Skip to content

Commit 29d911f

Browse files
josibakewillcl-arkpinheadmz
authored
add CVE images with signet (based on #498) (#539)
* add CVE images with signet (based on #498) add base image for building old versions with CVEs. these images are pulled from a branch where for each version signet has been packported and the patches applied. the image also supports building from a local source, which is useful when adding new images. Co-authored-by: Will Clark <6606587+willcl-ark@users.noreply.github.com> * remove acceptnonstdtx from baseConfig this option is not allowed on signet. could probably figure out a fix to allow it but doesnt seem worth it at this time and definitely not something we want in the base config, anyways. * fix 16.1 p2sh activation * remove unused tor section simplify entrypoint.sh by removing the tor dead code. we can add this in later if we revisit tor, but its likely not that we are using helm we will take a different approach for configuring this, anyways. * update tests to work with CVE images Co-authored-by: Matthew Zipkin <2084648+pinheadmz@users.noreply.github.com> --------- Co-authored-by: willcl-ark <will@256k1.dev> Co-authored-by: Will Clark <6606587+willcl-ark@users.noreply.github.com> Co-authored-by: Matthew Zipkin <2084648+pinheadmz@users.noreply.github.com>
1 parent a6b212c commit 29d911f

23 files changed

+503
-32
lines changed

‎resources/charts/bitcoincore/templates/_helpers.tpl

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,7 @@ Create the name of the service account to use
6161
Add network section heading in bitcoin.conf after v0.17.0
6262
*/}}
6363
{{- define "bitcoincore.check_semver" -}}
64-
{{- $tag := .Values.image.tag | trimPrefix "v" -}}
65-
{{- $version := semverCompare ">=0.17.0" $tag -}}
64+
{{- $version := semverCompare ">=0.17.0" .Values.image.tag -}}
6665
{{- if $version -}}
6766
[{{ .Values.chain }}]
6867
{{- end -}}

‎resources/charts/bitcoincore/values.yaml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,6 @@ prometheusMetricsPort: 9332
117117

118118
baseConfig: |
119119
checkmempool=0
120-
acceptnonstdtxn=1
121120
debuglogfile=0
122121
logips=1
123122
logtimemicros=1

‎resources/images/bitcoin/insecure/Dockerfile

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
# Base stage
2+
# ----------
3+
#
4+
# We use the alpine version to get the
5+
# correct version of glibc / gcc for building older bitcoin
6+
# core versions.
7+
8+
# Default is set here to quiet a warning from Docker, but the caller must
9+
# be sure to ALWAYS set this correct per the version of bitcoin core they are
10+
# trying to build
11+
ARG ALPINE_VERSION=3.7
12+
FROM alpine:${ALPINE_VERSION} AS base
13+
14+
# Setup deps stage
15+
# ----------------
16+
#
17+
# this installs the common dependencies for all of the old versions
18+
# and then version specific dependencies are passed via the
19+
# EXTRA_PACKAGES ARG
20+
FROM base AS deps
21+
ARG EXTRA_PACKAGES=""
22+
RUN --mount=type=cache,target=/var/cache/apk \
23+
sed -i 's/http\:\/\/dl-cdn.alpinelinux.org/https\:\/\/alpine.global.ssl.fastly.net/g' /etc/apk/repositories \
24+
&& apk --no-cache add \
25+
autoconf \
26+
automake \
27+
boost-dev \
28+
build-base \
29+
ccache \
30+
chrpath \
31+
file \
32+
gnupg \
33+
git \
34+
libevent-dev \
35+
libressl \
36+
libtool \
37+
linux-headers \
38+
zeromq-dev \
39+
${EXTRA_PACKAGES}
40+
41+
ENV BERKELEYDB_VERSION=db-4.8.30.NC
42+
ENV BERKELEYDB_PREFIX=/opt/${BERKELEYDB_VERSION}
43+
44+
RUN wget https://download.oracle.com/berkeley-db/${BERKELEYDB_VERSION}.tar.gz
45+
RUN tar -xzf *.tar.gz
46+
RUN sed s/__atomic_compare_exchange/__atomic_compare_exchange_db/g -i ${BERKELEYDB_VERSION}/dbinc/atomic.h
47+
RUN mkdir -p ${BERKELEYDB_PREFIX}
48+
49+
WORKDIR /${BERKELEYDB_VERSION}/build_unix
50+
51+
RUN ../dist/configure --enable-cxx --disable-shared --with-pic --prefix=${BERKELEYDB_PREFIX}
52+
RUN make -j$(nproc)
53+
RUN make install
54+
RUN rm -rf ${BERKELEYDB_PREFIX}/docs
55+
56+
# Build stage
57+
# -----------
58+
#
59+
# We can build from a git repo using the REPO and COMMIT_SHA args
60+
# or from a local directory using FROM_SRC=true and specifying the local
61+
# source directory. Build args are set using a default but can be changed
62+
# on an imnage by image basis, if needed
63+
#
64+
# PRE_CONFIGURE_COMMANDS is used for version specific fixes needed before
65+
# running ./autogen.sh && ./configure
66+
#
67+
# EXTRA_BUILD_ARGS is used for version specific build flags
68+
FROM deps AS build
69+
ARG FROM_SRC="false"
70+
ARG REPO=""
71+
ARG COMMIT_SHA=""
72+
ARG BUILD_ARGS="--disable-tests --without-gui --disable-bench --disable-fuzz-binary --enable-suppress-external-warnings"
73+
ARG EXTRA_BUILD_ARGS=""
74+
ARG PRE_CONFIGURE_COMMANDS=""
75+
76+
COPY --from=deps /opt /opt
77+
ENV BITCOIN_PREFIX=/opt/bitcoin
78+
WORKDIR /build
79+
80+
# Even if not being used, --build-context bitcoin-src must be specified else
81+
# this line will error. If building from a remote repo, use something like
82+
# --build-context bitcoin-src="."
83+
COPY --from=bitcoin-src . /tmp/bitcoin-source
84+
RUN if [ "$FROM_SRC" = "true" ]; then \
85+
# run with --progress=plain to see these log outputs
86+
echo "Using local files from /tmp/bitcoin-source"; \
87+
if [ -d "/tmp/bitcoin-source" ] && [ "$(ls -A /tmp/bitcoin-source)" ]; then \
88+
cp -R /tmp/bitcoin-source /build/bitcoin; \
89+
else \
90+
echo "Error: Local source directory is empty or does not exist" && exit 1; \
91+
fi \
92+
else \
93+
echo "Cloning from git repository"; \
94+
git clone --depth 1 "https://github.com/${REPO}" /build/bitcoin \
95+
&& cd /build/bitcoin \
96+
&& git fetch --depth 1 origin "$COMMIT_SHA" \
97+
&& git checkout "$COMMIT_SHA"; \
98+
fi;
99+
100+
# This is not our local ccache, but ccache in the docker cache
101+
# this does speed up builds substantially when building from source or building
102+
# multiple versions sequentially
103+
ENV CCACHE_DIR=/ccache
104+
RUN --mount=type=cache,target=/ccache \
105+
set -ex \
106+
&& cd /build/bitcoin \
107+
&& if [ -n "$PRE_CONFIGURE_COMMANDS" ]; then \
108+
eval ${PRE_CONFIGURE_COMMANDS}; \
109+
fi \
110+
&& ./autogen.sh \
111+
&& ./configure \
112+
LDFLAGS=-L`ls -d /opt/db*`/lib/ \
113+
CPPFLAGS="-g0 -I`ls -d /opt/db*`/include/ --param ggc-min-expand=1 --param ggc-min-heapsize=32768" \
114+
--prefix=${BITCOIN_PREFIX} \
115+
${BUILD_ARGS} \
116+
${EXTRA_BUILD_ARGS} \
117+
--with-daemon \
118+
&& make -j$(nproc) \
119+
&& make install \
120+
&& strip ${BITCOIN_PREFIX}/bin/bitcoin-cli \
121+
&& strip ${BITCOIN_PREFIX}/bin/bitcoind \
122+
&& rm -f ${BITCOIN_PREFIX}/lib/libbitcoinconsensus.a \
123+
&& rm -f ${BITCOIN_PREFIX}/lib/libbitcoinconsensus.so.0.0.0 \
124+
&& rm -f ${BITCOIN_PREFIX}/bin/bitcoin-tx \
125+
&& rm -f ${BITCOIN_PREFIX}/bin/bitcoin-wallet
126+
127+
# verify ccache is working, specify --progress=plain to see output in build logs
128+
RUN ccache -s
129+
130+
# Final clean stage
131+
# -----------------
132+
#
133+
# EXTRA_RUNTIME_PACKAGES is used for version specific runtime deps
134+
FROM alpine:${ALPINE_VERSION}
135+
ARG EXTRA_RUNTIME_PACKAGES=""
136+
ARG UID=100
137+
ARG GID=101
138+
ARG BITCOIN_VERSION
139+
ENV BITCOIN_DATA=/root/.bitcoin
140+
ENV BITCOIN_PREFIX=/opt/bitcoin
141+
ENV PATH=${BITCOIN_PREFIX}/bin:$PATH
142+
ENV BITCOIN_VERSION=${BITCOIN_VERSION}
143+
LABEL maintainer.0="bitcoindevproject"
144+
145+
RUN addgroup -g ${GID} -S bitcoin
146+
RUN adduser -u ${UID} -S bitcoin -G bitcoin
147+
RUN --mount=type=cache,target=/var/cache/apk sed -i 's/http\:\/\/dl-cdn.alpinelinux.org/https\:\/\/alpine.global.ssl.fastly.net/g' /etc/apk/repositories \
148+
&& apk --no-cache add \
149+
bash \
150+
boost-filesystem \
151+
boost-system \
152+
boost-thread \
153+
libevent \
154+
libzmq \
155+
shadow \
156+
sqlite-dev \
157+
su-exec \
158+
${EXTRA_RUNTIME_PACKAGES}
159+
160+
COPY --from=build /opt/bitcoin /usr/local
161+
COPY entrypoint.sh /entrypoint.sh
162+
163+
VOLUME ["/home/bitcoin/.bitcoin"]
164+
EXPOSE 8332 8333 18332 18333 18443 18444 38333 38332
165+
166+
ENTRYPOINT ["/entrypoint.sh"]
167+
CMD ["bitcoind"]
168+

‎resources/images/bitcoin/insecure/addrman_v0.16.1.patch

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
diff --git a/src/netaddress.cpp b/src/netaddress.cpp
2+
index 4fbfa2b5c85..0d8d5751268 100644
3+
--- a/src/netaddress.cpp
4+
+++ b/src/netaddress.cpp
5+
@@ -455,6 +455,8 @@ std::vector<unsigned char> CNetAddr::GetGroup() const
6+
vchRet.push_back(NET_IPV4);
7+
vchRet.push_back(GetByte(3) ^ 0xFF);
8+
vchRet.push_back(GetByte(2) ^ 0xFF);
9+
+ vchRet.push_back(GetByte(1) ^ 0xFF);
10+
+ vchRet.push_back(GetByte(0) ^ 0xFF);
11+
return vchRet;
12+
}
13+
else if (IsTor())

‎resources/images/bitcoin/insecure/addrman_v0.17.0.patch

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
diff --git a/src/netaddress.cpp b/src/netaddress.cpp
2+
index 778c2700f95..03d97bcd673 100644
3+
--- a/src/netaddress.cpp
4+
+++ b/src/netaddress.cpp
5+
@@ -354,6 +354,8 @@ std::vector<unsigned char> CNetAddr::GetGroup() const
6+
vchRet.push_back(NET_IPV4);
7+
vchRet.push_back(GetByte(3) ^ 0xFF);
8+
vchRet.push_back(GetByte(2) ^ 0xFF);
9+
+ vchRet.push_back(GetByte(1) ^ 0xFF);
10+
+ vchRet.push_back(GetByte(0) ^ 0xFF);
11+
return vchRet;
12+
}
13+
else if (IsTor())

‎resources/images/bitcoin/insecure/addrman_v0.19.2.patch

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
diff --git a/src/netaddress.cpp b/src/netaddress.cpp
2+
index 4fbfa2b5c85..0d8d5751268 100644
3+
--- a/src/netaddress.cpp
4+
+++ b/src/netaddress.cpp
5+
@@ -455,6 +455,8 @@ std::vector<unsigned char> CNetAddr::GetGroup() const
6+
vchRet.push_back(NET_IPV4);
7+
vchRet.push_back(GetByte(3) ^ 0xFF);
8+
vchRet.push_back(GetByte(2) ^ 0xFF);
9+
+ vchRet.push_back(GetByte(1) ^ 0xFF);
10+
+ vchRet.push_back(GetByte(0) ^ 0xFF);
11+
return vchRet;
12+
}
13+
else if (IsTor())

‎resources/images/bitcoin/insecure/addrman_v0.20.0.patch

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
diff --git a/src/netaddress.cpp b/src/netaddress.cpp
2+
index 228caf74a93..a6728321d1d 100644
3+
--- a/src/netaddress.cpp
4+
+++ b/src/netaddress.cpp
5+
@@ -517,6 +517,8 @@ std::vector<unsigned char> CNetAddr::GetGroup(const std::vector<bool> &asmap) co
6+
uint32_t ipv4 = GetLinkedIPv4();
7+
vchRet.push_back((ipv4 >> 24) & 0xFF);
8+
vchRet.push_back((ipv4 >> 16) & 0xFF);
9+
+ vchRet.push_back((ipv4 >> 8) & 0xFF);
10+
+ vchRet.push_back(ipv4 & 0xFF);
11+
return vchRet;
12+
} else if (IsTor()) {
13+
nStartByte = 6;

‎resources/images/bitcoin/insecure/addrman_v0.21.1.patch

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
diff --git a/src/netaddress.cpp b/src/netaddress.cpp
2+
index e0d4638dd6a..a84b3980f30 100644
3+
--- a/src/netaddress.cpp
4+
+++ b/src/netaddress.cpp
5+
@@ -742,6 +742,8 @@ std::vector<unsigned char> CNetAddr::GetGroup(const std::vector<bool> &asmap) co
6+
uint32_t ipv4 = GetLinkedIPv4();
7+
vchRet.push_back((ipv4 >> 24) & 0xFF);
8+
vchRet.push_back((ipv4 >> 16) & 0xFF);
9+
+ vchRet.push_back((ipv4 >> 8) & 0xFF);
10+
+ vchRet.push_back(ipv4 & 0xFF);
11+
return vchRet;
12+
} else if (IsTor() || IsI2P() || IsCJDNS()) {
13+
nBits = 4;

