iotaledger / iota / 40049193734

72%

Build Type

push

github

Committed by web-flow

Commit Message

fix(consensus): bound commit and latest header fetch entry counts while decoding (#13232)

# Description of change

Applies the bounded decoding from #13205 to the remaining fetch RPCs, so
no fetch response can make the client build many more entries than an
honest server sends.

- `FetchLatestBlockHeaders`: at most 256 headers per message, charged as
`TooManyFetchedHeadersReturned`.
- `FetchCommits` and `FetchCommitsAndTransactions`: one ceiling per
message over all fields together, from the new
`COMMITS_PER_FETCH_CEILING` (1024) plus, for fast sync, the transaction
entries a `MAX_FETCH_RESPONSE_BYTES` message can hold. A refusal is
charged as the new `TooManyCommitSyncEntries` (unprovable); the
collectors still check each field's count after decoding.
- The requests of these RPCs carry only numbers, so they get no entry
limit, and adding a field to them later stays compatible with older
servers.
- `GetLatestRounds` needs no limit: no client calls it.

## Links to any relevant issues

relates to iotaledger/iota-private#594

## How the change has been tested

- [x] Basic tests (linting, compilation, formatting, unit/integration
tests)
- [x] Patch-specific tests (correctness, functionality coverage)
- [x] I have added tests that prove my fix is effective or that my
feature works
- [x] I have checked that new and existing unit tests pass locally with
my changes

### Release Notes

- [ ] Protocol:
- [x] Nodes (Validators and Full nodes): `commit_sync_batch_size` and
`fast_commit_sync_batch_size` above 1024 are now rejected at startup.
- [ ] Indexer:
- [ ] JSON-RPC:
- [ ] GraphQL:
- [ ] CLI:
- [ ] Rust SDK:
- [ ] gRPC:

<!-- Do not remove: everything below this line is ignored by the
release-notes check. -->

---

Coverage Stats

137 of 138 new or added lines in 5 files covered. (99.28%)

3122 existing lines in 78 files now uncovered.

196892 of 275117 relevant lines covered (71.57%)

458052.4 hits per line