Commit graph

8236 commits

Author SHA1 Message Date
moneromooo-monero
b3a32d5505
functional_tests: add describe_transfer tests 2019-04-11 11:08:04 +00:00
moneromooo-monero
108f4375b8
console.py: support connecting to any host, not just 127.0.0.1 2019-04-11 11:08:01 +00:00
moneromooo-monero
064ab12340
functional_tests: add more blockchain related tests
Related to emission, reorgs, getting tx data back, output
distribution and histogram
2019-04-11 11:07:58 +00:00
moneromooo-monero
21b1ac1dd2
functional_tests: add bans tests 2019-04-11 11:07:55 +00:00
Riccardo Spagni
e03b9bcdfd
Merge pull request #5411
3de49afc README.md: fork table, copy lines from release branch (Gingeropolous)
e172fbae README.md: fix missing comma (Tyler Saballus)
97f0899b README.md: minor spelling issue (Justin Gerber)
2019-04-11 13:06:35 +02:00
Riccardo Spagni
5db72d12b4
Merge pull request #5388
0be5b2ee simplewallet: new unset_ring command (moneromooo-monero)
2019-04-11 13:05:43 +02:00
Riccardo Spagni
5c02316598
Merge pull request #5382
c12b43cb wallet: add number of blocks required for the balance to fully unlock (moneromooo-monero)
3f1e9e84 wallet2: set confirmations to 0 for pool txes in proofs (moneromooo-monero)
36c037ec wallet_rpc_server: error out on getting the spend key from a hot wallet (moneromooo-monero)
cd1eaff2 wallet_rpc_server: always fill out subaddr_indices in get_transfers (moneromooo-monero)
2019-04-11 13:03:55 +02:00
Riccardo Spagni
38717dafc0
Merge pull request #5381
def40161 miner: fix race when stopping mining with start mining enabled (moneromooo-monero)
2019-04-11 13:03:32 +02:00
Riccardo Spagni
915d9e5a1f
Merge pull request #5380
113e4877 blockchain_stats: fix sign in formatting function (moneromooo-monero)
adaea3ea various: remove unused variables (moneromooo-monero)
631ef00e blockchain: some debug info when adding txes-from-block fails (moneromooo-monero)
2019-04-11 13:02:59 +02:00
Riccardo Spagni
fa789109f6
Merge pull request #5379
83fc45a4 Add NanoX support (cslashm)
2019-04-11 13:02:47 +02:00
Riccardo Spagni
bd429033df
Merge pull request #5378
eda2661a Allow pruning before v10 (moneromooo-monero)
2019-04-11 13:02:35 +02:00
Riccardo Spagni
4a2cc76c84
Merge pull request #5376
c746f45d Add hash of top block to /getheight RPC (Howard Chu)
2019-04-11 13:01:54 +02:00
Riccardo Spagni
3a4008f0fc
Merge pull request #5374
a2561653 wallet: new option to start background mining (moneromooo-monero)
2019-04-11 13:01:30 +02:00
Riccardo Spagni
036daa3af9
Merge pull request #5373
aff80e70 blockchain: fix returned height in create_block_template (moneromooo-monero)
2019-04-11 13:00:55 +02:00
Riccardo Spagni
8e0c5b34dd
Merge pull request #5371
9f8dc4ce simplewallet: new net_stats command (moneromooo-monero)
2019-04-11 13:00:31 +02:00
moneromooo-monero
9f8dc4ce51
simplewallet: new net_stats command
displays total sent and received bytes
2019-04-11 10:46:41 +00:00
Riccardo Spagni
19e37c05d6
Merge pull request #5367
07b716bf util: name replace_file arguments better (moneromooo-monero)
2019-04-11 12:41:55 +02:00
Riccardo Spagni
793651e731
Merge pull request #5366
c2f271d1 device/trezor: increase live-refresh timeout (Dusan Klinec)
2019-04-11 12:41:34 +02:00
Riccardo Spagni
76fbcfe2dd
Merge pull request #5123
089c7637 cryptonote: rework block blob size sanity check (moneromooo-monero)
2019-04-11 12:41:07 +02:00
Riccardo Spagni
7d3cb10838
Merge pull request #4939
f064efae README: add and remove dependencies on OSX line (George)
2019-04-11 12:40:53 +02:00
Riccardo Spagni
7c85f3b28e
Merge pull request #5320
2e578b82 Enabling daemon-rpc SSL now requires non-system CA verification (Lee Clagett)
d58f3682 Require manual override for user chain certificates. (Lee Clagett)
97cd1fa9 Only check top-level certificate against fingerprint list. (Lee Clagett)
7c388fb3 Call `use_certificate_chain_file` instead of `use_certificate_file` (Lee Clagett)
eca0fea4 Perform RFC 2818 hostname verification in client SSL handshakes (Lee Clagett)
0416764c Require server verification when SSL is enabled. (Lee Clagett)
96d602ac Add `verify_fail_if_no_cert` option for proper client authentication (Lee Clagett)
