Nonprivileged inline action subjective limit

libraries/chain/abi_serializer.cpp

@@ -1,6 +1,4 @@
 #include <eosio/chain/abi_serializer.hpp>
-#include <eosio/chain/chain_config.hpp>
-#include <eosio/chain/transaction.hpp>
 #include <eosio/chain/asset.hpp>
 #include <eosio/chain/exceptions.hpp>
 #include <fc/io/raw.hpp>

libraries/chain/apply_context.cpp

@@ -242,12 +242,12 @@ void apply_context::require_recipient( account_name recipient ) {
  *  implicitly authorized by the current receiver (running code). This method has significant
  *  security considerations and several options have been considered:
  *
- *  1. priviledged accounts (those marked as such by block producers) can authorize any action
+ *  1. privileged accounts (those marked as such by block producers) can authorize any action
  *  2. all other actions are only authorized by 'receiver' which means the following:
  *         a. the user must set permissions on their account to allow the 'receiver' to act on their behalf
  *
- *  Discarded Implemenation:  at one point we allowed any account that authorized the current transaction
- *   to implicitly authorize an inline transaction. This approach would allow privelege escalation and
+ *  Discarded Implementation: at one point we allowed any account that authorized the current transaction
+ *   to implicitly authorize an inline transaction. This approach would allow privilege escalation and
  *   make it unsafe for users to interact with certain contracts.  We opted instead to have applications
  *   ask the user for permission to take certain actions rather than making it implicit. This way users
  *   can better understand the security risk.
@@ -288,6 +288,12 @@ void apply_context::execute_inline( action&& a ) {
       control.check_actor_list( actors );
    }
 
+   if( !privileged && control.is_producing_block() ) {
+      const auto& chain_config = control.get_global_properties().configuration;
+      EOS_ASSERT( a.data.size() < std::min(chain_config.max_inline_action_size, control.get_max_nonprivileged_inline_action_size()),
+                  inline_action_too_big_nonprivileged,
+                  "inline action too big for nonprivileged account ${account}", ("account", a.account));
+   }
    // No need to check authorization if replaying irreversible blocks or contract is privileged
    if( !control.skip_auth_check() && !privileged ) {
       try {
@@ -337,6 +343,12 @@ void apply_context::execute_context_free_inline( action&& a ) {
    EOS_ASSERT( a.authorization.size() == 0, action_validate_exception,
                "context-free actions cannot have authorizations" );
 
+   if( !privileged && control.is_producing_block() ) {
+      const auto& chain_config = control.get_global_properties().configuration;
+      EOS_ASSERT( a.data.size() < std::min(chain_config.max_inline_action_size, control.get_max_nonprivileged_inline_action_size()),
+                  inline_action_too_big_nonprivileged,
+                  "inline action too big for nonprivileged account ${account}", ("account", a.account));
+   }
 
    auto inline_receiver = a.account;
    _cfa_inline_actions.emplace_back(

libraries/chain/controller.cpp

@@ -1188,7 +1188,8 @@ struct controller_impl {
              || (code == contract_blacklist_exception::code_value)
              || (code == action_blacklist_exception::code_value)
              || (code == key_blacklist_exception::code_value)
-             || (code == sig_variable_size_limit_exception::code_value);
+             || (code == sig_variable_size_limit_exception::code_value)
+             || (code == inline_action_too_big_nonprivileged::code_value);
    }
 
    bool scheduled_failure_is_subjective( const fc::exception& e ) const {
@@ -2432,6 +2433,11 @@ const protocol_feature_manager& controller::get_protocol_feature_manager()const
    return my->protocol_features;
 }
 
+uint32_t controller::get_max_nonprivileged_inline_action_size()const
+{
+   return my->conf.max_nonprivileged_inline_action_size;
+}
+
 controller::controller( const controller::config& cfg, const chain_id_type& chain_id )
 :my( new controller_impl( cfg, *this, protocol_feature_set{}, chain_id ) )
 {

libraries/chain/include/eosio/chain/config.hpp

@@ -57,7 +57,7 @@ static const uint32_t maximum_elastic_resource_multiplier  = 1000;
 const static uint32_t   rate_limiting_precision        = 1000*1000;
 
