feat: restrict response sizes to expected sizes #20287
Merged
+210
−8
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
P2P ReqResp: Restrict response sizes to expected sizes
Summary
P2P request responses were previously limited to a default max size of 10MB for all ReqResp protocols. This change makes the limits dynamic based on what was actually requested. For example, if requesting 8 transactions, the limit is now
8 × MAX_TX_SIZE_KB + 1 KBinstead of a blanket 10MB.This reduces the attack surface for oversized response DoS and ensures predictable memory usage.
Changes
Size calculation per protocol
TxHashArraycount × 512 KB + 1 KBBitVectorrequestedCount × 512 KB + 1 KBFr(block number)StatusMessageAuthRequestFiles changed
stdlib/src/p2p/constants.ts— AddedMAX_L2_BLOCK_SIZE_KBconstant (3 MB)p2p/src/services/encoding.ts— AddedmaxSizeKbOverrideparameter toinboundTransformData()so callers can override topic-based limitsp2p/src/services/reqresp/protocols/tx.ts— AddedcalculateTxResponseSize()that computes expected size fromTxHashArraylengthp2p/src/services/reqresp/protocols/block_txs/block_txs_reqresp.ts— AddedcalculateBlockTxsResponseSize()that computes expected size fromBitVectorindicesp2p/src/services/reqresp/interface.ts— AddedsubProtocolSizeCalculatorsmap linking each protocol to its size calculatorp2p/src/services/reqresp/reqresp.ts—sendRequestToPeer()now computes expected response size from request payload and passes it through to decompression validationTests added
protocols/tx.test.ts(new) — Unit tests forcalculateTxResponseSizecovering single hash, multiple hashes, batch size, raw hash fallback, garbage input, and empty arrayprotocols/block_txs/block_txs.test.ts— Unit tests forcalculateBlockTxsResponseSizecovering various BitVector configurations and error casesencoding.test.ts— Tests formaxSizeKbOverrideparameter precedence over topic and default limitsNotes
MAX_TX_SIZE_KB(512 KB) constant is reused for all transaction size calculationsResolves A-469