RPC: Dns rebind protection #15962

holiman · 2018-01-24T10:36:30Z

This pr introduces the flag --rpcvhosts=<hosts>, which tells the RPC server about the hostname(s) to expect for incoming requests (defaults to localhost unless specified). This protection mechanism also does not bother preventing requests made against a raw ip address, either v4 or v6.

This prevents attacks like DNS rebinding, which bypasses SOP by simply masquerading as being within the same origin. These attacks do not utilize CORS, since they are not cross-domain.

By explicitly checking the Host-header, the server will not allow requests made against the server with a malicious host domain.

Additionally, this PR fixes a bug introduced in 54aeb8e, which caused the dumpconfig command to fail with

#build/bin/geth  --maxpeers=0 --nodiscover --rpc dumpconfig
toml: cannot marshal nil log.Logger

This PR potentially breaks applications which publish RPC ports towards the world; in order to continue doing so, geth needs to be started like this:

geth <flags> --rpcvhosts=infura.io,www.infura.io,...

There's also the possibility to use wildcards, effectively disabling the host-protection:

geth <flags> --rpcvhosts=*

…67258af67df3b266af3d

holiman · 2018-01-25T07:46:37Z

Travis errors:

ok  	github.com/ethereum/go-ethereum/eth	4.447s	coverage: 25.9% of statements
--- FAIL: TestFastCriticalRestarts (0.00s)
    --- FAIL: TestFastCriticalRestarts/protocol_64_progress_true (4.58s)
    	downloader_test.go:1819: pivot block not locked in after critical section failure
FAIL

and

--- FAIL: TestSimulation (7.30s)
	peer_test.go:426: node 5: failed to exchange bloom filter requirement in round 1.

Not related.

…pc virtual hostnames check

karalabe

Tiny changes, otherwise lgtm

karalabe · 2018-02-05T13:14:32Z

cmd/utils/flags.go

@@ -383,6 +383,11 @@ var (
 		Usage: "Comma separated list of domains from which to accept cross origin requests (browser enforced)",
 		Value: "",
 	}
+	RPCVirtualHostsFlag = cli.StringFlag{
+		Name:  "rpcvhosts",
+		Usage: "Comma separated list of virtual hostnames from which to accept requests (server enforced). Set to * to disable this protection.",


Nitpick, do we really need Set to * to disable this protection.? Just afraid the help usage text will wrap.

karalabe · 2018-02-05T13:20:07Z

node/api.go

@@ -114,7 +114,7 @@ func (api *PrivateAdminAPI) PeerEvents(ctx context.Context) (*rpc.Subscription,
 }

 // StartRPC starts the HTTP RPC API server.
-func (api *PrivateAdminAPI) StartRPC(host *string, port *int, cors *string, apis *string) (bool, error) {
+func (api *PrivateAdminAPI) StartRPC(host *string, port *int, cors *string, apis *string, hosts *string) (bool, error) {


Lets call this vhosts, otherwise host and hosts gets ambiguous.

karalabe · 2018-02-05T13:21:35Z

node/config.go

+	// By explicitly checking the Host-header, the server will not allow requests
+	// made against the server with a malicious host domain.
+	// Requests using ip address directly are not affected
+	HTTPVirtualHostnames []string `toml:",omitempty"`


Nitpick, can we just call this HTTPVirtualHosts? I.e. shorted than hostNAMEs and I don't see the added value.

karalabe · 2018-02-05T13:22:09Z

node/node.go

@@ -365,7 +365,7 @@ func (n *Node) stopIPC() {
 }

 // startHTTP initializes and starts the HTTP RPC endpoint.
-func (n *Node) startHTTP(endpoint string, apis []rpc.API, modules []string, cors []string) error {
+func (n *Node) startHTTP(endpoint string, apis []rpc.API, modules []string, cors []string, allowedHosts []string) error {


allowedHosts -> vhosts (keep te api consistent).

karalabe · 2018-02-05T13:24:56Z

node/node.go

 	n.log.Info(fmt.Sprintf("HTTP endpoint opened: http://%s", endpoint))
-
+	n.log.Info(fmt.Sprintf("HTTP config: cors %v, vhosts%v", cors, allowedHosts))
 	// All listeners booted successfully


I think these logs were leftovers from the auto log refactor. Could you change them to:

n.log.Info("HTTP endpoint opened", "url", fmt.Sprintf("http://%s", endpoint), "cors", strings.Join(cors, ","), "hvosts", strings.Join(vhosts, ","))

karalabe · 2018-02-05T13:25:47Z

rpc/http.go

+func NewHTTPServer(cors []string, hosts []string, srv *Server) *http.Server {
+	// Wrap the CORS-handler within a host-handler
+	handler := newCorsHandler(srv, cors)
+	handler = newHostHandler(hosts, handler)


Perhaps hosts -> vhosts and newHostHandler -> newVHostHandler

karalabe · 2018-02-05T13:26:13Z

rpc/http.go

@@ -195,6 +199,50 @@ func newCorsHandler(srv *Server, allowedOrigins []string) http.Handler {
 		AllowedMethods: []string{http.MethodPost, http.MethodGet},
 		MaxAge:         600,
 		AllowedHeaders: []string{"*"},
+		Debug:          true,


What's this for?

karalabe · 2018-02-05T13:32:14Z

rpc/http.go

+
+// ServeHTTP serves JSON-RPC requests over HTTP, implements http.Handler
+func (h *hostHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+


Pls no empty lines in these cases :P

karalabe · 2018-02-05T13:33:43Z

rpc/http.go

+// since they do in-domain requests against the RPC api. Instead, we can see on the Host-header
+// which domain was used, and validate that against a whitelist.
+type hostHandler struct {
+	AllowedHosts []string


Instead of storing a slice, lets store a map[string]struct{} instead. That way we can do quick lookups without incurring a linear scanning cost for every single request.

holiman · 2018-02-05T14:54:03Z

Addressed the concerns. I also made a last batch ot testing, after the changes were made.

testscript:

#!/bin/bash
data='{"jsonrpc":"2.0","method":"web3_clientVersion","params":[],"id":67}'

test(){
	h=$1
	echo "Target $h"
	curl -H "Content-Type: application/json" -H "host: $h" -X POST --data $data 127.0.0.1:8545
}
test localhost
test "127.0.0.1"
test "foobar.com"
test "x.localhost.com"

With std settings build/bin/geth --nodiscover --maxpeers 0 --rpc:

#bash testhosts.sh
Target localhost
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}
Target 127.0.0.1
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}
Target foobar.com
invalid host specified
Target x.localhost.com
invalid host specified

With #build/bin/geth --nodiscover --maxpeers 0 --rpc --rpcvhosts "foobar.com"

#bash testhosts.sh
Target localhost
invalid host specified
Target 127.0.0.1
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}
Target foobar.com
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}
Target x.localhost.com
invalid host specified

With #build/bin/geth --nodiscover --maxpeers 0 --rpc --rpcvhosts "foobar.com,localhost.com"

#bash testhosts.sh
Target localhost
invalid host specified
Target 127.0.0.1
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}
Target foobar.com
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}
Target x.localhost.com
invalid host specified

With #build/bin/geth --nodiscover --maxpeers 0 --rpc --rpcvhosts "foobar.com,x.localhost.com"

#bash testhosts.sh
Target localhost
invalid host specified
Target 127.0.0.1
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}
Target foobar.com
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}
Target x.localhost.com
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}

With wildcard #build/bin/geth --nodiscover --maxpeers 0 --rpc --rpcvhosts "a,b,*":

