Skip to content

Fix 1911#1922

Merged
oberstet merged 3 commits into
crossbario:masterfrom
oberstet:fix_1911
Jul 15, 2026
Merged

Fix 1911#1922
oberstet merged 3 commits into
crossbario:masterfrom
oberstet:fix_1911

Conversation

@oberstet

Copy link
Copy Markdown
Contributor

fixes #1911 - will be done with proper red-green two-phase TDD

oberstet added 3 commits July 14, 2026 22:17
…le (crossbario#1911)

The asyncio RawSocket receive size limit is hardwired to 16 MB: the dead
max_size=None branch in RawSocketProtocol.__init__ always yields length exponent
15, and there is no asyncio equivalent of the Twisted factory's
setProtocolOptions(maxMessagePayloadSize=...). So an asyncio WAMP peer cannot
tighten its receive cap for DoS hardening, and Crossbar's rawsocket
max_message_size has no effect on the asyncio path - a both-backend parity gap.

- test_aio_rawsocket.py: parametrized tests (RECV_LIMIT_CASES) asserting that
  after setProtocolOptions(maxMessagePayloadSize=N) the server handshake
  advertises the configured length exponent and enforces the matching receive
  cap (N rounded up to the next power of two), plus a test that a frame declaring
  more octets than the configured cap (but under 16 MB) is rejected.
- test_tx_rawsocket.py: the same table asserted against the Twisted backend
  (already configurable) as the parity contract - the two backends cannot be
  imported into one process (autobahn.twisted forces txaio.use_twisted), so
  parity is pinned by both matching the same formula.

To make the asyncio red behavioural rather than an AttributeError,
setProtocolOptions/resetProtocolOptions are added to the asyncio factory but not
yet applied to the protocol (__call__ ignores the configured value), so the new
tests fail because the cap stays hardwired at 16 MB. Enforcement lands next.

Note: This work was completed with AI assistance (Claude Code).
Activate the configuration surface added in the previous commit so
setProtocolOptions(maxMessagePayloadSize=...) actually reaches the protocol,
reaching parity with the Twisted backend.

- WampRawSocketFactory.__call__ now pushes the factory's _max_message_size onto
  the protocol via _set_max_message_size().
- RawSocketProtocol grows _set_max_message_size(max_size), which rounds the
  configured max up to the next power of two and derives the advertised
  handshake length exponent (2 ** (9 + exp)) and enforced receive cap, the same
  formula the Twisted backend uses. The dead max_size=None branch in __init__ is
  removed; __init__ keeps the 16 MB default for a protocol built without a
  factory.

An asyncio WAMP peer can now tighten its RawSocket receive cap for DoS
hardening, and Crossbar's RawSocket max_message_size takes effect on the asyncio
path. Makes the tests added in the previous commit pass; the Twisted parity test
pins both backends to the same accept/reject decisions.

Note: This work was completed with AI assistance (Claude Code).
@oberstet

Copy link
Copy Markdown
Contributor Author

@oberstet

Copy link
Copy Markdown
Contributor Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] asyncio RawSocket receive size limit is hardcoded to 16 MB (no setProtocolOptions), unlike the Twisted backend

1 participant