fix(framework): handle admin IPC failures and validate HTTP media types (#7085)

Author: 317787106

framework/src/main/java/org/tron/core/services/admin/ipc/client/IpcClient.java

@@ -124,7 +124,7 @@ int runExec(Socket socket, String commandLine) throws IOException {
         System.err.println("Disconnected from server before receiving a response.");
         return EXIT_FAILURE;
       }
-      IpcResponse parsedResponse = IpcResponse.parse(
+      IpcResponse parsedResponse = IpcResponse.parseForExec(
           response, command.getRequestId(), pendingOutputFormats);
       if (parsedResponse.isSuccessful()) {
         System.out.println(parsedResponse.getFormatted());

framework/src/main/java/org/tron/core/services/admin/ipc/client/IpcResponse.java

@@ -34,9 +34,14 @@ static IpcResponse parse(String response, Map<Integer, OutputFormat> pendingOutp
     return parse(response, null, pendingOutputFormats);
   }
 
-  /** Also verifies the numeric request ID when called for single-command execution. */
+  /** Also verifies the numeric request ID without changing JSON-RPC result semantics. */
   static IpcResponse parse(String response, Integer expectedId,
       Map<Integer, OutputFormat> pendingOutputFormats) {
+    return parse(response, expectedId, pendingOutputFormats, false);
+  }
+
+  private static IpcResponse parse(String response, Integer expectedId,
+      Map<Integer, OutputFormat> pendingOutputFormats, boolean checkBusinessResult) {
     try {
       JsonNode root = OBJECT_MAPPER.reader()
           .with(DeserializationFeature.FAIL_ON_TRAILING_TOKENS).readTree(response);
@@ -53,19 +58,32 @@ static IpcResponse parse(String response, Integer expectedId,
       if (root.has("error")) {
         return parseError(root.get("error"));
       }
+      JsonNode result = root.get("result");
+      if (checkBusinessResult && result.isObject() && result.path("success").isBoolean()
+          && !result.get("success").booleanValue()) {
+        JsonNode message = result.path("errorMessage");
+        return new IpcResponse(message.isTextual() && !message.textValue().trim().isEmpty()
+            ? message.textValue() : "Admin operation failed.", false);
+      }
       if (outputFormat == OutputFormat.TEXT) {
-        String table = new ActivePeerOutputFormatter().formatText(root.get("result"));
+        String table = new ActivePeerOutputFormatter().formatText(result);
         if (table != null) {
           return new IpcResponse(table, true);
         }
       }
       // only output column "result" of jsonrpc and ignore other columns
-      return new IpcResponse(formatJsonValue(root.get("result")), true);
+      return new IpcResponse(formatJsonValue(result), true);
     } catch (JsonProcessingException e) {
       return invalidResponse();
     }
   }
 
+  /** Formats a single-command response, treating a business rejection as a command failure. */
+  static IpcResponse parseForExec(String response, int expectedId,
+      Map<Integer, OutputFormat> pendingOutputFormats) {
+    return parse(response, expectedId, pendingOutputFormats, true);
+  }
+
   private static boolean isValidEnvelope(JsonNode root) {
     if (root == null || !root.isObject()
         || !"2.0".equals(root.path("jsonrpc").textValue())

framework/src/main/java/org/tron/core/services/admin/ipc/server/IpcService.java

@@ -55,7 +55,7 @@ public class IpcService extends AbstractService {
 
   private final Set<AFUNIXSocket> activeClientSockets = ConcurrentHashMap.newKeySet();
   private AFUNIXServerSocket unixServerSocket;
-  // Record paths only after this instance successfully creates the corresponding resource.
+  // Track paths only after this instance exclusively creates the private IPC directory.
   private Path socketDirectoryPath;
   private Path socketFilePath;
 
