fix: bound DKG pending message queues across NodeId reconnects - #7524
Draft
PastaPastaPasta wants to merge 1 commit into
Draft
fix: bound DKG pending message queues across NodeId reconnects#7524PastaPastaPasta wants to merge 1 commit into
PastaPastaPasta wants to merge 1 commit into
Conversation
PastaPastaPasta
force-pushed
the
sec/v017
branch
2 times, most recently
from
August 3, 2026 15:01
ee9c5e9 to
b988249
Compare
|
This pull request has conflicts, please rebase. |
CDKGPendingMessages limited intake per NodeId, but NodeId is an ephemeral per-connection identifier. Reconnecting peers could therefore obtain a fresh quota while previously queued payloads remained resident; observer-mode handlers could retain that state indefinitely. Bound each message-type queue by actual serialized payload bytes derived from its quorum parameters while retaining the per-connection count limit. Reject duplicates and invalid sizes before applying capacity pressure, evict the oldest payload from the peer with the largest occupancy when necessary, and keep locally generated DKG messages exempt. Add a protocol-handler finalization hook that releases a disconnecting peer's unprocessed payloads, quota, and corresponding seen hashes. Cover byte accounting, reconnect bounds, duplicate replay, eviction, local messages, and disconnect cleanup with focused unit tests.
PastaPastaPasta
force-pushed
the
sec/v017
branch
from
August 4, 2026 05:57
b988249 to
12f74e3
Compare
PastaPastaPasta
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue being fixed or feature implemented
v23.1.8 added param-derived limits for individual DKG messages, but aggregate pending-queue retention was still bounded only by
messagesPerNode[from] >= maxMessagesPerNode.NodeIdis an ephemeral per-connection identifier, and disconnecting a peer did not release its counter, queued payloads, or queuedseenMessageshashes.A peer could therefore reconnect under fresh
NodeIdvalues and repeatedly obtain a new quota while prior payloads remained resident. Observer-mode handlers are especially exposed because they enqueue DKG traffic but do not advance rounds and clear the queues.What was done?
develop, preserving the v23.1.8 per-message structural and size checks.How Has This Been Tested?
make -C src -j8 test/test_dash./src/test/test_dash --run_test=llmq_dkg_pending_tests(8 test cases)git diff upstream/develop...HEAD --checkThe focused tests cover per-node quotas, byte bounds across fresh
NodeIdvalues, oversized and empty payload rejection, duplicate replay behavior, byte-based eviction, local-message retention, and disconnect cleanup/accounting.Breaking Changes
None.
Checklist: