Rpc log ip anonymisation

Cargo.toml

@@ -33,7 +33,7 @@ arraydeque = "0.5.1"
 arrayref = "0.3.6"
 base64 = "0.22"
 bincode = "1.3.1"
-bitcoin = { version = "0.32.4", features = ["serde"] }
+bitcoin = { version = "0.32.4", features = ["serde", "rand"] }
 clap = "2.33.3"
 crossbeam-channel = "0.5.0"
 dirs = "5.0.1"

src/bin/electrs.rs

@@ -6,10 +6,11 @@ extern crate electrs;
 
 use crossbeam_channel::{self as channel};
 use error_chain::ChainedError;
-use std::process;
+use std::{env, process, thread};
 use std::sync::{Arc, RwLock};
 use std::time::Duration;
-
+use bitcoin::hex::DisplayHex;
+use bitcoin::secp256k1::rand;
 use electrs::{
     config::Config,
     daemon::Daemon,
@@ -28,6 +29,9 @@ use electrs::otlp_trace;
 use electrs::elements::AssetRegistry;
 use electrs::metrics::MetricOpts;
 
+/// Default salt rotation interval in seconds (24 hours)
+const DEFAULT_SALT_ROTATION_INTERVAL_SECS: u64 = 24 * 3600;
+
 fn fetch_from(config: &Config, store: &Store) -> FetchFrom {
     let mut jsonrpc_import = config.jsonrpc_import;
     if !jsonrpc_import {
@@ -44,7 +48,7 @@ fn fetch_from(config: &Config, store: &Store) -> FetchFrom {
     }
 }
 
-fn run_server(config: Arc<Config>) -> Result<()> {
+fn run_server(config: Arc<Config>, salt_rwlock: Arc<RwLock<String>>) -> Result<()> {
     let (block_hash_notify, block_hash_receive) = channel::bounded(1);
     let signal = Waiter::start(block_hash_receive);
     let metrics = Metrics::new(config.monitoring_addr);
@@ -116,7 +120,12 @@ fn run_server(config: Arc<Config>) -> Result<()> {
 
     // TODO: configuration for which servers to start
     let rest_server = rest::start(Arc::clone(&config), Arc::clone(&query));
-    let electrum_server = ElectrumRPC::start(Arc::clone(&config), Arc::clone(&query), &metrics);
+    let electrum_server = ElectrumRPC::start(
+        Arc::clone(&config),
+        Arc::clone(&query),
+        &metrics,
+        Arc::clone(&salt_rwlock),
+    );
 
     let main_loop_count = metrics.gauge(MetricOpts::new(
         "electrs_main_loop_count",
@@ -151,9 +160,49 @@ fn run_server(config: Arc<Config>) -> Result<()> {
     Ok(())
 }
 
+fn generate_salt() -> String {
+    let random_bytes: [u8; 32] = rand::random();
+    random_bytes.to_lower_hex_string()
+}
+
+fn rotate_salt(salt: &mut String) {
+    *salt = generate_salt();
+}
+
+fn get_salt_rotation_interval() -> Duration {
+    let var_name = "SALT_ROTATION_INTERVAL_SECS";
+    let secs = env::var(var_name)
+        .ok()
+        .and_then(|val| val.parse::<u64>().ok())
+        .unwrap_or(DEFAULT_SALT_ROTATION_INTERVAL_SECS);
+
+    Duration::from_secs(secs)
+}
+
+fn spawn_salt_rotation_thread() -> Arc<RwLock<String>> {
+    let salt = generate_salt();
+    let salt_rwlock = Arc::new(RwLock::new(salt));
+    let writer_arc = Arc::clone(&salt_rwlock);
+    let interval = get_salt_rotation_interval();
+
+    thread::spawn(move || {
+        loop {
+            thread::sleep(interval); // 24 hours
+            {
+                let mut guard = writer_arc.write().unwrap();
+                rotate_salt(&mut *guard);
+                info!("Salt rotated");
+            }
+        }
+    });
+    salt_rwlock
+}
+
 fn main_() {
+    let salt_rwlock = spawn_salt_rotation_thread();
+
     let config = Arc::new(Config::from_args());
-    if let Err(e) = run_server(config) {
+    if let Err(e) = run_server(config, Arc::clone(&salt_rwlock)) {
         error!("server failed: {}", e.display_chain());
         process::exit(1);
     }

