RPC: Allow rpcauth configs to specify a 4th parameter naming a specific wallet

[luke-jr]

Simple rebase of current RPC stuff. No endpoints yet.

[ryanofsky]

ACK b77b2f254cc365728790f345deedbed1204964bb.

Needs updated documentation, also would be good to have python tests.

Tested with:

bitcoind -regtest -wallet=w1.dat -wallet=w2.dat -debug=1
bitcoin-cli -regtest -rpcuser=user1 -rpcpassword=V6CGvawtTWCHzt51knRvFfTejjjfy06UzSt_FiB3Fxw= getwalletinfo
bitcoin-cli -regtest -rpcuser=user2 -rpcpassword=V6CGvawtTWCHzt51knRvFfTejjjfy06UzSt_FiB3Fxw= getwalletinfo
bitcoin-cli -regtest -rpcuser=user3 -rpcpassword=V6CGvawtTWCHzt51knRvFfTejjjfy06UzSt_FiB3Fxw= getwalletinfo

And $HOME/.bitcoin/bitcoin.conf:

rpcauth=user1:51902a7be9c9911079af388a927f$22904ad1bfec659ee1e61d1b3dd73f7b552c6d2d0d1e9f71f6ee833954d062da:w1.dat
rpcauth=user2:51902a7be9c9911079af388a927f$22904ad1bfec659ee1e61d1b3dd73f7b552c6d2d0d1e9f71f6ee833954d062da:w2.dat
rpcauth=user3:51902a7be9c9911079af388a927f$22904ad1bfec659ee1e61d1b3dd73f7b552c6d2d0d1e9f71f6ee833954d062da:-

[ryanofsky]

In commit "RPC: Pass wallet through JSONRPCRequest"

Could drop this ifdef also.

[ryanofsky]

In commit "RPC: Allow rpcauth configs to specify..."

Should update -rpcauth documentation to mention the new field.

[promag]

Also add a test for the new parameter?

[ryanofsky]

There was a lot of objection at last IRC meeting (https://botbot.me/freenode/bitcoin-core-dev/msg/87311878/) to choosing wallet based on RPC username & password, mostly for security reasons ("securing RPC for multiple users is absolutely a nightmare").

Personally, I don't like the choosing wallet based on username because I think it makes for a clumsy UI. Adding support for a simple -wallet= option to bitcoin-cli and working with regular cookie authentication just seems a lot more user-friendly than having to deal with -rpcauth, the share/rpcuser script, and all of that.

ACKing this PR though because it makes multiwallet usable, and the implementation is pretty clean. If we don't want to use rpcauth for wallet security, we could allow all users to access all wallets and just interpret the new rpcauth wallet option as the default wallet for the user.

[ryanofsky]

In commit "RPC: Allow rpcauth configs to specify..."

I think instead of interpreting the 4th rpcauth field as a wallet filename field, it might be better to treat it as a generic options field (similar to the field in fstab files for mount options). E.g. instead of:

rpcauth=user:salt:hash:filename.dat

You would write:

rpcauth=user:salt:hash:wallet=filename.dat

This would be more extensible, also more readable.

[jnewbery]

Multi-user for multiwallet is definitely a very useful feature and one that we should be aiming for long-term, so this is good to see. I think the implementation some more work before its ready:

• most importantly, having individual user wallet access authentication will give users the impression that it's safe to open RPC access to multiple users, which it absolutely isn't. Just using the standard RPC commands, a malicious user could cause mischief by stopping the node, changing consensus state using invalidateblock/preciousblock, eclipse the node using disconnectnode/addnode, etc. RPC is not a secure interface and we should be very careful to not give users the impression that it is.
• this implementation adds a lot of #ifdef ENABLE_WALLETs to libbitcoin_server.a. We should be trying to remove those in order to remove circular dependency between libbitcoin_server.a and libbitcoin_wallet.a (see Remaining instances of ENABLE_WALLET in libbitcoin_server.a #7965). This PR would make future work to cleanly separate wallet from server more difficult.
• this implementation needlessly binds multiwallet to multi-user. It does not allow a single user to have access to multiple wallets or select a wallet on a per-call basis.

So, definite concept ACK that we should do this, but I think it should be sequenced after wallet separation. That would make the implementation a lot cleaner and make it easier to provide an implementation that is secure and safe for users.

[promag]

Also add a test for the new parameter?

[promag]

Just wallet_name?

[promag]

wallet_name.

[luke-jr]

Rebased

[DrahtBot]

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Conflicts

Reviewers, this pull request conflicts with the following ones:

• #13756 (wallet: "avoid_reuse" wallet flag for improved privacy by kallewoof)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

[jnewbery]

Concept ACK. I still have a few concerns about RPC security and the level of coupling between RPC users and wallets. I think the first thing to do is add release notes explaining the exact model, and update the PR description to match.

[promag]

IIUC this limits one wallet per user (auth)?

This is incomplete now that there's dynamic support for wallets:

• there should be a way to dynamically update access credentials?
• rpcauth.py should be updated?
• probably there's issues with external wallets (paths) and other characters?
• already mentioned, needs tests.

Alternatively it could whitelist RPC categories (not wallets) by user/auth: For instance:

rpcauth=promag:ec94a02...$07e90e0...:blockchain,rawtransactions

[DrahtBot]

Needs rebase

[laanwj]

This seems to have been inactive for a long time, and it was controversial in the first place, closing.