Skip to content

MaxSize computation for sized proto messages#3619

Open
pompon0 wants to merge 7 commits into
mainfrom
gprusak-msg-maxsize
Open

MaxSize computation for sized proto messages#3619
pompon0 wants to merge 7 commits into
mainfrom
gprusak-msg-maxsize

Conversation

@pompon0

@pompon0 pompon0 commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

For each message with "wireguard.sized = true", we generate "MaxSize() int" method. It will be used to bound buffers intended for caching those messages. Additionally I have made wireguard apply implicit max_count = 1 to every singular field, because proto.Unmarshal silently merges recursively instances of singular fields (if there are many), therefore making Scan() useless (which applies bounds field arity by instance). We have no use case for encoding singular fields as multiple partitions, so we simply disallow such encoding instead.

@pompon0 pompon0 requested review from sei-will and wen-coding June 22, 2026 13:26
@cursor

cursor Bot commented Jun 22, 2026

Copy link
Copy Markdown

PR Summary

Medium Risk
Changes pre-unmarshal wire validation and generated limits across consensus/P2P/ABCI message types; stricter rules may reject previously tolerated encodings, but intent is hardening against malformed or oversized inputs.

Overview
Extends the wireguard protoc plugin and runtime so bounded proto messages get compile-time wire limits and safer pre-decode validation.

For messages marked wireguard.sized = true, the generator now emits a MaxSize() int method (computed from field bounds) for sizing caches/buffers. Generated schemas also apply implicit MaxCount: 1 on every singular field, so Scan rejects duplicate wire occurrences that proto.Unmarshal would silently merge. Map fields are validated via a new IsMap rule and scanMapEntry.

The plugin registers wireguard schemas for all messages in generated files (not only the old annotation closure), refreshes .wireguard.go across ABCI, autobahn, p2p, and tendermint protos, and adds validation for max_total_size on non-repeated fields, recursive sized messages, and group fields in sized messages. Tests cover MaxSize vs encoded size, map scanning, duplicate singular fields, and packed = false repeated scalars.

Reviewed by Cursor Bugbot for commit 025002f. Bugbot is set up for automated code reviews on this repo. Configure here.

@github-actions

github-actions Bot commented Jun 22, 2026

Copy link
Copy Markdown

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

BuildFormatLintBreakingUpdated (UTC)
✅ passed✅ passed✅ passed✅ passedJun 22, 2026, 2:54 PM

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 2299c65. Configure here.

}
genFileName := strings.TrimSuffix(filepath.Base(file.Desc.Path()), ".proto") + ".wireguard.go"
g := p.NewGeneratedFile(filepath.Join(genDir, genFileName), file.GoImportPath)
g := p.NewGeneratedFile(filepath.Join(string(file.GoImportPath), genFileName), file.GoImportPath)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ignored module breaks output paths

High Severity

emit passes the full protobuf go_package import path into NewGeneratedFile instead of a path relative to the plugin module option. parseConfig reads module from the request but the result is discarded, so buf’s module=… opt no longer strips the prefix. Regeneration writes .wireguard.go files under nested github.com/… directories instead of beside the existing packages.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 2299c65. Configure here.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why is module param dropped here?

@codecov

codecov Bot commented Jun 22, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 81.59112% with 199 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.27%. Comparing base (f83a111) to head (025002f).
⚠️ Report is 2 commits behind head on main.

Files with missing lines Patch % Lines
...rmint/internal/protoutils/wireguard_plugin/main.go 28.30% 142 Missing and 10 partials ⚠️
...dermint/internal/autobahn/pb/autobahn.wireguard.go 68.42% 42 Missing ⚠️
...ndermint/proto/tendermint/store/types.wireguard.go 0.00% 5 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #3619      +/-   ##
==========================================
- Coverage   59.01%   58.27%   -0.75%     
==========================================
  Files        2224     2167      -57     
  Lines      182814   175202    -7612     
==========================================
- Hits       107893   102100    -5793     
+ Misses      65220    64094    -1126     
+ Partials     9701     9008     -693     
Flag Coverage Δ
sei-chain-pr 74.55% <81.59%> (?)
sei-db 70.41% <ø> (-0.22%) ⬇️
sei-db-state-db ?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
sei-tendermint/abci/types/types.wireguard.go 100.00% <100.00%> (ø)
...nternal/hashable/internal/pb/testonly.wireguard.go 100.00% <100.00%> (ø)
...i-tendermint/internal/p2p/giga/pb/api.wireguard.go 100.00% <100.00%> (ø)
...ei-tendermint/internal/p2p/mux/pb/mux.wireguard.go 100.00% <100.00%> (ø)
sei-tendermint/internal/p2p/pb/p2p.wireguard.go 100.00% <100.00%> (ø)
...-tendermint/internal/protoutils/runtime/runtime.go 89.74% <100.00%> (+6.88%) ⬆️
...rmint/internal/protoutils/test/a/pb/a.wireguard.go 100.00% <100.00%> (ø)
...mint/proto/tendermint/blocksync/types.wireguard.go 100.00% <100.00%> (ø)
...mint/proto/tendermint/consensus/types.wireguard.go 100.00% <100.00%> (ø)
...ermint/proto/tendermint/consensus/wal.wireguard.go 100.00% <100.00%> (ø)
... and 19 more

... and 75 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

size := 1
values := fd.Enum().Values()
for i := range values.Len() {
size = max(size, protowire.SizeVarint(uint64(int64(values.Get(i).Number())))) // nolint: gosec // WAI, negative enums are encoded as uint64

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: this is the size known to receiving side, but the sending side could define a much larger enum value and send it over?

}
genFileName := strings.TrimSuffix(filepath.Base(file.Desc.Path()), ".proto") + ".wireguard.go"
g := p.NewGeneratedFile(filepath.Join(genDir, genFileName), file.GoImportPath)
g := p.NewGeneratedFile(filepath.Join(string(file.GoImportPath), genFileName), file.GoImportPath)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why is module param dropped here?

for fullName := range inSchema {
d := byName[fullName]
func validateRuleValues(byName map[protoreflect.FullName]protoreflect.MessageDescriptor, exts wireguardExts) error {
for _, d := range byName {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would this iterate on all messages including external importas as well?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants