Commit Graph

13442 Commits

Author SHA1 Message Date
Howard Chu
c361303184
Silence miner debugmsg spam
Don't try to allocate the dataset repeatedly if it has already failed.
2019-12-09 15:59:52 +00:00
moneromooo-monero
d93e1dffa9
simplewallet: warn on refresh if refresh-from-block-height seems off 2019-12-09 14:09:39 +00:00
moneromooo-monero
a6a2ad6cac
simplewallet: set manual refresh mode in rescan_bc
This ensures we get asked for the password if needed
2019-12-07 13:57:26 +00:00
Jason Rhinelander
72ca7e3b0f Fix time comparison math
Dividing `dt` here by 1e6 converts it to seconds, but that is clearly
wrong since `REQUEST_NEXT_SCHEDULED_SPAN_THRESHOLD_STANDBY` is measured
in microseconds.  As a result, this if statement was effectively never
used.
2019-12-05 21:02:18 -04:00
naughtyfox
a2578892c0 --disable-ban-rpc option to prevent RPC users from banning 2019-12-04 17:45:27 +03:00
Bertrand Jacquin
021cf733c6
ssl: server-side: allow multiple version of TLS
boost::asio::ssl::context is created using specifically TLSv1.2, which
blocks the ability to use superior version of TLS like TLSv1.3.

Filtering is also made specially later in the code to remove unsafe
version for TLS such SSLv2, SSLv3 etc..

This change is removing double filtering to allow TLSv1.2 and above to
be used.

testssl.sh 3.0rc5 now reports the following (please note monerod was
built with USE_EXTRA_EC_CERT):

 $ ./testssl.sh --openssl=/usr/bin/openssl \
     --each-cipher --cipher-per-proto \
     --server-defaults --server-preference \
     --vulnerable --heartbleed --ccs --ticketbleed \
     --robot --renegotiation --compression --breach \
     --poodle --tls-fallback --sweet32 --beast --lucky13 \
     --freak --logjam --drown --pfs --rc4 --full \
     --wide --hints 127.0.0.1:38081

 Using "OpenSSL 1.1.1d  10 Sep 2019" [~80 ciphers]
 on ip-10-97-15-6:/usr/bin/openssl
 (built: "Dec  3 21:14:51 2019", platform: "linux-x86_64")

 Start 2019-12-03 21:51:25        -->> 127.0.0.1:38081 (127.0.0.1) <<--

 rDNS (127.0.0.1):       --
 Service detected:       HTTP

 Testing protocols via sockets except NPN+ALPN

 SSLv2      not offered (OK)
 SSLv3      not offered (OK)
 TLS 1      not offered
 TLS 1.1    not offered
 TLS 1.2    offered (OK)
 TLS 1.3    offered (OK): final
 NPN/SPDY   not offered
 ALPN/HTTP2 not offered

 Testing for server implementation bugs

 No bugs found.

 Testing cipher categories

 NULL ciphers (no encryption)                  not offered (OK)
 Anonymous NULL Ciphers (no authentication)    not offered (OK)
 Export ciphers (w/o ADH+NULL)                 not offered (OK)
 LOW: 64 Bit + DES, RC[2,4] (w/o export)       not offered (OK)
 Triple DES Ciphers / IDEA                     not offered (OK)
 Average: SEED + 128+256 Bit CBC ciphers       not offered
 Strong encryption (AEAD ciphers)              offered (OK)

 Testing robust (perfect) forward secrecy, (P)FS -- omitting Null Authentication/Encryption, 3DES, RC4

 PFS is offered (OK), ciphers follow (client/browser support is important here)

Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
-----------------------------------------------------------------------------------------------------------------------------
 x1302   TLS_AES_256_GCM_SHA384            ECDH 253   AESGCM      256      TLS_AES_256_GCM_SHA384
 x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH 253   ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256
 xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 xc02c   ECDHE-ECDSA-AES256-GCM-SHA384     ECDH 253   AESGCM      256      TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
 xcca9   ECDHE-ECDSA-CHACHA20-POLY1305     ECDH 253   ChaCha20    256      TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
 xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
 x1301   TLS_AES_128_GCM_SHA256            ECDH 253   AESGCM      128      TLS_AES_128_GCM_SHA256
 xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 xc02b   ECDHE-ECDSA-AES128-GCM-SHA256     ECDH 253   AESGCM      128      TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

