Commit e8cc4e4
authored
chore: bump libp2p version (#280)
This PR bumps the libp2p version to
2f14d0ec9665a01cfb6a02326c90628c4bba521c (the commit is in our fork).
# Changelog
Here's the summary of meaningful changes from upstream `master`:
## Gossipsub Changes (likely fixed our issue)
### `5d47d9d` - Port of 55e4a64 (biggest change)
**Multiple gossipsub fixes to `Instant` arithmetic and backoff
handling:**
- **GRAFT flood penalty fix**: Replaced unsafe `Instant` subtraction
(which can panic/overflow) with `checked_sub` +
`saturating_duration_since`. The old code computed `(backoff_time +
graft_flood_threshold) - prune_backoff` which could panic if the
arithmetic overflowed. This is likely **the fix** that resolved
cross-client mesh issues: if a peer's GRAFT was incorrectly penalized
due to arithmetic overflow, it would never join the mesh.
- **IWANT followup time**: Added `checked_add` to prevent `Instant`
overflow
- **Fanout TTL check**: Replaced `Instant` addition with
`saturating_duration_since`
- **IDONTWANT timeout**: Same pattern, safer arithmetic
- **Max PRUNE backoff cap**: Added `MAX_REMOTE_PRUNE_BACKOFF_SECONDS =
3600` to prevent a remote peer from requesting an absurdly long backoff
### `a7d59cb` - CVE fix (GHSA-gc42-3jg7-rxr2)
**Security fix**: Ignore oversized PRUNE backoff values. A malicious
peer could send a PRUNE with a backoff duration so large that
`Instant::now() + time` would overflow, causing a panic. Now uses
`checked_add` and ignores invalid values.
### `7637c23` - Optimize IDONTWANT send
Only send IDONTWANT for first-seen large messages, deduplicating
redundant messages.
### `aa7a9ec` - Partial messages extension
New gossipsub feature for partial message delivery (spec:
libp2p/specs#704).
### `055186d` - Fix duplicate metrics
Bug fix for double-counted metrics.
## Other Changes
- `8541b83` - Remove `async_trait` from request_response (this caused
our codec.rs compile fix)
- `b6b79b2` - MSRV bump to 1.88.0, Rust edition 2024
- `aad1f8e` - Remove unused `rpc.rs`
- `7cbf7c1` - TLS key logging via SSLKEYLOGFILE
- `3f88b30` - Rendezvous protocol port
- ~35 dependency bumps
## Root Cause Analysis
The GRAFT flood penalty fix in `5d47d9d` is almost certainly what fixed
our cross-client block propagation. The old code had unsafe `Instant`
arithmetic that could overflow when zeam peers (with slightly different
timing) sent GRAFT requests. The overflow would cause the penalty check
to always trigger, causing ethlambda to PRUNE zeam peers from the block
topic mesh. Attestations worked because they used fanout (bypasses
mesh/GRAFT entirely).1 parent c2e33d3 commit e8cc4e4
3 files changed
Lines changed: 80 additions & 86 deletions
0 commit comments