search

flux-framework / flux-core

core services for the Flux resource management framework
GNU Lesser General Public License v3.0
166 stars 49 forks source link

kvs: investigate and prevent potential denial of service #6125

Open chu11 opened 1 month ago

chu11 commented 1 month ago

Related to #6124, there may be some denial or service possibilities in the KVS.

The first one that comes to mind is that there is no limit on the size of a kvstxn that can be sent to the KVS, like it could be a billion entries long.

(Mildly related, #1202, #1206, #1207, where some data could become crazy huge)

Edit: #5613 also related, although that issue is a bit more broad.

garlick commented 1 month ago

It might be interesting to survey blob sizes currently in the content cache on el cap. We could just look at one of the dump files I guess and make a histogram.

The original design for content was to have a 1MB limit on blobs, FWIW.

Edit: oh, I guess surveying keys in the dump is not the same as blob sizes but it would still be interesting.