Commit graph

304 commits

Author SHA1 Message Date
moneromooo-monero
2a41dc0453
epee: fix connections not being properly closed in some instances
Fixed by Fixed by crCr62U0
2019-08-19 22:09:55 +00:00
luigi1111
8a0711f2f2
Merge pull request #5674
fcbf7b3 p2p: propagate out peers limit to payload handler (moneromooo-monero)
098aadf p2p: close the right number of connections on setting max in/out peers (moneromooo-monero)
2019-08-15 17:22:39 -05:00
luigi1111
df064eaa36
Merge pull request #5649
a182df2 Bans for RPC connections (hyc)
2019-08-15 17:10:49 -05:00
Thomas Winget
155475d971
Add IPv6 support
new cli options (RPC ones also apply to wallet):
  --p2p-bind-ipv6-address (default = "::")
  --p2p-bind-port-ipv6    (default same as ipv4 port for given nettype)
  --rpc-bind-ipv6-address (default = "::1")

  --p2p-use-ipv6          (default false)
  --rpc-use-ipv6          (default false)

  --p2p-require-ipv4      (default true, if ipv4 bind fails and this is
                           true, will not continue even if ipv6 bind
                           successful)
  --rpc-require-ipv4      (default true, description as above)

ipv6 addresses are to be specified as "[xx:xx:xx::xx:xx]:port" except
in the cases of the cli args for bind address.  For those the square
braces can be omitted.
2019-07-31 20:04:57 -04:00
luigi1111
38e0e58a95
Merge pull request #5531
9a6006b abstract_tcp_server2: move some things out of a lock (moneromooo-monero)
2019-07-24 14:08:52 -05:00
luigi1111
e579fe4ae0
Merge pull request #5530
6abaaaa remove obsolete save_graph skeleton code (moneromooo-monero)
2019-07-24 14:07:29 -05:00
luigi1111
8774384ace
Merge pull request #5528
f61a315 net_utils: fix m_ssl type from time_t to bool (moneromooo-monero)
2019-07-24 14:05:18 -05:00
Lee Clagett
3b24b1d082 Added support for "noise" over I1P/Tor to mask Tx transmission. 2019-07-17 14:22:37 +00:00
Lee Clagett
bdfc63ae4d Add ref-counted buffer byte_slice. Currently used for sending TCP data. 2019-07-16 16:30:35 +00:00
Jethro Grassie
30779de39d
fix feature not introduced until boost 1.66 2019-08-20 01:06:59 -04:00
moneromooo-monero
65c4004963
allow blocking whole subnets 2019-07-16 11:35:53 +00:00
moneromooo-monero
098aadf084
p2p: close the right number of connections on setting max in/out peers 2019-06-19 11:49:36 +00:00
Howard Chu
a182df21d0
Bans for RPC connections
Make bans control RPC sessions too. And auto-ban some bad requests.
Drops HTTP connections whenever response code is 500.
2019-06-16 11:38:08 +01:00
moneromooo-monero
bc09766bf9
abstract_tcp_server2: improve DoS resistance 2019-06-14 08:47:26 +00:00
luigi1111
9c0e9c40ec
Merge pull request #5618
b0a04f7 epee: fix SSL autodetect on reconnection (xiphon)
2019-06-11 18:15:48 -05:00
xiphon
b0a04f7d45 epee: fix SSL autodetect on reconnection 2019-06-10 10:40:16 +00:00
moneromooo-monero
35c20c4332
Fix GCC 9.1 build warnings
GCC wants operator= aand copy ctor to be both defined, or neither
2019-06-09 09:39:18 +00:00
Lee Clagett
3544596f9f Add ssl_options support to monerod's rpc mode. 2019-05-22 00:09:11 -04:00
moneromooo-monero
9a6006bad8
abstract_tcp_server2: move some things out of a lock
The lock is meant for the network throttle object only,
and this should help coverity get unconfused
2019-05-10 14:18:11 +00:00
moneromooo-monero
6abaaaa994
remove obsolete save_graph skeleton code 2019-05-10 14:17:18 +00:00
moneromooo-monero
f61a315e8b
net_utils: fix m_ssl type from time_t to bool 2019-05-10 14:14:49 +00:00
moneromooo-monero
a62e072571
net_ssl: SSL config tweaks for compatibility and security
add two RSA based ciphers for Windows/depends compatibility
also enforce server cipher ordering
also set ECDH to auto because vtnerd says it is good :)

