Browse Source

Don't reveal whether password is <20 or >20 characters in RPC

As discussed on IRC.

It seems bad to base a decision to delay based on the password length,
as it leaks a small amount of information.
0.10
Wladimir J. van der Laan 10 years ago
parent
commit
01094bd01f
  1. 3
      src/rpcserver.cpp

3
src/rpcserver.cpp

@ -849,10 +849,9 @@ static bool HTTPReq_JSONRPC(AcceptedConnection *conn, @@ -849,10 +849,9 @@ static bool HTTPReq_JSONRPC(AcceptedConnection *conn,
if (!HTTPAuthorized(mapHeaders))
{
LogPrintf("ThreadRPCServer incorrect password attempt from %s\n", conn->peer_address_to_string());
/* Deter brute-forcing short passwords.
/* Deter brute-forcing
If this results in a DoS the user really
shouldn't have their RPC port exposed. */
if (mapArgs["-rpcpassword"].size() < 20)
MilliSleep(250);
conn->stream() << HTTPError(HTTP_UNAUTHORIZED, false) << std::flush;

Loading…
Cancel
Save