ARCHIVE/rippled
1
0
Fork 0
mirror of https://github.com/XRPLF/rippled.git synced 2026-08-21 22:30:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Cap untrusted manifests per message and drop oversized ones

Browse Source 
Bound the number of manifests carried in a single TMManifests message
(kMaxManifestsPerMessage). Trusted manifests are always included and
processed; untrusted gossip is capped per message on both send and
receive, and the sender is charged only when untrusted entries are
actually skipped. Oversized TMManifests messages are dropped without
penalty at the protocol layer so an unpatched peer is not disconnected.

Complements the cache bound from #276/#323.
This commit is contained in:
Valentin Balaschenko
2026-07-31 21:18:28 +01:00
committed by Ed Hennis
parent 0cce5a06d9
commit 4bd1d1ca2f
11 changed files with 178 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
include/xrpl/basics/base64.h
View File

@@ -54,16 +54,16 @@ encodedSize(std::size_t const nBytes)
}
/**
* Returns the maximum number of bytes a base64 string of @p nChars characters
* Returns the maximum number of bytes a base64 string of @p numChars characters
* decodes to.
*
* @param nChars Number of base64 characters.
* @param numChars Number of base64 characters.
* @return Upper bound on the number of decoded bytes.
*/
constexpr std::size_t
decodedSize(std::size_t const nChars)
decodedSize(std::size_t const numChars)
{
return ((nChars / 4) * 3) + 2;
return ((numChars / 4) * 3) + 2;
}
} // namespace base64

45
include/xrpl/server/Manifest.h
View File

@@ -47,8 +47,8 @@ namespace xrpl {
entry (which contains the manifest for this validator) is decoded and
added to the manifest cache. Other manifests are added as "gossip"
received from xrpld peers, including ones for validators this node does not
list. Manifests for unlisted validators are capped (kMaxUntrustedCount)
so peer gossip cannot grow the cache without bound; listed validators are
trust. Manifests for untrusted validators are capped (kMaxUntrustedCount)
so peer gossip cannot grow the cache without bound; trusted validators are
not capped. Entries are never evicted, so a stored revocation is permanent.
When an ephemeral key is compromised, a new signing key pair is created,
@@ -149,7 +149,7 @@ to_string(Manifest const& m);
* field body. Taking every field at its largest gives the maximum below, so
* anything larger cannot be a valid manifest.
*
* Field header + length + body = bytes
* Field header + length + body = bytes
* sfVersion (U16) 2 0 2 4
* sfSequence (U32) 1 0 4 5
* sfPublicKey (33) 1 1 33 35
@@ -172,16 +172,31 @@ constexpr std::size_t kMaxManifestBytes = 358;
*/
constexpr std::size_t kMaxManifestBase64 = base64::encodedSize(kMaxManifestBytes);
/**
* Constructs Manifest from serialized string
*
* @param s Serialized manifest string
*
* @return `std::nullopt` if string is invalid
*
* @note This does not verify manifest signatures.
* `Manifest::verify` should be called after constructing manifest.
*/
/** Maximum number of manifests carried in a single TMManifests message.
Outbound, the TMManifests message sent to a peer includes every trusted
manifest and fills the rest of this budget with untrusted gossip, so it
never exceeds this size. Inbound, trusted manifests are always processed
and untrusted ones are processed up to this many, so a peer sending its
whole cache cannot force unbounded work.
The trusted set is tiny relative to this bound, so trusted manifests are
not dropped in practice. This is a transitional per-message cap; the cache
already bounds untrusted manifests (see kMaxUntrustedCount), so it is no
longer needed once the network has upgraded past nodes that send their
whole cache in one message.
*/
constexpr std::size_t kMaxManifestsPerMessage = 200;
/** Constructs Manifest from serialized string
@param s Serialized manifest string
@return `std::nullopt` if string is invalid
@note This does not verify manifest signatures.
`Manifest::verify` should be called after constructing manifest.
*/
/** @{ */
std::optional<Manifest>
deserializeManifest(Slice s, beast::Journal journal);
@@ -282,7 +297,7 @@ to_string(ManifestDisposition m)
* must choose. `Capped` is the safe, flood-resistant value; only listed or
* configured keys should use `Uncapped`.
*/
enum class ManifestRateLimitCap : std::uint8_t {
enum class ManifestRateLimitCapPolicy : std::uint8_t {
Capped, ///< Subject to the untrusted cap (unlisted peer gossip)
Uncapped ///< Bypasses the cap (listed/trusted or config manifests)
};
@@ -433,7 +448,7 @@ public:
May be called concurrently
*/
ManifestDisposition
applyManifest(Manifest m, ManifestRateLimitCap cap);
applyManifest(Manifest m, ManifestRateLimitCapPolicy cap);
/**
* Stop counting a master key against the untrusted cap.