When built with the depends system, openssl does not include any
cipher on the current whitelist, so add this one, which fixes the
problem, and does seem sensible.
2019-05-07 10:01:42 +00:00
moneromooo-monero
5e0da6fb68
change SSL certificate fingerprint whitelisting from SHA1 to SHA-256
SHA1 is too close to bruteforceable
2019-04-26 11:37:15 +00:00
Riccardo Spagni
5d09e39174
Merge pull request #5482
9956500d net_helper: clear recv buffer on eof (moneromooo-monero)
2019-04-24 22:40:12 +02:00
moneromooo-monero
9956500d14
net_helper: clear recv buffer on eof 2019-04-23 13:23:17 +00:00
moneromooo-monero
edbae2d05b
levin_protocol_handler_async: tune down preallocation a fair bit
It can allocate a lot when getting a lot of connections
(in particular, the stress test on windows apparently pushes
that memory to actual use, rather than just allocated)
2019-04-22 22:35:32 +00:00
Riccardo Spagni
c8ce4217cf
Merge pull request #5445
b18f0b10 wallet: new --offline option (moneromooo-monero)
2019-04-16 22:46:53 +02:00
Riccardo Spagni
e9527f5eed
Merge pull request #5436
61d63900 net_helper: avoid unnecessary memcpy (moneromooo-monero)
2019-04-16 22:43:15 +02:00
moneromooo-monero
b18f0b1051
wallet: new --offline option
It will avoid connecting to a daemon (so useful for cold signing
using a RPC wallet), and not perform DNS queries.
2019-04-15 09:14:12 +00:00
moneromooo-monero
61d63900b9
net_helper: avoid unnecessary memcpy 2019-04-13 13:24:58 +00:00
moneromooo-monero
c3cf930f75
abstract_tcp_server2: fix timeout on exit
When closing connections due to exiting, the IO service is
already gone, so the data exchange needed for a gracious SSL
shutdown cannot happen. We just close the socket in that case.
2019-04-12 18:13:31 +00:00
moneromooo-monero
4b3bb829c2
epee: init a new ssl related variable in ctor 2019-04-11 11:10:15 +00:00
moneromooo-monero
9f8dc4ce51
simplewallet: new net_stats command
displays total sent and received bytes
2019-04-11 10:46:41 +00:00
Lee Clagett
2e578b8214 Enabling daemon-rpc SSL now requires non-system CA verification
If `--daemon-ssl enabled` is set in the wallet, then a user certificate,
fingerprint, or onion/i2p address must be provided.
2019-04-07 13:02:43 -04:00
Lee Clagett
d58f368289 Require manual override for user chain certificates.
An override for the wallet to daemon connection is provided, but not for
other SSL contexts. The intent is to prevent users from supplying a
system CA as the "user" whitelisted certificate, which is less secure
since the key is controlled by a third party.
2019-04-07 00:44:37 -04:00
Lee Clagett
eca0fea45a Perform RFC 2818 hostname verification in client SSL handshakes
If the verification mode is `system_ca`, clients will now do hostname
verification. Thus, only certificates from expected hostnames are
allowed when SSL is enabled. This can be overridden by forcible setting
the SSL mode to autodetect.

Clients will also send the hostname even when `system_ca` is not being
performed. This leaks possible metadata, but allows servers providing
multiple hostnames to respond with the correct certificate. One example
is cloudflare, which getmonero.org is currently using.
2019-04-07 00:44:37 -04:00
Lee Clagett
0416764cae Require server verification when SSL is enabled.
If SSL is "enabled" via command line without specifying a fingerprint or
certificate, the system CA list is checked for server verification and
_now_ fails the handshake if that check fails. This change was made to
remain consistent with standard SSL/TLS client behavior. This can still
be overridden by using the allow any certificate flag.

