Commit Graph

609 Commits

Author SHA1 Message Date
Interchained
c61abf87c0 remove empty statements
Cleaning up a little around the code base.
2020-02-17 11:55:15 -05:00
moneromooo-monero
760ecf2ac8
console_handler: do not let exception past the dor
Coverity 208373
2020-02-12 21:05:25 +00:00
Alexander Blair
a62f7dc573
Merge pull request #6182
e896cca8 epee: reorder a couple init list fields to match declaration (moneromooo-monero)
2020-02-06 00:34:15 -08:00
Martijn Otto
5002a0343f
Explicitly define copy assignment operator
The implicit copy assignment operator was deprecated because the class
has an explicit copy constructor. According to the standard:

The generation of the implicitly-defined copy assignment operator is
deprecated (since C++11) if T has a user-declared destructor or
user-declared copy constructor.

Recent versions of gcc (9.1+) and clang (10.0) warn about this.
2020-01-28 14:59:55 +01:00
moneromooo-monero
3004835b51
epee: remove backward compatible endian specific address serialization 2020-01-26 18:37:34 +00:00
moneromooo-monero
b595583f3d
serialization: do not write optional fields with default value 2020-01-26 18:37:30 +00:00
moneromooo-monero
56a4469ef3
network: log traffic and add a simple traffic analysis script 2020-01-26 00:33:41 +00:00
Alexander Blair
8039fd4cab
Merge pull request #6143
6efeefbc epee: set application/json MIME type on json errors (moneromooo-monero)
2020-01-16 17:46:13 -08:00
Alexander Blair
f1ca98a7ef
Merge pull request #6133
b2ad757f Replace memset with memwipe. (Bert Peters)
2020-01-16 17:41:35 -08:00
Alexander Blair
fbc15de2cd
Merge pull request #6125
584d057f epee: fix console_handlers_binder race, wait for thread to finish (xiphon)
2020-01-16 17:32:15 -08:00
Alexander Blair
fe736070d2
Merge pull request #6120
feef1c6a epee: fix peer ids being truncated on display (moneromooo-monero)
2020-01-16 17:30:17 -08:00
moneromooo-monero
352bd13254
abstract_tcp_server2: guard against negative timeouts 2019-12-16 18:24:52 +00:00
moneromooo-monero
e896cca86e
epee: reorder a couple init list fields to match declaration
This is a bug waiting to happen
2019-11-25 19:27:54 +00:00
moneromooo-monero
6efeefbca2
epee: set application/json MIME type on json errors 2019-11-15 19:39:20 +00:00
moneromooo-monero
feef1c6aac
epee: fix peer ids being truncated on display 2019-11-14 18:27:12 +00:00
Bert Peters
b2ad757f48 Replace memset with memwipe. 2019-11-13 18:00:50 +01:00
xiphon
584d057f74 epee: fix console_handlers_binder race, wait for thread to finish 2019-11-12 16:07:59 +00:00
Lee Clagett
a9bdc6e4c4 Improved performance for epee serialization:
- Removed copy of field names in binary deserialization
  - Removed copy of array values in binary deserialization
  - Removed copy of string values in json deserialization
  - Removed unhelpful allocation in json string value parsing
  - Removed copy of blob data on binary and json serialization
2019-11-04 01:46:41 +00:00
moneromooo-monero
3d649d528a
epee: close connection when the peer has done so
This fixes rapid reconnections failing as the peer hasn't yet
worked out the other side is gone, and will reject "duplicate"
connections until a timeout.
2019-11-11 20:05:24 +00:00
Lee Clagett
5d7ae2d279 Adding support for hidden (anonymity) txpool 2019-11-02 20:36:03 +00:00
moneromooo-monero
dcff02e4c3
epee: allow a random component in once_a_time timeouts 2019-11-01 20:57:24 +00:00
luigi1111
960c215801
Merge pull request #5357
b3a9a4d add a quick early out to get_blocks.bin when up to date (moneromooo-monero)
2899379 daemon, wallet: new pay for RPC use system (moneromooo-monero)
ffa4602 simplewallet: add public_nodes command (moneromooo-monero)
2019-10-25 13:38:21 -05:00
moneromooo-monero
2899379791
daemon, wallet: new pay for RPC use system
Daemons intended for public use can be set up to require payment
in the form of hashes in exchange for RPC service. This enables
public daemons to receive payment for their work over a large
number of calls. This system behaves similarly to a pool, so
payment takes the form of valid blocks every so often, yielding
a large one off payment, rather than constant micropayments.