21eb1b07 Pass SSL arguments via one class and use shared_ptr instead of reference (Lee Clagett)
1f5ed328 Change default SSL to "enabled" if user specifies fingerprint/certificate (Lee Clagett)
f18a069f Do not require client certificate unless server has some whitelisted. (Lee Clagett)
a3b02848 Change SSL certificate file list to OpenSSL builtin load_verify_location (Lee Clagett)
2019-04-11 12:39:56 +02:00
Dusan Klinec
41901b8deb
device/trezor: env-configurable ports 2019-04-10 18:29:24 +02:00
Dusan Klinec
c97a1f79d6
tests: trezor tests fixes and improvements
- configurable hardforks via env vars
2019-04-10 17:00:12 +02:00
moneromooo-monero
374f388de2
wallet_rpc_server: add a all flag to export_outputs
if we don't want to export new outputs only
2019-04-10 10:37:34 +00:00
Martijn Otto
8df827075f
Fix linker issues using easylogging 2019-04-10 11:37:02 +02:00
stoffu
e9fac29a4b
unit_tests/long_term_block_weight: some tweaks that seem to make more sense 2019-04-09 20:21:45 +09:00
stoffu
467f4c7ed3
tests/block_weight: use integer division when computing median 2019-04-09 19:40:57 +09:00
stoffu
815d08dc5f
tests/block_weight: remove unused MULTIPLIER_SMALL 2019-04-09 19:40:52 +09:00
stoffu
661f1fb8b2
blockchain: remove unused calc of short_term_constraint 2019-04-09 19:39:24 +09:00
erciccione
f4f1471ce8
readme: add some more instructions for translators
- added link to guide for Pootle
- link directly to CLI project on Pootle
- improved wording
2019-04-08 13:04:41 +02:00
Gingeropolous
3de49afc53 README.md: fork table, copy lines from release branch 2019-04-07 21:38:04 +00:00
Tyler Saballus
e172fbaef3 README.md: fix missing comma 2019-04-07 21:35:36 +00:00
Justin Gerber
97f0899b8f README.md: minor spelling issue
The word 'dont' is not spelled correctly.
2019-04-07 21:33:22 +00:00
Lee Clagett
2e578b8214 Enabling daemon-rpc SSL now requires non-system CA verification
If `--daemon-ssl enabled` is set in the wallet, then a user certificate,
fingerprint, or onion/i2p address must be provided.
2019-04-07 13:02:43 -04:00
Dusan Klinec
d4a78c74ac
build: libusb static compilation fix 2019-04-07 18:52:25 +02:00
Dusan Klinec
ac874e2d40
tests: fix test_options initialization error 2019-04-07 18:18:54 +02:00
Dusan Klinec
c4f8a8a6a9
build fix: combinator.h stdexcept missing include 2019-04-07 17:41:13 +02:00
moneromooo-monero
66d73d2f7d
easylogging++: update to v9.96.7 2019-04-07 14:31:00 +00:00
moneromooo-monero
bea1918a05
blockchain_import: error out if preparing to handle blocks fails
Coverity 197562
2019-04-07 13:48:19 +00:00
moneromooo-monero
ffdbcfb6b3
core: don't check block rate nor fork time in regtest mode 2019-04-07 13:30:02 +00:00
Dusan Klinec
c68fe7873b
device/trezor: add button pressed request 2019-04-07 13:35:49 +02:00
Lee Clagett
d58f368289 Require manual override for user chain certificates.
An override for the wallet to daemon connection is provided, but not for
other SSL contexts. The intent is to prevent users from supplying a
system CA as the "user" whitelisted certificate, which is less secure
since the key is controlled by a third party.
2019-04-07 00:44:37 -04:00
Lee Clagett
97cd1fa98d Only check top-level certificate against fingerprint list.
This allows "chain" certificates to be used with the fingerprint
whitelist option. A user can get a system-ca signature as backup while
clients explicitly whitelist the server certificate. The user specified
CA can also be combined with fingerprint whitelisting.
2019-04-07 00:44:37 -04:00
Lee Clagett
7c388fb358 Call use_certificate_chain_file instead of use_certificate_file
The former has the same behavior with single self signed certificates
while allowing the server to have separate short-term authentication
keys with long-term authorization keys.
2019-04-07 00:44:37 -04:00
Lee Clagett
eca0fea45a Perform RFC 2818 hostname verification in client SSL handshakes
If the verification mode is `system_ca`, clients will now do hostname
verification. Thus, only certificates from expected hostnames are
allowed when SSL is enabled. This can be overridden by forcible setting
the SSL mode to autodetect.

