fix(cli): support HTTPS in ipfs --api (#10659)
* fix(cli): support HTTPS in ipfs --api Closes #10539 * chore: go-ipfs-cmds v0.14.1 https://github.com/ipfs/go-ipfs-cmds/releases/tag/v0.14.1 * docs: ipfs --api example * test(cli): https rpc support makes sure we dont have regression where HTTPS endpoint starts getting cleartext requests
Marcin Rataj committed
Jan 10, 2025 at 22:34 UTC
3b098b969af9aa7e9904ec1e6428dd96384e6fa6
5 files changed
+64
-4
cmd/ipfs/kubo/start.go
+5
@@ -330,6 +330,11 @@ func makeExecutor(req *cmds.Request, env interface{}) (cmds.Executor, error) {
330
switch network {
331
case "tcp", "tcp4", "tcp6":
332
tpt = http.DefaultTransport
333
+ // RPC over HTTPS requires explicit schema in the address passed to cmdhttp.NewClient
334
+ httpAddr := apiAddr.String()
335
+ if !strings.HasPrefix(host, "http:") && !strings.HasPrefix(host, "https:") && (strings.Contains(httpAddr, "/https") || strings.Contains(httpAddr, "/tls/http")) {
336
+ host = "https://" + host
337
+ }
338
case "unix":
339
path := host
340
host = "unix"
docs/changelogs/v0.33.md
+10
-1
@@ -12,6 +12,7 @@
12
- [Using default `libp2p_rcmgr` metrics](#using-default-libp2p_rcmgr--metrics)
13
- [Flatfs does not `sync` on each write](#flatfs-does-not-sync-on-each-write)
14
- [`ipfs add --to-files` no longer works with `--wrap`](#ipfs-add---to-files-no-longer-works-with---wrap)
15
+ - [`ipfs --api` supports HTTPS RPC endpoints](#ipfs---api-supports-https-rpc-endpoints)
16
- [New options for faster writes: `WriteThrough`, `BlockKeyCacheSize`, `BatchMaxNodes`, `BatchMaxSize`](#new-options-for-faster-writes-writethrough-blockkeycachesize-batchmaxnodes-batchmaxsize)
17
- [MFS stability with large number of writes](#mfs-stability-with-large-number-of-writes)
18
- [📦️ Important dependency updates](#-important-dependency-updates)
@@ -61,6 +62,15 @@ The old default was overly conservative and caused performance issues in big rep
62
63
Onboarding files and directories with `ipfs add --to-files` now requires non-empty names. due to this, The `--to-files` and `--wrap` options are now mutually exclusive ([#10612](https://github.com/ipfs/kubo/issues/10612)).
64
65
+#### `ipfs --api` supports HTTPS RPC endpoints
66
+
67
+CLI and RPC client now supports accessing Kubo RPC over `https://` protocol when multiaddr ending with `/https` or `/tls/http` is passed to `ipfs --api`:
68
+
69
+```console
70
+$ ipfs id --api /dns/kubo-rpc.example.net/tcp/5001/tls/http
71
+# → https://kubo-rpc.example.net:5001
72
+```
73
+
74
#### New options for faster writes: `WriteThrough`, `BlockKeyCacheSize`, `BatchMaxNodes`, `BatchMaxSize`
75
76
Now that Kubo supports [`pebble`](https://github.com/ipfs/kubo/blob/master/docs/datastores.md#pebbleds) as a datastore backend, it becomes very useful to expose some additional configuration options for how the blockservice/blockstore/datastore combo behaves.
@@ -90,7 +100,6 @@ We have fixed a number of issues that were triggered by writing or copying many
100
- update `p2p-forge/client` to [v0.2.0](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.2.0) (incl. [v0.1.0](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.1.0))
101
- update `ipfs-webui` to [v4.4.2](https://github.com/ipfs/ipfs-webui/releases/tag/v4.4.2) (incl. [v4.4.1](https://github.com/ipfs/ipfs-webui/releases/tag/v4.4.1))
102
93
-
103
#### Escape Redirect URL for Directory
104
105
When navigating to a subdirectory, served by the Kubo web server, a subdirectory without a trailing slash gets redirected to a URL with a trailing slash. If there are special characters such as "%" in the subdirectory name then these must be escaped in the redirect URL. Previously this was not being done and was preventing navigation to such subdirectories, requiring the user to manually add a trailing slash to the subdirectory URL. This is now fixed to handle the redirect to URLs with characters that must be escaped.
go.mod
+1
-1
@@ -34,7 +34,7 @@ require (
34
github.com/ipfs/go-ds-measure v0.2.0
35
github.com/ipfs/go-ds-pebble v0.4.0
36
github.com/ipfs/go-fs-lock v0.0.7
37
- github.com/ipfs/go-ipfs-cmds v0.14.0
37
+ github.com/ipfs/go-ipfs-cmds v0.14.1
38
github.com/ipfs/go-ipld-cbor v0.2.0
39
github.com/ipfs/go-ipld-format v0.6.0
40
github.com/ipfs/go-ipld-git v0.1.1
go.sum
+2
-2
@@ -411,8 +411,8 @@ github.com/ipfs/go-ipfs-blockstore v1.3.1 h1:cEI9ci7V0sRNivqaOr0elDsamxXFxJMMMy7
411
github.com/ipfs/go-ipfs-blockstore v1.3.1/go.mod h1:KgtZyc9fq+P2xJUiCAzbRdhhqJHvsw8u2Dlqy2MyRTE=
412
github.com/ipfs/go-ipfs-blocksutil v0.0.1 h1:Eh/H4pc1hsvhzsQoMEP3Bke/aW5P5rVM1IWFJMcGIPQ=
413
github.com/ipfs/go-ipfs-blocksutil v0.0.1/go.mod h1:Yq4M86uIOmxmGPUHv/uI7uKqZNtLb449gwKqXjIsnRk=
414
-github.com/ipfs/go-ipfs-cmds v0.14.0 h1:sxdurhAHSdQr5VrSNJjc+t92uJObSNq+gRVm/wLZGMM=
415
-github.com/ipfs/go-ipfs-cmds v0.14.0/go.mod h1:zj2jN7bHJ4pDucRmqdq863AQYcsqdxXrfVkr9eqPfvo=
414
+github.com/ipfs/go-ipfs-cmds v0.14.1 h1:TA8vBixPwXL3k7VtcbX3r4FQgw2m+jMOWlslUOlM9Rs=
415
+github.com/ipfs/go-ipfs-cmds v0.14.1/go.mod h1:SCYxNUVPeVR05cE8DJ6wyH2+aQ8vPgjxxkxQWOXobzo=
416
github.com/ipfs/go-ipfs-delay v0.0.0-20181109222059-70721b86a9a8/go.mod h1:8SP1YXK1M1kXuc4KJZINY3TQQ03J2rwBG9QfXmbRPrw=
417
github.com/ipfs/go-ipfs-delay v0.0.1 h1:r/UXYyRcddO6thwOnhiznIAiSvxMECGgtv35Xs1IeRQ=
418
github.com/ipfs/go-ipfs-delay v0.0.1/go.mod h1:8SP1YXK1M1kXuc4KJZINY3TQQ03J2rwBG9QfXmbRPrw=
test/cli/cli_https_test.go
new
+46
@@ -0,0 +1,46 @@
1
+package cli
2
+
3
+import (
4
+ "fmt"
5
+ "net"
6
+ "net/http"
7
+ "net/http/httptest"
8
+ "net/url"
9
+ "testing"
10
+
11
+ "github.com/ipfs/kubo/test/cli/harness"
12
+ "github.com/stretchr/testify/require"
13
+)
14
+
15
+func TestCLIWithRemoteHTTPS(t *testing.T) {
16
+ tests := []struct{ addrSuffix string }{{"https"}, {"tls/http"}}
17
+ for _, tt := range tests {
18
+ t.Run("with "+tt.addrSuffix+" multiaddr", func(t *testing.T) {
19
+
20
+ // Create HTTPS test server
21
+ server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
22
+ if r.TLS == nil {
23
+ t.Error("Mocked Kubo RPC received plain HTTP request instead of HTTPS TLS Handshake")
24
+ }
25
+ _, _ = w.Write([]byte("OK"))
26
+ }))
27
+ defer server.Close()
28
+
29
+ serverURL, _ := url.Parse(server.URL)
30
+ _, port, _ := net.SplitHostPort(serverURL.Host)
31
+
32
+ // Create Kubo repo
33
+ node := harness.NewT(t).NewNode().Init()
34
+
35
+ // Attempt to talk to remote Kubo RPC endpoint over HTTPS
36
+ resp := node.RunIPFS("id", "--api", fmt.Sprintf("/ip4/127.0.0.1/tcp/%s/%s", port, tt.addrSuffix))
37
+
38
+ // Expect HTTPS error (confirming TLS and https:// were used, and not Cleartext HTTP)
39
+ require.Error(t, resp.Err)
40
+ require.Contains(t, resp.Stderr.String(), "Error: tls: failed to verify certificate: x509: certificate signed by unknown authority")
41
+
42
+ node.StopDaemon()
43
+
44
+ })
45
+ }
46
+}