This system can also be used by third parties as a "paywall"
layer, where users of a service can pay for use by mining Monero
to the service provider's address. An example of this for web
site access is Primo, a Monero mining based website "paywall":
https://github.com/selene-kovri/primo

This has some advantages:
 - incentive to run a node providing RPC services, thereby promoting the availability of third party nodes for those who can't run their own
 - incentive to run your own node instead of using a third party's, thereby promoting decentralization
 - decentralized: payment is done between a client and server, with no third party needed
 - private: since the system is "pay as you go", you don't need to identify yourself to claim a long lived balance
 - no payment occurs on the blockchain, so there is no extra transactional load
 - one may mine with a beefy server, and use those credits from a phone, by reusing the client ID (at the cost of some privacy)
 - no barrier to entry: anyone may run a RPC node, and your expected revenue depends on how much work you do
 - Sybil resistant: if you run 1000 idle RPC nodes, you don't magically get more revenue
 - no large credit balance maintained on servers, so they have no incentive to exit scam
 - you can use any/many node(s), since there's little cost in switching servers
 - market based prices: competition between servers to lower costs
 - incentive for a distributed third party node system: if some public nodes are overused/slow, traffic can move to others
 - increases network security
 - helps counteract mining pools' share of the network hash rate
 - zero incentive for a payer to "double spend" since a reorg does not give any money back to the miner

And some disadvantages:
 - low power clients will have difficulty mining (but one can optionally mine in advance and/or with a faster machine)
 - payment is "random", so a server might go a long time without a block before getting one
 - a public node's overall expected payment may be small

Public nodes are expected to compete to find a suitable level for
cost of service.

The daemon can be set up this way to require payment for RPC services:

  monerod --rpc-payment-address 4xxxxxx \
    --rpc-payment-credits 250 --rpc-payment-difficulty 1000

These values are an example only.

The --rpc-payment-difficulty switch selects how hard each "share" should
be, similar to a mining pool. The higher the difficulty, the fewer
shares a client will find.
The --rpc-payment-credits switch selects how many credits are awarded
for each share a client finds.
Considering both options, clients will be awarded credits/difficulty
credits for every hash they calculate. For example, in the command line
above, 0.25 credits per hash. A client mining at 100 H/s will therefore
get an average of 25 credits per second.
For reference, in the current implementation, a credit is enough to
sync 20 blocks, so a 100 H/s client that's just starting to use Monero
and uses this daemon will be able to sync 500 blocks per second.

The wallet can be set to automatically mine if connected to a daemon
which requires payment for RPC usage. It will try to keep a balance
of 50000 credits, stopping mining when it's at this level, and starting
again as credits are spent. With the example above, a new client will
mine this much credits in about half an hour, and this target is enough
to sync 500000 blocks (currently about a third of the monero blockchain).

There are three new settings in the wallet:

 - credits-target: this is the amount of credits a wallet will try to
reach before stopping mining. The default of 0 means 50000 credits.

 - auto-mine-for-rpc-payment-threshold: this controls the minimum
credit rate which the wallet considers worth mining for. If the
daemon credits less than this ratio, the wallet will consider mining
to be not worth it. In the example above, the rate is 0.25

 - persistent-rpc-client-id: if set, this allows the wallet to reuse
a client id across runs. This means a public node can tell a wallet
that's connecting is the same as one that connected previously, but
allows a wallet to keep their credit balance from one run to the
other. Since the wallet only mines to keep a small credit balance,
this is not normally worth doing. However, someone may want to mine
on a fast server, and use that credit balance on a low power device
such as a phone. If left unset, a new client ID is generated at
each wallet start, for privacy reasons.

To mine and use a credit balance on two different devices, you can
use the --rpc-client-secret-key switch. A wallet's client secret key
can be found using the new rpc_payments command in the wallet.
Note: anyone knowing your RPC client secret key is able to use your
credit balance.

The wallet has a few new commands too:

 - start_mining_for_rpc: start mining to acquire more credits,
regardless of the auto mining settings
 - stop_mining_for_rpc: stop mining to acquire more credits
 - rpc_payments: display information about current credits with
the currently selected daemon

The node has an extra command:

