-
Notifications
You must be signed in to change notification settings - Fork 1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[New]
RestServer
Plugin
#3390
base: master
Are you sure you want to change the base?
[New]
RestServer
Plugin
#3390
Conversation
throw new QueryParameterNotFoundException(nameof(method)); | ||
try | ||
{ | ||
var engine = ScriptHelper.InvokeMethod(_neosystem.Settings, _neosystem.StoreView, contracts.Hash, method, contractParameters, out var script); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Need supporting signer account and scope like what invokefunction did, or methods can't pass verifywitness.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@cschuchardt88 conflict |
|
Ban method should be by endPoint instead of controller before merge, some methods are prone to denial of service |
Maybe Can you give a working example? |
|
Nothing will happen to the server in that case. The page will just not load. The reason I didn't page it is, because I checked A DOS happens when a server is manipulating data or killing a thread or process. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It must be secure, and now it is prone to denial of service.
It doesn't affect the node or the server at all. The request will timeout. If user stops the request this will just cancel the iterator. There is no different if the Timeout Settingsoptions.Limits.KeepAliveTimeout = TimeSpan.FromSeconds(_settings.KeepAliveTimeout); // default is 120 seconds in 'RestServer.json'
options.Limits.RequestHeadersTimeout = TimeSpan.FromSeconds(15); I have done my R&D and this is why I added |
No, is not, the request can be canceled, but the iteration don't receive the cancelationRequest, so it will iterate until end, and another thread can do the same until denail the service. |
Unless you have working example or evidence, Request draining with ASP.NET Core Kestrel web server
|
Thank you for identifying this issue. This is indeed a significant DoS entry point. A simple request can consume considerable CPU and memory resources, especially given the current number of accounts. Reference: neo/src/Neo/Extensions/SmartContract/GasTokenExtensions.cs Lines 23 to 40 in 292540e
|
Trust in security experts, it will be better for you, this PR contains multiple Denial of Services end points. |
Because your two's claims are built on assumptions. Mine are built on facts. see #3390 (comment) If this is true then |
Thank you for pointing it out. Where is it in the |
neo/src/Plugins/RpcServer/RpcServer.Wallet.cs Line 136 in 292540e
neo/src/Plugins/RpcServer/RpcServer.Wallet.cs Line 193 in 292540e
|
That’s not a major concern, as most wallets don’t contain many addresses. Additionally, openwallet is disabled by default in the RPCServer. However, in the current plugin, a simple
I feel disheartened by this response. I invested time and effort into conducting tests to help improve NEO's security, and it’s difficult for me to accept being dismissed this way. I truly appreciate productive discussions and differences in perspective, but let’s keep the focus on the PR itself and avoid making it personal. Your expertise in the .NET field is undeniable, and I respect that. However, this doesn’t change the core issue—users can indeed place a significant load on a node with a simple request. That said, I hadn’t initially noticed this problem, thanks to the good design in this plugin, such as the implementation of pagination and max size limits, which help mitigate many risks. It seems that pagination is quite challenging here (credit to @Hecate2). Shargon's proposal might be a better approach. It would be more efficient to give users control over banning high-load methods, and we should set that as the default. |
The fact is: if you put this plugin in a consensus node, I can deny the services and kill one consensus node, I told you how can this be more secure, and you refuse to do the changes. If you want to delegate in kestrel the cancellation and you call your own code, you must listen HttpContext.RequestAborted, otherwise the task will wait until finish your code to be cancelled. |
To ensure my understanding was correct, I also consulted with security expert @vang1ong7ang on this issue. His view is that DoS risks should be assessed based on the theoretical worst-case scenario. For example, the worst-case for the NEO's account API could return 100 million records, while for the GAS's account API, it could return 100 million * 100 million records. From this perspective, it should fundamentally be considered as having a DoS risk. |
All you concerns have been addressed. |
Thanks for your new commit! You made a great point—while applying page and size pagination at the outer layer reduces the returned data, it doesn’t necessarily decrease the internal CPU and memory load if the underlying processing remains the same (credit to @Hecate2). We suspect that this pagination approach might not be as effective as expected. @shargon, what are your thoughts? |
I think that we also need to be able to disable some endPoints, do it by controller it could be not enough |
We could add this too rate-limiting : https://learn.microsoft.com/en-us/aspnet/core/performance/rate-limit?view=aspnetcore-9.0 |
Description
In this section you will learn about
RestServer
plugin and how it works.Checkout the docs in
./docs/RestServer
folder.Dependencies
Required
Required
Required
Required
Required
Required
Required
linux maybe
Required
Required
Required
Swagger
(optional)Swagger
(optional)Swagger
(optional)Swagger
(optional)Swagger
(optional)Swagger UI
(optional)In Docker
These files go in the same directory as the
RestServer.dll
. In neo-cliplugins/RestServer/
folder.Response Headers
neo-cli
andRestServer
version.JSON Serializer
RestServer
uses custom Newtonsoft Json Converters to serialize controller actionresponses and
route
parameters.One Way Binding -
Write
only.Neo.SmartContract.ContractState
Neo.SmartContract.NefFile
Neo.SmartContract.MethodToken
Neo.SmartContract.Native.TrimmedBlock
Neo.SmartContract.Manifest.ContractAbi
Neo.SmartContract.Manifest.ContractGroup
Neo.SmartContract.Manifest.ContractManifest
Neo.SmartContract.Manifest.ContractPermission
Neo.SmartContract.Manifest.ContractPermissionDescriptor
Neo.Network.P2P.Payloads.Block
Neo.Network.P2P.Payloads.Header
Neo.Network.P2P.Payloads.Signer
Neo.Network.P2P.Payloads.TransactionAttribute
Neo.Network.P2P.Payloads.Transaction
Neo.Network.P2P.Payloads.Witness
Two Way Binding -
Read
&Write
System.Guid
System.ReadOnlyMemory<T>
Neo.BigDecimal
Neo.UInt160
Neo.UInt256
Neo.Cryptography.ECC.ECPoint
Neo.VM.Types.Array
Neo.VM.Types.Boolean
Neo.VM.Types.Buffer
Neo.VM.Types.ByteString
Neo.VM.Types.Integer
Neo.VM.Types.InteropInterface
Neo.VM.Types.Null
Neo.VM.Types.Map
Neo.VM.Types.Pointer
Neo.VM.Types.StackItem
Neo.VM.Types.Struct
Remote Endpoints
Parametes
{hash}
can be any Neo N3 address or scripthash;{address}
can be any Neo N3 address only;{number}
and{index}
can be any uint32.Parameter Examples
{hash}
- 0xef4073a0f2b305a38ec4050e4d3d28bc40ea63f5 or NiHURyS83nX2mpxtA7xq84cGxVbHojj5Wc{address}
- NiHURyS83nX2mpxtA7xq84cGxVbHojj5Wc{number}
- 1{index}
- 2500000Paths
[GET]
/api/v1/utils/{hash}/address
[GET]
/api/v1/utils/{address}/scripthash
[GET]
/api/v1/utils/{hash}/{address}/validate
[GET]
/api/v1/node/peers
[GET]
/api/v1/node/plugins
[GET]
/api/v1/node/settings
[GET]
/api/v1/ledger/neo/accounts
[GET]
/api/v1/ledger/gas/accounts
[GET]
/api/v1/ledger/blocks?page={number}&size={number}
[GET]
/api/v1/ledger/blocks/height
[GET]
/api/v1/ledger/blocks/{index}
[GET]
/api/v1/ledger/blocks/{index}/header
[GET]
/api/v1/ledger/blocks/{index}/witness
[GET]
/api/v1/ledger/blocks/{index}/transactions?page={number}&size={number}
[GET]
/api/v1/ledger/transactions/{hash}
[GET]
/api/v1/ledger/transactions/{hash}/witnesses
[GET]
/api/v1/ledger/transactions/{hash}/signers
[GET]
/api/v1/ledger/transactions/{hash}/attributes
[GET]
/api/v1/ledger/memorypool?page={number}&size={number}
[GET]
/api/v1/ledger/memorypool/verified?page={number}&size={number}
[GET]
/api/v1/ledger/memorypool/unverified?page={number}&size={number}
[GET]
/api/v1/ledger/memorypool/count
[GET]
/api/v1/tokens/balanceof/{address}
[GET]
/api/v1/tokens/nep-11?page={number}&size={number}
[GET]
/api/v1/tokens/nep-11/count
[GET]
/api/v1/tokens/nep-11/{hash}/balanceof/{address}
[GET]
/api/v1/tokens/nep-17?page={number}&size={number}
[GET]
/api/v1/tokens/nep-17/count
[GET]
/api/v1/tokens/nep-17/{hash}/balanceof/{address}
[GET]
/api/v1/contracts?page={number}&size={number}
[GET]
/api/v1/contracts/count
[GET]
/api/v1/contracts/{hash}
[GET]
/api/v1/contracts/{hash}/abi
[GET]
/api/v1/contracts/{hash}/manifest
[GET]
/api/v1/contracts/{hash}/nef
[GET]
/api/v1/contracts/{hash}/storage
Type of change
How Has This Been Tested?
By @superboyiii from neo-project/neo-modules#839
Checklist: