READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server440 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

8,844 bytes · SHA-256 66a2b273c3f2f557… · View upstream ↗

1#!/usr/bin/env python3
2# Copyright (c) 2014-present The Bitcoin Core developers
3# Distributed under the MIT software license, see the accompanying
4# file COPYING or http://www.opensource.org/licenses/mit-license.php.
5"""Test running bitcoind with the -rpcbind and -rpcallowip options."""
6
7from test_framework.netutil import NETWORK_ERRORS, all_interfaces, addr_to_hex, get_bind_addrs, test_ipv6_local
8from test_framework.test_framework import BitcoinTestFramework, SkipTest
9from test_framework.test_node import ErrorMatch
10from test_framework.util import assert_equal, rpc_port
11
12class RPCBindTest(BitcoinTestFramework):
13    def set_test_params(self):
14        self.setup_clean_chain = True
15        self.bind_to_localhost_only = False
16        self.num_nodes = 1
17
18    def skip_test_if_missing_module(self):
19        self.skip_if_platform_not_posix()
20        self.skip_if_no_lsof_on_nonlinux()
21
22    def setup_network(self):
23        self.add_nodes(self.num_nodes, None)
24
25    def add_options(self, parser):
26        parser.add_argument("--ipv4", action='store_true', dest="run_ipv4", help="Run ipv4 tests only", default=False)
27        parser.add_argument("--ipv6", action='store_true', dest="run_ipv6", help="Run ipv6 tests only", default=False)
28        parser.add_argument("--nonloopback", action='store_true', dest="run_nonloopback", help="Run non-loopback tests only", default=False)
29
30    def run_bind_test(self, allow_ips, connect_to, addresses, expected):
31        '''
32        Start a node with requested rpcallowip and rpcbind parameters,
33        then try to connect, and check if the set of bound addresses
34        matches the expected set.
35        '''
36        self.log.info("Bind test for %s" % str(addresses))
37        expected = [(addr_to_hex(addr), port) for (addr, port) in expected]
38        base_args = ['-disablewallet', '-nolisten']
39        if allow_ips:
40            base_args += ['-rpcallowip=' + x for x in allow_ips]
41        binds = ['-rpcbind='+addr for addr in addresses]
42        self.nodes[0].rpchost = connect_to
43        self.start_node(0, base_args + binds)
44        pid = self.nodes[0].process.pid
45        assert_equal(set(get_bind_addrs(pid)), set(expected))
46        self.stop_nodes()
47
48    def run_invalid_bind_test(self, allow_ips, addresses):
49        '''
50        Attempt to start a node with requested rpcallowip and rpcbind
51        parameters, expecting that the node will fail.
52        '''
53        self.log.info(f'Invalid bind test for {addresses}')
54        base_args = ['-disablewallet', '-nolisten']
55        if allow_ips:
56            base_args += ['-rpcallowip=' + x for x in allow_ips]
57        init_error = 'Error: Invalid port specified in -rpcbind: '
58        for addr in addresses:
59            self.nodes[0].assert_start_raises_init_error(base_args + [f'-rpcbind={addr}'], init_error + f"'{addr}'")
60
61    def run_allowip_test(self, allow_ips, rpchost, rpcport):
62        '''
63        Start a node with rpcallow IP, and request getnetworkinfo
64        at a non-localhost IP.
65        '''
66        success = True
67        self.log.info("Allow IP test for %s:%d" % (rpchost, rpcport))
68        node_args = \
69            ['-disablewallet', '-nolisten'] + \
70            ['-rpcallowip='+x for x in allow_ips] + \
71            ['-rpcbind='+addr for addr in ['127.0.0.1', "%s:%d" % (rpchost, rpcport)]] # Bind to localhost as well so start_nodes doesn't hang
72        self.nodes[0].rpchost = None
73        self.start_nodes([node_args])
74        self.nodes[0].rpchost = f"{rpchost}:{rpcport}"
75        # connect to node through non-loopback interface
76        node = self.nodes[0].create_new_rpc_connection()
77        try:
78            node.getnetworkinfo()
79        except NETWORK_ERRORS:
80            success = False
81        self.stop_nodes()
82        return success
83
84    def run_invalid_allowip_test(self):
85        '''
86        Check parameter interaction with -rpcallowip and -cjdnsreachable.
87        RFC4193 addresses are fc00::/7 like CJDNS but have an optional
88        "local" L bit making them fd00:: which should always be OK.
89        '''
90        self.log.info("Allow RFC4193 when compatible with CJDNS options")
91        # Don't rpcallow RFC4193 with L-bit=0 if CJDNS is enabled
92        self.nodes[0].assert_start_raises_init_error(
93            ["-rpcallowip=fc00:db8:c0:ff:ee::/80","-cjdnsreachable"],
94            "Invalid -rpcallowip subnet specification",