 Elliptic curves offered:     prime256v1 secp384r1 secp521r1 X25519 X448

 Testing server preferences

 Has server cipher order?     yes (OK)
 Negotiated protocol          TLSv1.3
 Negotiated cipher            TLS_AES_256_GCM_SHA384, 253 bit ECDH (X25519)
 Cipher order
    TLSv1.2:   ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256
    TLSv1.3:   TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256

 Testing server defaults (Server Hello)

 TLS extensions (standard)    "renegotiation info/#65281" "EC point formats/#11" "supported versions/#43" "key share/#51" "max fragment length/#1" "extended master secret/#23"
 Session Ticket RFC 5077 hint no -- no lifetime advertised
 SSL Session ID support       yes
 Session Resumption           Tickets no, ID: no
 TLS clock skew               Random values, no fingerprinting possible

  Server Certificate #1 (in response to request w/o SNI)
   Signature Algorithm          SHA256 with RSA
   Server key size              RSA 4096 bits
   Server key usage             --
   Server extended key usage    --
   Serial / Fingerprints        01 / SHA1 132E42981812F5575FA0AE64922B18A81B38C03F
                                SHA256 EBA3CC4AA09DEF26706E64A70DB4BC8D723533BB67EAE12B503A845019FB61DC
   Common Name (CN)             (no CN field in subject)
   subjectAltName (SAN)         missing (NOT ok) -- Browsers are complaining
   Issuer
   Trust (hostname)             certificate does not match supplied URI
   Chain of trust               NOT ok (self signed)
   EV cert (experimental)       no
   "eTLS" (visibility info)     not present
   Certificate Validity (UTC)   181 >= 60 days (2019-12-03 21:51 --> 2020-06-02 21:51)
   # of certificates provided   1
   Certificate Revocation List  --
   OCSP URI                     --
                                NOT ok -- neither CRL nor OCSP URI provided
   OCSP stapling                not offered
   OCSP must staple extension   --
   DNS CAA RR (experimental)    not offered
   Certificate Transparency     --

  Server Certificate #2 (in response to request w/o SNI)
   Signature Algorithm          ECDSA with SHA256
   Server key size              EC 256 bits
   Server key usage             --
   Server extended key usage    --
   Serial / Fingerprints        01 / SHA1 E17B765DD8124525B1407E827B89A31FB167647D
                                SHA256 AFB7F44B1C33831F521357E5AEEB813044CB02532143E92D35650A3FF792A7C3
   Common Name (CN)             (no CN field in subject)
   subjectAltName (SAN)         missing (NOT ok) -- Browsers are complaining
   Issuer
   Trust (hostname)             certificate does not match supplied URI
   Chain of trust               NOT ok (self signed)
   EV cert (experimental)       no
   "eTLS" (visibility info)     not present
   Certificate Validity (UTC)   181 >= 60 days (2019-12-03 21:51 --> 2020-06-02 21:51)
   # of certificates provided   1
   Certificate Revocation List  --
   OCSP URI                     --
                                NOT ok -- neither CRL nor OCSP URI provided
   OCSP stapling                not offered
   OCSP must staple extension   --
   DNS CAA RR (experimental)    not offered
   Certificate Transparency     --

 Testing HTTP header response @ "/"

 HTTP Status Code             404 Not found (Hint: supply a path which doesn't give a "404 Not found")
 HTTP clock skew              Got no HTTP time, maybe try different URL?
 Strict Transport Security    not offered
 Public Key Pinning           --
 Server banner                Epee-based
 Application banner           --
 Cookie(s)                    (none issued at "/") -- maybe better try target URL of 30x
 Security headers             --
 Reverse Proxy banner         --

 Testing vulnerabilities

 Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension
 CCS (CVE-2014-0224)                       not vulnerable (OK)
 Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK), no session ticket extension
 ROBOT                                     Server does not support any cipher suites that use RSA key transport
 Secure Renegotiation (CVE-2009-3555)      not vulnerable (OK)
 Secure Client-Initiated Renegotiation     not vulnerable (OK)
 CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)
 BREACH (CVE-2013-3587)                    no HTTP compression (OK)  - only supplied "/" tested
 POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)
 TLS_FALLBACK_SCSV (RFC 7507)              No fallback possible, no protocol below TLS 1.2 offered (OK)
 SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)
 FREAK (CVE-2015-0204)                     not vulnerable (OK)
 DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)
                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services
                                           https://censys.io/ipv4?q=EBA3CC4AA09DEF26706E64A70DB4BC8D723533BB67EAE12B503A845019FB61DC could help you to find out
 LOGJAM (CVE-2015-4000), experimental      not vulnerable (OK): no DH EXPORT ciphers, no DH key detected with <= TLS 1.2
 BEAST (CVE-2011-3389)                     no SSL3 or TLS1 (OK)
 LUCKY13 (CVE-2013-0169), experimental     not vulnerable (OK)
 RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)

 Testing ciphers per protocol via OpenSSL plus sockets against the server, ordered by encryption strength

Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits     Cipher Suite Name (IANA/RFC)
-----------------------------------------------------------------------------------------------------------------------------
SSLv2
SSLv3
TLS 1
TLS 1.1
TLS 1.2
 xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 xc02c   ECDHE-ECDSA-AES256-GCM-SHA384     ECDH 253   AESGCM      256      TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
 xcca9   ECDHE-ECDSA-CHACHA20-POLY1305     ECDH 253   ChaCha20    256      TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
 xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
 xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 xc02b   ECDHE-ECDSA-AES128-GCM-SHA256     ECDH 253   AESGCM      128      TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS 1.3
 x1302   TLS_AES_256_GCM_SHA384            ECDH 253   AESGCM      256      TLS_AES_256_GCM_SHA384
 x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH 253   ChaCha20    256      TLS_CHACHA20_POLY1305_SHA256
 x1301   TLS_AES_128_GCM_SHA256            ECDH 253   AESGCM      128      TLS_AES_128_GCM_SHA256