@@ -90,15 +90,23 @@ public void innerStart() throws Exception {
     try {
       socketFiles.createSocketDirectory(socketDirectory);
       socketDirectoryPath = socketDirectory;
+      // A failed bind may already have created the socket file in our private directory.
+      socketFilePath = resolvedSocketFile;
       File socketFile = resolvedSocketFile.toFile();
       AFUNIXSocketAddress address = AFUNIXSocketAddress.of(socketFile);
-      unixServerSocket = AFUNIXServerSocket.bindOn(address);
-      socketFilePath = resolvedSocketFile;
+      unixServerSocket = AFUNIXServerSocket.newInstance();
+      unixServerSocket.bind(address);
       socketFiles.setOwnerOnlyPermissions(socketFilePath);
       unixServerSocket.setShutdownOnClose(true);
 
       logger.info("IpcService started, listening on {}", socketFile.getAbsolutePath());
     } catch (IOException | RuntimeException e) {
+      logger.error("Admin IPC cannot start at {}: {}. Check socket-directory access permissions "
+              + "and filesystem support for Unix sockets and POSIX permission changes. Configure "
+              + "node.admin.ipc.socketDirectory to an existing absolute directory on a compatible "
+              + "local filesystem (in Docker, use a container-local directory such as /tmp). "
+              + "Alternatively, set node.admin.ipc.enable=false to start without Admin IPC.",
+          resolvedSocketFile, e.toString());
       throw rollbackStartup(e);
     }
     Runnable runnable = () -> {

framework/src/main/java/org/tron/core/services/jsonrpc/JsonRpcMediaType.java

@@ -1,11 +1,15 @@
 package org.tron.core.services.jsonrpc;
 
 import java.util.Locale;
+import java.util.regex.Pattern;
 
 public final class JsonRpcMediaType {
 
   private static final String APPLICATION_JSON = "application/json";
   private static final String APPLICATION_JSON_RPC = "application/json-rpc";
+  // RFC 6838 subtype names start with an ASCII letter or digit and contain at most 127 characters.
+  private static final Pattern APPLICATION_JSON_SUFFIX =
+      Pattern.compile("application/[a-z0-9][a-z0-9!#$&^_.+-]{0,121}\\+json");
 
   private JsonRpcMediaType() {
   }
@@ -21,6 +25,6 @@ public static boolean isSupported(String contentType) {
         .toLowerCase(Locale.ROOT);
     return APPLICATION_JSON.equals(mediaType)
         || APPLICATION_JSON_RPC.equals(mediaType)
-        || mediaType.startsWith("application/") && mediaType.endsWith("+json");
+        || APPLICATION_JSON_SUFFIX.matcher(mediaType).matches();
   }
 }

framework/src/test/java/org/tron/core/services/admin/http/AdminRpcServletTest.java

@@ -300,16 +300,44 @@ public void missingContentTypeIsRejected() throws Exception {
     assertEquals(0, response.getContentAsByteArray().length);
   }
 
+  @Test(timeout = 30_000)
+  public void malformedJsonContentTypesAreRejectedBeforeInvocation() throws Exception {
+    TestAdminRpcHttpService service = new TestAdminRpcHttpService();
+    service.setMaxRequestSize(REQUEST_LIMIT);
+    ReflectionTestUtils.setField(service, "adminRpcServlet", servlet);
+    String body = "{\"jsonrpc\":\"2.0\",\"method\":\"admin_listBlockedIps\",\"id\":1}";
+    try {
+      service.start().get(5, TimeUnit.SECONDS);
+      for (String contentType : new String[] {"application/+json",
+          "APPLICATION/+JSON; charset=UTF-8", "application/ +json", "application/a b+json",
+          "application/a/b+json", "application/*+json", "application/.vendor+json",
+          "application/vnd.tron@+json", "application/vnd.troné+json",
+          "application/" + Strings.repeat("a", 123) + "+json"}) {
+        String response = service.postWithContentType(body, contentType);
+
+        assertTrue(contentType + ": " + response,
+            response.startsWith("HTTP/1.1 415 "));
+        assertTrue(response, response.contains("\r\nContent-Length: 0\r\n"));
+        assertEquals("", response.substring(response.indexOf("\r\n\r\n") + 4));
+        verifyNoInteractions(adminJsonRpc);
+      }
+    } finally {
+      service.stop().get(5, TimeUnit.SECONDS);
+    }
+  }
+
   @Test
   public void jsonContentTypesAreAccepted() throws Exception {
     String body = "{\"jsonrpc\":\"2.0\",\"method\":\"admin_listBlockedIps\",\"id\":1}";
-
-    assertEquals(HttpServletResponse.SC_OK,
-        doPost(body, "application/json; charset=UTF-8").getStatus());
-    assertEquals(HttpServletResponse.SC_OK,
-        doPost(body, "application/json-rpc").getStatus());
-    assertEquals(HttpServletResponse.SC_OK,
-        doPost(body, "application/vnd.tron+json").getStatus());
+    String[] contentTypes = {"application/json; charset=UTF-8", "application/json-rpc",
+        "application/vnd.tron+json", "Application/Vnd.Tron+Json; charset=UTF-8",
+        " application/vnd.tron+json ", "application/a+json", "application/1+json",
+        "application/a!#$&^_.+-+json", "application/" + Strings.repeat("a", 122) + "+json"};
+    for (String contentType : contentTypes) {
+      assertEquals(contentType, HttpServletResponse.SC_OK,
+          doPost(body, contentType).getStatus());
+    }
+    verify(adminJsonRpc, times(contentTypes.length)).listBlockedIps();
   }
 
   @Test
@@ -706,17 +734,26 @@ String post(String body, boolean chunked) throws Exception {
     }
 
     String post(String body, boolean chunked, String accept) throws Exception {
+      return post(body, chunked, accept, "application/json");
+    }
+
+    private String post(String body, boolean chunked, String accept, String contentType)
+        throws Exception {
       String framing = chunked ? "Transfer-Encoding: chunked\r\n"
           : "Content-Length: " + body.length() + "\r\n";
       String content = chunked ? Integer.toHexString(body.length()) + "\r\n"
           + body + "\r\n0\r\n\r\n" : body;
       String request = "POST /admin HTTP/1.1\r\n"
           + "Host: 127.0.0.1\r\n"
-          + "Content-Type: application/json\r\n"
+          + "Content-Type: " + contentType + "\r\n"
           + (accept == null ? "" : "Accept: " + accept + "\r\n")
           + "Connection: close\r\n" + framing + "\r\n" + content;
       return connector.getResponse(request, 5, TimeUnit.SECONDS);
     }
+
+    String postWithContentType(String body, String contentType) throws Exception {
+      return post(body, false, null, contentType);
+    }
   }
 
 

framework/src/test/java/org/tron/core/services/admin/ipc/client/IpcClientTest.java

@@ -309,6 +309,78 @@ public void testExecRejectsMismatchedResponseIds() throws Exception {
     }
   }
 
