[stable2512] Backport #10416

Cargo.toml

@@ -724,7 +724,7 @@ cfg-if = { version = "1.0" }
 chain-spec-builder = { path = "substrate/bin/utils/chain-spec-builder", default-features = false, package = "staging-chain-spec-builder" }
 chain-spec-guide-runtime = { path = "docs/sdk/src/reference_docs/chain_spec_runtime" }
 chrono = { version = "0.4.31" }
-cid = { version = "0.9.0" }
+cid = { version = "0.11.1" }
 clap = { version = "4.5.13" }
 clap_complete = { version = "4.5.13" }
 cmd_lib = { version = "1.9.5" }
@@ -908,7 +908,7 @@ linked-hash-map = { version = "0.5.4" }
 linked_hash_set = { version = "0.1.4" }
 linregress = { version = "0.5.1" }
 lite-json = { version = "0.2.0", default-features = false }
-litep2p = { version = "0.12.0", features = ["rsa", "websocket"] }
+litep2p = { version = "0.12.2", features = ["rsa", "websocket"] }
 log = { version = "0.4.22", default-features = false }
 macro_magic = { version = "0.5.1" }
 maplit = { version = "1.0.2" }

prdoc/pr_10416.prdoc

@@ -0,0 +1,12 @@
+title: 'Added CID filtering to Bitswap server'
+doc:
+- audience: Node Dev
+  description: |-
+    This PR adds CID (Content Identifier) validation and filtering to the Bitswap server
+    implementation. The server now validates incoming CID requests before processing them.
+
+crates:
+- name: sc-network
+  bump: minor
+- name: sc-network-types
+  bump: minor

substrate/client/network/Cargo.toml

@@ -30,7 +30,6 @@ async-channel = { workspace = true }
 async-trait = { workspace = true }
 asynchronous-codec = { workspace = true }
 bytes = { workspace = true, default-features = true }
-cid = { workspace = true }
 codec = { features = ["derive"], workspace = true, default-features = true }
 either = { workspace = true, default-features = true }
 fnv = { workspace = true }
@@ -70,6 +69,7 @@ zeroize = { workspace = true, default-features = true }
 
 [dev-dependencies]
 assert_matches = { workspace = true }
+cid = { workspace = true }
 multistream-select = { workspace = true }
 sc-block-builder = { workspace = true, default-features = true }
 sp-consensus = { workspace = true, default-features = true }

substrate/client/network/src/bitswap/mod.rs

@@ -27,8 +27,8 @@ use crate::{
 	MAX_RESPONSE_SIZE,
 };
 
-use cid::{self, Version};
 use futures::StreamExt;
+use litep2p::types::cid::{Cid, Error as CidError, Version as CidVersion};
 use log::{debug, error, trace};
 use prost::Message;
 use sc_client_api::BlockBackend;
@@ -60,11 +60,16 @@ const MAX_WANTED_BLOCKS: usize = 16;
 /// Bitswap protocol name
 const PROTOCOL_NAME: &'static str = "/ipfs/bitswap/1.2.0";
 
+/// Check if a CID is supported by the bitswap protocol.
+pub fn is_cid_supported(cid: &Cid) -> bool {
+	cid.version() != CidVersion::V0 && cid.hash().size() == 32
+}
+
 /// Prefix represents all metadata of a CID, without the actual content.
 #[derive(PartialEq, Eq, Clone, Debug)]
 struct Prefix {
 	/// The version of CID.
-	pub version: Version,
+	pub version: CidVersion,
 	/// The codec of CID.
 	pub codec: u64,
 	/// The multihash type of CID.
@@ -189,19 +194,16 @@ impl<B: BlockT> BitswapRequestHandler<B> {
 		}
 
 		for entry in wantlist.entries {
-			let cid = match cid::Cid::read_bytes(entry.block.as_slice()) {
+			let cid = match Cid::read_bytes(entry.block.as_slice()) {
 				Ok(cid) => cid,
 				Err(e) => {
 					trace!(target: LOG_TARGET, "Bad CID {:?}: {:?}", entry.block, e);
 					continue
 				},
 			};
 
-			if cid.version() != cid::Version::V1 ||
-				cid.hash().code() != u64::from(cid::multihash::Code::Blake2b256) ||
-				cid.hash().size() != 32
-			{
-				debug!(target: LOG_TARGET, "Ignoring unsupported CID {}: {}", peer, cid);
+			if !is_cid_supported(&cid) {
+				trace!(target: LOG_TARGET, "Ignoring unsupported CID {}: {}", peer, cid);
 				continue
 			}
 
@@ -270,7 +272,7 @@ pub enum BitswapError {
 
 	/// Error parsing CID
 	#[error(transparent)]
-	BadCid(#[from] cid::Error),
+	BadCid(#[from] CidError),
 
 	/// Packet read error.
 	#[error(transparent)]
@@ -293,6 +295,7 @@ pub enum BitswapError {
 mod tests {
 	use super::*;
 	use futures::channel::oneshot;
+	use litep2p::types::multihash::Code;
 	use sc_block_builder::BlockBuilderBuilder;
 	use schema::bitswap::{
 		message::{wantlist::Entry, Wantlist},
@@ -441,7 +444,7 @@ mod tests {
 							block: cid::Cid::new_v1(
 								0x70,
 								cid::multihash::Multihash::wrap(
-									u64::from(cid::multihash::Code::Blake2b256),
+									u64::from(Code::Blake2b256),
 									&[0u8; 32],
 								)
 								.unwrap(),
@@ -502,7 +505,7 @@ mod tests {
 							block: cid::Cid::new_v1(
 								0x70,
 								cid::multihash::Multihash::wrap(
-									u64::from(cid::multihash::Code::Blake2b256),
+									u64::from(Code::Blake2b256),
 									&sp_crypto_hashing::blake2_256(&ext.encode()[pattern_index..]),
 								)
 								.unwrap(),

substrate/client/network/src/litep2p/shim/bitswap.rs

@@ -18,6 +18,7 @@
 
 //! Shim for litep2p's Bitswap implementation to make it work with `sc-network`.
 
+use crate::bitswap::is_cid_supported;
 use futures::StreamExt;
 use litep2p::protocol::libp2p::bitswap::{
 	BitswapEvent, BitswapHandle, BlockPresenceType, Config, ResponseType, WantType,
@@ -60,6 +61,7 @@ impl<Block: BlockT> BitswapServer<Block> {
 
 					let response: Vec<ResponseType> = cids
 						.into_iter()
+						.filter(|(cid, _)| is_cid_supported(&cid))
 						.map(|(cid, want_type)| {
 							let mut hash = Block::Hash::default();
 							hash.as_mut().copy_from_slice(&cid.hash().digest()[0..32]);