If the SSL behavior is autodetect, the system CA list is still checked
but a warning is logged if this fails. The stream is not rejected
because a re-connect will be attempted - its better to have an
unverified encrypted stream than an unverified + unencrypted stream.
2019-04-07 00:44:37 -04:00
Lee Clagett
21eb1b0725 Pass SSL arguments via one class and use shared_ptr instead of reference 2019-04-07 00:44:37 -04:00
Lee Clagett
a3b0284837 Change SSL certificate file list to OpenSSL builtin load_verify_location
Specifying SSL certificates for peer verification does an exact match,
making it a not-so-obvious alias for the fingerprints option. This
changes the checks to OpenSSL which loads concatenated certificate(s)
from a single file and does a certificate-authority (chain of trust)
check instead. There is no drop in security - a compromised exact match
fingerprint has the same worse case failure. There is increased security
in allowing separate long-term CA key and short-term SSL server keys.

This also removes loading of the system-default CA files if a custom
CA file or certificate fingerprint is specified.
2019-04-06 23:47:06 -04:00
Riccardo Spagni
38317f384c
Merge pull request #5348
59776a64 epee: some more minor JSON parsing speedup (moneromooo-monero)
2019-04-06 16:00:18 +02:00
Riccardo Spagni
1ed6441925
Merge pull request #5327
c23ea796 New interactive daemon command 'print_net_stats': Global traffic stats (rbrunner7)
2019-04-01 17:32:01 +02:00
moneromooo-monero
59776a64ff
epee: some more minor JSON parsing speedup 2019-03-25 14:29:29 +00:00
Lee Clagett
7acfa9f3cc Added socks proxy (tor/i2pd/kovri) support to wallet 2019-03-25 01:35:13 +00:00
rbrunner7
c23ea7962d New interactive daemon command 'print_net_stats': Global traffic stats 2019-03-24 16:58:57 +01:00
Riccardo Spagni
f5d7652f73
Merge pull request #5283
16590294 abstract_tcp_server2: fix crashy race on socket shutdown (moneromooo-monero)
2019-03-21 14:53:03 +02:00
moneromooo-monero
17769db946
epee: fix build with boost 1.70.0
get_io_service was deprecated, and got removed
2019-03-21 11:02:02 +00:00
moneromooo-monero
1659029469
abstract_tcp_server2: fix crashy race on socket shutdown 2019-03-19 16:50:00 +00:00
Riccardo Spagni
4c91eb23a0
Merge pull request #5061
1f2930ce Update 2019 copyright (binaryFate)
2019-03-17 17:49:30 +02:00
Howard Chu
b8c2e21cba
Fix startup errors with SSL cert generation
Use SSL API directly, skip boost layer
2019-03-08 15:15:24 +00:00
binaryFate
1f2930ce0b Update 2019 copyright 2019-03-05 22:05:34 +01:00
Martijn Otto
057c279cb4
epee: add SSL support
RPC connections now have optional tranparent SSL.

An optional private key and certificate file can be passed,
using the --{rpc,daemon}-ssl-private-key and
--{rpc,daemon}-ssl-certificate options. Those have as
argument a path to a PEM format private private key and
certificate, respectively.
If not given, a temporary self signed certificate will be used.

SSL can be enabled or disabled using --{rpc}-ssl, which
accepts autodetect (default), disabled or enabled.

Access can be restricted to particular certificates using the
--rpc-ssl-allowed-certificates, which takes a list of
paths to PEM encoded certificates. This can allow a wallet to
connect to only the daemon they think they're connected to,
by forcing SSL and listing the paths to the known good
certificates.

To generate long term certificates:

openssl genrsa -out /tmp/KEY 4096
openssl req -new -key /tmp/KEY -out /tmp/REQ
openssl x509 -req -days 999999 -sha256 -in /tmp/REQ -signkey /tmp/KEY -out /tmp/CERT

/tmp/KEY is the private key, and /tmp/CERT is the certificate,
both in PEM format. /tmp/REQ can be removed. Adjust the last
command to set expiration date, etc, as needed. It doesn't
make a whole lot of sense for monero anyway, since most servers
will run with one time temporary self signed certificates anyway.

SSL support is transparent, so all communication is done on the
existing ports, with SSL autodetection. This means you can start
using an SSL daemon now, but you should not enforce SSL yet or
nothing will talk to you.
2019-03-05 14:16:08 +01:00
moneromooo-monero
e396146aee
default initialize rpc structures 2019-03-04 22:38:03 +00:00
Riccardo Spagni
c83e80c263
Merge pull request #5162
4d3b61a3 Use io_service::work in epee tcp server (Lee Clagett)
2019-03-04 21:33:48 +02:00
Riccardo Spagni
f18a7e39b8
Merge pull request #5160
7af4fbd4 epee: Add space after ':' in additional http response headers (Tom Smeding)
2019-03-04 21:33:24 +02:00
Riccardo Spagni
722a856d7e
Merge pull request #5096
7c3ade44 network_throttle: use circular_buffer where appropriate (moneromooo-monero)
2019-03-04 21:21:25 +02:00
Riccardo Spagni
4466f4504e
Merge pull request #5091
123fc2a2 i2p: initial support (Jethro Grassie)
2019-03-04 21:20:34 +02:00
Tom Smeding
7af4fbd4d1 epee: Add space after ':' in additional http response headers 2019-02-18 14:56:28 +01:00
Lee Clagett
4d3b61a31b Use io_service::work in epee tcp server 2019-02-10 13:40:32 -05:00
moneromooo-monero
2456945408
epee: add SSL support
RPC connections now have optional tranparent SSL.

An optional private key and certificate file can be passed,
using the --{rpc,daemon}-ssl-private-key and
--{rpc,daemon}-ssl-certificate options. Those have as
argument a path to a PEM format private private key and
certificate, respectively.
If not given, a temporary self signed certificate will be used.

SSL can be enabled or disabled using --{rpc}-ssl, which
accepts autodetect (default), disabled or enabled.

Access can be restricted to particular certificates using the
--rpc-ssl-allowed-certificates, which takes a list of
paths to PEM encoded certificates. This can allow a wallet to
connect to only the daemon they think they're connected to,
by forcing SSL and listing the paths to the known good
certificates.

To generate long term certificates:

openssl genrsa -out /tmp/KEY 4096
openssl req -new -key /tmp/KEY -out /tmp/REQ
openssl x509 -req -days 999999 -sha256 -in /tmp/REQ -signkey /tmp/KEY -out /tmp/CERT

/tmp/KEY is the private key, and /tmp/CERT is the certificate,
both in PEM format. /tmp/REQ can be removed. Adjust the last
command to set expiration date, etc, as needed. It doesn't
make a whole lot of sense for monero anyway, since most servers
will run with one time temporary self signed certificates anyway.

SSL support is transparent, so all communication is done on the
existing ports, with SSL autodetection. This means you can start
using an SSL daemon now, but you should not enforce SSL yet or
nothing will talk to you.
2019-02-02 20:05:33 +00:00
moneromooo-monero
7c3ade4410
network_throttle: use circular_buffer where appropriate 2019-02-01 21:33:13 +00:00
Jethro Grassie
123fc2a25a
i2p: initial support 2019-01-30 13:37:45 -05:00
Lee Clagett
973403bc9f Adding initial support for broadcasting transactions over Tor
- Support for ".onion" in --add-exclusive-node and --add-peer
  - Add --anonymizing-proxy for outbound Tor connections
  - Add --anonymous-inbounds for inbound Tor connections
  - Support for sharing ".onion" addresses over Tor connections
  - Support for broadcasting transactions received over RPC exclusively
    over Tor (else broadcast over public IP when Tor not enabled).
2019-01-28 23:56:33 +00:00
moneromooo-monero
acfff8d0ce
rpc: fix internal daemon calls in restricted rpc getting partial data 2019-01-28 19:35:20 +00:00
moneromooo-monero
b750fb27b0
Pruning
The blockchain prunes seven eighths of prunable tx data.
This saves about two thirds of the blockchain size, while
keeping the node useful as a sync source for an eighth
of the blockchain.

No other data is currently pruned.

There are three ways to prune a blockchain:

- run monerod with --prune-blockchain
- run "prune_blockchain" in the monerod console
- run the monero-blockchain-prune utility

The first two will prune in place. Due to how LMDB works, this
will not reduce the blockchain size on disk. Instead, it will
mark parts of the file as free, so that future data will use
that free space, causing the file to not grow until free space
grows scarce.

The third way will create a second database, a pruned copy of
the original one. Since this is a new file, this one will be
smaller than the original one.