 - rpc_payments: display information about clients and their
balances

The node will forget about any balance for clients which have
been inactive for 6 months. Balances carry over on node restart.
2019-10-25 09:34:38 +00:00
luigi1111
42d84ad35e
Merge pull request #6006
9f3be3b epee: use SO_REUSEADDR on non-Windows targets (xiphon)
2019-10-24 12:41:59 -05:00
xiphon
9f3be3baed epee: use SO_REUSEADDR on non-Windows targets 2019-10-22 18:40:01 +00:00
luigi1111
6b58d6248a
Merge pull request #5996
23ba69e epee: fix SSL server handshake, run_one() can block, use poll_one() (xiphon)
2019-10-22 10:26:31 -05:00
luigi1111
18f62f89d8
Merge pull request #5986
1080136 abstract_tcp_server2: move 'Trying to connect' from error to debug (moneromooo-monero)
2019-10-22 10:23:04 -05:00
luigi1111
84ce43a239
Merge pull request #5966
be82c40 Support median block size > 4 GB (moneromooo-monero)
2019-10-22 10:08:32 -05:00
moneromooo-monero
be82c40703
Support median block size > 4 GB
add a 128/64 division routine so we can use a > 32 bit median block
size in calculations
2019-10-21 10:41:07 +00:00
xiphon
23ba69ec88 epee: fix SSL server handshake, run_one() can block, use poll_one() 2019-10-18 18:32:33 +00:00
luigi1111
7ec8d9640e
Merge pull request #5911
e48dcb7 levin: armour against some 'should not happen' case (moneromooo-monero)
2019-10-16 13:35:55 -05:00
moneromooo-monero
e48dcb7a01
levin: armour against some "should not happen" case
If adding a response handler after the protocol is released,
they could never be cancelled again, and would end up keeping
a ref that never goes away
2019-10-15 10:30:08 +00:00
luigi1111
8fcdf77d7b
Merge pull request #5947
c9cfbf7 epee: tcp server - set SO_LINGER instead of SO_REUSEADDR option (xiphon)
2019-10-14 20:04:02 -05:00
luigi1111
4118e4b1e9
Merge pull request #5937
4b654f6 abstract_tcp_server2: log pointer, not contents, where appropriate (moneromooo-monero)
2019-10-14 18:08:47 -05:00
moneromooo-monero
10801362f4
abstract_tcp_server2: move "Trying to connect" from error to debug
and fix the message grammar
2019-10-14 14:15:21 +00:00
luigi1111
18da0fa240
Merge pull request #5918
4371791 epee: implement handshake timeout for SSL connections (xiphon)
2019-10-08 14:30:45 -05:00
luigi1111
ca975bcb79
Merge pull request #5917
7d81850 epee: fix network timeouts in blocked_mode_client (xiphon)
2019-10-08 14:28:50 -05:00
xiphon
c9cfbf7fb3 epee: tcp server - set SO_LINGER instead of SO_REUSEADDR option 2019-10-02 19:08:02 +00:00
luigi1111
15b9b4e047
Merge pull request #5910
1b91beb abstract_tcp_server2: fix lingering connections (moneromooo-monero)
2019-09-30 18:55:58 -05:00
luigi1111
c6430f9dd0
Merge pull request #5893
Coverity fixes [3a81639, 1bd962d, 2825f07, d099658, d46f701, cd57a10] (anonimal)
2019-09-30 18:43:48 -05:00
moneromooo-monero
4b654f65a3
abstract_tcp_server2: log pointer, not contents, where appropriate 2019-09-27 15:15:32 +00:00
moneromooo-monero
89339551a2
epee: misc_log_ex.h can now be used in C code
use mfatal/merror/mwarning/minfo/mdebug/mtrace
2019-09-24 15:47:31 +00:00
xiphon
4371791977 epee: implement handshake timeout for SSL connections 2019-09-17 22:21:16 +00:00
xiphon
7d81850a46 epee: fix network timeouts in blocked_mode_client 2019-09-16 18:55:36 +00:00
moneromooo-monero
32f725d32f
Properly format multiline logs
As a side effect, colouring on Windows should now work
regardless of version
2019-09-16 16:58:01 +00:00
luigi1111
b4ac8969a8
Merge pull request #5898
73f22c4 depends: fix MacOS build with Clang 3.7.1 (vtnerd)
2019-09-14 13:22:35 -05:00
moneromooo-monero
1b91bebd2e
abstract_tcp_server2: fix lingering connections
Resetting the timer after shutdown was initiated would keep
a reference to the object inside ASIO, which would keep the
connection alive until the timer timed out
2019-09-12 12:10:50 +00:00
Lee Clagett
73f22c48e1
depends: fix MacOS build with Clang 3.7.1 2019-09-08 22:49:11 +02:00
anonimal
cd57a10c90
epee: abstract_tcp_server2: resolve CID 203919 (DC.WEAK_CRYPTO)
The problem actually exists in two parts:

1. When sending chunks over a connection, if the queue size is
greater than N, the seed is predictable across every monero node.

>"If rand() is used before any calls to srand(), rand() behaves as if
it was seeded with srand(1). Each time rand() is seeded with the same seed, it
must produce the same sequence of values."

2. The CID speaks for itself: "'rand' should not be used for security-related
applications, because linear congruential algorithms are too easy to break."

*But* this is an area of contention.

