Skip to content

wallet: restrict sensitive RPC commands under --restricted-rpc #212

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sanada08 merged 5 commits into from
Aug 12, 2026
Merged

wallet: restrict sensitive RPC commands under --restricted-rpc #212

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7f02243
wallet: restrict sensitive RPC commands under --restricted-rpc
deen-kakarot Aug 6, 2026
0a496df
wallet: restrict start_mining and stop_mining RPC commands
deen-kakarot Aug 7, 2026
8ae179b
build: increase _FORTIFY_SOURCE protection level and update README
deen-kakarot Aug 7, 2026
75f12f5
update: wallet RPC version and libcurl dependency documentation
deen-kakarot Aug 11, 2026
580ad8a
add: bounds check for P2P block and transaction requests
deen-kakarot Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -571,8 +571,8 @@ else()

# if those don't work for your compiler, single it out where appropriate
if(CMAKE_BUILD_TYPE STREQUAL "Release" AND NOT OPENBSD)
set(C_SECURITY_FLAGS "${C_SECURITY_FLAGS} -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=1")
set(CXX_SECURITY_FLAGS "${CXX_SECURITY_FLAGS} -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=1")
set(C_SECURITY_FLAGS "${C_SECURITY_FLAGS} -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2")
set(CXX_SECURITY_FLAGS "${CXX_SECURITY_FLAGS} -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2")
endif()

# warnings
Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ library archives (`.a`).
| libzmq | 4.3.0 | YES | `libzmq3-dev` | `zeromq` | `zeromq-devel` | NO | ZeroMQ library |
| sqlite3 | 3.24.0 | YES | `libsqlite3-dev` | `sqlite` | `sqlite-devel` | NO | Beldex Name System |
| libsodium | 1.0.9 | YES | `libsodium-dev` | `libsodium` | `libsodium-devel` | NO | cryptography |
| libcurl | 4.0 | NO | `curl` | `curl-devel` | NO | HTTP | RPC |
| libcurl | 4.0 | NO | `libcurl4-openssl-dev` | `curl-devel` | NO | HTTP | RPC |
| libuv (Win) | any | NO | (Windows only) | -- | -- | NO | RPC event loop |
| libunwind | any | NO | `libunwind8-dev` | `libunwind` | `libunwind-devel` | YES | Stack traces |
| liblzma | any | NO | `liblzma-dev` | `xz` | `xz-devel` | YES | For libunwind |
Expand All @@ -67,7 +67,7 @@ breakdown of the minimum set of required boost packages.
Install all dependencies at once on Debian/Ubuntu:

```
sudo apt update && sudo apt install build-essential cmake pkg-config libboost-all-dev libzmq3-dev libsodium-dev libunwind8-dev liblzma-dev libreadline6-dev doxygen graphviz libpgm-dev libsqlite3-dev curl
sudo apt update && sudo apt install build-essential cmake pkg-config libboost-all-dev libzmq3-dev libsodium-dev libunwind8-dev liblzma-dev libreadline6-dev doxygen graphviz libpgm-dev libsqlite3-dev curl libcurl4-openssl-dev
Comment thread
coderabbitai[bot] marked this conversation as resolved.
```

Install all dependencies at once on macOS with the provided Brewfile:
Expand Down
15 changes: 15 additions & 0 deletions src/cryptonote_protocol/cryptonote_protocol_handler.inl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1848,6 +1848,14 @@ skip:
template<class t_core>
int t_cryptonote_protocol_handler<t_core>::handle_request_chain(int command, NOTIFY_REQUEST_CHAIN::request& arg, cryptonote_connection_context& context)
{

if (arg.block_ids.size() > CURRENCY_PROTOCOL_MAX_OBJECT_REQUEST_COUNT)
{
LOG_ERROR_CCONTEXT("Too many block IDs requested: " << arg.block_ids.size() << " (maximum " << CURRENCY_PROTOCOL_MAX_OBJECT_REQUEST_COUNT << ")");
drop_connection(context, false, false);
return 1;
}

