hyperledger-labs / fabric-smart-client / 37762082191
91%

DEFAULT BRANCH: main
Ran
Jobs 0
Files 0
Run time –
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
37762082191

push

github

web-flow 
fix(view)!: bound concurrent responders per remote peer (#2024)

p2p.Service started one goroutine per message on the master session,
and each one created a comm session and a view context for its
responder. Nothing limited how many ran at once, so one authenticated
peer could make the node hold an unbounded number of goroutines,
contexts and sessions by sending first messages faster than its
responders finished.

Start now dispatches through per-peer counters keyed on msg.FromPKID,
which the comm layer takes from the authenticated stream. A peer can
run at most fsc.p2p.maxRespondersPerPeer responders at once (default
1000). As with the other fsc.p2p size keys, zero or a negative value
falls back to the default, so a mistyped value cannot turn the limit
off. The limit is per peer because a global one would let a single
peer take every slot.

A first message over the limit gets an error reply, so the initiator
fails fast. Up to the same number of rejections can be pending per
peer. They are counted separately from the responders, so pending
rejections never keep a peer from starting new ones; further first
messages are dropped. The peer controls how often both happen, so both
log at debug level. dispatch never blocks, and one peer cannot stall
the master session for the others.

The reply goes out through the new comm.Service.ReplyError, which
sends on a one-shot session that is never registered and then closes
it. A follow-up message can reach the master session before the
responder for its first message has registered the session. Because
the rejection never registers or deletes a session, it cannot take
over or close the session that responder uses, whichever goroutine
runs first.

A slot is freed only when its responder returns, so a responder that
never returns keeps its slot until shutdown. There is no deadline on
responder execution.

docs/configuration.md documents the new key, and the comm readme
describes the limit.

TestService_LimitsRespond... (continued)
Source Files on build 37762082191
Detailed source file information is not available for this build.