Skip to content

Commit

Permalink
accept only domain names (no ips) for ssl enabled electrum servers
Browse files Browse the repository at this point in the history
looks like using IP with ssl encryption isn't a common practice [1], also tls connector from tokio-rustls explicilty calls the ServerName argument in `connect` method `domain`, so lets stick with that.
https://stackoverflow.com/questions/2043617/is-it-possible-to-have-ssl-certificate-for-ip-address-not-domain-name
  • Loading branch information
mariocynicys committed Apr 13, 2024
1 parent e76b92e commit 8e814de
Showing 1 changed file with 9 additions and 2 deletions.
11 changes: 9 additions & 2 deletions mm2src/coins/utxo/rpc_clients.rs
Original file line number Diff line number Diff line change
Expand Up @@ -1466,6 +1466,13 @@ fn addr_to_socket_addr(input: &str) -> Result<SocketAddr, String> {
}
}

fn server_name_from_domain(dns_name: &str) -> Result<ServerName, String> {
match ServerName::try_from(dns_name) {
Ok(dns_name) if matches!(dns_name, ServerName::DnsName(_)) => Ok(dns_name),
_ => ERR!("Couldn't parse DNS name from '{}'", dns_name),
}
}

/// Attempts to process the request (parse url, etc), build up the config and create new electrum connection
/// The function takes `abortable_system` that will be used to spawn Electrum's related futures.
#[cfg(not(target_arch = "wasm32"))]
Expand All @@ -1483,7 +1490,7 @@ pub fn spawn_electrum(
.host()
.ok_or(ERRL!("Couldn't retrieve host from addr {}", req.url))?;

try_s!(ServerName::try_from(host));
try_s!(server_name_from_domain(host));

ElectrumConfig::SSL {
dns_name: host.into(),
Expand Down Expand Up @@ -2769,7 +2776,7 @@ async fn connect_loop<Spawner: SpawnFuture>(
TlsConnector::from(SAFE_TLS_CONFIG.clone())
};
// The address should always be correct since we checked it beforehand in initializaiton.
let dns = ServerName::try_from(dns_name.as_str()).map_err(|e| {
let dns = server_name_from_domain(dns_name.as_str()).map_err(|e| {
error!("{:?} error {:?}", addr, e);
})?;

Expand Down

0 comments on commit 8e814de

Please sign in to comment.