‎resources/images/bitcoin/insecure/build.md

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# Historic CVE images
2+
3+
These images are for old versions of Bitcoin Core with known CVEs. These images have signet backported
4+
and the addrman and isroutable patches applied.
5+
6+
# Build incantations
7+
8+
Run from top-level of project
9+
10+
## v0.21.1
11+
12+
```bash
13+
docker buildx build \
14+
--platform linux/amd64,linux/armhf \
15+
--build-context bitcoin-src="." \
16+
--build-arg ALPINE_VERSION="3.17" \
17+
--build-arg BITCOIN_VERSION="0.21.1" \
18+
--build-arg EXTRA_PACKAGES="sqlite-dev" \
19+
--build-arg EXTRA_RUNTIME_PACKAGES="boost-filesystem sqlite-dev" \
20+
--build-arg REPO="josibake/bitcoin" \
21+
--build-arg COMMIT_SHA="e0a22f14c15b4877ef6221f9ee2dfe510092d734" \
22+
--tag bitcoindevproject/bitcoin:0.21.1 \
23+
resources/images/bitcoin/insecure
24+
```
25+
26+
## v0.20.0
27+
28+
```bash
29+
docker buildx build \
30+
--platform linux/amd64,linux/armhf \
31+
--build-context bitcoin-src="." \
32+
--build-arg ALPINE_VERSION="3.12.12" \
33+
--build-arg BITCOIN_VERSION="0.20.0" \
34+
--build-arg EXTRA_PACKAGES="sqlite-dev miniupnpc" \
35+
--build-arg EXTRA_RUNTIME_PACKAGES="boost-filesystem sqlite-dev" \
36+
--build-arg REPO="josibake/bitcoin" \
37+
--build-arg COMMIT_SHA="0bbff8feff0acf1693dfe41184d9a4fd52001d3f" \
38+
--tag bitcoindevproject/bitcoin:0.20.0 \
39+
resources/images/bitcoin/insecure
40+
```
41+
42+
## v0.19.2
43+
44+
```bash
45+
docker buildx build \
46+
--platform linux/amd64,linux/armhf \
47+
--build-context bitcoin-src="." \
48+
--build-arg ALPINE_VERSION="3.12.12" \
49+
--build-arg BITCOIN_VERSION="0.19.2" \
50+
--build-arg EXTRA_PACKAGES="sqlite-dev libressl-dev" \
51+
--build-arg EXTRA_RUNTIME_PACKAGES="boost-chrono boost-filesystem libressl sqlite-dev" \
52+
--build-arg REPO="josibake/bitcoin" \
53+
--build-arg COMMIT_SHA="e20f83eb5466a7d68227af14a9d0cf66fb520ffc" \
54+
--tag bitcoindevproject/bitcoin:0.19.2 \
55+
resources/images/bitcoin/insecure
56+
```
57+
58+
## v0.17.0
59+
60+
```bash
61+
docker buildx build \
62+
--platform linux/amd64,linux/armhf \
63+
--build-context bitcoin-src="." \
64+
--build-arg ALPINE_VERSION="3.9" \
65+
--build-arg BITCOIN_VERSION="0.17.0" \
66+
--build-arg EXTRA_PACKAGES="protobuf-dev libressl-dev" \
67+
--build-arg EXTRA_RUNTIME_PACKAGES="boost boost-program_options libressl sqlite-dev" \
68+
--build-arg REPO="josibake/bitcoin" \
69+
--build-arg COMMIT_SHA="f6b2db49a707e7ad433d958aee25ce561c66521a" \
70+
--tag bitcoindevproject/bitcoin:0.17.0 \
71+
resources/images/bitcoin/insecure
72+
```
73+
74+
## v0.16.1
75+
76+
```bash
77+
docker buildx build \
78+
--platform linux/amd64,linux/armhf \
79+
--build-context bitcoin-src="." \
80+
--build-arg ALPINE_VERSION="3.7" \
81+
--build-arg BITCOIN_VERSION="0.16.1" \
82+
--build-arg EXTRA_PACKAGES="protobuf-dev libressl-dev" \
83+
--build-arg PRE_CONFIGURE_COMMANDS="sed -i '/AC_PREREQ/a\AR_FLAGS=cr' src/univalue/configure.ac && sed -i '/AX_PROG_CC_FOR_BUILD/a\AR_FLAGS=cr' src/secp256k1/configure.ac && sed -i 's:sys/fcntl.h:fcntl.h:' src/compat.h" \
84+
--build-arg EXTRA_RUNTIME_PACKAGES="boost boost-program_options libressl" \
85+
--build-arg REPO="josibake/bitcoin" \
86+
--build-arg COMMIT_SHA="dc94c00e58c60412a4e1a540abdf0b56093179e8" \
87+
--tag bitcoindevproject/bitcoin:0.16.1 \
88+
resources/images/bitcoin/insecure
89+
```

‎resources/images/bitcoin/insecure/entrypoint.sh

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
set -e
3+
4+
if [ "$(echo "$1" | cut -c1)" = "-" ]; then
5+
echo "$0: assuming arguments for bitcoind"
6+
7+
set -- bitcoind "$@"
8+
fi
9+
10+
if [ "$(echo "$1" | cut -c1)" = "-" ] || [ "$1" = "bitcoind" ]; then
11+
mkdir -p "$BITCOIN_DATA"
12+
chmod 700 "$BITCOIN_DATA"
13+
echo "$0: setting data directory to $BITCOIN_DATA"
14+
set -- "$@" -datadir="$BITCOIN_DATA"
15+
fi
16+
17+
# Incorporate additional arguments for bitcoind if BITCOIN_ARGS is set.
18+
if [ -n "$BITCOIN_ARGS" ]; then
19+
IFS=' ' read -ra ARG_ARRAY <<< "$BITCOIN_ARGS"
20+
set -- "$@" "${ARG_ARRAY[@]}"
21+
fi
22+
23+
# Conditionally add -printtoconsole for Bitcoin version 0.16.1
24+
if [ "${BITCOIN_VERSION}" == "0.16.1" ]; then
25+
exec "$@" -printtoconsole
26+
else
27+
exec "$@"
28+
fi

0 commit comments

Comments
 (0)