Comment on lines +1851 to +1858

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C 12 \
  'HANDLE_NOTIFY_T2|load_t_from_binary|NOTIFY_REQUEST_CHAIN|MAX_PACKET|MAX.*MESSAGE' \
  --glob '*.h' --glob '*.hpp' --glob '*.cpp' --glob '*.inl' . || true

Repository: Beldex-Coin/beldex

Length of output: 50374

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- container serialization macros ---'
rg -n -C 8 'KV_SERIALIZE_CONTAINER_POD_AS_BLOB|serialize_container|load_from_binary|load_storage' \
  contrib/epee/include/epee src/cryptonote_protocol \
  --glob '*.h' --glob '*.hpp' --glob '*.cpp' --glob '*.inl' \
  | head -n 500

printf '%s\n' '--- P2P deserialization call path ---'
rg -n -C 10 'buff_to_t_adapter|load_t_from_binary|handle_invoke_map|in_buff' \
  contrib/epee/include/epee/net contrib/epee/include/epee/storages \
  --glob '*.h' --glob '*.hpp' --glob '*.cpp' --glob '*.inl' \
  | head -n 500

Repository: Beldex-Coin/beldex

Length of output: 50374

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- binary reader array and packet bounds ---'
sed -n '40,145p' contrib/epee/include/epee/storages/portable_storage_from_bin.h
sed -n '215,250p' contrib/epee/include/epee/storages/portable_storage_from_bin.h
sed -n '130,170p' contrib/epee/include/epee/net/levin_protocol_handler.h
sed -n '155,220p' contrib/epee/include/epee/storages/levin_abstract_invoke2.h

printf '%s\n' '--- blob-container deserialization ---'
rg -n -C 12 'perform_serialize_blob_container|serialize_blob_container|blob_container' \
  contrib/epee/include/epee/serialization \
  --glob '*.h' --glob '*.hpp' --glob '*.cpp'

Repository: Beldex-Coin/beldex

Length of output: 14352

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '180,290p' contrib/epee/include/epee/serialization/keyvalue_serialization_overloads.h
rg -n -C 15 'unserialize_stl_container_pod_val_as_blob|serialize_stl_container_pod_val_as_blob|MAX_STRING_LEN_POSSIBLE' \
  contrib/epee/include/epee \
  --glob '*.h' --glob '*.hpp' --glob '*.cpp'

Repository: Beldex-Coin/beldex

Length of output: 24708

Reject oversized block_ids during deserialization.

buff_to_t_adapter loads the portable storage and populates NOTIFY_REQUEST_CHAIN::request before handle_request_chain runs. The blob deserializer has no CURRENCY_PROTOCOL_MAX_OBJECT_REQUEST_COUNT check and can populate far more than 500 list entries before the guard executes. Enforce the limit before resizing or inserting into the container.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/cryptonote_protocol/cryptonote_protocol_handler.inl` around lines 1851 -
1858, Enforce CURRENCY_PROTOCOL_MAX_OBJECT_REQUEST_COUNT while deserializing
NOTIFY_REQUEST_CHAIN::request, before buff_to_t_adapter resizes or inserts
entries into block_ids. Reject oversized serialized lists immediately and
preserve handle_request_chain’s existing validation for already-deserialized
requests.

MLOG_P2P_MESSAGE("Received NOTIFY_REQUEST_CHAIN (" << arg.block_ids.size() << " blocks");
NOTIFY_RESPONSE_CHAIN_ENTRY::request r;
if(!m_core.find_blockchain_supplement(arg.block_ids, r))
Expand Down Expand Up @@ -2514,6 +2522,13 @@ skip:
{
MLOG_P2P_MESSAGE("Received NOTIFY_RESPONSE_BLOCK_FLASHES: txs.size()=" << arg.txs.size());

if (arg.txs.size() > CURRENCY_PROTOCOL_MAX_TXS_REQUEST_COUNT)
{
LOG_ERROR_CCONTEXT("Too many flash transactions received: " << arg.txs.size() << " (maximum " << CURRENCY_PROTOCOL_MAX_TXS_REQUEST_COUNT << ")");
drop_connection(context, false, false);
return 1;
}

