Commit graph

19 commits

Author SHA1 Message Date
moneromooo-monero
2456945408
epee: add SSL support
RPC connections now have optional tranparent SSL.

An optional private key and certificate file can be passed,
using the --{rpc,daemon}-ssl-private-key and
--{rpc,daemon}-ssl-certificate options. Those have as
argument a path to a PEM format private private key and
certificate, respectively.
If not given, a temporary self signed certificate will be used.

SSL can be enabled or disabled using --{rpc}-ssl, which
accepts autodetect (default), disabled or enabled.

Access can be restricted to particular certificates using the
--rpc-ssl-allowed-certificates, which takes a list of
paths to PEM encoded certificates. This can allow a wallet to
connect to only the daemon they think they're connected to,
by forcing SSL and listing the paths to the known good
certificates.

To generate long term certificates:

openssl genrsa -out /tmp/KEY 4096
openssl req -new -key /tmp/KEY -out /tmp/REQ
openssl x509 -req -days 999999 -sha256 -in /tmp/REQ -signkey /tmp/KEY -out /tmp/CERT

/tmp/KEY is the private key, and /tmp/CERT is the certificate,
both in PEM format. /tmp/REQ can be removed. Adjust the last
command to set expiration date, etc, as needed. It doesn't
make a whole lot of sense for monero anyway, since most servers
will run with one time temporary self signed certificates anyway.

SSL support is transparent, so all communication is done on the
existing ports, with SSL autodetection. This means you can start
using an SSL daemon now, but you should not enforce SSL yet or
nothing will talk to you.
2019-02-02 20:05:33 +00:00
Martijn Otto
bd98e99c80
Removed a lot of unnecessary includes 2018-11-15 17:29:34 +01:00
moneromooo-monero
40ab12a773
epee: remove dependency on common 2018-01-10 01:57:51 +00:00
Riccardo Spagni
f48aeab5c4
Merge pull request #2756
0bf09154 Fix file permission issue (Tim L)
2017-11-14 16:02:28 +02:00
Tim L
fa51408272 RPC: get_info add rpc_connections_count 2017-11-07 16:34:49 -05:00
Tim L
0bf0915446 Fix file permission issue
This branch fixes a file permission issue introduced by 69c37200aa
2017-11-03 11:27:50 -04:00
Tim L
69c37200aa RPC Add cross origin resource sharing support 2017-10-30 13:55:56 -04:00
anonimal
dcf684c704
http_server_impl_base: set bind message to MGINFO 2017-02-21 18:30:43 +00:00
Lee Clagett
ce7fcbb4ae Add server auth to monerod, and client auth to wallet-cli and wallet-rpc 2017-02-06 01:15:41 -05:00
moneromooo-monero
5833d66f65
Change logging to easylogging++
This replaces the epee and data_loggers logging systems with
a single one, and also adds filename:line and explicit severity
levels. Categories may be defined, and logging severity set
by category (or set of categories). epee style 0-4 log level
maps to a sensible severity configuration. Log files now also
rotate when reaching 100 MB.

To select which logs to output, use the MONERO_LOGS environment
variable, with a comma separated list of categories (globs are
supported), with their requested severity level after a colon.
If a log matches more than one such setting, the last one in
the configuration string applies. A few examples:

This one is (mostly) silent, only outputting fatal errors:

MONERO_LOGS=*:FATAL

This one is very verbose:

MONERO_LOGS=*:TRACE

This one is totally silent (logwise):

MONERO_LOGS=""

This one outputs all errors and warnings, except for the
"verify" category, which prints just fatal errors (the verify
category is used for logs about incoming transactions and
blocks, and it is expected that some/many will fail to verify,
hence we don't want the spam):

MONERO_LOGS=*:WARNING,verify:FATAL

Log levels are, in decreasing order of priority:
FATAL, ERROR, WARNING, INFO, DEBUG, TRACE

Subcategories may be added using prefixes and globs. This
example will output net.p2p logs at the TRACE level, but all
other net* logs only at INFO:

MONERO_LOGS=*:ERROR,net*:INFO,net.p2p:TRACE

Logs which are intended for the user (which Monero was using
a lot through epee, but really isn't a nice way to go things)
should use the "global" category. There are a few helper macros
for using this category, eg: MGINFO("this shows up by default")
or MGINFO_RED("this is red"), to try to keep a similar look
and feel for now.

Existing epee log macros still exist, and map to the new log
levels, but since they're used as a "user facing" UI element
as much as a logging system, they often don't map well to log
severities (ie, a log level 0 log may be an error, or may be
something we want the user to see, such as an important info).
In those cases, I tried to use the new macros. In other cases,
I left the existing macros in. When modifying logs, it is
probably best to switch to the new macros with explicit levels.

The --log-level options and set_log commands now also accept
category settings, in addition to the epee style log levels.
2017-01-16 00:25:46 +00:00
Lee Clagett
d81cb08704 Added (not yet enabled) HTTP client authentication 2017-01-11 03:21:17 -05:00
Lee Clagett
bdc3d7496f Adding HTTP Digest Auth (but not yet enabled) 2016-12-13 00:19:54 -05:00
moneromooo-monero
eeb2bbc0fc
epee: optionally restrict HTTP service to a configurable user agent
This is intended to catch traffic coming from a web browser,
so we avoid issues with a web page sending a transfer RPC to
the wallet. Requiring a particular user agent can act as a
simple password scheme, while we wait for 0MQ and proper
authentication to be merged.
2016-09-18 20:32:02 +01:00
rfree2monero
9bfa593eee [fix] Network 1.8: unlimited the RPC connections
works for unit tests build, too
2015-04-08 19:54:07 +02:00
Riccardo Spagni
f4b69d553a
year updated in license 2015-01-02 18:52:46 +02:00
fluffypony
32f9d2b783 move modified epee code to new classes, revert license 2014-07-25 18:29:08 +02:00
fluffypony
6fc995fe5d License updated to BSD 3-clause 2014-07-23 15:03:52 +02:00
Antonio Juarez
8efa1313f3 some fixes 2014-03-20 11:46:11 +00:00
Antonio Juarez
296ae46ed8 moved all stuff to github 2014-03-03 22:07:58 +00:00