 1.2.3.4:8334
Use btcd -h to show usage

$ ./btcd --notls --rpclisten=1.2.3.4:12345
loadConfig: the --notls option may not be used when binding to non localhost addresses: 1.2.3.4:12345
Use btcd -h to show usage

$ ./btcd --notls --rpclisten=1234::1234
loadConfig: the --notls option may not be used when binding to non localhost addresses: [1234::1234]:8334
Use btcd -h to show usage

$ ./btcd --notls --rpclisten=[1234::1234]:12345
loadConfig: the --notls option may not be used when binding to non localhost addresses: [1234::1234]:12345
Use btcd -h to show usage

Allowed

$ ./btcd --notls
17:31:44 2014-12-20 [INF] BTCD: Version 0.9.0-beta

$ ./btcd --notls --rpclisten=localhost
17:31:49 2014-12-20 [INF] BTCD: Version 0.9.0-beta

$ ./btcd --notls --rpclisten=localhost:12345
17:31:52 2014-12-20 [INF] BTCD: Version 0.9.0-beta

$ ./btcd --notls --rpclisten=127.0.0.1
17:32:09 2014-12-20 [INF] BTCD: Version 0.9.0-beta

$ ./btcd --notls --rpclisten=127.0.0.1:12345
17:32:13 2014-12-20 [INF] BTCD: Version 0.9.0-beta

$ ./btcd --notls --rpclisten=::1
17:32:16 2014-12-20 [INF] BTCD: Version 0.9.0-beta

$ ./btcd --notls --rpclisten=[::1]:12345
17:32:20 2014-12-20 [INF] BTCD: Version 0.9.0-beta

@davecgh davecgh changed the title [DON'T MERGE YET] Allow disabling RPC server TLS for localhost only. Allow disabling RPC server TLS for localhost only. Dec 21, 2014
@jcvernaleo
Copy link
Member

Change looks good to me. No reason to allow notls when talking to the outside world but there are definitely times where I've need to not use it when local only.

This commit introduces a new flag, --notls, which can be used to disable
TLS for the RPC server.  However, the flag can only be used when the RPC
server is bound to localhost interfaces.  This is intended to prevent the
situation where someone decides they want to expose the RPC server to the
web for remote management/access, but forgot they have TLS disabled.
@conformal-deploy conformal-deploy merged commit 04d47de into btcsuite:master Jan 2, 2015
@davecgh davecgh deleted the allownotls branch January 15, 2015 22:50
davecgh added a commit to davecgh/btcd that referenced this pull request May 19, 2016
* txscript:  Add ScriptVerifyLowS to the standard flags

We've already been generating lowS sigs for quite a while.  This removes
the malleability vector.

This mimics Bitcoin Core commit 49dd5c629df0a08cf3b1ea8085c03312d1a81696

* txscript: Implement CheckLockTimeVerify (BIP0065)

See https://github.com/bitcoin/bips/blob/master/bip-0065.mediawiki for
more information.

This commit mimics Bitcoin Core commit bc60b2b4b401f0adff5b8b9678903ff8feb5867b
and includes additional tests from Bitcoin Core commit
cb54d17355864fa08826d6511a0d7692b21ef2c9

* wire: Export var length string serialization funcs.

This commit exports the ReadVarString and WriteVarString functions so
they are available for callers to use.

A variable length string is encoded as a variable length integer
containing the length of the string followed by the bytes that represent
the string itself.

* rpcserver: Copy btcwallet fix for verifymessage.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants