Inside Bitcoin

501            f"Basic {str_to_b64str('nocolon')}",
502            "Basic ",
503        ]
504        for auth_value in cases:
505            conn = BitcoinHTTPConnection(self.node)
506            conn.headers = {"Authorization": f"{auth_value}"}
507            response = conn.post('/', '{"method": "getbestblockhash"}')
508            assert_equal(response.status, http.client.UNAUTHORIZED)
509            assert response.getheader('WWW-Authenticate') is not None
510
511
512    def check_disallowed_http_methods(self):
513        self.log.info("Check that unsafe or unsupported HTTP methods are rejected")
514        for method, err in [
515            ['TRACE',   http.client.METHOD_NOT_ALLOWED],
516            ['CONNECT', http.client.METHOD_NOT_ALLOWED],
517            ['DELETE',  http.client.METHOD_NOT_ALLOWED],
518            ['PATCH',   http.client.METHOD_NOT_ALLOWED],
519            ['OPTIONS', http.client.METHOD_NOT_ALLOWED],
520            ['GET',     http.client.METHOD_NOT_ALLOWED] # RPC endpoint '/' only handles POST
521        ]:
522            conn = BitcoinHTTPConnection(self.node)
523            response = conn._request(method, '/', data=None, connection_header=None)
524            assert_equal(response.status, err)
525
526
527    def check_path_traversal(self):
528        self.log.info("Check that path traversal attempts are safely rejected")
529        traversal_paths = [
530            '/../etc/passwd',
531            '/../../etc/shadow',
532            '/%2e%2e/%2e%2e/etc/passwd',     # URL-encoded dots
533            '/..%2Fetc%2Fpasswd',            # URL-encoded slash
534            '/.%2e/.%2e/etc/passwd',         # mixed encoding
535            '/valid/../../../etc/passwd',
536        ]
537        for path in traversal_paths:
538            conn = BitcoinHTTPConnection(self.node)
539            response = conn.get(path)
540            assert_equal(response.status, http.client.NOT_FOUND)
541
542
543    def check_request_smuggling_cl_te(self):
544        self.log.info("Check request smuggling is not possible")
545        # https://www.rfc-editor.org/rfc/rfc7230#section-3.3.3
546        # Transfer-Encoding takes precedence over Content-Length.
547        # Sending both creates a smuggling vector: a front-end proxy that
548        # uses Content-Length while the back-end uses Transfer-Encoding lets an
549        # attacker prepend arbitrary bytes to the next victim's request.
550
551        # The real JSON-RPC body sent as a single chunk.
552        body = b'{"method":"getblockcount"}'
553        # Content-Length is set to the length of just the chunk-size line
554        # ("1a\r\n" = 4 bytes), not the full chunked body — the ambiguity that
555        # smuggling exploits. A server using Transfer-Encoding reads the complete
556        # chunk and responds with the block count; a server confused by the
557        # mismatch may stall, close the connection, or return an error.
558        chunk_size_line = f"{len(body):x}\r\n".encode("ascii")
559        # Signals end of body
560        empty_chunk = b'\r\n0\r\n\r\n'
561        chunk_body = chunk_size_line + body + empty_chunk
562
563        conn = BitcoinHTTPConnection(self.node)
564        raw = (
565            f"POST / HTTP/1.1\r\n"
566            f"Host: {conn.url.hostname}\r\n"
567            f"Authorization: Basic {str_to_b64str(conn.authpair)}\r\n"
568            f"Content-Length: {len(chunk_size_line)}\r\n"
569            f"Transfer-Encoding: chunked\r\n"
570            f"\r\n"
571        ).encode("ascii") + chunk_body
572        conn.send_raw(raw)
573        response = conn.recv_raw().decode()
574        assert "HTTP/1.1 200 OK" in response
575        count = self.node.getblockcount()
576        assert f'"result":{count}' in response
577
578
579    def check_duplicate_content_length(self):
580        self.log.info("Check that duplicate Content-Length headers are handled")
581        # https://www.rfc-editor.org/rfc/rfc7230#section-3.3.3
582        # Multiple Content-Length headers with differing values "MUST"
583        # result in an error.
584        conn = BitcoinHTTPConnection(self.node)
585        body = '{"method":"getblockcount"}'
586        raw = (
587            f"POST / HTTP/1.1\r\n"
588            f"Host: {conn.url.hostname}\r\n"
589            f"Authorization: Basic {str_to_b64str(conn.authpair)}\r\n"
590            f"Content-Length: {len(body)}\r\n"
591            f"Content-Length: 999\r\n"
592            f"\r\n"
593            f"{body}"
594        ).encode("ascii")
595        conn.send_raw(raw)
596        response = conn.recv_raw().decode()
597        assert response.startswith("HTTP/1.1 400")
598
599
600    def check_null_byte_in_uri(self):
601        self.log.info("Check that null bytes in the URI are safely rejected")
602        # Null-byte injection can truncate the path string in C environments,
603        # bypassing suffix/extension checks and causing unexpected file access.
604        conn = BitcoinHTTPConnection(self.node)
605        raw = (
606            "GET /safe\x00/../etc/passwd HTTP/1.1\r\n"
607            f"Host: {conn.url.hostname}\r\n"
608            f"Authorization: Basic {str_to_b64str(conn.authpair)}\r\n"
609            "\r\n"
610        ).encode("ascii")
611        conn.send_raw(raw)
612        response = conn.recv_raw().decode()
613        assert response.startswith("HTTP/1.1 400")
614
615
616    def check_invalid_http_version(self):
617        self.log.info("Check that requests with invalid HTTP versions are safely rejected")
618        cases = [
619            b"GET / \r\n\r\n",                                    # HTTP/0.9 — no version
620            b"GET / HTTP/9.9\r\nHost: localhost\r\n\r\n",         # far-future version
621            b"GET / HTTP/INVALID\r\nHost: localhost\r\n\r\n",     # non-numeric version
622            b"GET / NOTHTTP/1.1\r\nHost: localhost\r\n\r\n",      # wrong protocol name
623        ]
624        for raw in cases:
625            conn = BitcoinHTTPConnection(self.node)
626            conn.send_raw(raw)
627            response = conn.recv_raw().decode()
628            assert response.startswith("HTTP/1.1 400")
629
630
631    def check_whitespace_in_headers(self):
632        self.log.info("Check that requests with whitespace in headers are rejected")
633        # Extra whitespace before colon in header.
634        conn = BitcoinHTTPConnection(self.node)
635        conn.headers = {"Authorization ": f"Basic {str_to_b64str(conn.authpair)}"}
636        self.send_bad_and_tolerate_disconnect(conn, lambda: conn.post('/', '{"method": "getbestblockhash"}'))
637
638        # Extra whitespace at start of new line.
639        # "line folding" as defined in
640        # https://www.rfc-editor.org/rfc/rfc2616#section-2.2
641        # is considered unsafe and is explicitly deprecated in
642        # https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
643        conn = BitcoinHTTPConnection(self.node)
644        conn.headers = {"Authorization": f"Basic \n {str_to_b64str(conn.authpair)}"}
645        self.send_bad_and_tolerate_disconnect(conn, lambda: conn.post('/', '{"method": "getbestblockhash"}'))
646
647
648    def check_connection_limit(self):
649        self.log.info("Check connection limits")
650
651        # Disable timeout so the initial batch of clients stays connected
652        # until the end of the test.
653        for comment,                  extra_args,                                      limit in [
654            ("default (16)",          ["-rpcservertimeout=0", "-rest"],                16),
655            ("-rpcmaxconnections=64", ["-rpcservertimeout=0", "-rest",
656                                       "-rpcmaxconnections=64", "-maxconnections=16"], 64)
657        ]:
658            self.log.info(f"Using connection limit: {comment}")
659            self.restart_node(0, extra_args=extra_args)
660
661            # Close the persistent HTTP connection to this node by replacing it with
662            # a new AuthServiceProxy, reducing HTTPServer::GetConnectionsCount() to 0.
