Merge pull request #617 from ellemouton/allowLNDWhitelistCalls

ellemouton · web-flow · commit edab9a460772 · 2023-09-08T09:09:24.000+02:00
multi: allow LND and subserver whitelisted calls
diff --git a/itest/litd_mode_integrated_test.go b/itest/litd_mode_integrated_test.go
diff --git a/itest/litd_mode_remote_test.go b/itest/litd_mode_remote_test.go
@@ -63,11 +63,11 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 				runGRPCAuthTest(
 					ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
 					endpoint.macaroonFn(cfg),
+					endpoint.noAuth,
 					endpoint.requestFn,
 					endpoint.successPattern,
 					endpointEnabled,
-					"unknown permissions required for "+
-						"method",
+					"unknown request",
 				)
 			})
 		}
@@ -90,11 +90,11 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 				runUIPasswordCheck(
 					ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
 					cfg.UIPassword, endpoint.requestFn,
+					endpoint.noAuth,
 					shouldFailWithoutMacaroon,
 					endpoint.successPattern,
 					endpointEnabled,
-					"unknown permissions required for "+
-						"method",
+					"unknown request",
 				)
 			})
 		}
@@ -117,8 +117,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 					ttt, cfg.LitAddr(), cfg.UIPassword,
 					endpoint.grpcWebURI, withoutUIPassword,
 					endpointEnabled,
-					"unknown permissions required for "+
-						"method",
+					"unknown request", endpoint.noAuth,
 				)
 			})
 		}
@@ -142,12 +141,11 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 			tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
 				runGRPCAuthTest(
 					ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
-					superMacFile,
+					superMacFile, endpoint.noAuth,
 					endpoint.requestFn,
 					endpoint.successPattern,
 					endpointEnabled,
-					"unknown permissions required for "+
-						"method",
+					"unknown request",
 				)
 			})
 		}
@@ -168,7 +166,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 					endpoint.restWebURI,
 					endpoint.successPattern,
 					endpoint.restPOST, withoutUIPassword,
-					endpointDisabled,
+					endpointDisabled, endpoint.noAuth,
 				)
 			})
 		}
@@ -199,7 +197,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 					endpoint.successPattern,
 					endpoint.allowedThroughLNC,
 					"unknown service",
-					endpointDisabled,
+					endpointDisabled, endpoint.noAuth,
 				)
 			})
 		}
@@ -244,7 +242,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 					ttt, rawLNCConn, endpoint.requestFn,
 					endpoint.successPattern,
 					allowed, "permission denied",
-					endpointDisabled,
+					endpointDisabled, endpoint.noAuth,
 				)
 			})
 		}
diff --git a/perms/manager.go b/perms/manager.go
@@ -49,8 +49,13 @@ func NewManager(withAllSubServers bool) (*Manager, error) {
 	permissions := make(map[string]map[string][]bakery.Op)
 	permissions[litPerms] = RequiredPermissions
 	permissions[lndPerms] = lnd.MainRPCServerPermissions()
-	for k, v := range whiteListedLNDMethods {
-		permissions[lndPerms][k] = v
+
+	for url := range whiteListedLitMethods {
+		permissions[litPerms][url] = []bakery.Op{}
+	}
+
+	for url := range whiteListedLNDMethods {
+		permissions[lndPerms][url] = []bakery.Op{}
 	}
 
 	// Collect all LND sub-server permissions along with the name of the
@@ -96,10 +101,22 @@ func NewManager(withAllSubServers bool) (*Manager, error) {
 	}, nil
 }
 
+// IsWhiteListedURL returns true if the given URL has been whitelisted meaning
+// that it does not require a macaroon for validation. A URL is considered
+// white-listed if it has no operations associated with a URL.
+func (pm *Manager) IsWhiteListedURL(url string) bool {
+	pm.permsMu.Lock()
+	defer pm.permsMu.Unlock()
+
+	ops, ok := pm.perms[url]
+
+	return ok && len(ops) == 0
+}
+
 // RegisterSubServer adds the permissions of a given sub-server to the set
 // managed by the Manager.
 func (pm *Manager) RegisterSubServer(name string,
-	permissions map[string][]bakery.Op) {
+	permissions map[string][]bakery.Op, whiteListURLs map[string]struct{}) {
 
 	pm.permsMu.Lock()
 	defer pm.permsMu.Unlock()
@@ -109,6 +126,15 @@ func (pm *Manager) RegisterSubServer(name string,
 	for uri, ops := range permissions {
 		pm.perms[uri] = ops
 	}
+
+	for url := range whiteListURLs {
+		pm.perms[url] = nil
+
+		if pm.fixedPerms[name] == nil {
+			pm.fixedPerms[name] = make(map[string][]bakery.Op)
+		}
+		pm.fixedPerms[name][url] = []bakery.Op{}
+	}
 }
 
 // OnLNDBuildTags should be called once a list of LND build tags has been
diff --git a/perms/permissions.go b/perms/permissions.go
@@ -80,7 +80,7 @@ var (
 
 	// whiteListedLNDMethods is a map of all lnd RPC methods that don't
 	// require any macaroon authentication.
-	whiteListedLNDMethods = map[string][]bakery.Op{
+	whiteListedLNDMethods = map[string]struct{}{
 		"/lnrpc.WalletUnlocker/GenSeed":        {},
 		"/lnrpc.WalletUnlocker/InitWallet":     {},
 		"/lnrpc.WalletUnlocker/UnlockWallet":   {},
@@ -92,6 +92,10 @@ var (
 		"/lnrpc.State/GetState":       {},
 	}
 
+	// whiteListedLitMethods is a map of all LiT's RPC methods that don't
+	// require any macaroon authentication.
+	whiteListedLitMethods = map[string]struct{}{}
+
 	// lndSubServerNameToTag is a map from the name of an LND subserver to
 	// the name of the LND tag that corresponds to the subserver. This map
 	// only contains the subserver-to-tag pairs for the pairs where the
diff --git a/rpc_proxy.go b/rpc_proxy.go
@@ -34,9 +34,15 @@ const (
 	HeaderMacaroon = "Macaroon"
 )
 
-// ErrWaitingToStart is returned if Lit's rpcProxy is not yet ready to handle
-// calls.
-var ErrWaitingToStart = fmt.Errorf("waiting for the RPC server to start")
+var (
+	// ErrWaitingToStart is returned if Lit's rpcProxy is not yet ready to
+	// handle calls.
+	ErrWaitingToStart = fmt.Errorf("waiting for the RPC server to start")
+
+	// ErrUnknownRequest is an error returned when the request URI is
+	// unknown if the permissions for the request are unknown.
+	ErrUnknownRequest = fmt.Errorf("unknown request")
+)
 
 // proxyErr is an error type that adds more context to an error occurring in the
 // proxy.
@@ -375,8 +381,7 @@ func (p *rpcProxy) UnaryServerInterceptor(ctx context.Context, req interface{},
 
 	uriPermissions, ok := p.permsMgr.URIPermissions(info.FullMethod)
 	if !ok {
-		return nil, fmt.Errorf("%s: unknown permissions "+
-			"required for method", info.FullMethod)
+		return nil, ErrUnknownRequest
 	}
 
 	// For now, basic authentication is just a quick fix until we
@@ -420,8 +425,7 @@ func (p *rpcProxy) StreamServerInterceptor(srv interface{},
 
 	uriPermissions, ok := p.permsMgr.URIPermissions(info.FullMethod)
 	if !ok {
-		return fmt.Errorf("%s: unknown permissions required "+
-			"for method", info.FullMethod)
+		return ErrUnknownRequest
 	}
 
 	// For now, basic authentication is just a quick fix until we
@@ -521,8 +525,7 @@ func (p *rpcProxy) basicAuthToMacaroon(basicAuth, requestURI string,
 		macPath = p.cfg.MacaroonPath
 
 	default:
-		return nil, fmt.Errorf("unknown gRPC web request: %v",
-			requestURI)
+		return nil, ErrUnknownRequest
 	}
 
 	switch {
@@ -572,8 +575,7 @@ func (p *rpcProxy) convertSuperMacaroon(ctx context.Context, macHex string,
 
 	requiredPermissions, ok := p.permsMgr.URIPermissions(fullMethod)
 	if !ok {
-		return nil, fmt.Errorf("%s: unknown permissions required for "+
-			"method", fullMethod)
+		return nil, ErrUnknownRequest
 	}
 
 	// We have a super macaroon, from here on out we'll return errors if
diff --git a/subservers/faraday.go b/subservers/faraday.go
@@ -118,3 +118,11 @@ func (f *faradaySubServer) MacPath() string {
 func (f *faradaySubServer) Permissions() map[string][]bakery.Op {
 	return perms.RequiredPermissions
 }
+
+// WhiteListedURLs returns a map of all the sub-server's URLs that can be
+// accessed without a macaroon.
+//
+// NOTE: this is part of the SubServer interface.
+func (f *faradaySubServer) WhiteListedURLs() map[string]struct{} {
+	return nil
+}
diff --git a/subservers/interface.go b/subservers/interface.go
@@ -58,4 +58,8 @@ type SubServer interface {
 	// Permissions returns a map of all RPC methods and their required
 	// macaroon permissions to access the sub-server.
 	Permissions() map[string][]bakery.Op
+
+	// WhiteListedURLs returns a map of all the sub-server's URLs that can
+	// be accessed without a macaroon.
+	WhiteListedURLs() map[string]struct{}
 }
diff --git a/subservers/loop.go b/subservers/loop.go
@@ -128,3 +128,11 @@ func (l *loopSubServer) MacPath() string {
 func (l *loopSubServer) Permissions() map[string][]bakery.Op {
 	return perms.RequiredPermissions
 }
+
+// WhiteListedURLs returns a map of all the sub-server's URLs that can be
+// accessed without a macaroon.
+//
+// NOTE: this is part of the SubServer interface.
+func (l *loopSubServer) WhiteListedURLs() map[string]struct{} {
+	return nil
+}
diff --git a/subservers/manager.go b/subservers/manager.go
@@ -54,7 +54,9 @@ func (s *Manager) AddServer(ss SubServer) {
 		quit:      make(chan struct{}),
 	})
 