One could argue that a CSPRNG is warranted in order to fully mitigate any
potential timing attacks based on crafting chunk responses. Others could argue
that the existing LCG, or even an MTG, would suffice (if properly seeded). As a
compromise, I've used an MTG with a full bit space. This should give a healthy
balance of security and speed without relying on the existing crypto library
(which I'm told might break on some systems since epee is not (shouldn't be)
dependent upon the existing crypto library).
2019-09-08 01:14:39 +00:00
moneromooo-monero
bc1144e98e
Fix IP address serialization on big endian
IP addresses are stored in network byte order even on little
endian hosts
2019-09-04 14:54:01 +00:00
moneromooo-monero
516f7b9de0
storages: fix "portable" storage on big endian 2019-09-04 14:53:57 +00:00
moneromooo-monero
32c3834948
storages: fix writing varints on big endian 2019-09-04 14:53:57 +00:00
moneromooo-monero
bdda084651
epee: fix local/loopback checks on big endian
IPv4 addresses are kept in network byte order in memory
2019-09-04 14:53:56 +00:00
luigi1111
1b93cb74bb
Merge pull request #5824
2a41dc0 epee: fix connections not being properly closed in some instances (moneromooo-monero)
2019-09-04 09:40:21 -05:00
luigi1111
6fe281d315
Merge pull request #5814
bdcdb0e Remove unused code under WINDWOS_PLATFORM guard (tomsmeding)
a84aa04 syncobj.h no longer defines shared_guard, so remove those define's (tomsmeding)
2019-09-04 09:30:29 -05:00
luigi1111
23547e6ed6
Merge pull request #5536
1a367d6 simplewallet: lock console on inactivity (moneromooo-monero)
2019-09-04 09:18:38 -05:00
moneromooo-monero
1a367d6a22
simplewallet: lock console on inactivity 2019-08-28 19:01:48 +00:00
Tom Smeding
a84aa04d57 syncobj.h no longer defines shared_guard, so remove those define's
The removed preprocessor macro's refer to types that are not defined in
the file anymore; the only other place where shared_guard is defined is
in winobj.h, which also defines the same macro's. Therefore, this change
is safe.

(Side note is that these macro's weren't used at all anyway, but that is
orthogonal to the issue.)
2019-08-23 08:42:36 +02:00
Jethro Grassie
30779de39d
fix feature not introduced until boost 1.66 2019-08-20 01:06:59 -04:00
moneromooo-monero
2a41dc0453
epee: fix connections not being properly closed in some instances
Fixed by Fixed by crCr62U0
2019-08-19 22:09:55 +00:00
moneromooo-monero
eeca5ca0c8
epee: support unicode in parsed strings 2019-08-16 17:06:03 +00:00
luigi1111
8a0711f2f2
Merge pull request #5674
fcbf7b3 p2p: propagate out peers limit to payload handler (moneromooo-monero)
098aadf p2p: close the right number of connections on setting max in/out peers (moneromooo-monero)
2019-08-15 17:22:39 -05:00
luigi1111
df064eaa36
Merge pull request #5649
a182df2 Bans for RPC connections (hyc)
2019-08-15 17:10:49 -05:00
Tom Smeding
bdcdb0e813 Remove unused code under WINDWOS_PLATFORM guard
This code has been present, unchanged, ever since the original move to
github in 2014 with commit 296ae46ed.
2019-08-15 14:57:27 +02:00
Thomas Winget
155475d971
Add IPv6 support
new cli options (RPC ones also apply to wallet):
  --p2p-bind-ipv6-address (default = "::")
  --p2p-bind-port-ipv6    (default same as ipv4 port for given nettype)
  --rpc-bind-ipv6-address (default = "::1")

  --p2p-use-ipv6          (default false)
  --rpc-use-ipv6          (default false)

  --p2p-require-ipv4      (default true, if ipv4 bind fails and this is
                           true, will not continue even if ipv6 bind
                           successful)
  --rpc-require-ipv4      (default true, description as above)

ipv6 addresses are to be specified as "[xx:xx:xx::xx:xx]:port" except
in the cases of the cli args for bind address.  For those the square
braces can be omitted.
2019-07-31 20:04:57 -04:00
luigi1111
38e0e58a95
Merge pull request #5531
9a6006b abstract_tcp_server2: move some things out of a lock (moneromooo-monero)
2019-07-24 14:08:52 -05:00
luigi1111
e579fe4ae0
Merge pull request #5530
6abaaaa remove obsolete save_graph skeleton code (moneromooo-monero)
2019-07-24 14:07:29 -05:00
luigi1111
8774384ace
Merge pull request #5528
f61a315 net_utils: fix m_ssl type from time_t to bool (moneromooo-monero)
2019-07-24 14:05:18 -05:00
Lee Clagett
3b24b1d082 Added support for "noise" over I1P/Tor to mask Tx transmission. 2019-07-17 14:22:37 +00:00
Lee Clagett
bdfc63ae4d Add ref-counted buffer byte_slice. Currently used for sending TCP data. 2019-07-16 16:30:35 +00:00
moneromooo-monero
65c4004963
allow blocking whole subnets 2019-07-16 11:35:53 +00:00
moneromooo-monero
098aadf084
p2p: close the right number of connections on setting max in/out peers 2019-06-19 11:49:36 +00:00
Howard Chu
a182df21d0
Bans for RPC connections
Make bans control RPC sessions too. And auto-ban some bad requests.
Drops HTTP connections whenever response code is 500.
2019-06-16 11:38:08 +01:00
moneromooo-monero
bc09766bf9
abstract_tcp_server2: improve DoS resistance 2019-06-14 08:47:26 +00:00
moneromooo-monero
39169ace09
epee: basic sanity check on allocation size from untrusted source
Reported by guidov
2019-06-14 08:47:01 +00:00
luigi1111
9c0e9c40ec
Merge pull request #5618
b0a04f7 epee: fix SSL autodetect on reconnection (xiphon)
2019-06-11 18:15:48 -05:00
xiphon
b0a04f7d45 epee: fix SSL autodetect on reconnection 2019-06-10 10:40:16 +00:00
moneromooo-monero
35c20c4332
Fix GCC 9.1 build warnings
GCC wants operator= aand copy ctor to be both defined, or neither
2019-06-09 09:39:18 +00:00
Lee Clagett
3544596f9f Add ssl_options support to monerod's rpc mode. 2019-05-22 00:09:11 -04:00
moneromooo-monero
9a6006bad8
abstract_tcp_server2: move some things out of a lock
The lock is meant for the network throttle object only,
and this should help coverity get unconfused
2019-05-10 14:18:11 +00:00
moneromooo-monero
6abaaaa994
remove obsolete save_graph skeleton code 2019-05-10 14:17:18 +00:00
moneromooo-monero
f61a315e8b
net_utils: fix m_ssl type from time_t to bool 2019-05-10 14:14:49 +00:00
Riccardo Spagni
c0bc6d96cd
Merge pull request #5509
a62e0725 net_ssl: SSL config tweaks for compatibility and security (moneromooo-monero)
2019-05-07 17:39:20 +02:00
Riccardo Spagni
2d04b0e500
Merge pull request #5499
a4c4a2d8 blockchain: keep a rolling long term block weight median (moneromooo-monero)
2019-05-07 17:31:45 +02:00
moneromooo-monero
a62e072571
net_ssl: SSL config tweaks for compatibility and security
add two RSA based ciphers for Windows/depends compatibility
also enforce server cipher ordering
also set ECDH to auto because vtnerd says it is good :)

When built with the depends system, openssl does not include any
cipher on the current whitelist, so add this one, which fixes the
problem, and does seem sensible.
2019-05-07 10:01:42 +00:00
moneromooo-monero
a4c4a2d8aa
blockchain: keep a rolling long term block weight median 2019-05-02 09:47:01 +00:00
moneromooo-monero
5e0da6fb68
change SSL certificate fingerprint whitelisting from SHA1 to SHA-256
SHA1 is too close to bruteforceable
2019-04-26 11:37:15 +00:00
Riccardo Spagni
5d09e39174
Merge pull request #5482
9956500d net_helper: clear recv buffer on eof (moneromooo-monero)
2019-04-24 22:40:12 +02:00
Riccardo Spagni
d86dd5fa7c
Merge pull request #5479
edbae2d0 levin_protocol_handler_async: tune down preallocation a fair bit (moneromooo-monero)
2019-04-24 22:39:30 +02:00
moneromooo-monero
9956500d14
net_helper: clear recv buffer on eof 2019-04-23 13:23:17 +00:00
moneromooo-monero
edbae2d05b
levin_protocol_handler_async: tune down preallocation a fair bit
It can allocate a lot when getting a lot of connections
(in particular, the stress test on windows apparently pushes
that memory to actual use, rather than just allocated)
2019-04-22 22:35:32 +00:00
moneromooo-monero
7a9316ebef
serialization: set default log category 2019-04-21 09:26:25 +00:00
moneromooo-monero
b672d4d6e5
epee: use boost/timer/timer.hpp, boost/timer.hpp is deprecated 2019-04-18 15:12:34 +00:00
Riccardo Spagni
c8ce4217cf
Merge pull request #5445
b18f0b10 wallet: new --offline option (moneromooo-monero)
2019-04-16 22:46:53 +02:00
Riccardo Spagni
e9527f5eed
Merge pull request #5436
61d63900 net_helper: avoid unnecessary memcpy (moneromooo-monero)
2019-04-16 22:43:15 +02:00
moneromooo-monero
b18f0b1051
wallet: new --offline option
It will avoid connecting to a daemon (so useful for cold signing
using a RPC wallet), and not perform DNS queries.
2019-04-15 09:14:12 +00:00
moneromooo-monero
61d63900b9
net_helper: avoid unnecessary memcpy 2019-04-13 13:24:58 +00:00
moneromooo-monero
c3cf930f75
abstract_tcp_server2: fix timeout on exit
When closing connections due to exiting, the IO service is
already gone, so the data exchange needed for a gracious SSL
shutdown cannot happen. We just close the socket in that case.
2019-04-12 18:13:31 +00:00
moneromooo-monero
4b3bb829c2
epee: init a new ssl related variable in ctor 2019-04-11 11:10:15 +00:00
moneromooo-monero
9f8dc4ce51
simplewallet: new net_stats command
displays total sent and received bytes
2019-04-11 10:46:41 +00:00
Lee Clagett
2e578b8214 Enabling daemon-rpc SSL now requires non-system CA verification
If `--daemon-ssl enabled` is set in the wallet, then a user certificate,
fingerprint, or onion/i2p address must be provided.
2019-04-07 13:02:43 -04:00
Lee Clagett
d58f368289 Require manual override for user chain certificates.
An override for the wallet to daemon connection is provided, but not for
other SSL contexts. The intent is to prevent users from supplying a
system CA as the "user" whitelisted certificate, which is less secure
since the key is controlled by a third party.
2019-04-07 00:44:37 -04:00
Lee Clagett
eca0fea45a Perform RFC 2818 hostname verification in client SSL handshakes
If the verification mode is `system_ca`, clients will now do hostname
verification. Thus, only certificates from expected hostnames are
allowed when SSL is enabled. This can be overridden by forcible setting
the SSL mode to autodetect.

