RPC: Require HTTP basic authentication, like bitcoind. Add 'help' RPC.

Jeff Garzik · Jeff Garzik · commit 8513efe7f9fd · 2012-08-05T11:46:25.000-04:00
diff --git a/README b/README
@@ -7,7 +7,9 @@ In its current form, node.py does nothing more than listen for new
 transactions and blocks, perform some simple verification checks on
 the data, and store them in a database.  It does not handle script
 verification or chain reorg, and is therefore not safe for general use.
-See BUGS and TODO files.
+See BUGS and TODO files.  A simple HTTP server for JSON-RPC API calls
+is also included.  Send the "help" RPC call for a list of supported
+commands.
 
 It might be useful as the base for a P2P monitoring node, or similar
 tasks.
@@ -24,8 +26,12 @@ The configuration file is a key=value text file, with the following settings:
 	# port of network node to connect to (default: 8333)
 	port=8333
 
-	# Incoming (listen) port, for JSON-RPC requests (default: 9332)
-	port=9332
+	# JSON-RPC server user, password.  Uses HTTP Basic authentication.
+	rpcuser=XXXX
+	rpcpass=YYYY
+
+	# JSON-RPC server incoming TCP port (default: 9332)
+	rpcport=9332
 
 	# database directory
 	db=/tmp/chaindb
diff --git a/node.py b/node.py
@@ -17,6 +17,8 @@
 import cStringIO
 import copy
 import json
+import re
+import base64
 from Crypto.Hash import SHA256
 
 import ChainDb
@@ -435,6 +437,13 @@ def __init__(self, mempool, chaindb):
 		self.mempool = mempool
 		self.chaindb = chaindb
 
+	def help(self, params):
+		l = []
+		l.append("Available RPC calls:")
+		l.append("getrawmempool - list mempool contents")
+		l.append("getinfo - misc. node info")
+		return (l, None)
+
 	def getrawmempool(self, params):
 		l = []
 		for k in self.mempool.pool.iterkeys():
@@ -458,11 +467,42 @@ def __init__(self, conn, addr, server, privdata):
 	def do_GET(self):
 		self.send_error(501, "Unsupported method (%s)" %self.command)
 	
+	def check_auth(self):
+		hdr = self.headers.getheader('authorization')
+		if hdr is None:
+			return None
+
+		m = re.search('\s*(\w+)\s+(\S+)', hdr)
+		if m is None or m.group(0) is None:
+			return None
+		if m.group(1) != 'Basic':
+			return None
+
+		unpw = base64.b64decode(m.group(2))
+		if unpw is None:
+			return None
+
+		m = re.search('^([^:]+):(.*)$', unpw)
+		if m is None:
+			return None
+
+		un = m.group(1)
+		pw = m.group(2)
+		if (un != settings['rpcuser'] or
+		    pw != settings['rpcpass']):
+			return None
+
+		return un
+
 	def handle_data(self):
 		if self.path != '/':
 			self.send_error(404, "Path not found")
 			return
-		print "BODY", type(self.body), self.body
+		username = self.check_auth()
+		if username is None:
+			self.send_error(401, "Forbidden")
+			return
+
 		try:
 			rpcreq = json.loads(self.body)
 		except ValueError:
@@ -508,6 +548,8 @@ def jsonrpc(self, method, params):
 			return self.rpc.getrawmempool(params)
 		elif method == 'getinfo':
 			return self.rpc.getinfo(params)
+		elif method == 'help':
+			return self.rpc.help(params)
 		return (None, {"code":-32601, "message":"method not found"})
 
 if __name__ == '__main__':
@@ -537,6 +579,11 @@ def jsonrpc(self, method, params):
 	if 'log' not in settings or (settings['log'] == '-'):
 		settings['log'] = None
 
+	if ('rpcuser' not in settings or
+	    'rpcpass' not in settings):
+		print "You must set the following in config: rpcuser, rpcpass"
+		sys.exit(1)
+
 	settings['port'] = int(settings['port'])
 	settings['rpcport'] = int(settings['rpcport'])
 