95            match=ErrorMatch.PARTIAL_REGEX)
96        # OK to rpcallow RFC4193 with L-bit=1 if CJDNS is enabled
97        self.start_node(0, ["-rpcallowip=fd00:db8:c0:ff:ee::/80","-cjdnsreachable"])
98        self.stop_nodes()
99        # OK to rpcallow RFC4193 with L-bit=0 if CJDNS is not enabled
100        self.start_node(0, ["-rpcallowip=fc00:db8:c0:ff:ee::/80"])
101        self.stop_nodes()
102
103    def run_test(self):
104        if sum([self.options.run_ipv4, self.options.run_ipv6, self.options.run_nonloopback]) > 1:
105            raise AssertionError("Only one of --ipv4, --ipv6 and --nonloopback can be set")
106
107        self.log.info("Check for ipv6")
108        have_ipv6 = test_ipv6_local()
109        if not have_ipv6 and not (self.options.run_ipv4 or self.options.run_nonloopback):
110            raise SkipTest("This test requires ipv6 support.")
111
112        self.log.info("Check for non-loopback interface")
113        interfaces = all_interfaces()
114        if not interfaces:
115            raise AssertionError("all_interfaces() returned no IPv4 interfaces")
116        self.non_loopback_ip = None
117        for name,ip in interfaces:
118            if not ip.startswith('127.'):
119                self.non_loopback_ip = ip
120                break
121        if self.non_loopback_ip is None and self.options.run_nonloopback:
122            raise SkipTest("This test requires a non-loopback ip address.")
123
124        self.defaultport = rpc_port(0)
125
126        if not self.options.run_nonloopback:
127            self._run_loopback_tests()
128            if self.options.run_ipv4:
129                self.run_invalid_bind_test(['127.0.0.1'], ['127.0.0.1:notaport', '127.0.0.1:-18443', '127.0.0.1:0', '127.0.0.1:65536'])
130            if self.options.run_ipv6:
131                self.run_invalid_bind_test(['[::1]'], ['[::1]:notaport', '[::1]:-18443', '[::1]:0', '[::1]:65536'])
132                self.run_invalid_allowip_test()
133        if not self.options.run_ipv4 and not self.options.run_ipv6:
134            if self.non_loopback_ip:
135                self._run_nonloopback_tests()
136            else:
137                self.log.info('Non-loopback IP address not found, skipping non-loopback tests')
138
139    def _run_loopback_tests(self):
140        if self.options.run_ipv4:
141            # check only IPv4 localhost (explicit)
142            self.run_bind_test(['127.0.0.1'], '127.0.0.1', ['127.0.0.1'],
143                [('127.0.0.1', self.defaultport)])
144            # check only IPv4 localhost (explicit) with alternative port
145            self.run_bind_test(['127.0.0.1'], '127.0.0.1:32171', ['127.0.0.1:32171'],
146                [('127.0.0.1', 32171)])
147            # check only IPv4 localhost (explicit) with multiple alternative ports on same host
148            self.run_bind_test(['127.0.0.1'], '127.0.0.1:32171', ['127.0.0.1:32171', '127.0.0.1:32172'],
149                [('127.0.0.1', 32171), ('127.0.0.1', 32172)])
150        else:
151            # check default without rpcallowip (IPv4 and IPv6 localhost)
152            self.run_bind_test(None, '127.0.0.1', [],
153                [('127.0.0.1', self.defaultport), ('::1', self.defaultport)])
154            # check default with rpcallowip (IPv4 and IPv6 localhost)
155            self.run_bind_test(['127.0.0.1'], '127.0.0.1', [],
156                [('127.0.0.1', self.defaultport), ('::1', self.defaultport)])
157            # check only IPv6 localhost (explicit)
158            self.run_bind_test(['[::1]'], '[::1]', ['[::1]'],
159                [('::1', self.defaultport)])
160            # check both IPv4 and IPv6 localhost (explicit)
161            self.run_bind_test(['127.0.0.1'], '127.0.0.1', ['127.0.0.1', '[::1]'],
162                [('127.0.0.1', self.defaultport), ('::1', self.defaultport)])
163
164    def _run_nonloopback_tests(self):
165        self.log.info("Using interface %s for testing" % self.non_loopback_ip)
166
167        # check only non-loopback interface
168        self.run_bind_test([self.non_loopback_ip], self.non_loopback_ip, [self.non_loopback_ip],
169            [(self.non_loopback_ip, self.defaultport)])
170
171        # Check that connections from allowed IPs are allowed
172        assert self.run_allowip_test([self.non_loopback_ip], self.non_loopback_ip, self.defaultport)
173        # Otherwise we are denied
174        if self.options.usecli:
175            self.log.info("Skip negative IP test with CLI, because the CLI can not throw the tested exception type")
176            return
177        assert not self.run_allowip_test(['1.1.1.1'], self.non_loopback_ip, self.defaultport)
178
179if __name__ == '__main__':
180    RPCBindTest(__file__).main()
181

