tari-project / tari / 37777676484
77%

DEFAULT BRANCH: development
Ran
Jobs 1
Files 798
Run time 3min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 74.098% (+0.3%) from 73.774%
37777676484

push

github

web-flow 
fix: bound protobuf decode on every peer-reachable path (#8095)

## Summary
Bounds what a peer can make this node allocate when it decodes protobuf,
on every peer-reachable decode path, and moves RPC handshakes off the
server's accept loop.

Origin: a security analysis of `tari_comms_rpc_macros` found that the
generated RPC dispatch decoded the whole request before any type-aware
bound. A 6 MiB `submit_transaction` of empty inputs (2 wire bytes each)
decoded to 3.1M `TransactionInput`s at 776 B each: 2.46 GB peak per
request, measured; ten sessions per identity exceed a 16 GB host; the
same held for streamed `sync_blocks` items on the client. Details and
all decisions: `tari-issues/rpc_macros_bounded_decode/SPEC.md`
(Amendments 1-9).

## What changed
- **`#[derive(DecodeBudget)]`** (tari_comms_rpc_macros) generates a wire
walker from prost's field attributes: it charges message instances,
repeated bytes/string occurrences, unpacked scalar elements and
packed-scalar bytes, follows maps under any wire type (prost's map merge
ignores it), skips groups like prost, never enters bytes/strings.
Applied to every tari proto via `ProtobufCompiler`. Differential fuzzed
against prost 0.13.5 (7M cases, no undercount).
- **Budget before decode** on: RPC server requests and client
responses/stream items (`#[rpc(method, max_items, max_request_items,
reserved_methods)]`, const paths allowed; shared `BODY_MAX_DECODE_ITEMS`
= 262,144); messaging
NewTransaction/NewBlock/BaseNodeServiceRequest/Response; mempool sync
frames; DHT envelope/join/discovery; liveness ping; RPC handshake (1 KiB
codec limit).
- **Caps pinned to consensus** by a per-network test (max-weight
hydrated block ≈1.65x under the cap on mainnet, ≈1.19x on 127,795-weight
networks; compact sync ≈7x/5.8x).
- **Boxed large optional prost sub-messages**: `TransactionInput` 776 →
232 B, `TransactionOutput` 608 → 176 B.
- **RpcServer**: defaults 100 sessions / 10 per peer; handshakes run in
tasks under pending c... (continued)

2069 of 2196 new or added lines in 43 files covered. (94.22%)

239 existing lines in 28 files now uncovered.

121200 of 163568 relevant lines covered (74.1%)

328703.83 hits per line

Uncovered Changes

Lines Coverage ∆ File
30
84.73
15.61% comms/rpc_macros/src/expand.rs
20
95.58
comms/core/src/decode_budget.rs
17
87.89
1.83% comms/core/src/protocol/rpc/server/mod.rs
16
90.48
comms/rpc_macros/src/decode_budget.rs
9
0.0
0.0% common/src/build/protobuf.rs
8
84.03
8.08% comms/core/src/protocol/rpc/handshake.rs
8
93.0
0.44% comms/dht/src/inbound/decryption.rs
4
83.78
-1.93% comms/core/src/protocol/rpc/test/mock.rs
4
99.36
-0.36% comms/core/src/protocol/rpc/test/smoke.rs
3
26.67
0.48% base_layer/core/src/base_node/sync/block_sync/error.rs
2
36.21
-14.5% comms/dht/src/network_discovery/discovering.rs
2
83.72
6.98% comms/rpc_macros/src/options.rs
1
87.5
-12.5% base_layer/core/src/base_node/sync/rpc/mod.rs
1
74.83
2.88% base_layer/core/src/mempool/sync_protocol/mod.rs
1
99.72
-0.1% base_layer/core/src/mempool/sync_protocol/test.rs
1
50.0
-50.0% base_layer/p2p/src/services/utils.rs

Coverage Regressions

Lines Coverage ∆ File
61
36.21
-14.5% comms/dht/src/network_discovery/discovering.rs
54
62.8
-0.77% base_layer/core/src/chain_storage/blockchain_database.rs
37
59.09
1.78% base_layer/core/src/chain_storage/lmdb_db/lmdb_db.rs
13
80.91
3.33% base_layer/core/src/test_helpers/blockchain.rs
9
50.0
-50.0% base_layer/p2p/src/services/utils.rs
8
85.2
-1.4% comms/core/src/connection_manager/dialer.rs
6
91.47
-2.84% base_layer/core/src/base_node/chain_metadata_service/service.rs
5
71.44
-0.45% base_layer/core/src/base_node/comms_interface/inbound_handlers.rs
5
26.67
-18.79% base_layer/p2p/src/comms_connector/peer_message.rs
5
74.09
1.61% comms/core/src/connectivity/manager.rs
5
77.61
15.85% comms/core/src/message/envelope.rs
5
67.11
-0.33% comms/dht/src/inbound/dht_handler/task.rs
4
90.56
-1.72% comms/core/src/peer_validator/helpers.rs
3
90.41
-4.11% comms/core/src/pipeline/inbound.rs
3
87.98
-0.38% comms/dht/src/actor.rs
2
72.49
0.15% base_layer/wallet/src/output_manager_service/storage/sqlite_db/mod.rs
2
84.41
-0.14% comms/core/src/protocol/rpc/client/mod.rs
2
84.03
8.08% comms/core/src/protocol/rpc/handshake.rs
1
0.0
0.0% base_layer/core/src/base_node/rpc/mod.rs
1
59.04
2.41% base_layer/core/src/chain_storage/block_add_result.rs
1
0.0
0.0% base_layer/core/src/mempool/rpc/mod.rs
1
80.82
-1.37% base_layer/node_components/src/blocks/chain_block.rs
1
87.89
1.83% comms/core/src/protocol/rpc/server/mod.rs
1
88.74
0.05% comms/core/src/protocol/rpc/status.rs
1
83.78
-1.93% comms/core/src/protocol/rpc/test/mock.rs
1
88.61
-0.63% comms/dht/src/config.rs
1
0.0
0.0% comms/dht/src/rpc/mod.rs
1
84.73
15.61% comms/rpc_macros/src/expand.rs
Jobs
ID Job ID Ran Files Coverage
1 37777676484.1 798
74.1
GitHub Action Run
Source Files on build 37777676484