+  @Test
+  public void testExecReturnsFailureForBusinessRejection() throws Exception {
+    String dynamicConfigMessage = "Peer modification is unavailable while "
+        + "node.dynamicConfig.enable is true; "
+        + "update node.active in the configuration file instead.";
+    for (String[] scenario : new String[][] {
+        {"admin_blockIp 192.0.2.20", "Blocked IP limit of 10000 has been reached"},
+        {"admin_addPeer 192.0.2.20:18888", dynamicConfigMessage},
+        {"admin_removePeer 192.0.2.20:18888", dynamicConfigMessage},
+        {"admin_addPeer 192.0.2.20:18888",
+            "Cannot add active node because IP 192.0.2.20 is manually blocked"}}) {
+      ObjectNode response = OBJECT_MAPPER.createObjectNode();
+      response.put("jsonrpc", "2.0");
+      response.put("id", 1);
+      response.putObject("result").put("success", false).put("changed", false)
+          .put("disconnectedCount", 0).put("errorMessage", scenario[1]);
+
+      ExecResult execution = executeCommand(scenario[0], response.toString());
+
+      Assert.assertEquals(scenario[0], IpcClient.EXIT_FAILURE, execution.exitCode);
+      Assert.assertEquals("", execution.standardOutput);
+      Assert.assertEquals(scenario[1] + System.lineSeparator(), execution.errorOutput);
+    }
+  }
+
+  @Test
+  public void testExecKeepsUnchangedOperationsSuccessful() throws Exception {
+    String result = "{\"success\":true,\"changed\":false,\"disconnectedCount\":0,"
+        + "\"errorMessage\":\"\"}";
+    String response = "{\"jsonrpc\":\"2.0\",\"id\":1,\"result\":" + result + "}";
+    for (String command : new String[] {"admin_blockIp 192.0.2.20",
+        "admin_unblockIp 192.0.2.20"}) {
+      ExecResult execution = executeCommand(command, response);
+
+      Assert.assertEquals(IpcClient.EXIT_SUCCESS, execution.exitCode);
+      Assert.assertEquals(OBJECT_MAPPER.writerWithDefaultPrettyPrinter()
+          .writeValueAsString(OBJECT_MAPPER.readTree(result)) + System.lineSeparator(),
+          execution.standardOutput);
+      Assert.assertEquals("", execution.errorOutput);
+    }
+  }
+
+  @Test
+  public void testExecDoesNotCoerceBusinessSuccess() throws Exception {
+    for (String result : new String[] {"{}", "{\"success\":null}", "{\"success\":0}",
+        "{\"success\":\"false\"}"}) {
+      String response = "{\"jsonrpc\":\"2.0\",\"id\":1,\"result\":" + result + "}";
+      ExecResult execution = executeCommand("admin_listBlockedIps", response);
+
+      Assert.assertEquals(result, IpcClient.EXIT_SUCCESS, execution.exitCode);
+      Assert.assertEquals(OBJECT_MAPPER.writerWithDefaultPrettyPrinter()
+          .writeValueAsString(OBJECT_MAPPER.readTree(result)) + System.lineSeparator(),
+          execution.standardOutput);
+      Assert.assertEquals("", execution.errorOutput);
+    }
+  }
+
+  @Test
+  public void testExecBusinessRejectionHasFallbackMessage() throws Exception {
+    for (String message : new String[] {"", ",\"errorMessage\":null",
+        ",\"errorMessage\":\" \"", ",\"errorMessage\":7"}) {
+      String response = "{\"jsonrpc\":\"2.0\",\"id\":1,\"result\":{\"success\":false"
+          + message + "}}";
+      ExecResult execution = executeCommand("admin_blockIp 192.0.2.20", response);
+
+      Assert.assertEquals(IpcClient.EXIT_FAILURE, execution.exitCode);
+      Assert.assertEquals("", execution.standardOutput);
+      Assert.assertEquals("Admin operation failed." + System.lineSeparator(),
+          execution.errorOutput);
+    }
+  }
+
   @Test
   public void testExecAcceptsNullAndFalseResults() throws Exception {
     for (String value : new String[] {"null", "false"}) {

framework/src/test/java/org/tron/core/services/admin/ipc/client/IpcResponseTest.java

@@ -102,6 +102,34 @@ public void testStructuredResultIsPrettyPrinted() {
         "{", "  \"height\" : 10,", "  \"ready\" : true", "}"), response.getFormatted());
   }
 
+  @Test
+  public void testBusinessRejectionOnlyFailsExec() {
+    String response = RESPONSE_PREFIX + "\"result\":{\"success\":false,\"changed\":false,"
+        + "\"disconnectedCount\":0,\"errorMessage\":\"Operation rejected\"}}";
+
+    IpcResponse interactive = IpcResponse.parse(response, Collections.emptyMap());
+
+    Assert.assertTrue(interactive.isSuccessful());
+    Assert.assertTrue(interactive.getFormatted().contains("\"success\" : false"));
+    Assert.assertTrue(interactive.getFormatted()
+        .contains("\"errorMessage\" : \"Operation rejected\""));
+
+    IpcResponse exec = IpcResponse.parseForExec(response, 1, Collections.emptyMap());
+
+    Assert.assertFalse(exec.isSuccessful());
+    Assert.assertEquals("Operation rejected", exec.getFormatted());
+  }
+
+  @Test
+  public void testExecChecksResponseIdBeforeBusinessRejection() {
+    IpcResponse response = IpcResponse.parseForExec(
+        RESPONSE_PREFIX + "\"result\":{\"success\":false,\"errorMessage\":\"Operation rejected\"}}",
+        2, Collections.emptyMap());
+
+    Assert.assertFalse(response.isSuccessful());
+    Assert.assertEquals("IPC response ID does not match request.", response.getFormatted());
+  }
+
   @Test
   public void testNullAndScalarResultsAreSuccessful() {
     assertResponse(RESPONSE_PREFIX + "\"result\":null}", "null", true);