SearchV2 DOS protection #1357

New issue

Open

opened 2025-12-28 17:22:41 +00:00 by sami · 4 comments

sami commented

2025-12-28 17:22:41 +00:00

Owner

Originally created by @roman-khimov on GitHub (Feb 24, 2025).

I'm always frustrated when I realize that specifically crafted SearchV2 requests can make the node spend a lot of CPU cycles for nothing. Normal requests that want to quickly find something are no longer a problem, but some other can be.

Describe the solution you'd like

Add an iteration limit to the SearchV2 implementation. If we're making like 10K iterations with no results we're done, internal error is returned. The parameter is node-specific with this 10K default.

Describe alternatives you've considered

Time limits, but they're harder to check.

Additional context

#3058

Originally created by @roman-khimov on GitHub (Feb 24, 2025). ## Is your feature request related to a problem? Please describe. I'm always frustrated when I realize that specifically crafted SearchV2 requests can make the node spend a lot of CPU cycles for nothing. Normal requests that want to quickly find something are no longer a problem, but some other can be. ## Describe the solution you'd like Add an iteration limit to the SearchV2 implementation. If we're making like 10K iterations with no results we're done, internal error is returned. The parameter is node-specific with this 10K default. ## Describe alternatives you've considered Time limits, but they're harder to check. ## Additional context #3058

sami added the

neofs-storage

security

config

labels

2025-12-28 17:22:41 +00:00

sami commented

2025-12-28 17:22:42 +00:00

Author

Owner

@carpawell commented on GitHub (Feb 24, 2025):

What "iterations" means here?

@carpawell commented on GitHub (Feb 24, 2025): What "iterations" means here?

sami commented

2025-12-28 17:22:42 +00:00

Author

Owner

@roman-khimov commented on GitHub (Feb 24, 2025):

Keys evaluated as per primary index.

@roman-khimov commented on GitHub (Feb 24, 2025): Keys evaluated as per primary index.

sami commented

2025-12-28 17:22:42 +00:00

Author

Owner

@carpawell commented on GitHub (Feb 24, 2025):

So your suggestion does not allow to find (10K+1)th element ever?

@carpawell commented on GitHub (Feb 24, 2025): So your suggestion does not allow to find (10K+1)th element ever?

sami commented

2025-12-28 17:22:42 +00:00

Author

Owner

@roman-khimov commented on GitHub (Feb 24, 2025):

SV2 works with 1000 items returned along with the continuation token normally and this will still work for regular uses since there is just 1000 iterations per request. But if you have 6M objects in a container you can create a query for non-existing object and I don't want to scan 6M (or whatever per-node share of it) of entries to answer that.

@roman-khimov commented on GitHub (Feb 24, 2025): SV2 works with 1000 items returned along with the continuation token normally and this will still work for regular uses since there is just 1000 iterations per request. But if you have 6M objects in a container you can create a query for non-existing object and I don't want to scan 6M (or whatever per-node share of it) of entries to answer that.