 
-const static uint32_t   default_max_block_net_usage                 = 1024 * 1024; /// at 500ms blocks and 200byte trx, this enables ~10,000 TPS burst
+const static uint32_t   default_max_block_net_usage                  = 1024 * 1024; /// at 500ms blocks and 200byte trx, this enables ~10,000 TPS burst
 const static uint32_t   default_target_block_net_usage_pct           = 10 * percent_1; /// we target 1000 TPS
 const static uint32_t   default_max_transaction_net_usage            = default_max_block_net_usage / 2;
 const static uint32_t   default_base_per_transaction_net_usage       = 12;  // 12 bytes (11 bytes for worst case of transaction_receipt_header + 1 byte for static_variant tag)
@@ -66,22 +66,23 @@ const static uint32_t   default_context_free_discount_net_usage_num  = 20; // TO
 const static uint32_t   default_context_free_discount_net_usage_den  = 100;
 const static uint32_t   transaction_id_net_usage                     = 32; // 32 bytes for the size of a transaction id
 
-const static uint32_t   default_max_block_cpu_usage                 = 200'000; /// max block cpu usage in microseconds
-const static uint32_t   default_target_block_cpu_usage_pct          = 10 * percent_1;
-const static uint32_t   default_max_transaction_cpu_usage           = 3*default_max_block_cpu_usage/4; /// max trx cpu usage in microseconds
-const static uint32_t   default_min_transaction_cpu_usage           = 100; /// min trx cpu usage in microseconds (10000 TPS equiv)
-const static uint32_t   default_subjective_cpu_leeway_us            = 31000; /// default subjective cpu leeway in microseconds
-
-const static uint32_t   default_max_trx_lifetime               = 60*60; // 1 hour
-const static uint32_t   default_deferred_trx_expiration_window = 10*60; // 10 minutes
-const static uint32_t   default_max_trx_delay                  = 45*24*3600; // 45 days
-const static uint32_t   default_max_inline_action_size         = 4 * 1024;   // 4 KB
-const static uint16_t   default_max_inline_action_depth        = 4;
-const static uint16_t   default_max_auth_depth                 = 6;
-const static uint32_t   default_sig_cpu_bill_pct               = 50 * percent_1; // billable percentage of signature recovery
-const static uint32_t   default_block_cpu_effort_pct           = 80 * percent_1; // percentage of block time used for producing block
-const static uint16_t   default_controller_thread_pool_size    = 2;
-const static uint32_t   default_max_variable_signature_length  = 16384u;
+const static uint32_t   default_max_block_cpu_usage                  = 200'000; /// max block cpu usage in microseconds
+const static uint32_t   default_target_block_cpu_usage_pct           = 10 * percent_1;
+const static uint32_t   default_max_transaction_cpu_usage            = 3*default_max_block_cpu_usage/4; /// max trx cpu usage in microseconds
+const static uint32_t   default_min_transaction_cpu_usage            = 100; /// min trx cpu usage in microseconds (10000 TPS equiv)
+const static uint32_t   default_subjective_cpu_leeway_us             = 31000; /// default subjective cpu leeway in microseconds
+
+const static uint32_t   default_max_trx_lifetime                     = 60*60; // 1 hour
+const static uint32_t   default_deferred_trx_expiration_window       = 10*60; // 10 minutes
+const static uint32_t   default_max_trx_delay                        = 45*24*3600; // 45 days
+const static uint32_t   default_max_inline_action_size               = 512 * 1024;   // 512 KB
+const static uint16_t   default_max_inline_action_depth              = 4;
+const static uint16_t   default_max_auth_depth                       = 6;
+const static uint32_t   default_sig_cpu_bill_pct                     = 50 * percent_1; // billable percentage of signature recovery
+const static uint32_t   default_block_cpu_effort_pct                 = 80 * percent_1; // percentage of block time used for producing block
+const static uint16_t   default_controller_thread_pool_size          = 2;
+const static uint32_t   default_max_variable_signature_length        = 16384u;
+const static uint32_t   default_max_nonprivileged_inline_action_size = 4 * 1024; // 4 KB
 
 const static uint32_t   min_net_usage_delta_between_base_and_max_for_trx  = 10*1024;
 // Should be large enough to allow recovery from badly set blockchain parameters without a hard fork

