Skip to content
This repository was archived by the owner on Nov 15, 2023. It is now read-only.

jsonrpsee: add host and origin filtering #9787

Merged
niklasad1 merged 6 commits into from
Sep 15, 2021
Merged

jsonrpsee: add host and origin filtering #9787

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
426cdce
add access control in the jsonrpsee servers
niklasad1 Sep 15, 2021
a57b164
use master
niklasad1 Sep 15, 2021
085d52d
fix nits
niklasad1 Sep 15, 2021
b1d11b4
rpc runtime_version safe
niklasad1 Sep 15, 2021
a4a56d6
fix nits
niklasad1 Sep 15, 2021
fd3840d
fix grumbles
niklasad1 Sep 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
add access control in the jsonrpsee servers
  • Loading branch information
@niklasad1
niklasad1 committed Sep 15, 2021
commit 426cdce1fe8c95f5d14f1da9caae5b864064997b
38 changes: 22 additions & 16 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion bin/node-template/node/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ sp-runtime = { version = "4.0.0-dev", path = "../../../primitives/runtime" }
sp-timestamp = { version = "4.0.0-dev", path = "../../../primitives/timestamp" }

# These dependencies are used for the node template's RPCs
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["server"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["server"] }
sc-rpc = { version = "4.0.0-dev", path = "../../../client/rpc" }
sp-api = { version = "4.0.0-dev", path = "../../../primitives/api" }
sc-rpc-api = { version = "0.10.0-dev", path = "../../../client/rpc-api" }
Expand Down
2 changes: 1 addition & 1 deletion bin/node/cli/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ crate-type = ["cdylib", "rlib"]

[dependencies]
# third-party dependencies
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["server"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["server"] }
serde = { version = "1.0.126", features = ["derive"] }
futures = "0.3.16"
hex-literal = "0.3.1"
Expand Down
2 changes: 1 addition & 1 deletion bin/node/rpc-client/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ targets = ["x86_64-unknown-linux-gnu"]

[dependencies]
futures = "0.3.16"
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["client", "macros"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["client", "macros"] }
tokio = { version = "1.10", features = ["full"] }
node-primitives = { version = "2.0.0", path = "../primitives" }
sp-tracing = { version = "4.0.0-dev", path = "../../../primitives/tracing" }
Expand Down
2 changes: 1 addition & 1 deletion client/consensus/babe/rpc/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ readme = "README.md"
targets = ["x86_64-unknown-linux-gnu"]

[dependencies]
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["server"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["server"] }
sc-consensus-babe = { version = "0.10.0-dev", path = "../" }
sc-rpc-api = { version = "0.10.0-dev", path = "../../../rpc-api" }
sp-consensus-babe = { version = "0.10.0-dev", path = "../../../../primitives/consensus/babe" }
Expand Down
2 changes: 1 addition & 1 deletion client/consensus/manual-seal/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ targets = ["x86_64-unknown-linux-gnu"]
derive_more = "0.99.2"
futures = "0.3.9"

jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["server"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["server"] }
log = "0.4.8"
codec = { package = "parity-scale-codec", version = "2.0.0" }
serde = { version = "1.0", features = ["derive"] }
Expand Down
2 changes: 1 addition & 1 deletion client/finality-grandpa/rpc/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ sp-blockchain = { version = "4.0.0-dev", path = "../../../primitives/blockchain"
sp-core = { version = "4.0.0-dev", path = "../../../primitives/core" }
sp-runtime = { version = "4.0.0-dev", path = "../../../primitives/runtime" }
finality-grandpa = { version = "0.14.1", features = ["derive-codec"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["server"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["server"] }
futures = { version = "0.3.4", features = ["compat"] }
serde = { version = "1.0.105", features = ["derive"] }
serde_json = "1.0.50"
Expand Down
2 changes: 1 addition & 1 deletion client/rpc-api/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ sc-chain-spec = { path = "../chain-spec", version = "4.0.0-dev" }
serde = { version = "1.0.126", features = ["derive"] }
serde_json = "1.0.41"

jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["full"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["full"] }

sc-transaction-pool-api = { version = "4.0.0-dev", path = "../transaction-pool/api" }
sp-rpc = { version = "4.0.0-dev", path = "../../primitives/rpc" }
Expand Down
1 change: 1 addition & 0 deletions client/rpc-api/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ pub use policy::DenyUnsafe;

pub mod author;
pub mod chain;
/// Child state API
pub mod child_state;
pub mod offchain;
pub mod state;
Expand Down
2 changes: 1 addition & 1 deletion client/rpc-servers/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,5 +18,5 @@ log = "0.4.8"
prometheus-endpoint = { package = "substrate-prometheus-endpoint", path = "../../utils/prometheus", version = "0.9.0"}
serde_json = "1.0.41"
futures-channel = "0.3"
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["server"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["server"] }
tokio = { version = "1.10", features = ["full"] }
43 changes: 32 additions & 11 deletions client/rpc-servers/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
#![warn(missing_docs)]

use jsonrpsee::{
http_server::{HttpServerBuilder, HttpStopHandle},
http_server::{AccessControlBuilder, Host, HttpServerBuilder, HttpStopHandle},
ws_server::{WsServerBuilder, WsStopHandle},
RpcModule,
};
Expand Down Expand Up @@ -90,7 +90,7 @@ pub type WsServer = WsStopHandle;
/// Start HTTP server listening on given address.
pub fn start_http<M: Send + Sync + 'static>(
addr: std::net::SocketAddr,
_cors: Option<&Vec<String>>,
cors: Option<&Vec<String>>,
maybe_max_payload_mb: Option<usize>,
module: RpcModule<M>,
rt: tokio::runtime::Handle,
Expand All @@ -99,8 +99,24 @@ pub fn start_http<M: Send + Sync + 'static>(
.map(|mb| mb.saturating_mul(MEGABYTE))
.unwrap_or(RPC_MAX_PAYLOAD_DEFAULT);

let mut acl = AccessControlBuilder::new();

log::info!("starting JSONRPC HTTP server: addr={}, cors={:?}", addr, cors);

if let Some(cors) = cors {
Copy link
Contributor

@dvdplm dvdplm Sep 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't we put localhost/127.0.0.1 on the allowlist even if corse is None?

Copy link
Contributor Author

@niklasad1 niklasad1 Sep 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All hosts/origins are enabled by default: https://github.com/paritytech/jsonrpsee/blob/master/http-server/src/access_control/mod.rs#L115

We should probably document it clearly in jsonrpsee I guess

// Whitelist listening address.
let host = Host::parse(&format!("localhost:{}", addr.port()));
Copy link
Contributor Author

@niklasad1 niklasad1 Sep 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Incredible ugly and annoying, we should fix this API.

acl = acl.allow_host(host);
let host = Host::parse(&format!("127.0.0.1:{}", addr.port()));
acl = acl.allow_host(host);
for origin in cors {
acl = acl.cors_allow_origin(origin.into());
}
};

let server = HttpServerBuilder::default()
.max_request_body_size(max_request_body_size as u32)
.set_access_control(acl.build())
.build(addr)?;

let handle = server.stop_handle();
Expand All @@ -117,7 +133,7 @@ pub fn start_http<M: Send + Sync + 'static>(
pub fn start_ws<M: Send + Sync + 'static>(
addr: std::net::SocketAddr,
max_connections: Option<usize>,
_cors: Option<&Vec<String>>,
cors: Option<&Vec<String>>,
maybe_max_payload_mb: Option<usize>,
module: RpcModule<M>,
rt: tokio::runtime::Handle,
Expand All @@ -127,14 +143,19 @@ pub fn start_ws<M: Send + Sync + 'static>(
.unwrap_or(RPC_MAX_PAYLOAD_DEFAULT);
let max_connections = max_connections.unwrap_or(WS_MAX_CONNECTIONS);

let server = tokio::task::block_in_place(|| {
rt.block_on(
WsServerBuilder::default()
.max_request_body_size(max_request_body_size as u32)
.max_connections(max_connections as u64)
.build(addr),
)
})?;
let mut builder = WsServerBuilder::default()
.max_request_body_size(max_request_body_size as u32)
.max_connections(max_connections as u64);

log::info!("starting JSONRPC WS server: addr={}, cors={:?}", addr, cors);

if let Some(cors) = cors {
// Whitelist listening address.
builder = builder.set_allowed_hosts([format!("localhost:{}", addr.port()), format!("127.0.0.1:{}", addr.port())])?;
builder = builder.set_allowed_origins(cors)?;
}

let server = tokio::task::block_in_place(|| rt.block_on(builder.build(addr)))?;

let handle = server.stop_handle();
let rpc_api = build_rpc_api(module);
Expand Down
2 changes: 1 addition & 1 deletion client/rpc/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ sc-tracing = { version = "4.0.0-dev", path = "../tracing" }
hash-db = { version = "0.15.2", default-features = false }
parking_lot = "0.11.1"
lazy_static = { version = "1.4.0", optional = true }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["server"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["server"] }
sc-transaction-pool-api = { version = "4.0.0-dev", path = "../transaction-pool/api" }

[dev-dependencies]
Expand Down
2 changes: 1 addition & 1 deletion client/service/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ wasmtime = ["sc-executor/wasmtime"]
test-helpers = []

[dependencies]
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["server"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["server"] }

thiserror = "1.0.21"
futures01 = { package = "futures", version = "0.1.29" }
Expand Down
5 changes: 1 addition & 4 deletions client/service/src/builder.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -656,7 +656,7 @@ fn init_telemetry<TBl: BlockT, TCl: BlockBackend<TBl>>(
// Maciej: This is very WIP, mocking the original `gen_handler`. All of the `jsonrpsee`
// specific logic should be merged back to `gen_handler` down the road.
fn gen_rpc_module<TBl, TBackend, TCl, TExPool>(
_deny_unsafe: DenyUnsafe,
deny_unsafe: DenyUnsafe,
spawn_handle: SpawnTaskHandle,
client: Arc<TCl>,
on_demand: Option<Arc<OnDemand<TBl>>>,
Expand Down Expand Up @@ -690,9 +690,6 @@ where
{
const UNIQUE_METHOD_NAMES_PROOF: &str = "Method names are unique; qed";

// TODO(niklasad1): fix CORS.
let deny_unsafe = DenyUnsafe::No;

let system_info = sc_rpc::system::SystemInfo {
chain_name: config.chain_spec.name().into(),
impl_name: config.impl_name.clone(),
Expand Down
3 changes: 2 additions & 1 deletion client/sync-state-rpc/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@ targets = ["x86_64-unknown-linux-gnu"]
[dependencies]
thiserror = "1.0.21"
anyhow = "1"
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["server"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["server"] }
log = "0.4"

sc-chain-spec = { version = "4.0.0-dev", path = "../chain-spec" }
sc-client-api = { version = "4.0.0-dev", path = "../api" }
Expand Down
3 changes: 2 additions & 1 deletion frame/contracts/rpc/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,8 @@ targets = ["x86_64-unknown-linux-gnu"]

[dependencies]
codec = { package = "parity-scale-codec", version = "2" }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["server"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["server"] }
log = "0.4"
serde = { version = "1", features = ["derive"] }
serde_json = "1"

Expand Down
3 changes: 2 additions & 1 deletion frame/merkle-mountain-range/rpc/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,10 @@ targets = ["x86_64-unknown-linux-gnu"]

[dependencies]
codec = { package = "parity-scale-codec", version = "2.0.0" }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["server"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["server"] }
serde_json = "1"
serde = { version = "1.0.126", features = ["derive"] }
log = "0.4"
Copy link
Contributor

@dvdplm dvdplm Sep 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah so this is what you meant by the issue on log? Yeah this is a bit awkward. :/

Copy link
Contributor Author

@niklasad1 niklasad1 Sep 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah :)


sp-api = { version = "4.0.0-dev", path = "../../../primitives/api" }
sp-blockchain = { version = "4.0.0-dev", path = "../../../primitives/blockchain" }
Expand Down
4 changes: 3 additions & 1 deletion frame/transaction-payment/rpc/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,11 @@ readme = "README.md"
targets = ["x86_64-unknown-linux-gnu"]

[dependencies]
anyhow = "1"
codec = { package = "parity-scale-codec", version = "2.0.0" }

jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "master", features = ["server"] }
jsonrpsee = { git = "https://github.com/paritytech/jsonrpsee", branch = "na-http-server-export-acl", features = ["server"] }
log = "0.4"

sp-api = { version = "4.0.0-dev", path = "../../../primitives/api" }
sp-blockchain = { version = "4.0.0-dev", path = "../../../primitives/blockchain" }
Expand Down
Loading