Once the database is pruned, it will stay pruned as it syncs.
That is, there is no need to use --prune-blockchain again, etc.
2019-01-22 20:30:51 +00:00
Riccardo Spagni
846362842c
Merge pull request #4976
85665003 epee: better network buffer data structure (moneromooo-monero)
2019-01-16 19:04:22 +02:00
luigi1111
d8c03191ca
Merge pull request #4933
3cf85f0 Changed RECIEVED to RECEIVED in log messages. (normoes)
2018-12-31 15:33:18 -06:00
moneromooo-monero
85665003a7
epee: better network buffer data structure
avoids pointless allocs and memcpy
2018-12-23 16:46:07 +00:00
moneromooo-monero
9c923bad9b
epee: fix network packet header field endianness 2018-12-04 15:14:32 +00:00
Riccardo Spagni
c00ac446fd
Merge pull request #4854
bd98e99c Removed a lot of unnecessary includes (Martijn Otto)
2018-12-04 17:08:42 +02:00
Norman Moeschter
3cf85f0e83
Changed RECIEVED to RECEIVED in log messages. 2018-12-04 07:27:08 +01:00
Riccardo Spagni
299accd81f
Merge pull request #4819
7c298f5d No longer use a list for registering self references in the abstract tcp server (Martijn Otto)
2018-11-26 20:26:28 +02:00
Riccardo Spagni
a3d0c7c55c
Merge pull request #4807
b620443b epee: log HTTP/RPC calls at info level (moneromooo-monero)
2018-11-16 11:17:18 +02:00
Martijn Otto
bd98e99c80
Removed a lot of unnecessary includes 2018-11-15 17:29:34 +01:00
Martijn Otto
7c298f5d14
No longer use a list for registering self references in the abstract tcp
server

