aboutsummaryrefslogtreecommitdiff
path: root/contrib/epee/include/net
Commit message (Collapse)AuthorAgeFilesLines
...
* | levin_protocol_handler_async: tune down preallocation a fair bitmoneromooo-monero2019-04-221-1/+1
|/ | | | | | It can allocate a lot when getting a lot of connections (in particular, the stress test on windows apparently pushes that memory to actual use, rather than just allocated)
* Merge pull request #5445Riccardo Spagni2019-04-161-0/+12
|\ | | | | | | b18f0b10 wallet: new --offline option (moneromooo-monero)
| * wallet: new --offline optionmoneromooo-monero2019-04-151-0/+12
| | | | | | | | | | It will avoid connecting to a daemon (so useful for cold signing using a RPC wallet), and not perform DNS queries.
* | Merge pull request #5436Riccardo Spagni2019-04-161-3/+4
|\ \ | | | | | | | | | 61d63900 net_helper: avoid unnecessary memcpy (moneromooo-monero)
| * | net_helper: avoid unnecessary memcpymoneromooo-monero2019-04-131-3/+4
| |/
* / abstract_tcp_server2: fix timeout on exitmoneromooo-monero2019-04-122-2/+9
|/ | | | | | When closing connections due to exiting, the IO service is already gone, so the data exchange needed for a gracious SSL shutdown cannot happen. We just close the socket in that case.
* epee: init a new ssl related variable in ctormoneromooo-monero2019-04-111-0/+1
|
* simplewallet: new net_stats commandmoneromooo-monero2019-04-112-2/+30
| | | | displays total sent and received bytes
* Enabling daemon-rpc SSL now requires non-system CA verificationLee Clagett2019-04-071-0/+3
| | | | | If `--daemon-ssl enabled` is set in the wallet, then a user certificate, fingerprint, or onion/i2p address must be provided.
* Require manual override for user chain certificates.Lee Clagett2019-04-071-1/+2
| | | | | | | An override for the wallet to daemon connection is provided, but not for other SSL contexts. The intent is to prevent users from supplying a system CA as the "user" whitelisted certificate, which is less secure since the key is controlled by a third party.
* Perform RFC 2818 hostname verification in client SSL handshakesLee Clagett2019-04-072-2/+14
| | | | | | | | | | | | If the verification mode is `system_ca`, clients will now do hostname verification. Thus, only certificates from expected hostnames are allowed when SSL is enabled. This can be overridden by forcible setting the SSL mode to autodetect. Clients will also send the hostname even when `system_ca` is not being performed. This leaks possible metadata, but allows servers providing multiple hostnames to respond with the correct certificate. One example is cloudflare, which getmonero.org is currently using.
* Require server verification when SSL is enabled.Lee Clagett2019-04-071-0/+6
| | | | | | | | | | | | | If SSL is "enabled" via command line without specifying a fingerprint or certificate, the system CA list is checked for server verification and _now_ fails the handshake if that check fails. This change was made to remain consistent with standard SSL/TLS client behavior. This can still be overridden by using the allow any certificate flag. If the SSL behavior is autodetect, the system CA list is still checked but a warning is logged if this fails. The stream is not rejected because a re-connect will be attempted - its better to have an unverified encrypted stream than an unverified + unencrypted stream.
* Pass SSL arguments via one class and use shared_ptr instead of referenceLee Clagett2019-04-077-110/+151
|
* Change SSL certificate file list to OpenSSL builtin load_verify_locationLee Clagett2019-04-066-23/+20
| | | | | | | | | | | | | Specifying SSL certificates for peer verification does an exact match, making it a not-so-obvious alias for the fingerprints option. This changes the checks to OpenSSL which loads concatenated certificate(s) from a single file and does a certificate-authority (chain of trust) check instead. There is no drop in security - a compromised exact match fingerprint has the same worse case failure. There is increased security in allowing separate long-term CA key and short-term SSL server keys. This also removes loading of the system-default CA files if a custom CA file or certificate fingerprint is specified.