#bash testhosts.sh
Target localhost
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}
Target 127.0.0.1
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}
Target foobar.com
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}
Target x.localhost.com
{"jsonrpc":"2.0","id":67,"result":"Geth/v1.8.0-unstable-543df3f6/linux-amd64/go1.9.2"}

karalabe · 2018-02-12T12:44:52Z

rpc/http.go

+// The virtalHostHandler can prevent DNS rebinding attacks, which do not utilize CORS-headers,
+// since they do in-domain requests against the RPC api. Instead, we can see on the Host-header
+// which domain was used, and validate that against a whitelist.
+type virtalHostHandler struct {


virtalHostHandler forgot a u from virtUal

karalabe

LGTM

* cmd,node,rpc: add allowedHosts to prevent dns rebinding attacks * p2p,node: Fix bug with dumpconfig introduced in r54aeb8e4c0bb9f0e7a6c67258af67df3b266af3d * rpc: add wildcard support for rpcallowedhosts + go fmt * cmd/geth, cmd/utils, node, rpc: ignore direct ip(v4/6) addresses in rpc virtual hostnames check * http, rpc, utils: make vhosts into map, address review concerns * node: change log messages to use geth standard (not sprintf) * rpc: fix spelling

holiman added 2 commits January 24, 2018 11:01

cmd,node,rpc: add allowedHosts to prevent dns rebinding attacks

b0c2ac4

p2p,node: Fix bug with dumpconfig introduced in r54aeb8e4c0bb9f0e7a6c…

226aef1

…67258af67df3b266af3d

holiman requested review from fjl and zsfelfoldi as code owners January 24, 2018 10:36

holiman force-pushed the dns_rebind branch from 1004b88 to 91e1c9a Compare January 24, 2018 10:43

holiman changed the title ~~Dns rebind protection~~ RPC: Dns rebind protection Jan 24, 2018

holiman force-pushed the dns_rebind branch from 91e1c9a to 07ad43f Compare January 24, 2018 12:11

rpc: add wildcard support for rpcallowedhosts + go fmt

5d0c42e

holiman force-pushed the dns_rebind branch from 07ad43f to 5d0c42e Compare January 24, 2018 13:38

cmd/geth, cmd/utils, node, rpc: ignore direct ip(v4/6) addresses in r…

543df3f

…pc virtual hostnames check

holiman force-pushed the dns_rebind branch from 0dbce00 to 543df3f Compare January 25, 2018 09:00

ethereum deleted a comment from GitCop Jan 25, 2018

karalabe requested changes Feb 5, 2018

View reviewed changes

karalabe added this to the 1.8.0 milestone Feb 5, 2018

http, rpc, utils: make vhosts into map, address review concerns

dbf5bb1

node: change log messages to use geth standard (not sprintf)

76d0069

karalabe reviewed Feb 12, 2018

View reviewed changes

rpc: fix spelling

618dcfd

karalabe approved these changes Feb 12, 2018

View reviewed changes

karalabe merged commit 589b603 into ethereum:master Feb 12, 2018

pedropombeiro mentioned this pull request Feb 14, 2018

Investigate/perform upgrade to Geth 1.8.1 status-im/status-go#665

Closed

6 tasks

pedropombeiro mentioned this pull request Feb 24, 2018

Update to go-ethereum 1.8.1 status-im/status-go#702

Merged

5 tasks

karalabe mentioned this pull request Apr 10, 2018

console RPC connection to resolvable name does not connect #16457

Closed

karalabe mentioned this pull request Apr 20, 2018

Can't connect to my node via hostname #16535

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RPC: Dns rebind protection #15962

RPC: Dns rebind protection #15962

holiman commented Jan 24, 2018 •

edited

holiman commented Jan 25, 2018

karalabe left a comment

karalabe Feb 5, 2018

karalabe Feb 5, 2018

karalabe Feb 5, 2018

karalabe Feb 5, 2018

karalabe Feb 5, 2018

karalabe Feb 5, 2018

karalabe Feb 5, 2018

karalabe Feb 5, 2018

karalabe Feb 5, 2018

holiman commented Feb 5, 2018

karalabe Feb 12, 2018

holiman Feb 12, 2018

karalabe left a comment


		// ServeHTTP serves JSON-RPC requests over HTTP, implements http.Handler
		func (h hostHandler) ServeHTTP(w http.ResponseWriter, r http.Request) {

RPC: Dns rebind protection #15962

RPC: Dns rebind protection #15962

Conversation

holiman commented Jan 24, 2018 • edited

holiman commented Jan 25, 2018

karalabe left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

holiman commented Feb 5, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

karalabe left a comment

Choose a reason for hiding this comment

holiman commented Jan 24, 2018 •

edited