Updated assert message

Use a local variable that won't destruct at the end of the if-branch

Updated comment
2018-11-07 11:21:52 +01:00
Riccardo Spagni
dd973179ad
Merge pull request #3970
3381b651 abstract_tcp_server2: fix busy calling of idle IO service (moneromooo-monero)
2018-11-06 14:49:32 +02:00
moneromooo-monero
b620443b08
epee: log HTTP/RPC calls at info level
It's useful info to have when investigating logs
2018-11-05 16:14:06 +00:00
Riccardo Spagni
5ccd3d32b4
Merge pull request #4489
00901e9c epee: initialize a few data members where it seems to be appropriate (moneromooo-monero)
144a6c32 abstract_tcp_server2: move m_period to subclass (moneromooo-monero)
758d7684 connection_basic: remove unused floating time start time (moneromooo-monero)
e5108a29 Catch more exceptions in dtors (moneromooo-monero)
2018-10-15 13:37:18 +02:00
moneromooo-monero
e736964a0c
Remove epee header dependency on cryptonote_core 2018-10-12 17:16:44 +00:00
moneromooo-monero
00901e9c93
epee: initialize a few data members where it seems to be appropriate 2018-10-02 17:28:50 +00:00
moneromooo-monero
144a6c32c9
abstract_tcp_server2: move m_period to subclass
This is where it is actually used, and initialized
2018-10-02 17:28:48 +00:00
moneromooo-monero
758d768486
connection_basic: remove unused floating time start time 2018-10-02 17:28:46 +00:00
Riccardo Spagni
effcbf2060
Merge pull request #4459
bcf3f6af fuzz_tests: catch unhandled exceptions (moneromooo-monero)
3ebd05d4 miner: restore stream flags after changing them (moneromooo-monero)
a093092e levin_protocol_handler_async: do not propagate exception through dtor (moneromooo-monero)
1eebb82b net_helper: do not propagate exceptions through dtor (moneromooo-monero)
fb6a3630 miner: do not propagate exceptions through dtor (moneromooo-monero)
2e2139ff epee: do not propagate exception through dtor (moneromooo-monero)
0749a8bd db_lmdb: do not propagate exceptions in dtor (moneromooo-monero)
1b0afeeb wallet_rpc_server: exit cleanly on unhandled exceptions (moneromooo-monero)
418a9936 unit_tests: catch unhandled exceptions (moneromooo-monero)
ea7f9543 threadpool: do not propagate exceptions through the dtor (moneromooo-monero)
6e855422 gen_multisig: nice exit on unhandled exception (moneromooo-monero)
53df2deb db_lmdb: catch error in mdb_stat calls during migration (moneromooo-monero)
e67016dd blockchain_blackball: catch failure to commit db transaction (moneromooo-monero)
661439f4 mlog: don't remove old logs if we failed to rename the current file (moneromooo-monero)
5fdcda50 easylogging++: test for NULL before dereference (moneromooo-monero)
7ece1550 performance_test: fix bad last argument calling add_arg (moneromooo-monero)
a085da32 unit_tests: add check for page size > 0 before dividing (moneromooo-monero)
d8b1ec8b unit_tests: use std::shared_ptr to shut coverity up about leaks (moneromooo-monero)
02563bf4 simplewallet: top level exception catcher to print nicer messages (moneromooo-monero)
c57a65b2 blockchain_blackball: fix shift range for 32 bit archs (moneromooo-monero)
2018-09-29 22:20:38 +02:00
moneromooo-monero
4469b0c41e
abstract_tcp_server2: fix binding to the wrong IP 2018-09-09 10:48:21 +00:00
moneromooo-monero
8eab6147f4
epee: use the socket::bind variant which does not throw
When this throws in a loop, stack trace generation can take
a significant amount of CPU
2018-08-27 17:02:07 +00:00
luigi1111
0415863747
Merge pull request #4177
e7c0fcd epee: set jsonrpc to '2.0' in parse error return data (moneromooo-monero)
2018-08-15 17:42:09 -05:00
luigi1111
3b409a3b8a
Merge pull request #4130
979105b abstract_tcp_server2: fix race on shutdown (moneromooo-monero)
2018-08-15 17:13:35 -05:00
luigi1111
dd966c8a3a
Merge pull request #4090
42f3b7c http_protocol_handler: catch invalid numbers when parsing (moneromooo-monero)
0a4a7da http_protocol_handler: fix HTTP/x.y parsing (moneromooo-monero)
2018-08-15 17:08:10 -05:00
moneromooo-monero
e7c0fcd8f3
epee: set jsonrpc to "2.0" in parse error return data 2018-07-25 23:00:19 +01:00
moneromooo-monero
979105b298
abstract_tcp_server2: fix race on shutdown 2018-07-15 19:08:49 +01:00
moneromooo-monero
0a4a7da35c
http_protocol_handler: fix HTTP/x.y parsing
It was accepting any character for the dot (yeah, massive big I know)
2018-07-03 23:16:48 +01:00
moneromooo-monero
42f3b7cbca
http_protocol_handler: catch invalid numbers when parsing 2018-07-03 23:16:44 +01:00
Riccardo Spagni
c58758a016
Merge pull request #4080
dead780f abstract_tcp_server2: fix use after free (moneromooo-monero)
2018-07-03 15:24:01 +02:00
Riccardo Spagni
318fb23d7a
Merge pull request #3997
1a526ed5 abstract_tcp_server2: restart async accept on error (moneromooo-monero)
2018-07-03 15:16:04 +02:00
moneromooo-monero
dead780f8a
abstract_tcp_server2: fix use after free 2018-06-29 15:40:48 +01:00
luigi1111
8fad35f8e2
Merge pull request #3962
55c7fb8 epee: adaptive connection timeout system (moneromooo-monero)
2018-06-25 15:12:37 -05:00
luigi1111
c678413a89
Merge pull request #3902
f8dd433 epee: fix detection of 172.16.0.0/172.31.255.255 local IP range (moneromooo-monero)
5db9e3c unit_tests: add tests for local IP range detection (moneromooo-monero)
2018-06-20 14:22:44 -05:00
moneromooo-monero
1a526ed571
abstract_tcp_server2: restart async accept on error 2018-06-18 23:34:01 +01:00
jcktm
b43b9a1304 wallet-rpc: added IPs to error logging in simple_http_connection_handler 2018-06-13 15:41:51 +10:00
moneromooo-monero
55c7fb87a9
epee: adaptive connection timeout system
a connection's timeout is halved for every extra connection
from the same host.

Also keep track of when we don't need to use a connection
anymore, so we can close it and free the resource for another
connection.

Also use the longer timeout for non routable local addresses.
2018-06-10 19:39:38 +01:00
moneromooo-monero
3381b6517e
abstract_tcp_server2: fix busy calling of idle IO service
This would make monerod use 100% CPU when running with torsocks
without Tor running
2018-06-09 12:38:29 +01:00