| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
|
|
dd28383 depends: bump cppzmq version to 4.4.1 (anonimal)
157b3fc depends: bump zeromq version to 4.1.7 (anonimal)
|
|
b3a9a4d add a quick early out to get_blocks.bin when up to date (moneromooo-monero)
2899379 daemon, wallet: new pay for RPC use system (moneromooo-monero)
ffa4602 simplewallet: add public_nodes command (moneromooo-monero)
|
|
Daemons intended for public use can be set up to require payment
in the form of hashes in exchange for RPC service. This enables
public daemons to receive payment for their work over a large
number of calls. This system behaves similarly to a pool, so
payment takes the form of valid blocks every so often, yielding
a large one off payment, rather than constant micropayments.
This system can also be used by third parties as a "paywall"
layer, where users of a service can pay for use by mining Monero
to the service provider's address. An example of this for web
site access is Primo, a Monero mining based website "paywall":
https://github.com/selene-kovri/primo
This has some advantages:
- incentive to run a node providing RPC services, thereby promoting the availability of third party nodes for those who can't run their own
- incentive to run your own node instead of using a third party's, thereby promoting decentralization
- decentralized: payment is done between a client and server, with no third party needed
- private: since the system is "pay as you go", you don't need to identify yourself to claim a long lived balance
- no payment occurs on the blockchain, so there is no extra transactional load
- one may mine with a beefy server, and use those credits from a phone, by reusing the client ID (at the cost of some privacy)
- no barrier to entry: anyone may run a RPC node, and your expected revenue depends on how much work you do
- Sybil resistant: if you run 1000 idle RPC nodes, you don't magically get more revenue
- no large credit balance maintained on servers, so they have no incentive to exit scam
- you can use any/many node(s), since there's little cost in switching servers
- market based prices: competition between servers to lower costs
- incentive for a distributed third party node system: if some public nodes are overused/slow, traffic can move to others
- increases network security
- helps counteract mining pools' share of the network hash rate
- zero incentive for a payer to "double spend" since a reorg does not give any money back to the miner
And some disadvantages:
- low power clients will have difficulty mining (but one can optionally mine in advance and/or with a faster machine)
- payment is "random", so a server might go a long time without a block before getting one
- a public node's overall expected payment may be small
Public nodes are expected to compete to find a suitable level for
cost of service.
The daemon can be set up this way to require payment for RPC services:
monerod --rpc-payment-address 4xxxxxx \
--rpc-payment-credits 250 --rpc-payment-difficulty 1000
These values are an example only.
The --rpc-payment-difficulty switch selects how hard each "share" should
be, similar to a mining pool. The higher the difficulty, the fewer
shares a client will find.
The --rpc-payment-credits switch selects how many credits are awarded
for each share a client finds.
Considering both options, clients will be awarded credits/difficulty
credits for every hash they calculate. For example, in the command line
above, 0.25 credits per hash. A client mining at 100 H/s will therefore
get an average of 25 credits per second.
For reference, in the current implementation, a credit is enough to
sync 20 blocks, so a 100 H/s client that's just starting to use Monero
and uses this daemon will be able to sync 500 blocks per second.
The wallet can be set to automatically mine if connected to a daemon
which requires payment for RPC usage. It will try to keep a balance
of 50000 credits, stopping mining when it's at this level, and starting
again as credits are spent. With the example above, a new client will
mine this much credits in about half an hour, and this target is enough
to sync 500000 blocks (currently about a third of the monero blockchain).
There are three new settings in the wallet:
- credits-target: this is the amount of credits a wallet will try to
reach before stopping mining. The default of 0 means 50000 credits.
