What the developer wrote
Authored by Matt Leon
rpcclient: ensure http dial respects timeout
Ensure that the dial phase of rpcclient's HTTP posts respects the http.Client's Timeout. It was instead falling back to the OS settings.
What changed, and why it matters
This commit fixes a bug in btcd's RPC client where network connection attempts ignored the configured timeout and could hang for a very long time (relying on the operating system's default limits). The fix makes the dial operation respect the context and timeout that the HTTP client already carries. It is a reliability and availability improvement rather than a direct theft-of-funds bug, but long-hanging connections can be abused to exhaust client resources or stall dependent services.
Treat as a low-to-moderate reliability/security fix. Backport to maintained release branches if RPC client availability is a concern. No immediate emergency response is warranted because the bug primarily affects availability, not confidentiality or integrity of wallet/RPC data. Review whether other custom DialContext implementations in the codebase make the same mistake.
Security signals we found
Ignored context in custom DialContext caused timeout/cancellation bypass
Network dial phase fell back to OS-level timeouts instead of application-configured limits
Potential denial-of-service vector via connection exhaustion or indefinite blocking of RPC client callers
Fix is small and targeted: propagates existing context rather than adding new policy
Evidence from the diff
In rpcclient/infrastructure.go, newHTTPClient previously supplied a custom DialContext closure that discarded the supplied context and called net.Dial(network, address). Because the context was ignored, the http.Client.Timeout and any cancellation signal were not applied to the TCP dial phase; only the OS connect timeout applied. The patch passes the context through to a net.Dialer.DialContext call, so the dial now honors the HTTP client’s timeout and cancellation. This is a correctness fix for context propagation.
Changed components
btcd/rpcclient/infrastructure.gorpcclient HTTP transport dialerRPC client connection establishmentInspect captured patch +4 / −3
diff --git a/rpcclient/infrastructure.go b/rpcclient/infrastructure.go
index 373ffad..e34fc18 100644
--- a/rpcclient/infrastructure.go
+++ b/rpcclient/infrastructure.go
@@ -1356,10 +1356,11 @@ func newHTTPClient(config *ConnConfig) (*http.Client, error) {
Transport: &http.Transport{
Proxy: proxyFunc,
TLSClientConfig: tlsConfig,
- DialContext: func(_ context.Context, _,
+ DialContext: func(ctx context.Context, _,
_ string) (net.Conn, error) {
-
- return net.Dial(
+ d := &net.Dialer{}
+ return d.DialContext(
+ ctx,
parsedDialAddr.Network(),
parsedDialAddr.String(),
)
Why this scored 37/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.