-	s.permsMgr.RegisterSubServer(ss.Name(), ss.Permissions())
+	s.permsMgr.RegisterSubServer(
+		ss.Name(), ss.Permissions(), ss.WhiteListedURLs(),
+	)
 }
 
 // StartIntegratedServers starts all the manager's sub-servers that should be
diff --git a/subservers/pool.go b/subservers/pool.go
@@ -118,3 +118,11 @@ func (p *poolSubServer) MacPath() string {
 func (p *poolSubServer) Permissions() map[string][]bakery.Op {
 	return perms.RequiredPermissions
 }
+
+// WhiteListedURLs returns a map of all the sub-server's URLs that can be
+// accessed without a macaroon.
+//
+// NOTE: this is part of the SubServer interface.
+func (p *poolSubServer) WhiteListedURLs() map[string]struct{} {
+	return nil
+}
diff --git a/subservers/taproot-assets.go b/subservers/taproot-assets.go
@@ -174,3 +174,19 @@ func (t *taprootAssetsSubServer) MacPath() string {
 func (t *taprootAssetsSubServer) Permissions() map[string][]bakery.Op {
 	return perms.RequiredPermissions
 }
+
+// WhiteListedURLs returns a map of all the sub-server's URLs that can be
+// accessed without a macaroon.
+//
+// NOTE: this is part of the SubServer interface.
+func (t *taprootAssetsSubServer) WhiteListedURLs() map[string]struct{} {
+	// If the taproot-asset daemon is running in integrated mode, then we
+	// use cfg.RpcConf.AllowPublicStats to determine if the public stats
+	// endpoints should be included in the whitelist. If it is running in
+	// remote mode, however, then we don't know if the public stats are
+	// allowed, and so we just allow the request through since the remote
+	// daemon will handle blocking the call if it is not whitelisted there.
+	return perms.MacaroonWhitelist(
+		t.cfg.RpcConf.AllowPublicStats || t.remote,
+	)
+}
diff --git a/terminal.go b/terminal.go
@@ -116,6 +116,7 @@ var (
 	lndRESTRegistrations = []restRegistration{
 		lnrpc.RegisterLightningHandlerFromEndpoint,
 		lnrpc.RegisterWalletUnlockerHandlerFromEndpoint,
+		lnrpc.RegisterStateHandlerFromEndpoint,
 		autopilotrpc.RegisterAutopilotHandlerFromEndpoint,
 		chainrpc.RegisterChainNotifierHandlerFromEndpoint,
 		invoicesrpc.RegisterInvoicesHandlerFromEndpoint,
@@ -963,6 +964,12 @@ func (g *LightningTerminal) RegisterRestSubserver(ctx context.Context,
 func (g *LightningTerminal) ValidateMacaroon(ctx context.Context,
 	requiredPermissions []bakery.Op, fullMethod string) error {
 
+	// If the URL being queried has been whitelisted, then no macaroon
+	// validation is required for the query.
+	if g.permsMgr.IsWhiteListedURL(fullMethod) {
+		return nil
+	}
+
 	macHex, err := macaroons.RawMacaroonFromContext(ctx)
 	if err != nil {
 		return err