663            # The new AuthServiceProxy won't actually open an HTTP connection until
664            # it needs to send an RPC (for example, to stop the node at the end of the test).
665            self.node._rpc = self.node.create_new_rpc_connection(mode="AUTHPROXY")
666
667            MAX_HTTP_CONNECTIONS = limit
668            connections = []
669
670            # Connections all succeed up to the limit
671            with self.node.assert_debug_log(
672                expected_msgs = [f"method=invalidrpc_{i} " for i in range(1, MAX_HTTP_CONNECTIONS + 1)]
673            ):
674                for i in range(1, MAX_HTTP_CONNECTIONS + 1):
675                    conn = BitcoinHTTPConnection(self.node)
676                    # Each client makes a unique request so it's easy to find in the log
677                    conn.post('/', f'{{"method": "invalidrpc_{i}"}}', connection_header='keep-alive').read()
678                    connections.append(conn)
679
680            # The next connection is over the limit, expect it to timeout
681            with self.node.assert_debug_log(
682                expected_msgs = [],
683                unexpected_msgs = ["method=never_accepted"]
684            ):
685                conn = BitcoinHTTPConnection(self.node)
686                conn.set_timeout(5)
687                assert_raises(TimeoutError, lambda: conn.post('/', '{"method": "never_accepted"}', connection_header='keep-alive').read())
688
689            # All original clients are still connected
690            assert_equal(len(connections), MAX_HTTP_CONNECTIONS)
691            for client in connections:
692                assert not client.sock_closed()
693
694            # Try connecting again, but this time we'll wait for acceptance.
695            # Because the send is blocking, we'll execute in a background thread.
696
697            def wait_for_send(conn):
698                return conn.get('/rest/blockhashbyheight/0.json').read()
699
700            conn = BitcoinHTTPConnection(self.node)
701            conn.set_timeout(None)
702            executor = concurrent.futures.ThreadPoolExecutor(max_workers=1)
703            waiting_request = executor.submit(
704                wait_for_send,
705                conn
706            )
707
708            # We are waiting
709            assert not waiting_request.done()
710
711            # Close one of the original connections
712            popped_client = connections.pop()
713            popped_client.close_sock()
714
715            # The waiting connection gets processed
716            delayed_response = waiting_request.result(timeout=5)
717            assert "0f9188f13cb7b2c71f2a335e3a4fc328bf5beb436012afca590b1a11466e2206" in delayed_response.decode()
718
719            # Close all remaining connections for clean up
720            for client in connections:
721                client.close_sock()
722
723
724    def check_pipelined_data_is_throttled(self):
725        self.log.info("Check that pipelined data is throttled while a request is in flight")
726        self.restart_node(0, extra_args=["-rpcservertimeout=0"])
727
728        conn = BitcoinHTTPConnection(self.node)
729
730        # A blocking RPC request: the server reads it fully and it enters the
731        # worker pool as "in flight" (m_req_busy) until a new block arrives.
732        tip_height = self.node.getblockcount()
733        conn.post_raw('/', f'{{"method": "waitforblockheight", "params": [{tip_height + 1}]}}')
734
735        # The server logs each successful socket read with the peer's address
736        # (our ephemeral port) and the connection id. The port uniquely
737        # identifies the flood connection's log lines.
738        local_port = conn.conn.sock.getsockname()[1]
739
740        # Flood the same connection with big pipelined requests:
741        # Large garbage submitblock (just under MAX_BODY_SIZE each, including HTTP/jsonrpc overhead)
742        garbage_block = "0" * (MAX_BODY_SIZE - 100)
743        body = f'{{"method": "submitblock", "params": ["{garbage_block}"]}}'
744        flood = (
745            f'POST / HTTP/1.1\r\nAuthorization: Basic {str_to_b64str(conn.authpair)}\r\n'
746            f'Content-Length: {len(body)}\r\n\r\n' +
747            body
748        ).encode("ascii")
749
750        # Save a debug log checkpoint