- auto-mine-for-rpc-payment-threshold: this controls the minimum
credit rate which the wallet considers worth mining for. If the
daemon credits less than this ratio, the wallet will consider mining
to be not worth it. In the example above, the rate is 0.25
- persistent-rpc-client-id: if set, this allows the wallet to reuse
a client id across runs. This means a public node can tell a wallet
that's connecting is the same as one that connected previously, but
allows a wallet to keep their credit balance from one run to the
other. Since the wallet only mines to keep a small credit balance,
this is not normally worth doing. However, someone may want to mine
on a fast server, and use that credit balance on a low power device
such as a phone. If left unset, a new client ID is generated at
each wallet start, for privacy reasons.
To mine and use a credit balance on two different devices, you can
use the --rpc-client-secret-key switch. A wallet's client secret key
can be found using the new rpc_payments command in the wallet.
Note: anyone knowing your RPC client secret key is able to use your
credit balance.
The wallet has a few new commands too:
- start_mining_for_rpc: start mining to acquire more credits,
regardless of the auto mining settings
- stop_mining_for_rpc: stop mining to acquire more credits
- rpc_payments: display information about current credits with
the currently selected daemon
The node has an extra command:
- rpc_payments: display information about clients and their
balances
The node will forget about any balance for clients which have
been inactive for 6 months. Balances carry over on node restart.
|
|
Resolves https://hackerone.com/reports/652911
|
|
|
|
9f3be3b epee: use SO_REUSEADDR on non-Windows targets (xiphon)
|
|
|
|
23ba69e epee: fix SSL server handshake, run_one() can block, use poll_one() (xiphon)
|
|
1080136 abstract_tcp_server2: move 'Trying to connect' from error to debug (moneromooo-monero)
|
|
be82c40 Support median block size > 4 GB (moneromooo-monero)
|
|
add a 128/64 division routine so we can use a > 32 bit median block
size in calculations
|
|
|
|
e48dcb7 levin: armour against some 'should not happen' case (moneromooo-monero)
|
|
If adding a response handler after the protocol is released,
they could never be cancelled again, and would end up keeping
a ref that never goes away
|
|
c9cfbf7 epee: tcp server - set SO_LINGER instead of SO_REUSEADDR option (xiphon)
|
|
4b654f6 abstract_tcp_server2: log pointer, not contents, where appropriate (moneromooo-monero)
|
|
and fix the message grammar
|
|
24473d7 build: fix MinGW GUI dependencies build (xiphon)
|
|
4371791 epee: implement handshake timeout for SSL connections (xiphon)
|
|
7d81850 epee: fix network timeouts in blocked_mode_client (xiphon)
|
|
|
|
1b91beb abstract_tcp_server2: fix lingering connections (moneromooo-monero)
|
|
Coverity fixes [3a81639, 1bd962d, 2825f07, d099658, d46f701, cd57a10] (anonimal)
|
|
5f8524e Streamline build setup (hyc)
|
|
|
|
|
|
Usually it's unset, but depends toolchain files set it explicitly
for cross-compiling. Don't override preset values. But make sure
it's set for all x86 / x86_64 builds, not just Linux.
Also make sure -std=c++11 is set for Darwin builds, not all
submodules were getting it consistently before.
|
|
Use shorter, prefix-unique directory names
gitian-builder -> builder
gitian-sigs -> sigs
monero-binaries -> out
Just use builder/inputs/monero, no need for 2nd repo clone
|
|
use mfatal/merror/mwarning/minfo/mdebug/mtrace
|
|
ab2819a depends: attempt to fix readline (iDunk5400)
|
|
e09dbc6 depends: fix monero binaries Boost linking errors (iDunk5400)
|
|
0c55837 contrib: add a suppressions file for leak sanitizer (moneromooo-monero)
|
|
|
|
|
|
As a side effect, colouring on Windows should now work
regardless of version
|
|
73f22c4 depends: fix MacOS build with Clang 3.7.1 (vtnerd)
|
|
Resetting the timer after shutdown was initiated would keep
a reference to the object inside ASIO, which would keep the
connection alive until the timer timed out
|
|
It would try to link against host system Boost libs when building outside gitian. Tested with x86_64-linux-gnu target.
|
|
5f4bd92 Fix Travis build on Windows + Mac (hyperreality)
|
|
|
|
The problem actually exists in two parts:
1. When sending chunks over a connection, if the queue size is
greater than N, the seed is predictable across every monero node.
>"If rand() is used before any calls to srand(), rand() behaves as if
it was seeded with srand(1). Each time rand() is seeded with the same seed, it
must produce the same sequence of values."
2. The CID speaks for itself: "'rand' should not be used for security-related
applications, because linear congruential algorithms are too easy to break."
*But* this is an area of contention.
One could argue that a CSPRNG is warranted in order to fully mitigate any
potential timing attacks based on crafting chunk responses. Others could argue
that the existing LCG, or even an MTG, would suffice (if properly seeded). As a
compromise, I've used an MTG with a full bit space. This should give a healthy
balance of security and speed without relying on the existing crypto library
(which I'm told might break on some systems since epee is not (shouldn't be)
dependent upon the existing crypto library).
|
|
Make readline actually compile, and make ncurses use existing terminfo data (if available).
|
|
|
|
|
|
IP addresses are stored in network byte order even on little
endian hosts
|
|
|
|
|
|
IPv4 addresses are kept in network byte order in memory
|
|
2a41dc0 epee: fix connections not being properly closed in some instances (moneromooo-monero)
|
|
bdcdb0e Remove unused code under WINDWOS_PLATFORM guard (tomsmeding)
a84aa04 syncobj.h no longer defines shared_guard, so remove those define's (tomsmeding)
|
|
e3cff3d Gitian build script fixes for MacOS (jonathancross)
|
|
f26e663 Gitian build (mac, linux): gzip => bzip2 (jonathancross)
|
|
1a367d6 simplewallet: lock console on inactivity (moneromooo-monero)
|
|
with the Cryptonight per-thread buffer
|
|
|
|
Following 13c0b8c, the unwind package is being attempted to be built on
Windows and Mac when it should only be built on Linux.
|
|
The removed preprocessor macro's refer to types that are not defined in
the file anymore; the only other place where shared_guard is defined is
in winobj.h, which also defines the same macro's. Therefore, this change
is safe.
(Side note is that these macro's weren't used at all anyway, but that is
orthogonal to the issue.)
|
|
30779de fix feature not introduced until boost 1.66 (jtgrassie)
|
|
13c0b8c Add depends riscv 64 bit support (TheCharlatan)
|
|
|
|
|
|
9a5933f Gitian: Add version string to output tar archives (TheCharlatan)
|
|
59eecc7 Update icu4c to latest support version (TheCharlatan)
|
|
Fixed by Fixed by crCr62U0
|
|
|
|
28c3e73 gitian build README improvements (jonathancross)
|
|
fcbf7b3 p2p: propagate out peers limit to payload handler (moneromooo-monero)
098aadf p2p: close the right number of connections on setting max in/out peers (moneromooo-monero)
|
|
a182df2 Bans for RPC connections (hyc)
|
|
This code has been present, unchanged, ever since the original move to
github in 2014 with commit 296ae46ed.
|
|
|
|
new cli options (RPC ones also apply to wallet):
--p2p-bind-ipv6-address (default = "::")
--p2p-bind-port-ipv6 (default same as ipv4 port for given nettype)
--rpc-bind-ipv6-address (default = "::1")
--p2p-use-ipv6 (default false)
--rpc-use-ipv6 (default false)
--p2p-require-ipv4 (default true, if ipv4 bind fails and this is
true, will not continue even if ipv6 bind
successful)
--rpc-require-ipv4 (default true, description as above)
ipv6 addresses are to be specified as "[xx:xx:xx::xx:xx]:port" except
in the cases of the cli args for bind address. For those the square
braces can be omitted.