Comment on lines +2525 to +2531

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C 12 \
  'handle_request_block_flashes|get_mined_flashes|NOTIFY_RESPONSE_BLOCK_FLASHES|CURRENCY_PROTOCOL_MAX_TXS_REQUEST_COUNT' \
  --glob '*.h' --glob '*.hpp' --glob '*.cpp' --glob '*.inl' . || true

Repository: Beldex-Coin/beldex

Length of output: 31334

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- handler and producer implementation ---'
sed -n '2488,2555p' src/cryptonote_protocol/cryptonote_protocol_handler.inl
sed -n '630,680p' src/cryptonote_core/tx_pool.cpp

printf '%s\n' '--- all flash request construction and dispatch sites ---'
rg -n -C 8 \
  'NOTIFY_REQUEST_BLOCK_FLASHES|post_notify<NOTIFY_REQUEST_BLOCK_FLASHES>|heights\.push_back|heights\s*=' \
  src tests --glob '*.h' --glob '*.hpp' --glob '*.cpp' --glob '*.inl' || true

printf '%s\n' '--- relevant limit definitions and uses ---'
rg -n -C 4 \
  'CURRENCY_PROTOCOL_MAX_OBJECT_REQUEST_COUNT|CURRENCY_PROTOCOL_MAX_TXS_REQUEST_COUNT|NOTIFY_RESPONSE_BLOCK_FLASHES' \
  src tests --glob '*.h' --glob '*.hpp' --glob '*.cpp' --glob '*.inl' || true

Repository: Beldex-Coin/beldex

Length of output: 49584

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import re

handler = Path("src/cryptonote_protocol/cryptonote_protocol_handler.inl").read_text()
pool = Path("src/cryptonote_core/tx_pool.cpp").read_text()

m = re.search(
    r'int\s+t_cryptonote_protocol_handler<[^>]+>::handle_request_block_flashes\b.*?'
    r'\n\s*}\n\s*//-+\n\s*template<class t_core>\n\s*int\s+t_cryptonote_protocol_handler<[^>]+>::handle_response_block_flashes',
    handler,
    re.S,
)
assert m, "flash handler region not found"
request_handler = m.group(0)
assert "get_mined_flashes" in request_handler
assert "post_notify<NOTIFY_RESPONSE_BLOCK_FLASHES>(r, context)" in request_handler
assert not re.search(r'get_mined_flashes.*?CURRENCY_PROTOCOL_MAX_TXS_REQUEST_COUNT', request_handler, re.S)

m = re.search(
    r'tx_memory_pool::get_mined_flashes\b.*?\n\s*}\n',
    pool,
    re.S,
)
assert m, "get_mined_flashes implementation not found"
producer = m.group(0)
assert "result.push_back(hashes[i])" in producer
assert "CURRENCY_PROTOCOL_MAX_TXS_REQUEST_COUNT" not in producer
assert not re.search(r'result\.size\(\).*?(?:5000|CURRENCY_PROTOCOL_MAX_TXS_REQUEST_COUNT)', producer, re.S)

print("handle_request_block_flashes forwards the complete get_mined_flashes result.")
print("get_mined_flashes appends every matching hash and has no 5000-item bound.")
print("The response handler rejects a response above CURRENCY_PROTOCOL_MAX_TXS_REQUEST_COUNT before its GET_TXS batching loop.")
PY

Repository: Beldex-Coin/beldex

Length of output: 427

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- flash-pool capacity and insertion limits ---'
rg -n -C 5 \
  'max.*(flash|tx)|flash.*max|max_txpool|max_tx_pool|m_txpool_max_size|m_max.*pool|tx_pool_max|add.*flash|m_flashes|flash_hashes_and_mined_heights' \
  src/cryptonote_core src/cryptonote_protocol --glob '*.h' --glob '*.hpp' --glob '*.cpp' --glob '*.inl' || true

printf '%s\n' '--- request handlers and request-size validation ---'
sed -n '288,306p' src/cryptonote_protocol/cryptonote_protocol_defs.h
sed -n '124,140p' src/cryptonote_protocol/cryptonote_protocol_defs.cpp
rg -n -C 15 \
  'handle_request_block_flashes|arg\.heights\.size\(\)|NOTIFY_REQUEST_BLOCK_FLASHES' \
  src/cryptonote_protocol --glob '*.h' --glob '*.hpp' --glob '*.cpp' --glob '*.inl' || true

printf '%s\n' '--- flash-related configuration ---'
rg -n -i -C 3 \
  'flash.*(limit|count|size)|limit.*flash|flash.*pool|pool.*flash' \
  src tests --glob '*.h' --glob '*.hpp' --glob '*.cpp' --glob '*.inl' --glob '*.conf' --glob '*.ini' || true