Clients will also send the hostname even when `system_ca` is not being
performed. This leaks possible metadata, but allows servers providing
multiple hostnames to respond with the correct certificate. One example
is cloudflare, which getmonero.org is currently using.
2019-04-07 00:44:37 -04:00
Lee Clagett
0416764cae Require server verification when SSL is enabled.
If SSL is "enabled" via command line without specifying a fingerprint or
certificate, the system CA list is checked for server verification and
_now_ fails the handshake if that check fails. This change was made to
remain consistent with standard SSL/TLS client behavior. This can still
be overridden by using the allow any certificate flag.

If the SSL behavior is autodetect, the system CA list is still checked
but a warning is logged if this fails. The stream is not rejected
because a re-connect will be attempted - its better to have an
unverified encrypted stream than an unverified + unencrypted stream.
2019-04-07 00:44:37 -04:00
Lee Clagett
96d602ac84 Add verify_fail_if_no_cert option for proper client authentication
Using `verify_peer` on server side requests a certificate from the
client. If no certificate is provided, the server silently accepts the
connection and rejects if the client sends an unexpected certificate.
Adding `verify_fail_if_no_cert` has no affect on client and for server
requires that the peer sends a certificate or fails the handshake. This
is the desired behavior when the user specifies a fingerprint or CA file.
2019-04-07 00:44:37 -04:00
Lee Clagett
21eb1b0725 Pass SSL arguments via one class and use shared_ptr instead of reference 2019-04-07 00:44:37 -04:00
Lee Clagett
1f5ed328aa Change default SSL to "enabled" if user specifies fingerprint/certificate
Currently if a user specifies a ca file or fingerprint to verify peer,
the default behavior is SSL autodetect which allows for mitm downgrade
attacks. It should be investigated whether a manual override should be
allowed - the configuration is likely always invalid.
2019-04-06 23:47:07 -04:00
Lee Clagett
f18a069fcc Do not require client certificate unless server has some whitelisted.
Currently a client must provide a certificate, even if the server is
configured to allow all certificates. This drops that requirement from
the client - unless the server is configured to use a CA file or
fingerprint(s) for verification - which is the standard behavior for SSL
servers.

The "system-wide" CA is not being used as a "fallback" to verify clients
before or after this patch.
2019-04-06 23:47:06 -04:00