@aztec/p2p 5.0.0-rc.1 → 5.0.0

package/src/services/reqresp/reqresp.ts

@@ -10,12 +10,18 @@ import type { Libp2p } from 'libp2p';
 import { pipeline } from 'node:stream/promises';
 import type { Uint8ArrayList } from 'uint8arraylist';
 
-import { IndividualReqRespTimeoutError } from '../../errors/reqresp.error.js';
-import { OversizedSnappyResponseError, SnappyTransform } from '../encoding.js';
+import { IndividualReqRespTimeoutError, OversizedReqRespRequestError } from '../../errors/reqresp.error.js';
+import {
+  DEFAULT_MAX_RESPONSE_SIZE_KB,
+  OversizedSnappyResponseError,
+  ResponseSizeLimitExceededError,
+  SnappyTransform,
+} from '../encoding.js';
 import type { PeerScoring } from '../peer-manager/peer_scoring.js';
 import {
   DEFAULT_INDIVIDUAL_REQUEST_TIMEOUT_MS,
   DEFAULT_REQRESP_DIAL_TIMEOUT_MS,
+  MAX_REQRESP_REQUEST_SIZE_BYTES,
   type P2PReqRespConfig,
 } from './config.js';
 import { ConnectionSampler, RandomSampler } from './connection-sampler/connection_sampler.js';
@@ -207,6 +213,11 @@ export class ReqResp implements ReqRespInterface {
     payload: Buffer,
     dialTimeout: number = this.dialTimeoutMs,
   ): Promise<ReqRespResponse> {
+    // Thrown before the try block so the generic error handling below does not penalize the peer for our own bug.
+    if (payload.length > MAX_REQRESP_REQUEST_SIZE_BYTES) {
+      throw new OversizedReqRespRequestError(subProtocol, payload.length, MAX_REQRESP_REQUEST_SIZE_BYTES);
+    }
+
     let stream: Stream | undefined;
     try {
       this.metrics.recordRequestSent(subProtocol);
@@ -291,6 +302,14 @@ export class ReqResp implements ReqRespInterface {
    * - The first chunk should contain a control byte, indicating the status of the response see `ReqRespStatus`
    * - The second chunk should contain the response data
    *
+   * To bound memory usage we abort reception as soon as the accumulated compressed bytes exceed a
+   * bound derived from `maxSizeKb`, before the full stream has been buffered. Without this a peer we
+   * dialed could stream data up to the request timeout, forcing us to buffer arbitrarily much (the
+   * `maxSizeKb` guard in `inboundTransformData` only runs after the whole compressed payload is
+   * concatenated, so it does nothing to cap reception memory). Snappy can expand incompressible input
+   * to ~1.17x its size, so we allow 2x `maxSizeKb`: comfortably above the worst-case expansion of a
+   * legitimate max-size response, while still capping buffered memory at twice the permitted size.
+   *
    * @param source - The async iterable source of data chunks
    * @param maxSizeKb - Optional maximum expected size in KB for the decompressed response
    */
@@ -298,10 +317,20 @@ export class ReqResp implements ReqRespInterface {
     let status: ReqRespStatus | undefined;
     const chunks: Uint8Array[] = [];
 
+    const maxAccumulatedBytes = (maxSizeKb ?? DEFAULT_MAX_RESPONSE_SIZE_KB) * 1024 * 2;
+    let accumulatedBytes = 0;
+
     try {
       for await (const chunk of source) {
         const statusParsed = status !== undefined;
         if (statusParsed) {
+          // Use `byteLength` (the logical length) rather than `chunk.subarray().length`: calling
+          // `subarray()` on a `Uint8ArrayList` consolidates its backing buffers into a single copy,
+          // which would materialize the very chunk we are trying to reject.
+          accumulatedBytes += chunk.byteLength;
+          if (accumulatedBytes > maxAccumulatedBytes) {
+            throw new ResponseSizeLimitExceededError(accumulatedBytes, maxAccumulatedBytes);
+          }
           chunks.push(chunk.subarray());
           continue;
         }
@@ -440,6 +469,9 @@ export class ReqResp implements ReqRespInterface {
     await pipeline(
       stream.source,
       async function* (source: any) {
+        // Req/resp is one-request-one-response: an honest sender writes a single payload and half-closes.
+        // Process only the first chunk and return, so extra frames a peer queues on the same stream cannot
+        // drive further handler invocations that bypass the per-stream rate-limit check in streamHandler.
         for await (const chunk of source) {
           const response = await handler(connection.remotePeer, chunk.subarray());
 
@@ -454,6 +486,7 @@ export class ReqResp implements ReqRespInterface {
 
           yield SUCCESS;
           yield snappy.outboundTransformData(response);
+          return;
         }
       },
       stream.sink,
@@ -564,6 +597,13 @@ export class ReqResp implements ReqRespInterface {
       return PeerErrorSeverity.LowToleranceError;
     }
 
+    // Response exceeded the reception buffer bound: the peer streamed more compressed data than the
+    // per-request size limit allows. Same protocol violation as above, penalize harshly.
+    if (e instanceof ResponseSizeLimitExceededError) {
+      this.logger.warn(`Oversized response from peer ${peerId.toString()} in ${subProtocol}: ${e.message}`, logTags);
+      return PeerErrorSeverity.LowToleranceError;
+    }
+
     return this.categorizeConnectionErrors(e, peerId, subProtocol);
   }
 

package/src/services/service.ts

@@ -58,6 +58,19 @@ export type DuplicateProposalInfo = {
  */
 export type P2PDuplicateProposalCallback = (info: DuplicateProposalInfo) => void;
 
+/** Minimal info passed to the oversized proposal callback. */
+export type OversizedProposalInfo = {
+  slot: SlotNumber;
+  proposer: EthAddress;
+};
+
+/**
+ * Callback for when a block proposal whose index lands at or beyond the consensus per-checkpoint block
+ * limit is stored and re-broadcast as slashing evidence. May fire multiple times per (slot, proposer)
+ * if the proposer signed several oversized proposals; consumers are expected to dedup.
+ */
+export type P2POversizedProposalCallback = (info: OversizedProposalInfo) => void;
+
 /** Minimal info passed to the duplicate attestation callback. */
 export type DuplicateAttestationInfo = {
   slot: SlotNumber;
@@ -108,6 +121,12 @@ export interface P2PService {
    */
   registerDuplicateProposalCallback(callback: P2PDuplicateProposalCallback): void;
 
+  /**
+   * Registers a callback invoked when an oversized block proposal (index at or beyond the consensus
+   * per-checkpoint block limit) is stored and re-broadcast as slashing evidence.
+   */
+  registerOversizedProposalCallback(callback: P2POversizedProposalCallback): void;
+
   /**
    * Registers a callback invoked when a duplicate attestation is detected (equivocation).
    * A validator signing attestations for different proposals at the same slot.

package/src/test-helpers/testbench-utils.ts

@@ -171,6 +171,10 @@ export class InMemoryTxPool extends EventEmitter implements TxPoolV2 {
     return Promise.resolve(this.txsByHash.size);
   }
 
+  async hasEligiblePendingTxs(minCount: number): Promise<boolean> {
+    return (await this.getPendingTxCount()) >= minCount;
+  }
+
   getMinedTxHashes(): Promise<[TxHash, L2BlockId][]> {
     return Promise.resolve([]);
   }