fix(connect): reject a ClusterActivation over a 256 MiB ceiling before parsing it (#1078)

AD
4d ago
+719-3

What

ClusterActivation.tensor_data was unbounded and the declared seq_len/hidden_size come from the same untrusted message, so ParseFromArray would allocate an oversized activation in full before any validation could reject it (up to protobuf's ~2 GB limit).

  • RAC_CONNECT_MAX_CLUSTER_ACTIVATION_BYTES (256 MiB) in rac_connect.h caps one serialized ClusterActivation.
  • rac_connect_cluster_validate_activation_proto checks request_size against it before parse_message, returning RAC_SUCCESS with a typed accepted = false validation (the same shape as every other activation rejection) without touching the payload.
  • The ceiling is stated in the idl/connect.proto contract next to the message and in the header doc.

Tests

core/tests/test_connect_proto_abi.cpp 11c: a request one byte over the ceiling is rejected with a "ceiling" reason. Only the length is consulted before parsing, so a 1-byte buffer stands in for the oversized message and the test does not allocate 256 MiB.

Notes

The receive path in #1071 (#1053) is the natural second place for this check once it lands; this keeps the commons entry point safe regardless of transport. Stacked on #723 (the activation validator lives there), so the diff includes #723's commits until it merges; idl/SCHEMA_LOCK regenerated for the comment change.

Closes #1078

Summary by cubic

Adds the local AI cluster orchestration API (rac_connect_cluster_start_proto, join, stop, validate_activation_proto) and rejects ClusterActivation messages over 256 MiB before parsing them, so an oversized tensor_data is never allocated from an untrusted payload. Previously ParseFromArray would allocate the full activation up to protobuf's ~2 GB limit before validation ran, and the declared seq_len/hidden_size come from the same untrusted message so they cannot bound it.

  • Start validates peer assignments and contiguous, gap-free layer ranges; join checks the peer's assigned span against its advertised max_layers; stop tears down the active cluster.
  • The ceiling (RAC_CONNECT_MAX_CLUSTER_ACTIVATION_BYTES) is checked against request_size before parsing and returns the same typed accepted = false validation as every other activation rejection.
  • The test covers a request one byte over the ceiling using a 1-byte buffer, so it does not allocate 256 MiB.

Summary by CodeRabbit

  • New Features
    • Added support for starting, joining, and stopping local clusters, with checks for peer assignments, contiguous layer ranges, and compatible cluster settings.
    • Added cluster activation validation for active clusters, layer assignments, tensor dimensions, and minimum data size. Serialized activation requests larger than 256 MiB are rejected before parsing.
    • Added cluster state and peer information to responses for successful start, join, and stop operations.