src/config.rs

@@ -40,7 +40,7 @@ pub struct Config {
     pub utxos_limit: usize,
     pub electrum_txs_limit: usize,
     pub electrum_banner: String,
-    pub electrum_rpc_logging: Option<RpcLogging>,
+    pub rpc_logging: RpcLogging,
     pub zmq_addr: Option<SocketAddr>,
 
     /// Enable compaction during initial sync
@@ -74,10 +74,6 @@ fn str_to_socketaddr(address: &str, what: &str) -> SocketAddr {
 impl Config {
     pub fn from_args() -> Config {
         let network_help = format!("Select network type ({})", Network::names().join(", "));
-        let rpc_logging_help = format!(
-            "Select RPC logging option ({})",
-            RpcLogging::options().join(", ")
-        );
 
         let args = App::new("Electrum Rust Server")
             .version(crate_version!())
@@ -201,10 +197,20 @@ impl Config {
                     .help("Welcome banner for the Electrum server, shown in the console to clients.")
                     .takes_value(true)
             ).arg(
-                Arg::with_name("electrum_rpc_logging")
-                    .long("electrum-rpc-logging")
-                    .help(&rpc_logging_help)
-                    .takes_value(true),
+                Arg::with_name("enable_json_rpc_logging")
+                    .long("enable-json-rpc-logging")
+                    .help("turns on rpc logging")
+                    .takes_value(false)
+            ).arg(
+                Arg::with_name("hide_json_rpc_logging_parameters")
+                    .long("hide-json-rpc-logging-parameters")
+                    .help("disables parameter printing in rpc logs")
+                    .takes_value(false)
+            ).arg(
+                Arg::with_name("anonymize_json_rpc_logging_source_ip")
+                    .long("anonymize-json-rpc-logging-source-ip")
+                    .help("enables ip anonymization in rpc logs")
+                    .takes_value(false)
             ).arg(
                 Arg::with_name("initial_sync_compaction")
                     .long("initial-sync-compaction")
@@ -427,9 +433,15 @@ impl Config {
             electrum_rpc_addr,
             electrum_txs_limit: value_t_or_exit!(m, "electrum_txs_limit", usize),
             electrum_banner,
-            electrum_rpc_logging: m
-                .value_of("electrum_rpc_logging")
-                .map(|option| RpcLogging::from(option)),
+            rpc_logging: {
+                let params = RpcLogging {
+                    enabled: m.is_present("enable_json_rpc_logging"),
+                    hide_params: m.is_present("hide_json_rpc_logging_parameters"),
+                    anonymize_ip: m.is_present("anonymize_json_rpc_logging_source_ip"),
+                };
+                params.validate();
+                params
+            },
             http_addr,
             http_socket_file,
             monitoring_addr,
@@ -471,25 +483,17 @@ impl Config {
     }
 }
 
-#[derive(Debug, Clone)]
-pub enum RpcLogging {
-    Full,
-    NoParams,
+#[derive(Debug, Default, Clone)]
+pub struct RpcLogging {
+    pub enabled: bool,
+    pub hide_params: bool,
+    pub anonymize_ip: bool,
 }
 
 impl RpcLogging {
-    pub fn options() -> Vec<String> {
-        return vec!["full".to_string(), "no-params".to_string()];
-    }
-}
-
-impl From<&str> for RpcLogging {
-    fn from(option: &str) -> Self {
-        match option {
-            "full" => RpcLogging::Full,
-            "no-params" => RpcLogging::NoParams,
-
-            _ => panic!("unsupported RPC logging option: {:?}", option),
+    pub fn validate(&self) {
+        if !self.enabled && (self.hide_params || self.anonymize_ip) {
+            panic!("Flags '--hide-json-rpc-logging-parameters' or '--anonymize-json-rpc-logging-source-ip' require '--enable-json-rpc-logging'");
         }
     }
 }