Clients will also send the hostname even when `system_ca` is not being
performed. This leaks possible metadata, but allows servers providing
multiple hostnames to respond with the correct certificate. One example
is cloudflare, which getmonero.org is currently using.
2019-04-07 00:44:37 -04:00
Lee Clagett
0416764cae Require server verification when SSL is enabled.
If SSL is "enabled" via command line without specifying a fingerprint or
certificate, the system CA list is checked for server verification and
_now_ fails the handshake if that check fails. This change was made to
remain consistent with standard SSL/TLS client behavior. This can still
be overridden by using the allow any certificate flag.

If the SSL behavior is autodetect, the system CA list is still checked
but a warning is logged if this fails. The stream is not rejected
because a re-connect will be attempted - its better to have an
unverified encrypted stream than an unverified + unencrypted stream.
2019-04-07 00:44:37 -04:00
Lee Clagett
21eb1b0725 Pass SSL arguments via one class and use shared_ptr instead of reference 2019-04-07 00:44:37 -04:00
Lee Clagett
a3b0284837 Change SSL certificate file list to OpenSSL builtin load_verify_location
Specifying SSL certificates for peer verification does an exact match,
making it a not-so-obvious alias for the fingerprints option. This
changes the checks to OpenSSL which loads concatenated certificate(s)
from a single file and does a certificate-authority (chain of trust)
check instead. There is no drop in security - a compromised exact match
fingerprint has the same worse case failure. There is increased security
in allowing separate long-term CA key and short-term SSL server keys.

This also removes loading of the system-default CA files if a custom
CA file or certificate fingerprint is specified.
2019-04-06 23:47:06 -04:00
Riccardo Spagni
0baf26c8d6
Merge pull request #5375
1569776a Add missing include (Leon Klingele)
2019-04-06 16:04:06 +02:00
Riccardo Spagni
38317f384c
Merge pull request #5348
59776a64 epee: some more minor JSON parsing speedup (moneromooo-monero)
2019-04-06 16:00:18 +02:00
Riccardo Spagni
1ed6441925
Merge pull request #5327
c23ea796 New interactive daemon command 'print_net_stats': Global traffic stats (rbrunner7)
2019-04-01 17:32:01 +02:00
Riccardo Spagni
87840192dd
Merge pull request #5309
43042a28 Implement array_entry_t copy constructor (Guido Vranken)
2019-04-01 17:28:08 +02:00
Leon Klingele
1569776a52
Add missing include 2019-03-31 18:39:25 +02:00
moneromooo-monero
59776a64ff
epee: some more minor JSON parsing speedup 2019-03-25 14:29:29 +00:00
Lee Clagett
7acfa9f3cc Added socks proxy (tor/i2pd/kovri) support to wallet 2019-03-25 01:35:13 +00:00
Riccardo Spagni
676b17d36d
Merge pull request #5285
6ef816de console_handler: print newline on EOF (moneromooo-monero)
2019-03-24 19:38:04 +02:00
rbrunner7
c23ea7962d New interactive daemon command 'print_net_stats': Global traffic stats 2019-03-24 16:58:57 +01:00
Riccardo Spagni
f5d7652f73
Merge pull request #5283
16590294 abstract_tcp_server2: fix crashy race on socket shutdown (moneromooo-monero)
2019-03-21 14:53:03 +02:00
moneromooo-monero
17769db946
epee: fix build with boost 1.70.0
get_io_service was deprecated, and got removed
2019-03-21 11:02:02 +00:00
moneromooo-monero
1659029469
abstract_tcp_server2: fix crashy race on socket shutdown 2019-03-19 16:50:00 +00:00
Guido Vranken
43042a28ec Implement array_entry_t copy constructor
Manually initialize the array_entry_t iterator to ensure it points
to the correct m_array, thereby preventing a potential use-after-free
situation.

Signed-off-by: Guido Vranken <guidovranken@gmail.com>
2019-03-18 00:49:12 +01:00
Riccardo Spagni
4c91eb23a0
Merge pull request #5061
1f2930ce Update 2019 copyright (binaryFate)
2019-03-17 17:49:30 +02:00
moneromooo-monero
6ef816de2b
console_handler: print newline on EOF
This avoids the annoying case where the shell prints its prompt
after the last line from Monero output, causing line editing to
sometimes go wonky, for lack of a better term
2019-03-13 16:52:22 +00:00
Howard Chu
b8c2e21cba
Fix startup errors with SSL cert generation
Use SSL API directly, skip boost layer
2019-03-08 15:15:24 +00:00
binaryFate
1f2930ce0b Update 2019 copyright 2019-03-05 22:05:34 +01:00
Martijn Otto
057c279cb4
epee: add SSL support
RPC connections now have optional tranparent SSL.

An optional private key and certificate file can be passed,
using the --{rpc,daemon}-ssl-private-key and
--{rpc,daemon}-ssl-certificate options. Those have as
argument a path to a PEM format private private key and
certificate, respectively.
If not given, a temporary self signed certificate will be used.

SSL can be enabled or disabled using --{rpc}-ssl, which
accepts autodetect (default), disabled or enabled.

Access can be restricted to particular certificates using the
--rpc-ssl-allowed-certificates, which takes a list of
paths to PEM encoded certificates. This can allow a wallet to
connect to only the daemon they think they're connected to,
by forcing SSL and listing the paths to the known good
certificates.

To generate long term certificates:

openssl genrsa -out /tmp/KEY 4096
openssl req -new -key /tmp/KEY -out /tmp/REQ
openssl x509 -req -days 999999 -sha256 -in /tmp/REQ -signkey /tmp/KEY -out /tmp/CERT

/tmp/KEY is the private key, and /tmp/CERT is the certificate,
both in PEM format. /tmp/REQ can be removed. Adjust the last
command to set expiration date, etc, as needed. It doesn't
make a whole lot of sense for monero anyway, since most servers
will run with one time temporary self signed certificates anyway.

SSL support is transparent, so all communication is done on the
existing ports, with SSL autodetection. This means you can start
using an SSL daemon now, but you should not enforce SSL yet or
nothing will talk to you.
2019-03-05 14:16:08 +01:00
moneromooo-monero
e396146aee
default initialize rpc structures 2019-03-04 22:38:03 +00:00
Riccardo Spagni
c83e80c263
Merge pull request #5162
4d3b61a3 Use io_service::work in epee tcp server (Lee Clagett)
2019-03-04 21:33:48 +02:00
Riccardo Spagni
f18a7e39b8
Merge pull request #5160
7af4fbd4 epee: Add space after ':' in additional http response headers (Tom Smeding)
2019-03-04 21:33:24 +02:00
Riccardo Spagni
4a390d43f8
Merge pull request #5113
c0e9e805 Fixed missing return value in once_a_time class on windows (Markus Behm)
2019-03-04 21:25:44 +02:00
Riccardo Spagni
a28237c9ca
Merge pull request #5102
1eef0565 performance_tests: better stats, and keep track of timing history (moneromooo-monero)
2019-03-04 21:22:51 +02:00
Riccardo Spagni
722a856d7e
Merge pull request #5096
7c3ade44 network_throttle: use circular_buffer where appropriate (moneromooo-monero)
2019-03-04 21:21:25 +02:00
Riccardo Spagni
4466f4504e
Merge pull request #5091
123fc2a2 i2p: initial support (Jethro Grassie)
2019-03-04 21:20:34 +02:00
Tom Smeding
7af4fbd4d1 epee: Add space after ':' in additional http response headers 2019-02-18 14:56:28 +01:00
Lee Clagett
4d3b61a31b Use io_service::work in epee tcp server 2019-02-10 13:40:32 -05:00
Markus Behm
c0e9e80581 Fixed missing return value in once_a_time class on windows 2019-02-09 15:24:34 -05:00
moneromooo-monero
2456945408
epee: add SSL support
RPC connections now have optional tranparent SSL.

An optional private key and certificate file can be passed,
using the --{rpc,daemon}-ssl-private-key and
--{rpc,daemon}-ssl-certificate options. Those have as
argument a path to a PEM format private private key and
certificate, respectively.
If not given, a temporary self signed certificate will be used.

SSL can be enabled or disabled using --{rpc}-ssl, which
accepts autodetect (default), disabled or enabled.

Access can be restricted to particular certificates using the
--rpc-ssl-allowed-certificates, which takes a list of
paths to PEM encoded certificates. This can allow a wallet to
connect to only the daemon they think they're connected to,
by forcing SSL and listing the paths to the known good
certificates.