 Running client simulations (HTTP) via sockets

 Browser                      Protocol  Cipher Suite Name (OpenSSL)       Forward Secrecy
------------------------------------------------------------------------------------------------
 Android 4.2.2                No connection
 Android 4.4.2                TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
 Android 5.0.0                TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
 Android 6.0                  TLSv1.2   ECDHE-RSA-AES128-GCM-SHA256       256 bit ECDH (P-256)
 Android 7.0                  TLSv1.2   ECDHE-RSA-CHACHA20-POLY1305       253 bit ECDH (X25519)
 Android 8.1 (native)         No connection
 Android 9.0 (native)         TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
 Chrome 65 Win 7              TLSv1.2   ECDHE-RSA-CHACHA20-POLY1305       253 bit ECDH (X25519)
 Chrome 74 (Win 10)           No connection
 Firefox 62 Win 7             TLSv1.2   ECDHE-RSA-CHACHA20-POLY1305       253 bit ECDH (X25519)
 Firefox 66 (Win 8.1/10)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
 IE 6 XP                      No connection
 IE 7 Vista                   No connection
 IE 8 Win 7                   No connection
 IE 8 XP                      No connection
 IE 11 Win 7                  No connection
 IE 11 Win 8.1                No connection
 IE 11 Win Phone 8.1          No connection
 IE 11 Win 10                 TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
 Edge 15 Win 10               TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
 Edge 17 (Win 10)             TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       253 bit ECDH (X25519)
 Opera 60 (Win 10)            No connection
 Safari 9 iOS 9               TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
 Safari 9 OS X 10.11          TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
 Safari 10 OS X 10.12         TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
 Apple ATS 9 iOS 9            TLSv1.2   ECDHE-RSA-AES256-GCM-SHA384       256 bit ECDH (P-256)
 Tor 17.0.9 Win 7             No connection
 Java 6u45                    No connection
 Java 7u25                    No connection
 Java 8u161                   TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     256 bit ECDH (P-256)
 Java 9.0.4                   TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     256 bit ECDH (P-256)
 OpenSSL 1.0.1l               TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     256 bit ECDH (P-256)
 OpenSSL 1.0.2e               TLSv1.2   ECDHE-ECDSA-AES256-GCM-SHA384     256 bit ECDH (P-256)
 OpenSSL 1.1.0j (Debian)      TLSv1.2   ECDHE-RSA-CHACHA20-POLY1305       253 bit ECDH (X25519)
 OpenSSL 1.1.1b (Debian)      TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
 Thunderbird (60.6)           TLSv1.3   TLS_AES_256_GCM_SHA384            253 bit ECDH (X25519)
2019-12-03 22:02:16 +00:00
moneromooo-monero
94266eeb89
simplewallet: fix output age display with duplicate heights
The highlight check was based on height, so would highlight
any output at that height, resulting in several matches if
a fake out was picked at the same height as the real spend
2019-12-03 18:50:28 +00:00
moneromooo-monero
f1d379d27d
simplewallet: fix "outputs in same tx" detector
It was comparing source txids, but txids were empty,
so all checks triggered
2019-12-03 18:50:22 +00:00
moneromooo-monero
5985c5afe8
rpc: add bad-blocks to flush_cache RPC
Flushes m_invalid_blocks in Blockchain.
2019-12-02 18:53:30 +00:00
moneromooo-monero
948534877e
easylogging++: add emscripten support
This is upstream, but seems to have got lost in conflicts
when merging support for BSDs or android.
2019-12-02 15:09:21 +00:00
TheCharlatan
1d78db2709
Add travis freebsd 2019-12-02 01:04:40 +01:00
woodser
ef95a76d0d remove unused variable 'ptx' from on_describe_transfer() 2019-12-01 13:07:26 -05:00
moneromooo-monero
02b8051339
unit_tests: remove invalid bulletproofs unit test
It was intended to check a case which is actually valid (0 gamma),
but was actually duplicating the bad amount test.

Reported by WhatDo_ on IRC.
2019-12-01 15:40:59 +00:00
moneromooo-monero
5f2a32c15a
daemon: run with -rpc-payment-address and --rpc-restricted-bind-port 2019-11-29 20:07:01 +00:00
moneromooo-monero
f8127831c7
simplewallet: fix encrypted payment id note triggering on dummy ones 2019-11-29 20:02:46 +00:00
moneromooo-monero
316ab7b56e
wallet2: better error when restoring a wallet with the wrong keys 2019-11-28 18:22:29 +00:00
moneromooo-monero
b90c4bc39e
rpc: error out from get_info if the proxied call errors out
Coverity 205410
2019-11-27 19:52:39 +00:00
moneromooo-monero
fa16df9996
make_test_signature: exit nicely on top level exception
Coverity 205411
2019-11-27 19:52:38 +00:00
moneromooo-monero
054b2621b1
node_rpc_proxy: init some new rpc payment fields in invalidate
The cache time would take care of these, but it's cleaner that way

Coverity 205412
2019-11-27 19:52:37 +00:00
moneromooo-monero
d0faae2a92
rpc: init a few missing client_info members
Coverity 205414
2019-11-27 19:52:37 +00:00
moneromooo-monero
d56a483abe
rpc: do not propagate exceptions out of a dtor
Coverity 205415
2019-11-27 19:52:36 +00:00
moneromooo-monero
3c849188ab
rpc: always set the update field in update on sucess
Coverity 205416
2019-11-27 19:52:33 +00:00
moneromooo-monero
2d1afceb0d
net_ssl: load default certificates in CA mode on Windows
Because it always does things wonkily doens't it
2019-11-26 19:34:16 +00:00
moneromooo-monero
3813a992e4
download: catch exceptions checking for size
Happens on at least one windows box
2019-11-26 18:42:00 +00:00
Gingeropolous
0bae2277b5
update readme to encourage joining #monero-dev
replaces #6126 because I can't squash things with the github web GUI
2019-11-26 10:13:59 -05:00
moneromooo-monero
8231c7cd04
rpc: fix bootstrap RPC payment RPC being made in raw JSON, not JSON RPC 2019-11-25 19:28:43 +00:00
moneromooo-monero
e896cca86e
epee: reorder a couple init list fields to match declaration
This is a bug waiting to happen
2019-11-25 19:27:54 +00:00
luigi1111
411f1b0ee3
Merge pull request #6174
9cb8d92 ANONYMITY_NETWORKS.md : fix unintentional wrapping (jonathancross)
2019-11-25 12:40:05 -06:00
moneromooo-monero
88b82befc7
simplewallet: point to "set help" in the lock screen message 2019-11-25 13:17:21 +00:00
moneromooo-monero
f19c9f2307
util: allow newlines in string to be split 2019-11-25 13:17:18 +00:00
selsta
7ac7d5d32f
updates: fix source code URL on _WIN32 2019-11-25 00:37:54 +01:00
Jonathan Cross
9cb8d92202
ANONYMITY_NETWORKS.md : fix unintentional wrapping 2019-11-23 17:06:57 +01:00
moneromooo-monero
81c2658989
rpc: don't auto fail RPC needing payment in bootstrap mode 2019-11-22 18:12:29 +00:00
moneromooo-monero
d7cf872767
rpc: add received_timestamp for pool txes in gettransactions 2019-11-22 15:53:40 +00:00
Matt Smith
0e0351c456 wallet_rpc_server: add count parameter to create_address 2019-11-22 12:00:01 +00:00
TheCharlatan
dc589ef07e
Add TheCharlatan pgp key 2019-11-21 01:44:21 +01:00
luigi1111
3e3db92303
Merge pull request #6117
0f7c9f4 Gitian Readme: adding android signing & fix v0.15 checksum. (jonathancross)
2019-11-20 09:23:19 -06:00
TheCharlatan
bd6a577880
Gitian: Fix sigs generation 2019-11-20 13:03:41 +01:00
xiphon
f3e155ea79 add xiphon's GPG key 2019-11-20 00:23:40 +00:00
luigi1111
f971068363
Merge pull request #6155
d8fc8d8 make d2h et al. constant-time (jtgrassie)
2019-11-19 10:00:09 -06:00
moneromooo-monero
402dd2078c
db_lmdb: guard against non NUL terminated keys 2019-11-19 11:12:49 +00:00
Jethro Grassie
d8fc8d8868
make d2h et al. constant-time 2019-11-19 04:21:02 -05:00
xiphon
3b41933335 wallet: don't issue node rpc proxy requests in '--offline' mode 2019-11-19 03:26:42 +00:00
moneromooo-monero
24adee4a08
p2p: don't request flags after closing connection 2019-11-19 02:03:39 +00:00
luigi1111
81da5246e4
Merge pull request #6148
47d094c Fix #6147 DB corruption from child process overwrite (hyc)
2019-11-18 13:24:42 -06:00
luigi1111
ac0e6f7ecd
Merge pull request #6118
gitian: add FreeBSD support (75c5a04, 607c01a, cca6e5c, 35b5e91, 024a1c7, b14d9ab, 5eea312, 9cbba5a, 2e435df, abeed9a) (hyc)
2019-11-18 13:21:08 -06:00
Lee Clagett
68a6507c3f Fixed bug in ZMQ JSON-RPC method field 2019-11-18 12:59:41 +00:00
Howard Chu
abeed9a767
"Fix" non-determinism in native_cctools build
By omitting the otool binary which is built non-deterministically.
We don't use it anyway.
2019-11-18 09:18:00 +00:00
Howard Chu
47d094c0c4
Fix #6147 DB corruption from child process overwrite
Don't leave stdout/stderr dangling on a fork.
2019-11-17 14:04:22 +00:00
Howard Chu
2e435dfe76
Fixup compiled python in OSX 2019-11-17 13:44:18 +00:00