src/wallet/receive.cpp

src/wallet/coinselection.cpp

src/consensus/validation.h

src/primitives/transaction.cpp

src/script/descriptor.cpp

src/bitcoin-cli.cpp

src/rpc/blockchain.cpp

src/rpc/rawtransaction.cpp

src/init.cpp

src/crypto/sha256.cpp

src/consensus/merkle.h

src/consensus/tx_check.h

src/consensus/tx_verify.h

src/policy/feerate.h

src/policy/feerate.cpp

src/primitives/transaction_identifier.h

src/chainparamsbase.h

src/chainparamsbase.cpp

src/util/moneystr.cpp

src/crypto/ripemd160.h

src/crypto/sha1.h

src/crypto/sha512.h

src/crypto/hmac_sha256.h

src/crypto/hmac_sha512.h

src/crypto/hmac_sha256.cpp

src/crypto/hmac_sha512.cpp

src/crypto/hkdf_sha256_32.h

src/crypto/hkdf_sha256_32.cpp

src/support/cleanse.h

src/support/cleanse.cpp

src/crypto/siphash.cpp

src/crypto/muhash.h

src/crypto/chacha20.h

src/crypto/poly1305.h

src/crypto/chacha20poly1305.h

src/crypto/chacha20poly1305.cpp

src/util/chaintype.cpp

src/util/obfuscation.h

src/util/byte_units.h

src/util/overflow.h

src/blockencodings.cpp

src/net_permissions.cpp

src/policy/packages.cpp

src/policy/rbf.cpp

src/policy/truc_policy.cpp

src/policy/ephemeral_policy.cpp

src/policy/settings.cpp

src/policy/policy.cpp

src/node/transaction.cpp

src/node/coin.cpp

src/rpc/client.cpp

src/rpc/external_signer.cpp

src/rpc/request.cpp

src/rpc/server_util.cpp

src/rpc/fees.cpp

src/rpc/output_script.cpp

src/rpc/rawtransaction_util.cpp

src/rpc/rawtransaction_util.h

src/rpc/register.h

src/rpc/request.h

src/rpc/server_util.h

src/rpc/protocol.h

src/rpc/server.h

src/rpc/signmessage.cpp

src/rpc/txoutproof.cpp

src/rpc/util.cpp

src/rpc/util.h

src/wallet/rpc/addresses.cpp

src/wallet/rpc/backup.cpp

src/wallet/rpc/coins.cpp

src/wallet/rpc/encrypt.cpp

src/wallet/rpc/signmessage.cpp

src/wallet/rpc/util.cpp

src/wallet/rpc/util.h

src/wallet/coincontrol.cpp

src/wallet/coincontrol.h

src/wallet/context.cpp

src/wallet/context.h

src/wallet/crypter.cpp

src/wallet/crypter.h

src/wallet/db.cpp

src/wallet/export.cpp

src/wallet/external_signer_scriptpubkeyman.cpp

src/wallet/rpc/spend.cpp

src/wallet/rpc/transactions.cpp

src/wallet/rpc/wallet.cpp

src/wallet/feebumper.cpp

src/wallet/feebumper.h

src/index/base.h

src/index/base.cpp

src/index/txindex.h

src/index/txindex.cpp

src/index/txindex_key.h

src/index/txospenderindex.h

src/index/txospenderindex.cpp

src/index/blockfilterindex.h

src/index/blockfilterindex.cpp

src/index/coinstatsindex.h

src/index/coinstatsindex.cpp

src/index/db_key.h

src/index/disktxpos.h

src/kernel/chain.cpp

src/kernel/chain.h

src/kernel/checks.cpp

src/kernel/checks.h

src/kernel/context.cpp

src/kernel/context.h

src/kernel/cs_main.cpp

src/kernel/cs_main.h

src/kernel/disconnected_transactions.cpp

src/kernel/disconnected_transactions.h

src/kernel/mempool_removal_reason.cpp

src/kernel/mempool_removal_reason.h

src/kernel/coinstats.cpp

src/kernel/coinstats.h

src/kernel/chainparams.cpp

src/kernel/chainparams.h

src/wallet/sqlite.cpp

src/wallet/sqlite.h

src/wallet/transaction.cpp

src/wallet/transaction.h

src/wallet/dump.cpp

src/wallet/dump.h

src/wallet/init.cpp

src/wallet/walletutil.cpp

src/wallet/walletutil.h

src/wallet/wallettool.cpp

src/wallet/wallettool.h

src/wallet/export.h

src/wallet/migrate.cpp

src/wallet/migrate.h

src/wallet/db.h

src/wallet/walletdb.cpp

src/wallet/interfaces.cpp

src/wallet/scriptpubkeyman.cpp

src/wallet/scriptpubkeyman.h

src/kernel/bitcoinkernel.cpp

src/kernel/bitcoinkernel.h

src/kernel/bitcoinkernel_wrapper.h

src/node/chainstate.cpp

src/node/chainstate.h

src/node/blockstorage.cpp

src/node/blockstorage.h

src/node/mempool_persist.cpp

src/node/mempool_persist.h

src/node/utxo_snapshot.cpp

src/node/utxo_snapshot.h

src/node/kernel_notifications.cpp

src/node/kernel_notifications.h

src/node/blockmanager_args.cpp

src/kernel/blockmanager_opts.h

src/util/expected.cpp

src/policy/settings.h

src/util/types.h

src/kernel/messagestartchars.h

src/kernel/warning.h

src/util/exception.h

src/common/license_info.h

src/node/coins_view_args.h

src/node/database_args.h

src/util/batchpriority.h

src/util/ui_change_type.h

src/node/coins_view_args.cpp

src/node/peerman_args.h

src/util/serfloat.h

src/node/blockmanager_args.h

src/node/database_args.cpp

src/util/overloaded.h

src/interfaces/types.h

src/node/chainstatemanager_args.h

src/node/minisketchwrapper.h

src/util/macros.h

src/util/syserror.h

src/common/run_command.h

src/util/bytevectorhash.cpp

src/node/mempool_persist_args.cpp

src/util/exec.h

src/util/rbf.h

src/crypto/hex_base.h

src/node/mempool_persist_args.h

src/interfaces/echo.h

src/util/any.h

src/util/batchpriority.cpp

src/util/threadnames.h

src/node/coin.h

src/node/mempool_args.h

src/util/asmap.h

src/util/bytevectorhash.h

src/node/context.cpp

src/util/insert.h

src/util/readwritefile.h

src/node/peerman_args.cpp

src/node/interface_ui.cpp

src/interfaces/handler.h

src/node/mining_args.h

src/util/hasher.cpp

src/common/init.h

src/kernel/mempool_limits.h

src/common/system.h

src/crypto/sha3.h

src/util/threadinterrupt.cpp

src/node/protocol_version.h

src/util/exception.cpp

src/common/messages.h

src/node/connection_types.cpp

src/util/bip32.h

src/common/license_info.cpp

