Repository: bitcoin/bitcoin
File: test/functional/interface_http.py (Python)

Code before:
#!/usr/bin/env python3
# Copyright (c) 2014-2021 The Bitcoin Core developers
# Distributed under the MIT software license, see the accompanying
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
"""Test the RPC HTTP basics."""

from test_framework.test_framework import BitcoinTestFramework
from test_framework.util import assert_equal, str_to_b64str

import http.client
import urllib.parse

class HTTPBasicsTest (BitcoinTestFramework):
    def set_test_params(self):
        self.num_nodes = 3
        self.supports_cli = False

    def setup_network(self):
        self.setup_nodes()

    def run_test(self):

        #################################################
        # lowlevel check for http persistent connection #
        #################################################
        url = urllib.parse.urlparse(self.nodes[0].url)
        authpair = f'{url.username}:{url.password}'
        headers = {"Authorization": f"Basic {str_to_b64str(authpair)}"}

        conn = http.client.HTTPConnection(url.hostname, url.port)
        conn.connect()
        conn.request('POST', '/', '{"method": "getbestblockhash"}', headers)
        out1 = conn.getresponse().read()
        assert b'"error":null' in out1
        assert conn.sock is not None  #according to http/1.1 connection must still be open!

        #send 2nd request without closing connection
        conn.request('POST', '/', '{"method": "getchaintips"}', headers)
        out1 = conn.getresponse().read()
        assert b'"error":null' in out1  #must also response with a correct json-rpc message
        assert conn.sock is not None  #according to http/1.1 connection must still be open!
        conn.close()

        #same should be if we add keep-alive because this should be the std. behaviour
        headers = {"Authorization": f"Basic {str_to_b64str(authpair)}", "Connection": "keep-alive"}

        conn = http.client.HTTPConnection(url.hostname, url.port)
        conn.connect()
        conn.request('POST', '/', '{"method": "getbestblockhash"}', headers)
        out1 = conn.getresponse().read()
        assert b'"error":null' in out1
        assert conn.sock is not None  #according to http/1.1 connection must still be open!

        #send 2nd request without closing connection
        conn.request('POST', '/', '{"method": "getchaintips"}', headers)
        out1 = conn.getresponse().read()
        assert b'"error":null' in out1  #must also response with a correct json-rpc message
        assert conn.sock is not None  #according to http/1.1 connection must still be open!
        conn.close()

        #now do the same with "Connection: close"
        headers = {"Authorization": f"Basic {str_to_b64str(authpair)}", "Connection":"close"}

        conn = http.client.HTTPConnection(url.hostname, url.port)
        conn.connect()
        conn.request('POST', '/', '{"method": "getbestblockhash"}', headers)
        out1 = conn.getresponse().read()
        assert b'"error":null' in out1
        assert conn.sock is None  #now the connection must be closed after the response

        #node1 (2nd node) is running with disabled keep-alive option
        urlNode1 = urllib.parse.urlparse(self.nodes[1].url)
        authpair = f'{urlNode1.username}:{urlNode1.password}'
        headers = {"Authorization": f"Basic {str_to_b64str(authpair)}"}

        conn = http.client.HTTPConnection(urlNode1.hostname, urlNode1.port)
        conn.connect()
        conn.request('POST', '/', '{"method": "getbestblockhash"}', headers)
        out1 = conn.getresponse().read()
        assert b'"error":null' in out1

        #node2 (third node) is running with standard keep-alive parameters which means keep-alive is on
        urlNode2 = urllib.parse.urlparse(self.nodes[2].url)
        authpair = f'{urlNode2.username}:{urlNode2.password}'
        headers = {"Authorization": f"Basic {str_to_b64str(authpair)}"}

        conn = http.client.HTTPConnection(urlNode2.hostname, urlNode2.port)
        conn.connect()
        conn.request('POST', '/', '{"method": "getbestblockhash"}', headers)
        out1 = conn.getresponse().read()
        assert b'"error":null' in out1
        assert conn.sock is not None  #connection must be closed because bitcoind should use keep-alive by default

        # Check excessive request size
        conn = http.client.HTTPConnection(urlNode2.hostname, urlNode2.port)
        conn.connect()
        conn.request('GET', f'/{"x"*1000}', '', headers)
        out1 = conn.getresponse()
        assert_equal(out1.status, http.client.NOT_FOUND)

        conn = http.client.HTTPConnection(urlNode2.hostname, urlNode2.port)
        conn.connect()
        conn.request('GET', f'/{"x"*10000}', '', headers)
        out1 = conn.getresponse()
        assert_equal(out1.status, http.client.BAD_REQUEST)


if __name__ == '__main__':
    HTTPBasicsTest(__file__).main()