* Merge pull request #5348Riccardo Spagni2019-04-061-3/+3
|\ | | | | | | 59776a64 epee: some more minor JSON parsing speedup (moneromooo-monero)
| * epee: some more minor JSON parsing speedupmoneromooo-monero2019-03-251-3/+3
| |
* | Merge pull request #5327Riccardo Spagni2019-04-012-1/+5
|\ \ | | | | | | | | | c23ea796 New interactive daemon command 'print_net_stats': Global traffic stats (rbrunner7)
| * | New interactive daemon command 'print_net_stats': Global traffic statsrbrunner72019-03-242-1/+5
| | |
* | | Added socks proxy (tor/i2pd/kovri) support to walletLee Clagett2019-03-254-75/+79
| |/ |/|
* | Merge pull request #5283Riccardo Spagni2019-03-211-5/+6
|\ \ | | | | | | | | | 16590294 abstract_tcp_server2: fix crashy race on socket shutdown (moneromooo-monero)
| * | abstract_tcp_server2: fix crashy race on socket shutdownmoneromooo-monero2019-03-191-5/+6
| | |
* | | epee: fix build with boost 1.70.0moneromooo-monero2019-03-211-5/+11
| |/ |/| | | | | get_io_service was deprecated, and got removed
* | Merge pull request #5061Riccardo Spagni2019-03-174-4/+4
|\ \ | |/ |/| | | 1f2930ce Update 2019 copyright (binaryFate)
| * Update 2019 copyrightbinaryFate2019-03-054-4/+4
| |
* | Fix startup errors with SSL cert generationHoward Chu2019-03-081-1/+0
|/ | | | Use SSL API directly, skip boost layer
* epee: add SSL supportMartijn Otto2019-03-056-19/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RPC connections now have optional tranparent SSL. An optional private key and certificate file can be passed, using the --{rpc,daemon}-ssl-private-key and --{rpc,daemon}-ssl-certificate options. Those have as argument a path to a PEM format private private key and certificate, respectively. If not given, a temporary self signed certificate will be used. SSL can be enabled or disabled using --{rpc}-ssl, which accepts autodetect (default), disabled or enabled. Access can be restricted to particular certificates using the --rpc-ssl-allowed-certificates, which takes a list of paths to PEM encoded certificates. This can allow a wallet to connect to only the daemon they think they're connected to, by forcing SSL and listing the paths to the known good certificates. To generate long term certificates: openssl genrsa -out /tmp/KEY 4096 openssl req -new -key /tmp/KEY -out /tmp/REQ openssl x509 -req -days 999999 -sha256 -in /tmp/REQ -signkey /tmp/KEY -out /tmp/CERT /tmp/KEY is the private key, and /tmp/CERT is the certificate, both in PEM format. /tmp/REQ can be removed. Adjust the last command to set expiration date, etc, as needed. It doesn't make a whole lot of sense for monero anyway, since most servers will run with one time temporary self signed certificates anyway. SSL support is transparent, so all communication is done on the existing ports, with SSL autodetection. This means you can start using an SSL daemon now, but you should not enforce SSL yet or nothing will talk to you.
* default initialize rpc structuresmoneromooo-monero2019-03-041-0/+14
|
* Merge pull request #5162Riccardo Spagni2019-03-042-6/+14
|\ | | | | | | 4d3b61a3 Use io_service::work in epee tcp server (Lee Clagett)
| * Use io_service::work in epee tcp serverLee Clagett2019-02-102-6/+14
| |
* | Merge pull request #5160Riccardo Spagni2019-03-041-1/+1
|\ \ | | | | | | | | | 7af4fbd4 epee: Add space after ':' in additional http response headers (Tom Smeding)
| * | epee: Add space after ':' in additional http response headersTom Smeding2019-02-181-1/+1
| |/
* | Merge pull request #5096Riccardo Spagni2019-03-041-1/+2
|\ \ | | | | | | | | | 7c3ade44 network_throttle: use circular_buffer where appropriate (moneromooo-monero)
| * | network_throttle: use circular_buffer where appropriatemoneromooo-monero2019-02-011-1/+2
| | |
* | | Merge pull request #5091Riccardo Spagni2019-03-041-1/+4
|\ \ \ | | | | | | | | | | | | 123fc2a2 i2p: initial support (Jethro Grassie)
| * | | i2p: initial supportJethro Grassie2019-01-301-1/+4
| | |/ | |/|
* / | epee: add SSL supportmoneromooo-monero2019-02-028-198/+539
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RPC connections now have optional tranparent SSL. An optional private key and certificate file can be passed, using the --{rpc,daemon}-ssl-private-key and --{rpc,daemon}-ssl-certificate options. Those have as argument a path to a PEM format private private key and certificate, respectively. If not given, a temporary self signed certificate will be used. SSL can be enabled or disabled using --{rpc}-ssl, which accepts autodetect (default), disabled or enabled. Access can be restricted to particular certificates using the --rpc-ssl-allowed-certificates, which takes a list of paths to PEM encoded certificates. This can allow a wallet to connect to only the daemon they think they're connected to, by forcing SSL and listing the paths to the known good certificates. To generate long term certificates: openssl genrsa -out /tmp/KEY 4096 openssl req -new -key /tmp/KEY -out /tmp/REQ openssl x509 -req -days 999999 -sha256 -in /tmp/REQ -signkey /tmp/KEY -out /tmp/CERT /tmp/KEY is the private key, and /tmp/CERT is the certificate, both in PEM format. /tmp/REQ can be removed. Adjust the last command to set expiration date, etc, as needed. It doesn't make a whole lot of sense for monero anyway, since most servers will run with one time temporary self signed certificates anyway. SSL support is transparent, so all communication is done on the existing ports, with SSL autodetection. This means you can start using an SSL daemon now, but you should not enforce SSL yet or nothing will talk to you.
* | Adding initial support for broadcasting transactions over TorLee Clagett2019-01-285-98/+267
| | | | | | | | | | | | | | | | | | - Support for ".onion" in --add-exclusive-node and --add-peer - Add --anonymizing-proxy for outbound Tor connections - Add --anonymous-inbounds for inbound Tor connections - Support for sharing ".onion" addresses over Tor connections - Support for broadcasting transactions received over RPC exclusively over Tor (else broadcast over public IP when Tor not enabled).
* | rpc: fix internal daemon calls in restricted rpc getting partial datamoneromooo-monero2019-01-281-6/+6
| |
* | Pruningmoneromooo-monero2019-01-222-2/+10
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | The blockchain prunes seven eighths of prunable tx data. This saves about two thirds of the blockchain size, while keeping the node useful as a sync source for an eighth of the blockchain. No other data is currently pruned. There are three ways to prune a blockchain: - run monerod with --prune-blockchain - run "prune_blockchain" in the monerod console - run the monero-blockchain-prune utility The first two will prune in place. Due to how LMDB works, this will not reduce the blockchain size on disk. Instead, it will mark parts of the file as free, so that future data will use that free space, causing the file to not grow until free space grows scarce. The third way will create a second database, a pruned copy of the original one. Since this is a new file, this one will be smaller than the original one. Once the database is pruned, it will stay pruned as it syncs. That is, there is no need to use --prune-blockchain again, etc.
* Merge pull request #4976Riccardo Spagni2019-01-166-40/+97
|\ | | | | | | 85665003 epee: better network buffer data structure (moneromooo-monero)
| * epee: better network buffer data structuremoneromooo-monero2018-12-236-40/+97
| | | | | | | | avoids pointless allocs and memcpy
* | Merge pull request #4933luigi11112018-12-312-2/+2
|\ \ | |/ |/| | | 3cf85f0 Changed RECIEVED to RECEIVED in log messages. (normoes)
| * Changed RECIEVED to RECEIVED in log messages.Norman Moeschter2018-12-042-2/+2
| |
* | epee: fix network packet header field endiannessmoneromooo-monero2018-12-044-53/+108
| |
* | Merge pull request #4854Riccardo Spagni2018-12-044-18/+4
|\ \ | |/ |/| | | bd98e99c Removed a lot of unnecessary includes (Martijn Otto)
| * Removed a lot of unnecessary includesMartijn Otto2018-11-154-18/+4
| |
* | Merge pull request #4819Riccardo Spagni2018-11-262-6/+10
|\ \ | | | | | | | | | 7c298f5d No longer use a list for registering self references in the abstract tcp server (Martijn Otto)
| * | No longer use a list for registering self references in the abstract tcpMartijn Otto2018-11-072-6/+10
| |/ | | | | | | | | | | | | | | | | | | server Updated assert message Use a local variable that won't destruct at the end of the if-branch Updated comment
* | Merge pull request #4807Riccardo Spagni2018-11-161-1/+6
|\ \ | |/ |/| | | b620443b epee: log HTTP/RPC calls at info level (moneromooo-monero)
| * epee: log HTTP/RPC calls at info levelmoneromooo-monero2018-11-051-1/+6
| | | | | | | | It's useful info to have when investigating logs
generated by cgit v1.2.3 (git 2.51.0) at 2026-08-17 01:04:59 +0000