src/util/stdmutex.h

src/common/run_command.cpp

src/util/check.cpp

src/util/golombrice.h

src/node/types.h

src/node/timeoffsets.h

src/util/readwritefile.cpp

src/util/fastrange.h

src/util/signalinterrupt.h

src/util/task_runner.h

src/util/syserror.cpp

src/common/interfaces.cpp

src/common/types.h

src/util/threadinterrupt.h

src/kernel/chainstatemanager_opts.h

src/node/psbt.h

src/policy/ephemeral_policy.h

src/util/trace.h

src/common/url.cpp

src/kernel/mempool_options.h

src/util/serfloat.cpp

src/kernel/notifications_interface.h

src/node/timeoffsets.cpp

src/node/warnings.cpp

src/util/hash_type.h

src/crypto/hex_base.cpp

src/node/eviction.h

src/util/tokenbucket.h

src/crypto/aes.h

src/common/pcp.h

src/util/feefrac.cpp

src/node/transaction.h

src/util/threadnames.cpp

src/common/signmessage.h

src/util/exec.cpp

src/util/signalinterrupt.cpp

src/clientversion.cpp

src/common/signmessage.cpp

src/compat/assumptions.h

src/compat/byteswap.h

src/deploymentinfo.cpp

src/deploymentinfo.h

src/deploymentstatus.cpp

src/deploymentstatus.h

src/dummywallet.cpp

src/external_signer.h

src/init/bitcoin-gui.cpp

src/init/bitcoin-node.cpp

src/init/bitcoin-qt.cpp

src/init/bitcoin-wallet.cpp

src/init/bitcoind.cpp

src/init/common.h

src/interfaces/init.h

src/interfaces/ipc.h

src/key_io.h

src/logging/categories.h

src/logging/timer.h

src/mapport.h

src/musig.h

src/net_permissions.h

src/netgroup.h

src/netmessagemaker.h

src/node/chainstatemanager_args.cpp

src/node/connection_types.h

src/node/context.h

src/node/interface_ui.h

src/node/mempool_args.cpp

src/node/mining_args.cpp

src/node/minisketchwrapper.cpp

src/node/txreconciliation.h

src/policy/fees/estimator_args.cpp

src/policy/fees/estimator_args.h

src/policy/fees/estimator_man.cpp

src/policy/fees/estimator_man.h

src/policy/packages.h

src/policy/rbf.h

src/policy/truc_policy.h

src/pow.h

src/primitives/block.cpp

src/randomenv.h

src/rest.h

src/script/keyorigin.h

src/script/parsing.cpp

src/script/parsing.h

src/script/script_error.h

src/script/sigcache.cpp

src/script/sigcache.h

src/script/solver.h

src/script/verify_flags.h

src/semaphore_grant.h

src/signet.h

src/span.h

src/support/allocators/secure.h

src/support/allocators/zeroafterfree.h

src/util/tokenpipe.cpp

src/util/translation.h

src/util/vector.h

src/versionbits.h

src/versionbits_impl.h

src/wallet/external_signer_scriptpubkeyman.h

src/wallet/fees.h

src/wallet/load.h

src/wallet/receive.h

src/wallet/rpc/wallet.h

src/wallet/types.h

src/walletinitinterface.h

src/zmq/zmqabstractnotifier.cpp

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.