Skip to content

Commit e8cc4e4

Browse files
authored
chore: bump libp2p version (#280)
This PR bumps the libp2p version to 2f14d0ec9665a01cfb6a02326c90628c4bba521c (the commit is in our fork). # Changelog Here's the summary of meaningful changes from upstream `master`: ## Gossipsub Changes (likely fixed our issue) ### `5d47d9d` - Port of 55e4a64 (biggest change) **Multiple gossipsub fixes to `Instant` arithmetic and backoff handling:** - **GRAFT flood penalty fix**: Replaced unsafe `Instant` subtraction (which can panic/overflow) with `checked_sub` + `saturating_duration_since`. The old code computed `(backoff_time + graft_flood_threshold) - prune_backoff` which could panic if the arithmetic overflowed. This is likely **the fix** that resolved cross-client mesh issues: if a peer's GRAFT was incorrectly penalized due to arithmetic overflow, it would never join the mesh. - **IWANT followup time**: Added `checked_add` to prevent `Instant` overflow - **Fanout TTL check**: Replaced `Instant` addition with `saturating_duration_since` - **IDONTWANT timeout**: Same pattern, safer arithmetic - **Max PRUNE backoff cap**: Added `MAX_REMOTE_PRUNE_BACKOFF_SECONDS = 3600` to prevent a remote peer from requesting an absurdly long backoff ### `a7d59cb` - CVE fix (GHSA-gc42-3jg7-rxr2) **Security fix**: Ignore oversized PRUNE backoff values. A malicious peer could send a PRUNE with a backoff duration so large that `Instant::now() + time` would overflow, causing a panic. Now uses `checked_add` and ignores invalid values. ### `7637c23` - Optimize IDONTWANT send Only send IDONTWANT for first-seen large messages, deduplicating redundant messages. ### `aa7a9ec` - Partial messages extension New gossipsub feature for partial message delivery (spec: libp2p/specs#704). ### `055186d` - Fix duplicate metrics Bug fix for double-counted metrics. ## Other Changes - `8541b83` - Remove `async_trait` from request_response (this caused our codec.rs compile fix) - `b6b79b2` - MSRV bump to 1.88.0, Rust edition 2024 - `aad1f8e` - Remove unused `rpc.rs` - `7cbf7c1` - TLS key logging via SSLKEYLOGFILE - `3f88b30` - Rendezvous protocol port - ~35 dependency bumps ## Root Cause Analysis The GRAFT flood penalty fix in `5d47d9d` is almost certainly what fixed our cross-client block propagation. The old code had unsafe `Instant` arithmetic that could overflow when zeam peers (with slightly different timing) sent GRAFT requests. The overflow would cause the penalty check to always trigger, causing ethlambda to PRUNE zeam peers from the block topic mesh. Attestations worked because they used fanout (bypasses mesh/GRAFT entirely).
1 parent c2e33d3 commit e8cc4e4

3 files changed

Lines changed: 80 additions & 86 deletions

File tree

0 commit comments

Comments
 (0)