Original file line number	Diff line number	Diff line change
`@@ -63,11 +63,11 @@ func remoteTestSuite(ctx context.Context, net NetworkHarness, t testing.T,`
`63`	`63`	`runGRPCAuthTest(`
`64`	`64`	`ttt, cfg.LitAddr(), cfg.LitTLSCertPath,`
`65`	`65`	`endpoint.macaroonFn(cfg),`
	`66`	`+ endpoint.noAuth,`
`66`	`67`	`endpoint.requestFn,`
`67`	`68`	`endpoint.successPattern,`
`68`	`69`	`endpointEnabled,`
`69`		`- "unknown permissions required for "+`
`70`		`- "method",`
	`70`	`+ "unknown request",`
`71`	`71`	`)`
`72`	`72`	`})`
`73`	`73`	`}`
`@@ -90,11 +90,11 @@ func remoteTestSuite(ctx context.Context, net NetworkHarness, t testing.T,`
`90`	`90`	`runUIPasswordCheck(`
`91`	`91`	`ttt, cfg.LitAddr(), cfg.LitTLSCertPath,`
`92`	`92`	`cfg.UIPassword, endpoint.requestFn,`
	`93`	`+ endpoint.noAuth,`
`93`	`94`	`shouldFailWithoutMacaroon,`
`94`	`95`	`endpoint.successPattern,`
`95`	`96`	`endpointEnabled,`
`96`		`- "unknown permissions required for "+`
`97`		`- "method",`
	`97`	`+ "unknown request",`
`98`	`98`	`)`
`99`	`99`	`})`
`100`	`100`	`}`
`@@ -117,8 +117,7 @@ func remoteTestSuite(ctx context.Context, net NetworkHarness, t testing.T,`
`117`	`117`	`ttt, cfg.LitAddr(), cfg.UIPassword,`
`118`	`118`	`endpoint.grpcWebURI, withoutUIPassword,`
`119`	`119`	`endpointEnabled,`
`120`		`- "unknown permissions required for "+`
`121`		`- "method",`
	`120`	`+ "unknown request", endpoint.noAuth,`
`122`	`121`	`)`
`123`	`122`	`})`
`124`	`123`	`}`
`@@ -142,12 +141,11 @@ func remoteTestSuite(ctx context.Context, net NetworkHarness, t testing.T,`
`142`	`141`	`tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {`
`143`	`142`	`runGRPCAuthTest(`
`144`	`143`	`ttt, cfg.LitAddr(), cfg.LitTLSCertPath,`
`145`		`- superMacFile,`
	`144`	`+ superMacFile, endpoint.noAuth,`
`146`	`145`	`endpoint.requestFn,`
`147`	`146`	`endpoint.successPattern,`
`148`	`147`	`endpointEnabled,`
`149`		`- "unknown permissions required for "+`
`150`		`- "method",`
	`148`	`+ "unknown request",`
`151`	`149`	`)`
`152`	`150`	`})`
`153`	`151`	`}`
`@@ -168,7 +166,7 @@ func remoteTestSuite(ctx context.Context, net NetworkHarness, t testing.T,`
`168`	`166`	`endpoint.restWebURI,`
`169`	`167`	`endpoint.successPattern,`
`170`	`168`	`endpoint.restPOST, withoutUIPassword,`
`171`		`- endpointDisabled,`
	`169`	`+ endpointDisabled, endpoint.noAuth,`
`172`	`170`	`)`
`173`	`171`	`})`
`174`	`172`	`}`
`@@ -199,7 +197,7 @@ func remoteTestSuite(ctx context.Context, net NetworkHarness, t testing.T,`
`199`	`197`	`endpoint.successPattern,`
`200`	`198`	`endpoint.allowedThroughLNC,`
`201`	`199`	`"unknown service",`
`202`		`- endpointDisabled,`
	`200`	`+ endpointDisabled, endpoint.noAuth,`
`203`	`201`	`)`
`204`	`202`	`})`
`205`	`203`	`}`
`@@ -244,7 +242,7 @@ func remoteTestSuite(ctx context.Context, net NetworkHarness, t testing.T,`
`244`	`242`	`ttt, rawLNCConn, endpoint.requestFn,`
`245`	`243`	`endpoint.successPattern,`
`246`	`244`	`allowed, "permission denied",`
`247`		`- endpointDisabled,`
	`245`	`+ endpointDisabled, endpoint.noAuth,`
`248`	`246`	`)`
`249`	`247`	`})`
`250`	`248`	`}`
Original file line number	Diff line number	Diff line change
`@@ -58,4 +58,8 @@ type SubServer interface {`
`58`	`58`	`// Permissions returns a map of all RPC methods and their required`
`59`	`59`	`// macaroon permissions to access the sub-server.`
`60`	`60`	`Permissions() map[string][]bakery.Op`
	`61`	`+`
	`62`	`+ // WhiteListedURLs returns a map of all the sub-server's URLs that can`
	`63`	`+ // be accessed without a macaroon.`
	`64`	`+ WhiteListedURLs() map[string]struct{}`
`61`	`65`	`}`
Original file line number	Diff line number	Diff line change
`@@ -54,7 +54,9 @@ func (s *Manager) AddServer(ss SubServer) {`
`54`	`54`	`quit: make(chan struct{}),`
`55`	`55`	`})`
`56`	`56`
`57`		`- s.permsMgr.RegisterSubServer(ss.Name(), ss.Permissions())`
	`57`	`+ s.permsMgr.RegisterSubServer(`
	`58`	`+ ss.Name(), ss.Permissions(), ss.WhiteListedURLs(),`
	`59`	`+ )`
`58`	`60`	`}`
`59`	`61`
`60`	`62`	`// StartIntegratedServers starts all the manager's sub-servers that should be`