To generate long term certificates:

openssl genrsa -out /tmp/KEY 4096
openssl req -new -key /tmp/KEY -out /tmp/REQ
openssl x509 -req -days 999999 -sha256 -in /tmp/REQ -signkey /tmp/KEY -out /tmp/CERT

/tmp/KEY is the private key, and /tmp/CERT is the certificate,
both in PEM format. /tmp/REQ can be removed. Adjust the last
command to set expiration date, etc, as needed. It doesn't
make a whole lot of sense for monero anyway, since most servers
will run with one time temporary self signed certificates anyway.

SSL support is transparent, so all communication is done on the
existing ports, with SSL autodetection. This means you can start
using an SSL daemon now, but you should not enforce SSL yet or
nothing will talk to you.
2019-02-02 20:05:33 +00:00
moneromooo-monero
7c3ade4410
network_throttle: use circular_buffer where appropriate 2019-02-01 21:33:13 +00:00
Jethro Grassie
123fc2a25a
i2p: initial support 2019-01-30 13:37:45 -05:00
Lee Clagett
973403bc9f Adding initial support for broadcasting transactions over Tor
- Support for ".onion" in --add-exclusive-node and --add-peer
  - Add --anonymizing-proxy for outbound Tor connections
  - Add --anonymous-inbounds for inbound Tor connections
  - Support for sharing ".onion" addresses over Tor connections
  - Support for broadcasting transactions received over RPC exclusively
    over Tor (else broadcast over public IP when Tor not enabled).
2019-01-28 23:56:33 +00:00
moneromooo-monero
acfff8d0ce
rpc: fix internal daemon calls in restricted rpc getting partial data 2019-01-28 19:35:20 +00:00
moneromooo-monero
1eef056588
performance_tests: better stats, and keep track of timing history 2019-01-28 15:45:37 +00:00
moneromooo-monero
b750fb27b0
Pruning
The blockchain prunes seven eighths of prunable tx data.
This saves about two thirds of the blockchain size, while
keeping the node useful as a sync source for an eighth
of the blockchain.

No other data is currently pruned.

There are three ways to prune a blockchain:

- run monerod with --prune-blockchain
- run "prune_blockchain" in the monerod console
- run the monero-blockchain-prune utility

The first two will prune in place. Due to how LMDB works, this
will not reduce the blockchain size on disk. Instead, it will
mark parts of the file as free, so that future data will use
that free space, causing the file to not grow until free space
grows scarce.

The third way will create a second database, a pruned copy of
the original one. Since this is a new file, this one will be
smaller than the original one.

Once the database is pruned, it will stay pruned as it syncs.
That is, there is no need to use --prune-blockchain again, etc.
2019-01-22 20:30:51 +00:00
moneromooo-monero
21777daf6e
epee: speedup word/number matching
Number matching semantics are slightly changed: since this is used
as a filter to check whether a number is signed and/or floating
point, we can speed this up further. strto* functions are called
afterwards and will error out where necessary. We now also accept
numbers like .4 which were not accepted before.

The strto* calls on a boost::string_ref will not access unallocated
memory since the parsers always stop at the first bad character,
and the original string is zero terminated.

in arbitrary time measurement units for some arbitrary test case:

match_number2: 235 -> 70
match_word2: 330 -> 108
2019-01-16 19:59:40 +00:00
Riccardo Spagni
a093a7569e
Merge pull request #5021
b82efa32 epee: speed up json parsing (moneromooo-monero)
2019-01-16 21:37:29 +02:00
Riccardo Spagni
3e9bb9626a
Merge pull request #5001
a5ffc2d5 Remove boost::lexical_cast for uuid and unused uuid function (Lee Clagett)
2019-01-16 19:27:13 +02:00
Riccardo Spagni
846362842c
Merge pull request #4976
85665003 epee: better network buffer data structure (moneromooo-monero)
2019-01-16 19:04:22 +02:00
Riccardo Spagni
3ce7977389
Merge pull request #4950
68f045de easylogging++: check allowed categories before logging (moneromooo-monero)
2019-01-06 20:38:10 +02:00
Riccardo Spagni
13b006137c
Merge pull request #4949
5464725a protocol: change standby mode to not wait sleeping (moneromooo-monero)
85807dfb add a once_a_time_milliseconds class (moneromooo-monero)
2019-01-06 20:37:51 +02:00
Riccardo Spagni
ad1eb3338c
Merge pull request #4938
a13eb0a1 epee: speed up string matching a bit (moneromooo-monero)
3a3858dc epee: avoid string allocation when parsing a pod from string (moneromooo-monero)
2019-01-06 20:36:46 +02:00
luigi1111
d8c03191ca
Merge pull request #4933
3cf85f0 Changed RECIEVED to RECEIVED in log messages. (normoes)
2018-12-31 15:33:18 -06:00
moneromooo-monero
b82efa32e7
epee: speed up json parsing 2018-12-27 14:28:30 +00:00