Review comment (security):
That should be 2, I guess since the timeout is set to 2. E.g. disconnecting after 1.5 seconds is unexpected and should be treated as an error.

```diff
diff --git i/test/functional/interface_http.py w/test/functional/interface_http.py
index 4f10b55afd..9c345c30b9 100755
--- i/test/functional/interface_http.py
+++ w/test/functional/interface_http.py
@@ -185,13 +185,14 @@ class HTTPBasicsTest (BitcoinTestFramework):
         # so low on this one node, its connection will quickly timeout and get dropped by
         # the server. Negating this setting will force the AuthServiceProxy
         # for this node to create a fresh new HTTP connection for every command
         # called for the remainder of this test.
         self.nodes[2].reuse_http_connections = False
 
-        self.restart_node(2, extra_args=["-rpcservertimeout=2"])
+        rpcservertimeout = 2
+        self.restart_node(2, extra_args=[f"-rpcservertimeout={rpcservertimeout}"])
         # This is the amount of time the server will wait for a client to
         # send a complete request. Test it by sending an incomplete but
         # so-far otherwise well-formed HTTP request, and never finishing it.
 
         # Copied from http_incomplete_test_() in regress_http.c in libevent.
         # A complete request would have an additional "\r\n" at the end.
@@ -199,24 +200,24 @@ class HTTPBasicsTest (BitcoinTestFramework):
 
         # Get the underlying socket from HTTP connection so we can send something unusual
         conn = http.client.HTTPConnection(urlNode2.hostname, urlNode2.port)
         conn.connect()
         sock = conn.sock
         sock.sendall(http_request.encode("utf-8"))
-        # Wait for response, but expect a timeout disconnection after 1 second
+        # Wait for response, but expect a timeout disconnection after `rpcservertimeout` seconds
         start = time.time()
         res = sock.recv(1024)
         stop = time.time()
         # Server disconnected with EOF
         assert res == b""
         # Server disconnected within an acceptable range of time:
         # not immediately, and not too far over the configured duration.
         # This allows for some jitter in the test between client and server.
         duration = stop - start
         assert duration <= 4, f"Server disconnected too slow: {duration} > 4"
-        assert duration >= 1, f"Server disconnected too fast: {duration} < 1"
+        assert duration >= rpcservertimeout, f"Server disconnected too fast: {duration} < {rpcservertimeout}"
         # The connection is definitely closed.
         try:
             conn.request('GET', '/')
             conn.getresponse()
         #       macos/linux           windows
         except (ConnectionResetError, ConnectionAbortedError):
```

Code after:
        self.restart_node(2, extra_args=["-rpcservertimeout=2"])
        # This is the amount of time the server will wait for a client to
        # send a complete request. Test it by sending an incomplete but
        # so-far otherwise well-formed HTTP request, and never finishing it.

        # Copied from http_incomplete_test_() in regress_http.c in libevent.
        # A complete request would have an additional "\r\n" at the end.
        http_request = "GET /test1 HTTP/1.1\r\nHost: somehost\r\n"

        # Get the underlying socket from HTTP connection so we can send something unusual
        conn = http.client.HTTPConnection(urlNode2.hostname, urlNode2.port)
        conn.connect()
        sock = conn.sock
        sock.sendall(http_request.encode("utf-8"))
        # Wait for response, but expect a timeout disconnection after 1 second
        start = time.time()
        res = sock.recv(1024)
        stop = time.time()
        # Server disconnected with EOF
        assert_equal(res, b"")
        # Server disconnected within an acceptable range of time:
        # not immediately, and not too far over the configured duration.
        # This allows for some jitter in the test between client and server.
        duration = stop - start
        assert duration <= 4, f"Server disconnected too slow: {duration} > 4"
        assert duration >= 1, f"Server disconnected too fast: {duration} < 1"

        # The connection is definitely closed.
        got_expected_error = False
        try:
            conn.request('GET', '/')
            conn.getresponse()
        #       macos/linux           windows
        except (ConnectionResetError, ConnectionAbortedError):
            got_expected_error = True
        assert got_expected_error

        # Sanity check
        http_request = "GET /test2 HTTP/1.1\r\nHost: somehost\r\n\r\n"
        conn = http.client.HTTPConnection(urlNode2.hostname, urlNode2.port)
        conn.connect()
        sock = conn.sock
        sock.sendall(http_request.encode("utf-8"))
        res = sock.recv(1024)
        assert res.startswith(b"HTTP/1.1 404 Not Found")
        # still open
        conn.request('GET', '/')
        conn.getresponse()

if __name__ == '__main__':
    HTTPBasicsTest(__file__).main()