@libp2p/floodsub 11.0.25 → 11.0.26-02fcf704d

package/src/peer-streams.ts

@@ -1,6 +1,7 @@
 import { pbStream } from '@libp2p/utils'
 import { TypedEventEmitter } from 'main-event'
 import { RPC } from './message/rpc.ts'
+import type { RPCDecodeLimits } from './decodeRpc.ts'
 import type { PubSubRPC } from './floodsub.ts'
 import type { PeerStreamsEvents } from './index.ts'
 import type { Stream, PeerId } from '@libp2p/interface'
@@ -38,7 +39,7 @@ export class PeerStreams extends TypedEventEmitter<PeerStreamsEvents> {
     this.shutDownController = new AbortController()
   }
 
-  attachInboundStream (stream: Stream, streamOpts?: Partial<ProtobufStreamOpts>): void {
+  attachInboundStream (stream: Stream, streamOpts?: Partial<ProtobufStreamOpts>, decodeRpcLimits?: RPCDecodeLimits): void {
     this.inboundPb = pbStream(stream, streamOpts).pb(RPC)
 
     Promise.resolve().then(async () => {
@@ -48,7 +49,8 @@ export class PeerStreams extends TypedEventEmitter<PeerStreamsEvents> {
         }
 
         const message = await this.inboundPb.read({
-          signal: this.shutDownController.signal
+          signal: this.shutDownController.signal,
+          limits: decodeRpcLimits
         })
 
         this.safeDispatchEvent('message', {
@@ -57,7 +59,11 @@ export class PeerStreams extends TypedEventEmitter<PeerStreamsEvents> {
       }
     })
       .catch(err => {
+        // the inbound stream errored (e.g. a frame exceeded the decode limits):
+        // reset it and close the peer so floodsub removes it instead of leaving
+        // a half-open peer with a dead inbound stream
         this.inboundPb?.unwrap().unwrap().abort(err)
+        this.close()
       })
   }
 

package/src/sign.ts

@@ -80,14 +80,18 @@ export function messagePublicKey (message: SignedMessage): PublicKey {
     throw new Error('Could not get the public key from the originator id')
   }
 
-  if (message.key != null) {
-    return message.key
-  }
-
+  // an Ed25519/secp256k1 peer id embeds its own public key, so a key recovered
+  // from `from` is provably the author's; trust it over the supplied message.key
   if (message.from.publicKey != null) {
     return message.from.publicKey
   }
 
+  // otherwise the supplied key must derive to the from peer id, else a message
+  // could be signed by one key while claiming a different author
+  if (message.key != null && message.from.equals(message.key.toMultihash().bytes)) {
+    return message.key
+  }
+
   // We couldn't validate pubkey is from the originator, error
   throw new Error('Could not get the public key from the originator id')
 }

package/dist/typedoc-urls.json

@@ -1,41 +0,0 @@
-{
-  "TopicValidatorResult": "https://libp2p.github.io/js-libp2p/enums/_libp2p_floodsub.TopicValidatorResult.html",
-  ".:TopicValidatorResult": "https://libp2p.github.io/js-libp2p/enums/_libp2p_floodsub.TopicValidatorResult.html",
-  "FloodSub": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.FloodSub.html",
-  ".:FloodSub": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.FloodSub.html",
-  "FloodSubComponents": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.FloodSubComponents.html",
-  ".:FloodSubComponents": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.FloodSubComponents.html",
-  "FloodSubEvents": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.FloodSubEvents.html",
-  ".:FloodSubEvents": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.FloodSubEvents.html",
-  "FloodSubInit": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.FloodSubInit.html",
-  ".:FloodSubInit": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.FloodSubInit.html",
-  "PeerStreamsEvents": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.PeerStreamsEvents.html",
-  ".:PeerStreamsEvents": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.PeerStreamsEvents.html",
-  "PublishResult": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.PublishResult.html",
-  ".:PublishResult": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.PublishResult.html",
-  "SignedMessage": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.SignedMessage.html",
-  ".:SignedMessage": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.SignedMessage.html",
-  "Subscription": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.Subscription.html",
-  ".:Subscription": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.Subscription.html",
-  "SubscriptionChangeData": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.SubscriptionChangeData.html",
-  ".:SubscriptionChangeData": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.SubscriptionChangeData.html",
-  "TopicValidatorFn": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.TopicValidatorFn.html",
-  ".:TopicValidatorFn": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.TopicValidatorFn.html",
-  "UnsignedMessage": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.UnsignedMessage.html",
-  ".:UnsignedMessage": "https://libp2p.github.io/js-libp2p/interfaces/_libp2p_floodsub.UnsignedMessage.html",
-  "Message": "https://libp2p.github.io/js-libp2p/types/_libp2p_floodsub.Message.html",
-  ".:Message": "https://libp2p.github.io/js-libp2p/types/_libp2p_floodsub.Message.html",
-  "SignaturePolicy": "https://libp2p.github.io/js-libp2p/types/_libp2p_floodsub.SignaturePolicy.html",
-  ".:SignaturePolicy": "https://libp2p.github.io/js-libp2p/types/_libp2p_floodsub.SignaturePolicy.html",
-  "protocol": "https://libp2p.github.io/js-libp2p/variables/_libp2p_floodsub.protocol.html",
-  ".:protocol": "https://libp2p.github.io/js-libp2p/variables/_libp2p_floodsub.protocol.html",
-  "pubSubSymbol": "https://libp2p.github.io/js-libp2p/variables/_libp2p_floodsub.pubSubSymbol.html",
-  "StrictNoSign": "https://libp2p.github.io/js-libp2p/variables/_libp2p_floodsub.StrictNoSign.html",
-  ".:StrictNoSign": "https://libp2p.github.io/js-libp2p/variables/_libp2p_floodsub.StrictNoSign.html",
-  "StrictSign": "https://libp2p.github.io/js-libp2p/variables/_libp2p_floodsub.StrictSign.html",
-  ".:StrictSign": "https://libp2p.github.io/js-libp2p/variables/_libp2p_floodsub.StrictSign.html",
-  "floodsub": "https://libp2p.github.io/js-libp2p/functions/_libp2p_floodsub.floodsub.html",
-  ".:floodsub": "https://libp2p.github.io/js-libp2p/functions/_libp2p_floodsub.floodsub.html",
-  "isPubSub": "https://libp2p.github.io/js-libp2p/functions/_libp2p_floodsub.isPubSub.html",
-  ".:isPubSub": "https://libp2p.github.io/js-libp2p/functions/_libp2p_floodsub.isPubSub.html"
-}