aboutsummaryrefslogtreecommitdiffstats
path: root/node/config.go
diff options
context:
space:
mode:
authorMartin Holst Swende <martin@swende.se>2018-02-12 20:52:07 +0800
committerPéter Szilágyi <peterke@gmail.com>2018-02-12 20:52:07 +0800
commit589b603a9b1e17930d1e83ca64ce7cdc4c3d5c85 (patch)
treec1993266024190bd6789a471f5957b9dfa6f4dbc /node/config.go
parent9123eceb0f78f69e88d909a56ad7fadb75570198 (diff)
downloaddexon-589b603a9b1e17930d1e83ca64ce7cdc4c3d5c85.tar.gz
dexon-589b603a9b1e17930d1e83ca64ce7cdc4c3d5c85.tar.zst
dexon-589b603a9b1e17930d1e83ca64ce7cdc4c3d5c85.zip
rpc: dns rebind protection (#15962)
* cmd,node,rpc: add allowedHosts to prevent dns rebinding attacks * p2p,node: Fix bug with dumpconfig introduced in r54aeb8e4c0bb9f0e7a6c67258af67df3b266af3d * rpc: add wildcard support for rpcallowedhosts + go fmt * cmd/geth, cmd/utils, node, rpc: ignore direct ip(v4/6) addresses in rpc virtual hostnames check * http, rpc, utils: make vhosts into map, address review concerns * node: change log messages to use geth standard (not sprintf) * rpc: fix spelling
Diffstat (limited to 'node/config.go')
-rw-r--r--node/config.go11
1 files changed, 10 insertions, 1 deletions
diff --git a/node/config.go b/node/config.go
index 7a0c1688e..dda24583e 100644
--- a/node/config.go
+++ b/node/config.go
@@ -105,6 +105,15 @@ type Config struct {
// useless for custom HTTP clients.
HTTPCors []string `toml:",omitempty"`
+ // HTTPVirtualHosts is the list of virtual hostnames which are allowed on incoming requests.
+ // This is by default {'localhost'}. Using this prevents attacks like
+ // DNS rebinding, which bypasses SOP by simply masquerading as being within the same
+ // origin. These attacks do not utilize CORS, since they are not cross-domain.
+ // By explicitly checking the Host-header, the server will not allow requests
+ // made against the server with a malicious host domain.
+ // Requests using ip address directly are not affected
+ HTTPVirtualHosts []string `toml:",omitempty"`
+
// HTTPModules is a list of API modules to expose via the HTTP RPC interface.
// If the module list is empty, all RPC API endpoints designated public will be
// exposed.
@@ -137,7 +146,7 @@ type Config struct {
WSExposeAll bool `toml:",omitempty"`
// Logger is a custom logger to use with the p2p.Server.
- Logger log.Logger
+ Logger log.Logger `toml:",omitempty"`
}
// IPCEndpoint resolves an IPC endpoint based on a configured value, taking into