Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make (un)subscribe and filter RPC methods require only read perm #10825

Merged
merged 1 commit into from
May 9, 2023

Conversation

fridrik01
Copy link
Contributor

@fridrik01 fridrik01 commented May 4, 2023

Fixes: #10682

Context
This PR changes the API permission of eth_subscribe/eth_unsubscribe and all eth filter methods to only require read permission instead of write permission.

Test Plan

Build generated files:

make gen

Pick eth_subscribe to test, replicated the perm error before applying this PR:

wscat --connect ws://localhost:1234/rpc/v1 
Connected (press CTRL+C to quit)
> {"jsonrpc":  "2.0",  "id":  1,  "method":  "eth_subscribe",  "params":  ["newHeads"]}
< {"jsonrpc":"2.0","id":1,"error":{"code":1,"message":"missing permission to invoke 'EthSubscribe' (need 'write')"}}

After applying this PR, then it goes through:

wscat --connect ws://localhost:1234/rpc/v1 
Connected (press CTRL+C to quit)
> {"jsonrpc":  "2.0",  "id":  1,  "method":  "eth_subscribe",  "params":  ["newHeads"]}
< {"jsonrpc":"2.0","result":"0x46d6940586e840e9abbf304fab4678d200000000000000000000000000000000","id":1}

< {"jsonrpc":"2.0","method":"eth_subscription","params":{"subscription":"0x46d6940586e840e9abbf304fab4678d200000000000000000000000000000000","result":{"hash":"0x4e34f7a21c0ee8b3ac70dfbe73c87f37a016f1c640e7bda8752fe0ae798209f8","parentHash":"0x8709fe49b800cd389d3b6123ef2e8d03abb3249f8347c72e5c068fb378faf1f0","sha3Uncles":"0x1dcc4de8dec75d7aab85b567b6ccd41ad312451b948a7413f0a142fd40d49347","miner":"0x0000000000000000000000000000000000000000","stateRoot":"0x0000000000000000000000000000000000000000000000000000000000000000","transactionsRoot":"0x0000000000000000000000000000000000000000000000000000000000000000","receiptsRoot":"0x0000000000000000000000000000000000000000000000000000000000000000","logsBloom":"0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff","difficulty":"0x0","totalDifficulty":"0x0","number":"0x2b3000","gasLimit":"0x2540be400","gasUsed":"0x1c85a017a","timestamp":"0x6453d860","extraData":"0x","mixHash":"0x0000000000000000000000000000000000000000000000000000000000000000","nonce":"0x0000000000000000","baseFeePerGas":"0x20373cf","size":"0x0","transactions":[{"chainId":"0x13a","nonce":"0x3c18b","hash":"0x7768e8d1fa5d46c7a27c03a1efc0950f5d2d043028e1477da74b7c0fea672d5d","blockHash":"0x4e34f7a21c0ee8b3ac70dfbe73c87f37a016f1c640e7bda8752fe0ae798209f8","blockNumber":"0x2b3000","transactionIndex":"0x0","from":"0xff000000000000000000000000000000001e02b8","to":"0xff00000000000000000000000000000000000005","value":"0x0","type":"0x2","input":"0x","gas":"0x12c1a6db","maxFeePerGas":"0x9787c21","maxPriorityFeePerGas":"0x2d755f","accessList":[],"v":"0x0","r":"0x0","s":"0x0"},{"chainId":"0x13a","nonce":"0x11737","hash":"0x3f770b3c026f6db328fb99418882145713f17c9d0769812186083bcee123756c","blockHash":"0x4e34f7a21c0ee8b3ac70dfbe73c87f37a016f1c640e7bda8752fe0ae798209f8","blockNumber":"0x2b3000","transactionIndex":"0x1","from":"0xff000000000000000000000000000000001ea34
...

@fridrik01 fridrik01 marked this pull request as ready for review May 4, 2023 16:25
@fridrik01 fridrik01 requested a review from a team as a code owner May 4, 2023 16:25
Copy link
Member

@raulk raulk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SGTM because these methods are read-only (although the create state in memory, e.g. filter or subscription). However, as reported in issues, perm:write is the wrong permission here since hosted RPC nodes use read users to call from their gateways into Lotus, which prevents those RPC nodes from ever offering these operations.

If nodes want to limit/block such operations, they can do it elsewhere (frontend).

@raulk raulk requested a review from magik6k May 4, 2023 17:34
@magik6k magik6k merged commit 07e5abb into master May 9, 2023
92 checks passed
@magik6k magik6k deleted the 10682-read-perm-for-subscribe-and-filter-methods branch May 9, 2023 16:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Change the perm for eth_subscribe to read
3 participants