1

With hangzhou2net update we've faced weird behaviour regarding acl rpc policy. Request to chains/main/blocks/head/helpers/scripts/run_operation/ fails with 401 status code. We are hosting our node using docker-compose

version: "3"
services:
  testnet:
    image: tezos/tezos:11.0.0
    command: ["tezos-node"]
    hostname: node
    ports:
      - "8732:8732"
      - "9732:9732/udp"
    volumes:
      - "./config.json:/home/tezos/.tezos-node/config.json"
      - "./data/tezos:/var/run/tezos/node/"

The config file is:

{ "data-dir": "/var/run/tezos/node/data",
  "rpc":
    { "listen-addrs": [ ":8732" ],
      "acl":
        [ { "address": ":8732", "blacklist": [] } ] },
  "p2p":
    { "bootstrap-peers":
        [ "hangzhounet.teztnets.xyz", "hangzhounet.kaml.fr",
          "hangzhounet.smartpy.io", "hangzhounet.tezos.co.il",
          "hangzhounet.boot.tez.ie" ], "listen-addr": "[::]:9732",
      "limits":
        { "connection-timeout": 10, "max-download-speed": 2048,
          "max-upload-speed": 2048, "max_known_points": [ 400, 300 ],
          "max_known_peer_ids": [ 400, 300 ] } },
  "shell":
    { "chain_validator": { "synchronisation_threshold": 5 },
      "history_mode": "archive" }, "network": "hangzhounet" }

While node startup we see log message:

Dec  1 12:13:55.685 - node.main: FULL access to RPC enabled; this is very risky. (addresses = :8732)

so i assume the ACL is completely disabled.

Other requests (for instance chains/main/blocks/head runs fine).

Looks like the issue is specific to hangzhou2net, because nearly same setup works as expected at granadanet

EDIT: solved with help @dmirg i've updated docker-compose to:

version: "3"
services:
  testnet:
    image: tezos/tezos:11.0.0
    command: ["tezos-node", "--allow-all-rpc 0.0.0.0:8732", "--rpc-addr 0.0.0.0:8732"]
    hostname: node
    network_mode: host
    volumes:
      - "./config.json:/home/tezos/.tezos-node/config.json"
      - "./data/tezos:/var/run/tezos/node/"
2
  • I've not noticed any issues with run_operation on the nodes i'm using. Just a theory, but I noticed an extra slash at the end of your run_operation URL. I know dealing with other technologies that ACL's can be very temperamental with exact URL matching. Try removing the slash and just use chains/main/blocks/head/helpers/scripts/run_operation Dec 1, 2021 at 12:48
  • unfortunately, this doesn't help chains/main/blocks/head/helpers/scripts/run_operation acts the same as chains/main/blocks/head/helpers/scripts/run_operation/ - still receiving 401 Dec 1, 2021 at 12:58

1 Answer 1

1

You need to modify your config to allow remote access by adding 0.0.0.0 to listen-addrs and acl address:

{ "data-dir": "/var/run/tezos/node/data",
  "rpc":
    { "listen-addrs": [ "0.0.0.0:8732" ],
      "acl":
        [ { "address": "0.0.0.0:8732", "blacklist": [] } ] },
  "p2p":
    { "bootstrap-peers":
        [ "hangzhounet.teztnets.xyz", "hangzhounet.kaml.fr",
          "hangzhounet.smartpy.io", "hangzhounet.tezos.co.il",
          "hangzhounet.boot.tez.ie" ], "listen-addr": "[::]:9732",
      "limits":
        { "connection-timeout": 10, "max-download-speed": 2048,
          "max-upload-speed": 2048, "max_known_points": [ 400, 300 ],
          "max_known_peer_ids": [ 400, 300 ] } },
  "shell":
    { "chain_validator": { "synchronisation_threshold": 5 },
      "history_mode": "archive" }, "network": "hangzhounet" }

For running node from the sh scrip it will be something like ./mainnet.sh node start --rpc-addr 0.0.0.0:8732 --allow-all-rpc 0.0.0.0:8732

1
  • 1
    That helped, thanks a lot. Dec 1, 2021 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.