|
|
|
|
afbf05b Add option to run gitian-build.py on non-debian os (TheCharlatan)
|
|
9a6006b abstract_tcp_server2: move some things out of a lock (moneromooo-monero)
|
|
6abaaaa remove obsolete save_graph skeleton code (moneromooo-monero)
|
|
f61a315 net_utils: fix m_ssl type from time_t to bool (moneromooo-monero)
|
|
|
|
|
|
|
|
|
|
8f22279 Depends: Update HIDAPI version (TheCharlatan)
|
|
The tar archives generated by gitian are currently unversioned. This
adds either a tag name when building from a tag, or a short commit id
when building from a commit hash.
|
|
The macos binaries in release v0.14.1.0 were compiled with the buggy
hidapi-0.8.0-rc1 version. This resulted in users not being able to use
their Ledger with the latest cli wallet. After the patch depends now
fetches the source from the libusb hidapi repository that has taken over
maintenance of hidapi.
|
|
Before this commit the icu4c repo was fetched from TheCharlatan's
repository. This step was made, because up until recently the source
code was hosted on sourceforge and their downloads proved very
unreliable. The origin is now the official icu4c repository.
Also remove some commented lines left over from development.
|
|
This commits adds the `--no-apt` flag to the gitian-build.py script.
This allows gitian builds to be run without root access and non-debian
based operating systems.
|
|
Readline support is now compiled with the ncurses backend.
|
|
To speedup the depends cached builds, remove some some clutter from the package
files. This mainly incldues removing all the shared libraries and .la
linker files. It also gives stronger guarantees that monero only links
the static libs without any external rvalues.
|
|
Packages can now be built individually and for each stage. This allows
easier debugging.
|
|
|
|
Make bans control RPC sessions too. And auto-ban some bad requests.
Drops HTTP connections whenever response code is 500.
|
|
NULL is valid when size is 0, but memcpy uses nonnull attributes,
so let's not poke the bear
|
|
|
|
Reported by guidov
|
|
3a0fbea Don't use -march=native (hyc)
f8b2f25 Allow parallel make (hyc)
01ced20 Delete redundant cppzmq dependency (hyc)
1dc4ebf Use 9 digit build IDs (hyc)
|
|
c27d961 [depends] update openssl to 1.0.2r (who-biz)
|
|
|
|
|
|
|
|
|
|
b0a04f7 epee: fix SSL autodetect on reconnection (xiphon)
|
|
|
|
GCC wants operator= aand copy ctor to be both defined, or neither
|
|
|
|
- This addresses https://www.openssl.org/news/secadv/20190226.txt (CVE: 2019-1559) which impacted all versions of openssl-1.0.
Note that this does not address CVE-2019-1543 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1543), which impacts all versions of openssl 1.1 through 1.1.0j and 1.1.1b.
The above (1.1) is patched in openssl, where it was marked as low severity. Similar issues possibly present in monero, should be looked into w.r.t. CVE-2019-1543.
|
|
3f612cda Changed odd bullet point to low level header (Rohaq)
af9bc4ec Used subeaders to avoid slightly wonky looking formatting (Rohaq)
1873af35 Made code block usage consistent across all .md files (Rohaq)
68103075 Updated Copyright notice (Rohaq)
39bd157f Added Table of Contents to main README.md (Rohaq)
|
|
9a7a453 net_ssl: free certs after setting them up (moneromooo-monero)
|
|
b8b957d cmake: fix incorrect hint for OPENSSL_ROOT_DIR (moneromooo-monero)
367bb80 mlog: default to not showing SSL errors (moneromooo-monero)
|
|
|
|
The lock is meant for the network throttle object only,
and this should help coverity get unconfused
|
|
|
|
|
|
|
|
a62e0725 net_ssl: SSL config tweaks for compatibility and security (moneromooo-monero)
|
|
a4c4a2d8 blockchain: keep a rolling long term block weight median (moneromooo-monero)
|
|
f29fecd5 build: debug and test builds via contrib (Dusan Klinec)
|
|
add two RSA based ciphers for Windows/depends compatibility
also enforce server cipher ordering
also set ECDH to auto because vtnerd says it is good :)
When built with the depends system, openssl does not include any
cipher on the current whitelist, so add this one, which fixes the
problem, and does seem sensible.
|
|
|
|
|
|
SHA1 is too close to bruteforceable
|
|
9956500d net_helper: clear recv buffer on eof (moneromooo-monero)
|
|
edbae2d0 levin_protocol_handler_async: tune down preallocation a fair bit (moneromooo-monero)
|
|
|
|
It can allocate a lot when getting a lot of connections
(in particular, the stress test on windows apparently pushes
that memory to actual use, rather than just allocated)
|
|
|
|
|
|
02c01c0b Add Brewfile to allow for an even easier management of dependencies (Florian)
|
|
b18f0b10 wallet: new --offline option (moneromooo-monero)
|
|
61d63900 net_helper: avoid unnecessary memcpy (moneromooo-monero)
|
|
c3cf930f abstract_tcp_server2: fix timeout on exit (moneromooo-monero)
|
|
|
|
It will avoid connecting to a daemon (so useful for cold signing
using a RPC wallet), and not perform DNS queries.
|
|
e72c2c5d do not build in parallel as it is non-deterministic (Jane Mercer)
|
|
|
|
When closing connections due to exiting, the IO service is
already gone, so the data exchange needed for a gracious SSL
shutdown cannot happen. We just close the socket in that case.
|
|
|
|
displays total sent and received bytes
|
|
|
|
If `--daemon-ssl enabled` is set in the wallet, then a user certificate,
fingerprint, or onion/i2p address must be provided.
|
|
An override for the wallet to daemon connection is provided, but not for
other SSL contexts. The intent is to prevent users from supplying a
system CA as the "user" whitelisted certificate, which is less secure
since the key is controlled by a third party.
|
|
This allows "chain" certificates to be used with the fingerprint
whitelist option. A user can get a system-ca signature as backup while
clients explicitly whitelist the server certificate. The user specified
CA can also be combined with fingerprint whitelisting.
|
|
The former has the same behavior with single self signed certificates
while allowing the server to have separate short-term authentication
keys with long-term authorization keys.
|
|
If the verification mode is `system_ca`, clients will now do hostname
verification. Thus, only certificates from expected hostnames are
allowed when SSL is enabled. This can be overridden by forcible setting
the SSL mode to autodetect.
Clients will also send the hostname even when `system_ca` is not being
performed. This leaks possible metadata, but allows servers providing
multiple hostnames to respond with the correct certificate. One example
is cloudflare, which getmonero.org is currently using.
|
|
If SSL is "enabled" via command line without specifying a fingerprint or
certificate, the system CA list is checked for server verification and
_now_ fails the handshake if that check fails. This change was made to
remain consistent with standard SSL/TLS client behavior. This can still
be overridden by using the allow any certificate flag.
If the SSL behavior is autodetect, the system CA list is still checked
but a warning is logged if this fails. The stream is not rejected
because a re-connect will be attempted - its better to have an
unverified encrypted stream than an unverified + unencrypted stream.
|
|
Using `verify_peer` on server side requests a certificate from the
client. If no certificate is provided, the server silently accepts the
connection and rejects if the client sends an unexpected certificate.
Adding `verify_fail_if_no_cert` has no affect on client and for server
requires that the peer sends a certificate or fails the handshake. This
is the desired behavior when the user specifies a fingerprint or CA file.
|
|
|
|
Currently a client must provide a certificate, even if the server is
configured to allow all certificates. This drops that requirement from
the client - unless the server is configured to use a CA file or
fingerprint(s) for verification - which is the standard behavior for SSL
servers.
The "system-wide" CA is not being used as a "fallback" to verify clients
before or after this patch.
|
|
Specifying SSL certificates for peer verification does an exact match,
making it a not-so-obvious alias for the fingerprints option. This
changes the checks to OpenSSL which loads concatenated certificate(s)
from a single file and does a certificate-authority (chain of trust)
check instead. There is no drop in security - a compromised exact match
fingerprint has the same worse case failure. There is increased security
in allowing separate long-term CA key and short-term SSL server keys.
This also removes loading of the system-default CA files if a custom
CA file or certificate fingerprint is specified.
|
|
1569776a Add missing include (Leon Klingele)
|
|
dffdccdc No longer use deprecated RSA_generate_key in favor of RSA_generate_key_ex (Martijn Otto)
|
|
59776a64 epee: some more minor JSON parsing speedup (moneromooo-monero)
|
|
c23ea796 New interactive daemon command 'print_net_stats': Global traffic stats (rbrunner7)
|
|
43042a28 Implement array_entry_t copy constructor (Guido Vranken)
|
|
|
|
|
|
RSA_generate_key_ex
|
|
|
|
|
|
6ef816de console_handler: print newline on EOF (moneromooo-monero)
|
|
|
|
16590294 abstract_tcp_server2: fix crashy race on socket shutdown (moneromooo-monero)
|
|
9141a0a1 connection_basic: remove debug exception ^_^ (moneromooo-monero)
|
|
get_io_service was deprecated, and got removed
|
|
|
|
Manually initialize the array_entry_t iterator to ensure it points
to the correct m_array, thereby preventing a potential use-after-free
situation.
Signed-off-by: Guido Vranken <guidovranken@gmail.com>
|
|
1f2930ce Update 2019 copyright (binaryFate)
|
|
This avoids the annoying case where the shell prints its prompt
after the last line from Monero output, causing line editing to
sometimes go wonky, for lack of a better term
|
|
- pkey gets deleted by the pkey_deleter but the caller tries to serialize it which causes errors as the memory is freed
|
|
|
|
Use SSL API directly, skip boost layer
|
|
|
|
RPC connections now have optional tranparent SSL.
An optional private key and certificate file can be passed,
using the --{rpc,daemon}-ssl-private-key and
--{rpc,daemon}-ssl-certificate options. Those have as
argument a path to a PEM format private private key and
certificate, respectively.
If not given, a temporary self signed certificate will be used.
SSL can be enabled or disabled using --{rpc}-ssl, which
accepts autodetect (default), disabled or enabled.
Access can be restricted to particular certificates using the
--rpc-ssl-allowed-certificates, which takes a list of
paths to PEM encoded certificates. This can allow a wallet to
connect to only the daemon they think they're connected to,
by forcing SSL and listing the paths to the known good
certificates.
To generate long term certificates:
openssl genrsa -out /tmp/KEY 4096
openssl req -new -key /tmp/KEY -out /tmp/REQ
openssl x509 -req -days 999999 -sha256 -in /tmp/REQ -signkey /tmp/KEY -out /tmp/CERT
/tmp/KEY is the private key, and /tmp/CERT is the certificate,
both in PEM format. /tmp/REQ can be removed. Adjust the last
command to set expiration date, etc, as needed. It doesn't
make a whole lot of sense for monero anyway, since most servers
will run with one time temporary self signed certificates anyway.
SSL support is transparent, so all communication is done on the
existing ports, with SSL autodetection. This means you can start
using an SSL daemon now, but you should not enforce SSL yet or
nothing will talk to you.
|
|
|
|
|
|
4d3b61a3 Use io_service::work in epee tcp server (Lee Clagett)
|
|
7af4fbd4 epee: Add space after ':' in additional http response headers (Tom Smeding)
|
|
4a9257b4 Support docker for gitian builds (TheCharlatan)
|
|
7da7a9bb Update openssl to 1.0.2q in depends build system (who-biz)
|
|
f0fc4064 Various speedups to depends and Travis (TheCharlatan)
|
|
c0e9e805 Fixed missing return value in once_a_time class on windows (Markus Behm)
|
|
1eef0565 performance_tests: better stats, and keep track of timing history (moneromooo-monero)
|
|
7c3ade44 network_throttle: use circular_buffer where appropriate (moneromooo-monero)
|
|
123fc2a2 i2p: initial support (Jethro Grassie)
|
|
Further speedups to icu compilation, it is faster to run the
pre-generated configure scripts.
Ensure that the native protobuf installation only generates the required
libraries and binaries.
Disable qt compilation when running travis on windows. Qt is used for
lrelease, the travis recipe instead usese the a local installation of
lrelease.
Remove various packages and options from the travis recipe.
Update Readline to version 8.0. The previously used url 404'd sometimes,
use the official gnu ftp server instead.
Remove unused cmake config.
|
|
|
|
Building with docker is arguably easier and more familiar to most people
than either kvm, or lxc.
This commit also relaxes the back compat requirement a bit. 32 bit linux
now uses glibc version 2.0. Also, the docker shell could not handle gcc arguments
containing spaces, so the explicit '-DFELT_TYPE' declaration was dropped.
Lastly, this removes some packages from the osx descriptor.
|
|
|
|
|
|
|
|
RPC connections now have optional tranparent SSL.
An optional private key and certificate file can be passed,
using the --{rpc,daemon}-ssl-private-key and
--{rpc,daemon}-ssl-certificate options. Those have as
argument a path to a PEM format private private key and
certificate, respectively.
If not given, a temporary self signed certificate will be used.
SSL can be enabled or disabled using --{rpc}-ssl, which
accepts autodetect (default), disabled or enabled.
Access can be restricted to particular certificates using the
--rpc-ssl-allowed-certificates, which takes a list of
paths to PEM encoded certificates. This can allow a wallet to
connect to only the daemon they think they're connected to,
by forcing SSL and listing the paths to the known good
certificates.
To generate long term certificates:
openssl genrsa -out /tmp/KEY 4096
openssl req -new -key /tmp/KEY -out /tmp/REQ
openssl x509 -req -days 999999 -sha256 -in /tmp/REQ -signkey /tmp/KEY -out /tmp/CERT
/tmp/KEY is the private key, and /tmp/CERT is the certificate,
both in PEM format. /tmp/REQ can be removed. Adjust the last
command to set expiration date, etc, as needed. It doesn't
make a whole lot of sense for monero anyway, since most servers
will run with one time temporary self signed certificates anyway.
SSL support is transparent, so all communication is done on the
existing ports, with SSL autodetection. This means you can start
using an SSL daemon now, but you should not enforce SSL yet or
nothing will talk to you.
|
|
|
|
|
|
- Support for ".onion" in --add-exclusive-node and --add-peer
- Add --anonymizing-proxy for outbound Tor connections
- Add --anonymous-inbounds for inbound Tor connections
- Support for sharing ".onion" addresses over Tor connections
- Support for broadcasting transactions received over RPC exclusively
over Tor (else broadcast over public IP when Tor not enabled).
|
|
acfff8d0 rpc: fix internal daemon calls in restricted rpc getting partial data (moneromooo-monero)
|
|
|
|
45ea19fa bump sodium to 1.0.16 (italocoin)
|
|
ca86ef1b readline: don't dereference possible NULL pointer (Jethro Grassie)
|
|
|
|
The blockchain prunes seven eighths of prunable tx data.
This saves about two thirds of the blockchain size, while
keeping the node useful as a sync source for an eighth
of the blockchain.
No other data is currently pruned.
There are three ways to prune a blockchain:
- run monerod with --prune-blockchain
- run "prune_blockchain" in the monerod console
- run the monero-blockchain-prune utility
The first two will prune in place. Due to how LMDB works, this
will not reduce the blockchain size on disk. Instead, it will
mark parts of the file as free, so that future data will use
that free space, causing the file to not grow until free space
grows scarce.
The third way will create a second database, a pruned copy of
the original one. Since this is a new file, this one will be
smaller than the original one.
Once the database is pruned, it will stay pruned as it syncs.
That is, there is no need to use --prune-blockchain again, etc.
|
|
|
