Code review.

include/bitcoin/server/protocols/protocol_bitcoind_blockchain.hpp

@@ -170,14 +170,6 @@ class BCS_API protocol_bitcoind_blockchain
         wait_race::ptr race;
     };
 
-    void arm_wait(waiter&& waiting, double timeout) NOEXCEPT;
-    void do_wait_event() NOEXCEPT;
-    void handle_wait_timeout(const code& ec,
-        const waiter::ptr& waiting) NOEXCEPT;
-    void complete_wait(const code& ec) NOEXCEPT;
-    bool wait_done(const waiter& waiting) const NOEXCEPT;
-    void send_top() NOEXCEPT;
-
     void handle_prioritize(const code& ec, size_t height) NOEXCEPT;
     void do_precious_block(const code& ec) NOEXCEPT;
 
@@ -188,16 +180,35 @@ class BCS_API protocol_bitcoind_blockchain
     void do_scan_tx_out_set(
         const std::shared_ptr<network::rpc::array_t>& objects,
         const gate_t::ptr& gate) NOEXCEPT;
-    void complete_scan(const code& ec, network::rpc::object_t& result,
-        const gate_t::ptr& gate) NOEXCEPT;
 
+    void do_get_descriptor_activity(
+        const std::shared_ptr<network::rpc::array_t>& blockhashes,
+        const std::shared_ptr<network::rpc::array_t>& scanobjects,
+        bool include_mempool, const gate_t::ptr& gate) NOEXCEPT;
+
+    void do_get_mempool_entry(const system::hash_digest& hash,
+        const gate_t::ptr& gate) NOEXCEPT;
     void do_get_mempool_info(double minimum, double relay, double increment,
         const gate_t::ptr& gate) NOEXCEPT;
     bool mempool_entry(network::rpc::object_t& out,
         const database::tx_link& link) const NOEXCEPT;
     void do_get_raw_mempool(bool verbose, bool sequence,
         const gate_t::ptr& gate) NOEXCEPT;
-    void complete_mempool(const code& ec, network::rpc::value_t& result,
+
+    // Wait machinery.
+    void arm_wait(waiter&& waiting, double timeout) NOEXCEPT;
+    void do_wait_event() NOEXCEPT;
+    void handle_wait_timeout(const code& ec,
+        const waiter::ptr& waiting) NOEXCEPT;
+    void complete_wait(const code& ec) NOEXCEPT;
+    bool wait_done(const waiter& waiting) const NOEXCEPT;
+    void send_top() NOEXCEPT;
+
+    // Utilities.
+    void fail(const code& ec, const gate_t::ptr& gate) NOEXCEPT;
+    void complete_object(network::rpc::object_t& result,
+        const gate_t::ptr& gate) NOEXCEPT;
+    void complete_value(network::rpc::value_t& result,
         const gate_t::ptr& gate) NOEXCEPT;
 
     // This is thread safe.

include/bitcoin/server/protocols/protocol_rpc.hpp

@@ -88,11 +88,29 @@ class protocol_rpc
         if (claimed())
             return;
 
-        // Silently defer invalidated requests (to the protocol attached last).
-        if (!is_allowed_host(*post, post->version()) ||
-            !is_allowed_origin(*post, post->version()) ||
-            !post->body().template contains<network::rpc::request>())
+        // Enforce http host header (if any hosts are configured).
+        if (!is_allowed_host(*post, post->version()))
+        {
+            set_claimed();
+            send_bad_host(*post);
+            return;
+        }
+
+        // Enforce http origin policy (if any origins are configured).
+        if (!is_allowed_origin(*post, post->version()))
+        {
+            set_claimed();
+            send_forbidden(*post);
+            return;
+        }
+
+        // Endpoint accepts only json-rpc posts.
+        if (!post->body().template contains<network::rpc::request>())
+        {
+            set_claimed();
+            send_bad_request(*post);
             return;
+        }
 
         const auto& message =
             post->body().template get<network::rpc::request>().message;
@@ -129,9 +147,18 @@ class protocol_rpc
             return;
 
         // ws frames carry no headers, so ws authorization is enforced here.
-        if (!authorized() ||
-            !request.body().template contains<network::rpc::request>())
+        if (!authorized())
+        {
+            stop(network::error::unauthorized);
             return;
+        }
+
+        // Websocket frames are parsed as json-rpc requests (channel body type).
+        if (!request.body().template contains<network::rpc::request>())
+        {
+            stop(error::invalid_argument);
+            return;
+        }
 
         const auto& message =
             request.body().template get<network::rpc::request>().message;