DragonX/ObsidianDragon
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

fix(rpc): refuse plaintext-remote RPC by default and tighten isLocalHost

Browse Source 
F8 (security). Two related fixes to how the wallet decides whether an RPC target is
safe to send Basic-auth credentials to:

- isLocalHost() was matching any host that merely *starts* "127." via
  rfind("127.",0)==0, so "127.evil.com" (and "127.0.0.1.attacker", "127.300.0.1",
  "1270.0.0.1") were misclassified as loopback and treated as local. It now uses a
  strict isExactIPv4Loopback() parser: exactly four 0-255 dot-separated octets with
  the first == 127. localhost / ::1 / [::1] handling is unchanged.

- A remote rpchost over plain HTTP (no rpctls=1) previously only produced a
  dismissible warning and then sent rpcuser:rpcpassword in cleartext, where a
  local-network MITM could capture them. tryConnect() now REFUSES that connection
  (clear status line + one-time notification, no creds sent) unless the user opts in
  explicitly with rpcallowplaintext=1 in DRAGONX.conf (new
  ConnectionConfig::allow_plaintext_remote, parsed in parseConfFile; policy in the
  new allowsPlaintextRemote()). Local/embedded daemons and rpctls=1 remotes are
  unaffected.

BREAKING: a wallet configured for remote plaintext RPC will stop connecting until
rpcallowplaintext=1 (or rpctls=1) is added to DRAGONX.conf. Must be called out in the
release notes. The Settings-toggle UI is deferred (the conf-key opt-in is the recovery
path; see docs/daemon-startup-hardening.md).

Adds testIsLocalHost and testAllowsPlaintextRemote to test_phase4.cpp; one i18n key
(English) added to i18n.cpp.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
DanS
2026-08-02 11:40:35 -05:00
parent eb69e491b9
commit efb271cb9a
6 changed files with 126 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/app_network.cpp
View File

@@ -321,11 +321,21 @@ void App::tryConnect()
VERBOSE_LOGF("[connect #%d] Connecting to %s:%s (user=%s)\n",
connect_attempt, config.host.c_str(), config.port.c_str(), config.rpcuser.c_str());
if (rpc::Connection::usesPlaintextRemote(config) && !remote_rpc_plaintext_warning_shown_) {
remote_rpc_plaintext_warning_shown_ = true;
ui::Notifications::instance().warning(
"Remote RPC is using plaintext HTTP. Add rpctls=1 to DRAGONX.conf if your daemon supports TLS.",
10.0f);
if (rpc::Connection::usesPlaintextRemote(config) &&
!rpc::Connection::allowsPlaintextRemote(config)) {
// Refuse to send Basic-auth credentials in cleartext to a remote host — a local-network
// MITM would otherwise capture rpcuser:rpcpassword. This is a deliberate behaviour change
// from the old warn-and-proceed: opt in explicitly with rpcallowplaintext=1 in
// DRAGONX.conf (or enable TLS with rpctls=1) if the plaintext link is intended.
connection_in_progress_ = false;
connection_status_ = TR("sb_plaintext_remote_blocked");
if (!remote_rpc_plaintext_warning_shown_) {
remote_rpc_plaintext_warning_shown_ = true;
ui::Notifications::instance().warning(TR("sb_plaintext_remote_blocked"), 20.0f);
}
VERBOSE_LOGF("[connect #%d] refusing plaintext-remote RPC to %s:%s (set rpcallowplaintext=1 to override)\n",
connect_attempt, config.host.c_str(), config.port.c_str());
return;
}
// Run the blocking rpc_->connect() on the worker thread so the UI