security: harden gRPC server — disable by default, bind to localhost

docs/cli/server.md

@@ -62,7 +62,7 @@ The ```bor server``` command runs the Bor client.
 
 - ```gpo.percentile```: Suggested gas price is the given percentile of a set of recent transaction gas prices (default: 60)
 
-- ```grpc.addr```: Address and port to bind the GRPC server (default: :3131)
+- ```grpc.addr```: Address and port to bind the GRPC server (default: 127.0.0.1:3131)
 
 - ```history.logs```: Number of recent blocks to maintain log search index for (default = about 2 months, 0 = entire chain) (default: 2350000)
 

internal/cli/debug_test.go

@@ -36,8 +36,8 @@ func TestCommand_DebugBlock(t *testing.T) {
 
 	defer server.CloseMockServer(srv)
 
-	// get the grpc port
-	port := srv.GetGrpcAddr()
+	// get the grpc address
+	grpcAddr := srv.GetGrpcAddr()
 
 	// wait for 4 seconds to mine a 2 blocks
 	time.Sleep(2 * time.Duration(config.Developer.Period) * time.Second)
@@ -54,7 +54,7 @@ func TestCommand_DebugBlock(t *testing.T) {
 	// trace 1st block
 	start := time.Now()
 	dst1 := path.Join(output, prefix+time.Now().UTC().Format("2006-01-02-150405Z"), "block.json")
-	res := traceBlock(port, 1, output)
+	res := traceBlock(grpcAddr, 1, output)
 	require.Equal(t, 0, res)
 	t.Logf("Completed trace of block %d in %d ms at %s", 1, time.Since(start).Milliseconds(), dst1)
 
@@ -65,7 +65,7 @@ func TestCommand_DebugBlock(t *testing.T) {
 	start = time.Now()
 	latestBlock := srv.GetLatestBlockNumber().Int64()
 	dst2 := path.Join(output, prefix+time.Now().UTC().Format("2006-01-02-150405Z"), "block.json")
-	res = traceBlock(port, latestBlock, output)
+	res = traceBlock(grpcAddr, latestBlock, output)
 	require.Equal(t, 0, res)
 	t.Logf("Completed trace of block %d in %d ms at %s", latestBlock, time.Since(start).Milliseconds(), dst2)
 
@@ -80,12 +80,12 @@ func TestCommand_DebugBlock(t *testing.T) {
 }
 
 // traceBlock calls the cli command to trace a block
-func traceBlock(port string, number int64, output string) int {
+func traceBlock(addr string, number int64, output string) int {
 	ui := cli.NewMockUi()
 	command := &DebugBlockCommand{
 		Meta2: &Meta2{
 			UI:   ui,
-			addr: "127.0.0.1:" + port,
+			addr: addr,
 		},
 	}
 

internal/cli/server/config.go

@@ -999,7 +999,7 @@ func DefaultConfig() *Config {
 			DisableBorWallet:    true,
 		},
 		GRPC: &GRPCConfig{
-			Addr: ":3131",
+			Addr: "127.0.0.1:3131",
 		},
 		Developer: &DeveloperConfig{
 			Enabled:  false,

internal/cli/server/helper.go

@@ -21,7 +21,7 @@ func CreateMockServer(config *Config) (*Server, error) {
 	}
 
 	// The test uses grpc port from config so setting it here.
-	config.GRPC.Addr = fmt.Sprintf(":%d", grpcPort)
+	config.GRPC.Addr = fmt.Sprintf("127.0.0.1:%d", grpcPort)
 
 	// datadir
 	datadir, err := os.MkdirTemp("", "bor-cli-test")

internal/cli/server/server.go

@@ -521,7 +521,7 @@ func (s *Server) GetLatestBlockNumber() *big.Int {
 }
 
 func (s *Server) GetGrpcAddr() string {
-	return s.config.GRPC.Addr[1:]
+	return s.config.GRPC.Addr
 }
 
 // setupHealthService initializes the health service for Bor.

internal/cli/server/testdata/default.toml

@@ -178,7 +178,7 @@ devfakeauthor = false
   disable-bor-wallet = true
 
 [grpc]
-  addr = ":3131"
+  addr = "127.0.0.1:3131"
 
 [developer]
   dev = false

internal/cli/status_test.go

@@ -25,13 +25,13 @@ func TestStatusCommand(t *testing.T) {
 
 	defer server.CloseMockServer(srv)
 
-	// get the grpc port
-	port := srv.GetGrpcAddr()
+	// get the grpc address
+	grpcAddr := srv.GetGrpcAddr()
 
 	command1 := &StatusCommand{
 		Meta2: &Meta2{
 			UI:   cli.NewMockUi(),
-			addr: "127.0.0.1:" + port,
+			addr: grpcAddr,
 		},
 		wait: true,
 	}