monero-project/monero
monero-project/monero
1
0
Fork 0
mirror of https://github.com/monero-project/monero.git synced 2024-11-17 16:27:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

rpc: fix DoS vector in get_output_distribution

Browse source 
This will prevent people spending old pre-rct outputs using a
stranger's node, which may be a good thing
This commit is contained in:
moneromooo-monero 2021-10-24 16:49:11 +00:00
parent 753dc901a1
commit e8e507f36f
No known key found for this signature in database
GPG key ID: 686F07454D6CEFC3
1 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
src/rpc/core_rpc_server.cpp
View file

@ -3164,6 +3164,14 @@ namespace cryptonote
if (use_bootstrap_daemon_if_necessary<COMMAND_RPC_GET_OUTPUT_DISTRIBUTION>(invoke_http_mode::JON_RPC, "get_output_distribution", req, res, r)) if (use_bootstrap_daemon_if_necessary<COMMAND_RPC_GET_OUTPUT_DISTRIBUTION>(invoke_http_mode::JON_RPC, "get_output_distribution", req, res, r))
return r; return r;
const bool restricted = m_restricted && ctx;
if (restricted && req.amounts != std::vector<uint64_t>(1, 0))
{
error_resp.code = CORE_RPC_ERROR_CODE_RESTRICTED;
error_resp.message = "Restricted RPC can only get output distribution for rct outputs. Use your own node.";
return false;
}
size_t n_0 = 0, n_non0 = 0; size_t n_0 = 0, n_non0 = 0;
for (uint64_t amount: req.amounts) for (uint64_t amount: req.amounts)
if (amount) ++n_non0; else ++n_0; if (amount) ++n_non0; else ++n_0;
@ -3205,6 +3213,13 @@ namespace cryptonote
if (use_bootstrap_daemon_if_necessary<COMMAND_RPC_GET_OUTPUT_DISTRIBUTION>(invoke_http_mode::BIN, "/get_output_distribution.bin", req, res, r)) if (use_bootstrap_daemon_if_necessary<COMMAND_RPC_GET_OUTPUT_DISTRIBUTION>(invoke_http_mode::BIN, "/get_output_distribution.bin", req, res, r))
return r; return r;
const bool restricted = m_restricted && ctx;
if (restricted && req.amounts != std::vector<uint64_t>(1, 0))
{
res.status = "Restricted RPC can only get output distribution for rct outputs. Use your own node.";
return false;
}
size_t n_0 = 0, n_non0 = 0; size_t n_0 = 0, n_non0 = 0;
for (uint64_t amount: req.amounts) for (uint64_t amount: req.amounts)
if (amount) ++n_non0; else ++n_0; if (amount) ++n_non0; else ++n_0;