Repository: Beldex-Coin/beldex

Length of output: 50375

Limit or batch flash responses before posting them.

get_mined_flashes() returns every matching hash, and the flash pool has no 5000-item limit. If more than 5000 hashes match the requested heights, the receiver drops the connection before its batching loop. Limit or split NOTIFY_RESPONSE_BLOCK_FLASHES at the producer.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/cryptonote_protocol/cryptonote_protocol_handler.inl` around lines 2525 -
2531, Update the producer path that calls get_mined_flashes() and posts
NOTIFY_RESPONSE_BLOCK_FLASHES to cap each response at
CURRENCY_PROTOCOL_MAX_TXS_REQUEST_COUNT (5000) or split larger results into
multiple responses. Ensure every matching flash hash is delivered through
bounded batches so the receiver’s validation in cryptonote_protocol_handler does
not drop the connection.

m_core.get_pool().keep_missing_flashes(arg.txs);
if (arg.txs.empty())
{
Expand Down
12 changes: 6 additions & 6 deletions src/wallet/wallet_rpc_server_commands_defs.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
// advance which version they will stop working with
// Don't go over 32767 for any of these
#define WALLET_RPC_VERSION_MAJOR 1
#define WALLET_RPC_VERSION_MINOR 17
#define WALLET_RPC_VERSION_MINOR 18
#define MAKE_WALLET_RPC_VERSION(major,minor) (((major)<<16)|(minor))
#define WALLET_RPC_VERSION MAKE_WALLET_RPC_VERSION(WALLET_RPC_VERSION_MAJOR, WALLET_RPC_VERSION_MINOR)

Expand Down Expand Up @@ -1365,7 +1365,7 @@ BELDEX_RPC_DOC_INTROSPECT

BELDEX_RPC_DOC_INTROSPECT
// Export transfers to csv
struct EXPORT_TRANSFERS : RPC_COMMAND
struct EXPORT_TRANSFERS : RESTRICTED
Comment thread
coderabbitai[bot] marked this conversation as resolved.
{
static constexpr auto names() { return NAMES("export_transfers"); }

Expand Down Expand Up @@ -1419,7 +1419,7 @@ BELDEX_RPC_DOC_INTROSPECT

BELDEX_RPC_DOC_INTROSPECT
// Export a signed set of key images.
struct EXPORT_KEY_IMAGES : RPC_COMMAND
struct EXPORT_KEY_IMAGES : RESTRICTED
{
static constexpr auto names() { return NAMES("export_key_images"); }

Expand Down Expand Up @@ -1668,7 +1668,7 @@ BELDEX_RPC_DOC_INTROSPECT

BELDEX_RPC_DOC_INTROSPECT
// Start mining in the beldex daemon.
struct START_MINING : RPC_COMMAND
struct START_MINING : RESTRICTED
Comment thread
coderabbitai[bot] marked this conversation as resolved.
{
static constexpr auto names() { return NAMES("start_mining"); }

Expand All @@ -1684,7 +1684,7 @@ BELDEX_RPC_DOC_INTROSPECT

BELDEX_RPC_DOC_INTROSPECT
// Stop mining in the beldex daemon.
struct STOP_MINING : RPC_COMMAND
struct STOP_MINING : RESTRICTED
{
static constexpr auto names() { return NAMES("stop_mining"); }

Expand Down Expand Up @@ -1753,7 +1753,7 @@ BELDEX_RPC_DOC_INTROSPECT

BELDEX_RPC_DOC_INTROSPECT
// Close the currently opened wallet, after trying to save it.
struct CLOSE_WALLET : RPC_COMMAND
struct CLOSE_WALLET : RESTRICTED
{
static constexpr auto names() { return NAMES("close_wallet"); }

Expand Down
Loading