multi: add CLI flag to enable public access to uni proof courier RPCs

lightninglabs · Sep 11, 2023 · ef592c1 · ef592c1
1 parent c5bdbfe
commit ef592c1
Show file tree

Hide file tree

Showing 5 changed files with 32 additions and 18 deletions.
diff --git a/config.go b/config.go
@@ -45,6 +45,8 @@ type RPCConfig struct {
 
 	MacaroonPath string
 
+	AllowPublicMultiverseProofCourier bool
+
 	AllowPublicStats bool
 
 	LetsEncryptDir string

diff --git a/perms/perms.go b/perms/perms.go
@@ -209,13 +209,22 @@ var (
 
 // MacaroonWhitelist returns the set of RPC endpoints that don't require
 // macaroon authentication.
-func MacaroonWhitelist(allowPublicStats bool) map[string]struct{} {
+func MacaroonWhitelist(allowPublicMultiverseProofCourier bool,
+	allowPublicStats bool) map[string]struct{} {
+
 	// Make a copy of the default whitelist.
 	whitelist := make(map[string]struct{})
 	for k, v := range defaultMacaroonWhitelist {
 		whitelist[k] = v
 	}
 
+	// Conditionally add public multiverse proof courier RPC endpoints to
+	// the whitelist.
+	if allowPublicMultiverseProofCourier {
+		whitelist["/universerpc.Universe/QueryProof"] = struct{}{}
+		whitelist["/universerpc.Universe/InsertProof"] = struct{}{}
+	}
+
 	// Conditionally add public stats RPC endpoints to the whitelist.
 	if allowPublicStats {
 		whitelist["/universerpc.Universe/QueryAssetStats"] = struct{}{}

diff --git a/server.go b/server.go
@@ -228,6 +228,7 @@ func (s *Server) RunUntilShutdown(mainErrChan <-chan error) error {
 
 	// Get RPC endpoints which don't require macaroons.
 	macaroonWhitelist := perms.MacaroonWhitelist(
+		s.cfg.RPCConfig.AllowPublicMultiverseProofCourier,
 		s.cfg.RPCConfig.AllowPublicStats,
 	)
 

diff --git a/tapcfg/config.go b/tapcfg/config.go
@@ -204,7 +204,8 @@ type RpcConfig struct {
 	MacaroonPath string `long:"macaroonpath" description:"Path to write the admin macaroon for tapd's RPC and REST services if it doesn't exist"`
 	NoMacaroons  bool   `long:"no-macaroons" description:"Disable macaroon authentication, can only be used if server is not listening on a public interface."`
 
-	AllowPublicStats bool `long:"allow-public-stats" description:"Disable macaroon authentication for stats RPC endpoints."`
+	AllowPublicMultiverseProofCourier bool `long:"allow-public-multiverse-proof-courier" description:"Disable macaroon authentication for multiverse proof courier RPC endpoints."`
+	AllowPublicStats                  bool `long:"allow-public-stats" description:"Disable macaroon authentication for stats RPC endpoints."`
 
 	RestCORS []string `long:"restcors" description:"Add an ip:port/hostname to allow cross origin access from. To allow all origins, set as \"*\"."`
 

diff --git a/tapcfg/server.go b/tapcfg/server.go
@@ -384,22 +384,23 @@ func CreateServerFromConfig(cfg *Config, cfgLogger btclog.Logger,
 	serverCfg.SignalInterceptor = shutdownInterceptor
 
 	serverCfg.RPCConfig = &tap.RPCConfig{
-		LisCfg:            &lnd.ListenerCfg{},
-		RPCListeners:      cfg.rpcListeners,
-		RESTListeners:     cfg.restListeners,
-		GrpcServerOpts:    serverOpts,
-		RestDialOpts:      restDialOpts,
-		RestListenFunc:    restListen,
-		WSPingInterval:    cfg.RpcConf.WSPingInterval,
-		WSPongWait:        cfg.RpcConf.WSPongWait,
-		RestCORS:          cfg.RpcConf.RestCORS,
-		NoMacaroons:       cfg.RpcConf.NoMacaroons,
-		MacaroonPath:      cfg.RpcConf.MacaroonPath,
-		AllowPublicStats:  cfg.RpcConf.AllowPublicStats,
-		LetsEncryptDir:    cfg.RpcConf.LetsEncryptDir,
-		LetsEncryptListen: cfg.RpcConf.LetsEncryptListen,
-		LetsEncryptEmail:  cfg.RpcConf.LetsEncryptEmail,
-		LetsEncryptDomain: cfg.RpcConf.LetsEncryptDomain,
+		LisCfg:                            &lnd.ListenerCfg{},
+		RPCListeners:                      cfg.rpcListeners,
+		RESTListeners:                     cfg.restListeners,
+		GrpcServerOpts:                    serverOpts,
+		RestDialOpts:                      restDialOpts,
+		RestListenFunc:                    restListen,
+		WSPingInterval:                    cfg.RpcConf.WSPingInterval,
+		WSPongWait:                        cfg.RpcConf.WSPongWait,
+		RestCORS:                          cfg.RpcConf.RestCORS,
+		NoMacaroons:                       cfg.RpcConf.NoMacaroons,
+		MacaroonPath:                      cfg.RpcConf.MacaroonPath,
+		AllowPublicMultiverseProofCourier: cfg.RpcConf.AllowPublicMultiverseProofCourier,
+		AllowPublicStats:                  cfg.RpcConf.AllowPublicStats,
+		LetsEncryptDir:                    cfg.RpcConf.LetsEncryptDir,
+		LetsEncryptListen:                 cfg.RpcConf.LetsEncryptListen,
+		LetsEncryptEmail:                  cfg.RpcConf.LetsEncryptEmail,
+		LetsEncryptDomain:                 cfg.RpcConf.LetsEncryptDomain,
 	}
 
 	return tap.NewServer(serverCfg), nil