cherry-pick: add optional gRPC max message size limit to trillian logserver and logsigner #3801#427
Merged
cherry-pick: add optional gRPC max message size limit to trillian logserver and logsigner #3801#427
Conversation
…gsigner (google#3801) * add optional gRPC max message size limit to trillian logserver and logsigner Signed-off-by: Firas Ghanmi <fghanmi@redhat.com> * update CHANGELOG.md Signed-off-by: Firas Ghanmi <fghanmi@redhat.com> --------- Signed-off-by: Firas Ghanmi <fghanmi@redhat.com>
Reviewer's GuideAdds an optional --max_msg_size_bytes flag to both Trillian logsigner and logserver for enforcing a server-side gRPC receive message size limit when set to a positive value, preserving backward compatibility when unset or zero, and updates the CHANGELOG accordingly. Class diagram for updated Trillian logsigner and logserver main functionsclassDiagram
class Main {
+RPCEndpoint
+HTTPEndpoint
+TLSCertFile
+TLSKeyFile
+StatsPrefix
+ExtraOptions
+DBClose
+Registry
+RegisterServerFn
}
class grpc_ServerOption
class flag {
+Int(name, default, usage)
}
Main --> grpc_ServerOption : uses
Main --> flag : uses
class trillian_log_signer_main {
+maxMsgSize : int
main()
}
class trillian_log_server_main {
+maxMsgSize : int
main()
}
trillian_log_signer_main --> Main : configures
trillian_log_server_main --> grpc_ServerOption : configures
trillian_log_signer_main --> flag : defines maxMsgSize
trillian_log_server_main --> flag : defines maxMsgSize
Flow diagram for gRPC server option with max message sizeflowchart TD
A[Start logsigner/logserver] --> B{Is --max_msg_size_bytes > 0?}
B -- Yes --> C[Add grpc.MaxRecvMsgSize option]
B -- No --> D[No message size limit]
C --> E[Start gRPC server with limit]
D --> F[Start gRPC server without limit]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Hey @fghanmi - I've reviewed your changes - here's some feedback:
- It may be worth validating that max_msg_size_bytes isn’t negative (and failing fast) instead of silently treating negative values the same as zero.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- It may be worth validating that max_msg_size_bytes isn’t negative (and failing fast) instead of silently treating negative values the same as zero.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
SequeI
approved these changes
Aug 5, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This change introduces a new optional flag --max_msg_size_bytes to both Trillian logsigner and logserver.
When set to a positive value, the flag enables a gRPC server-side limit on the size of incoming messages using grpc.MaxRecvMsgSize(). This provides a safeguard against resource exhaustion and potential denial-of-service (DoS) attacks caused by overly large client requests.
If the flag is unset or set to 0, no message size limit is enforced, preserving backward compatibility with existing deployments.
This change is non-breaking by design and is disabled by default.
Checklist
Summary by Sourcery
Add a non‐breaking, opt‐in gRPC receive message size limit to the Trillian logserver and logsigner by introducing a new --max_msg_size_bytes flag that is disabled by default.
New Features:
Documentation: