diff options
| author | Martin Holst Swende <martin@swende.se> | 2018-02-12 20:52:07 +0800 |
|---|---|---|
| committer | Péter Szilágyi <peterke@gmail.com> | 2018-02-12 20:52:07 +0800 |
| commit | 589b603a9b1e17930d1e83ca64ce7cdc4c3d5c85 (patch) | |
| tree | c1993266024190bd6789a471f5957b9dfa6f4dbc /node/api.go | |
| parent | 9123eceb0f78f69e88d909a56ad7fadb75570198 (diff) | |
| download | go-tangerine-589b603a9b1e17930d1e83ca64ce7cdc4c3d5c85.tar go-tangerine-589b603a9b1e17930d1e83ca64ce7cdc4c3d5c85.tar.gz go-tangerine-589b603a9b1e17930d1e83ca64ce7cdc4c3d5c85.tar.bz2 go-tangerine-589b603a9b1e17930d1e83ca64ce7cdc4c3d5c85.tar.lz go-tangerine-589b603a9b1e17930d1e83ca64ce7cdc4c3d5c85.tar.xz go-tangerine-589b603a9b1e17930d1e83ca64ce7cdc4c3d5c85.tar.zst go-tangerine-589b603a9b1e17930d1e83ca64ce7cdc4c3d5c85.zip | |
rpc: dns rebind protection (#15962)
* cmd,node,rpc: add allowedHosts to prevent dns rebinding attacks
* p2p,node: Fix bug with dumpconfig introduced in r54aeb8e4c0bb9f0e7a6c67258af67df3b266af3d
* rpc: add wildcard support for rpcallowedhosts + go fmt
* cmd/geth, cmd/utils, node, rpc: ignore direct ip(v4/6) addresses in rpc virtual hostnames check
* http, rpc, utils: make vhosts into map, address review concerns
* node: change log messages to use geth standard (not sprintf)
* rpc: fix spelling
Diffstat (limited to 'node/api.go')
| -rw-r--r-- | node/api.go | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/node/api.go b/node/api.go index 1b04b7093..4e9b1edc4 100644 --- a/node/api.go +++ b/node/api.go @@ -114,7 +114,7 @@ func (api *PrivateAdminAPI) PeerEvents(ctx context.Context) (*rpc.Subscription, } // StartRPC starts the HTTP RPC API server. -func (api *PrivateAdminAPI) StartRPC(host *string, port *int, cors *string, apis *string) (bool, error) { +func (api *PrivateAdminAPI) StartRPC(host *string, port *int, cors *string, apis *string, vhosts *string) (bool, error) { api.node.lock.Lock() defer api.node.lock.Unlock() @@ -141,6 +141,14 @@ func (api *PrivateAdminAPI) StartRPC(host *string, port *int, cors *string, apis } } + allowedVHosts := api.node.config.HTTPVirtualHosts + if vhosts != nil { + allowedVHosts = nil + for _, vhost := range strings.Split(*host, ",") { + allowedVHosts = append(allowedVHosts, strings.TrimSpace(vhost)) + } + } + modules := api.node.httpWhitelist if apis != nil { modules = nil @@ -149,7 +157,7 @@ func (api *PrivateAdminAPI) StartRPC(host *string, port *int, cors *string, apis } } - if err := api.node.startHTTP(fmt.Sprintf("%s:%d", *host, *port), api.node.rpcAPIs, modules, allowedOrigins); err != nil { + if err := api.node.startHTTP(fmt.Sprintf("%s:%d", *host, *port), api.node.rpcAPIs, modules, allowedOrigins, allowedVHosts); err != nil { return false, err } return true, nil |