libraries/chain/include/eosio/chain/contract_types.hpp

@@ -1,8 +1,6 @@
 #pragma once
 
 #include <eosio/chain/authority.hpp>
-#include <eosio/chain/chain_config.hpp>
-#include <eosio/chain/config.hpp>
 #include <eosio/chain/types.hpp>
 
 namespace eosio { namespace chain {

libraries/chain/include/eosio/chain/controller.hpp

@@ -73,6 +73,7 @@ namespace eosio { namespace chain {
             uint64_t                 reversible_guard_size  =  chain::config::default_reversible_guard_size;
             uint32_t                 sig_cpu_bill_pct       =  chain::config::default_sig_cpu_bill_pct;
             uint16_t                 thread_pool_size       =  chain::config::default_controller_thread_pool_size;
+            uint32_t   max_nonprivileged_inline_action_size =  chain::config::default_max_nonprivileged_inline_action_size;
             bool                     read_only              =  false;
             bool                     force_all_checks       =  false;
             bool                     disable_replay_opts    =  false;
@@ -181,6 +182,7 @@ namespace eosio { namespace chain {
          const authorization_manager&          get_authorization_manager()const;
          authorization_manager&                get_mutable_authorization_manager();
          const protocol_feature_manager&       get_protocol_feature_manager()const;
+         uint32_t                              get_max_nonprivileged_inline_action_size()const;
 
          const flat_set<account_name>&   get_actor_whitelist() const;
          const flat_set<account_name>&   get_actor_blacklist() const;

libraries/chain/include/eosio/chain/exceptions.hpp

@@ -304,6 +304,8 @@ namespace eosio { namespace chain {
                                     3050010, "Action attempts to increase RAM usage of account without authorization" )
       FC_DECLARE_DERIVED_EXCEPTION( restricted_error_code_exception, action_validate_exception,
                                     3050011, "eosio_assert_code assertion failure uses restricted error code value" )
+      FC_DECLARE_DERIVED_EXCEPTION( inline_action_too_big_nonprivileged, action_validate_exception,
+                                    3050012, "Inline action exceeds maximum size limit for a non-privileged account" )
 
    FC_DECLARE_DERIVED_EXCEPTION( database_exception, chain_exception,
                                  3060000, "Database exception" )

libraries/testing/include/eosio/testing/tester.hpp

@@ -152,7 +152,7 @@ namespace eosio { namespace testing {
 
          virtual ~base_tester() {};
 
-         void              init(const setup_policy policy = setup_policy::full, db_read_mode read_mode = db_read_mode::SPECULATIVE);
+         void              init(const setup_policy policy = setup_policy::full, db_read_mode read_mode = db_read_mode::SPECULATIVE, optional<uint32_t> genesis_max_inline_action_size = optional<uint32_t>{}, optional<uint32_t> config_max_nonprivileged_inline_action_size = optional<uint32_t>{});
          void              init(controller::config config, const snapshot_reader_ptr& snapshot);
          void              init(controller::config config, const genesis_state& genesis);
          void              init(controller::config config);
@@ -390,7 +390,7 @@ namespace eosio { namespace testing {
             return genesis;
          }
 
-         static std::pair<controller::config, genesis_state> default_config(const fc::temp_directory& tempdir) {
+         static std::pair<controller::config, genesis_state> default_config(const fc::temp_directory& tempdir, optional<uint32_t> genesis_max_inline_action_size = optional<uint32_t>{}, optional<uint32_t> config_max_nonprivileged_inline_action_size = optional<uint32_t>{}) {
             controller::config cfg;
             cfg.blocks_dir      = tempdir.path() / config::default_blocks_dir_name;
             cfg.state_dir  = tempdir.path() / config::default_state_dir_name;
@@ -411,7 +411,14 @@ namespace eosio { namespace testing {
                else if(boost::unit_test::framework::master_test_suite().argv[i] == std::string("--eos-vm-oc"))
                   cfg.wasm_runtime = chain::wasm_interface::vm_type::eos_vm_oc;
             }
-            return {cfg, default_genesis()};
+            auto gen = default_genesis();
+            if (genesis_max_inline_action_size) {
+               gen.initial_configuration.max_inline_action_size = *genesis_max_inline_action_size;
+            }
+            if (config_max_nonprivileged_inline_action_size) {
+               cfg.max_nonprivileged_inline_action_size = *config_max_nonprivileged_inline_action_size;
+            }
+            return {cfg, gen};
          }
 
       protected:
@@ -441,8 +448,8 @@ namespace eosio { namespace testing {
 
    class tester : public base_tester {
    public:
-      tester(setup_policy policy = setup_policy::full, db_read_mode read_mode = db_read_mode::SPECULATIVE) {
-         init(policy, read_mode);
+      tester(setup_policy policy = setup_policy::full, db_read_mode read_mode = db_read_mode::SPECULATIVE, optional<uint32_t> genesis_max_inline_action_size = optional<uint32_t>{}, optional<uint32_t> config_max_nonprivileged_inline_action_size = optional<uint32_t>{}) {
+         init(policy, read_mode, genesis_max_inline_action_size, config_max_nonprivileged_inline_action_size);
       }
 
       tester(controller::config config, const genesis_state& genesis) {

libraries/testing/tester.cpp

@@ -150,8 +150,8 @@ namespace eosio { namespace testing {
      return control->head_block_id() == other.control->head_block_id();
    }
 
-   void base_tester::init(const setup_policy policy, db_read_mode read_mode) {
-      auto def_conf = default_config(tempdir);
+   void base_tester::init(const setup_policy policy, db_read_mode read_mode, optional<uint32_t> genesis_max_inline_action_size, optional<uint32_t> config_max_nonprivileged_inline_action_size) {
+      auto def_conf = default_config(tempdir, genesis_max_inline_action_size, config_max_nonprivileged_inline_action_size);
       def_conf.first.read_mode = read_mode;
       cfg = def_conf.first;
 
@@ -332,6 +332,7 @@ namespace eosio { namespace testing {
             auto trace = control->push_transaction( itr->trx_meta, fc::time_point::maximum(), DEFAULT_BILLED_CPU_TIME_US, true );
             traces.emplace_back( trace );
             if(!no_throw && trace->except) {
+               // this always throws an fc::exception, since the original exception is copied into an fc::exception
                trace->except->dynamic_rethrow_exception();
             }
             itr = unapplied_transactions.erase( itr );
@@ -343,6 +344,7 @@ namespace eosio { namespace testing {
                auto trace = control->push_scheduled_transaction( trx, fc::time_point::maximum(), DEFAULT_BILLED_CPU_TIME_US, true );
                traces.emplace_back( trace );
                if( !no_throw && trace->except ) {
+                  // this always throws an fc::exception, since the original exception is copied into an fc::exception
                   trace->except->dynamic_rethrow_exception();
                }
             }

plugins/chain_plugin/chain_plugin.cpp

@@ -312,6 +312,7 @@ void chain_plugin::set_program_options(options_description& cli, options_descrip
          ("eos-vm-oc-enable", bpo::bool_switch(), "Enable EOS VM OC tier-up runtime")
 #endif
          ("enable-account-queries", bpo::value<bool>()->default_value(false), "enable queries to find accounts by various metadata.")
+         ("max-nonprivileged-inline-action-size", bpo::value<uint32_t>()->default_value(config::default_max_nonprivileged_inline_action_size), "maximum allowed size (in bytes) of an inline action for a nonprivileged account")
          ;
 
 // TODO: rate limiting
@@ -755,6 +756,9 @@ void chain_plugin::plugin_initialize(const variables_map& options) {
       if( options.count( "reversible-blocks-db-guard-size-mb" ))
          my->chain_config->reversible_guard_size = options.at( "reversible-blocks-db-guard-size-mb" ).as<uint64_t>() * 1024 * 1024;
 
+      if( options.count( "max-nonprivileged-inline-action-size" ))
+         my->chain_config->max_nonprivileged_inline_action_size = options.at( "max-nonprivileged-inline-action-size" ).as<uint32_t>();
+
       if( options.count( "chain-threads" )) {
          my->chain_config->thread_pool_size = options.at( "chain-threads" ).as<uint16_t>();
          EOS_ASSERT( my->chain_config->thread_pool_size > 0, plugin_config_exception,