Bitcointalk

JSON-RPC password

中本聪 · 2010 年 7 月 18 日

SN-1416　已核对来源，附原文与上下文。

阅读语言

我把给 JSON-RPC 加密码的修改传到 SVN 了。如果你搭好了编译环境，请帮忙测试。

I uploaded to SVN my changes to add a password to JSON-RPC. If you're set up to build, please test it.

-server 开关被 -rpcpw= 取代，bitcoind 也用它。

The -server switch is replaced with -rpcpw=, which is also used with bitcoind.

bitcoin -rpcpw= -- 带开放的 JSON-RPC 端口运行

bitcoin -rpcpw= -- runs with JSON-RPC port open

bitcoind -rpcpw= -- 带密码的守护进程

bitcoind -rpcpw= -- daemon with password

如果你对开关的名字有更好的想法，告诉我，但请记住将来数据库加密也需要一个密码。我不确定，但我觉得两种密码他们可能会想用不同的。

If you have a better idea for the switch name, let me know, but keep in mind there will eventually be a password for encrypting the database too. I'm not sure but I think they may want to use different passwords for the two.

不设密码的话会给出警告。

It gives a warning if you don't set a password.

现在所有命令都要把密码作为第一个参数。运行 "bitcoind help" 会告诉你这一点。

All commands now require the password as the first parameter. It'll tell you that if you run "bitcoind help".

核心代码：

The central code:

// Check password

  if (params.size() < 1 || params[0].type() != str_type)
      throw runtime_error("First parameter must be the password.");
  if (params[0].get_str() != strRPCPassword)
  {
      if (strRPCPassword.size() < 15)
          Sleep(50);
      begin = strRequest.end();
      printf("ThreadRPCServer incorrect password attempt
");
      throw runtime_error("Incorrect password.");
  }

对这些决定有什么意见吗？

Any comments on these decisions?

1) if (strRPCPassword.size() < 15) Sleep(50); -- 意思是密码短的话，每次尝试之后等 50ms。这可能被用来做 DoS 攻击，但我想如果密码短，更重要的是防暴力密码扫描。这可能让外人得知密码不足 15 个字符，但不足 15 也不算什么值得注意的信息，大多数密码都不到 15。如果你想封死 DoS 的可能，用 15 个字符或更长的密码就是。

1) if (strRPCPassword.size() < 15) Sleep(50); -- this means if it's a short password, it'll wait 50ms after each attempt. This might be used as a DoS attack, but I figured if it's a short password, it's more important to protect against brute force password scan. This may tell outsiders whether the password is less than 15 characters, but less than 15 isn't all that noteworthy, most passwords are less than 15. If you want to close the DoS possibility, just use a password 15 characters or longer.

2) begin = strRequest.end(); -- 如果是单个请求携带多个调用，只要有一个密码错误，我就把剩下的全部丢弃。这样就不能在一个包里塞进上百万次密码尝试。你们觉得这样做对吗？（多调用反正几乎从来没人用）

2) begin = strRequest.end(); -- if it's a single request with multiple invocations, I throw away the rest if one has a bad password. This is so you can't stuff it with millions of password attempts in one packet. What do you think, is this the right thing to do? (multiple invocation is probably almost never used anyway)

我还修了帮助里列出的两个重复命令：

I also fixed the two duplicated commands listed in the help:

getaddressesbylabel

getbalance

getblockcount

getblocknumber

getconnectioncount

getdifficulty

getgenerate

getinfo

getlabel

getnewaddress [label]

getreceivedbyaddress [minconf=1]

getreceivedbylabel [minconf=1]

help

listreceivedbyaddress [minconf=1] [includeempty=false]

listreceivedbylabel [minconf=1] [includeempty=false]

sendtoaddress [comment] [comment-to]

setgenerate [genproclimit]

setlabel

stop

上下文

← 上一条 SN-1416 · 当前后文 · martin → 在档案中查看完整主题串 →

来源

Bitcointalk 原始链接 ↗ 记录编号 SN-1416