fix: limit bitswap requests

[LesnyRumcajs]

Summary of changes

Changes introduced in this pull request:

• hardening of bitswap layer - against potential DoS, right now bad peers can WANT a lot, possibly stalling the node on IO operations

Reference issue to close (if applicable)

Closes

Other information and links

Change checklist

• I have performed a self-review of my own code,
• I have made corresponding changes to the documentation. All new code adheres to the team's documentation standards,
• I have added tests that prove my fix is effective or that my feature works (if possible),
• I have made sure the CHANGELOG is up-to-date. All user-facing changes should be reflected in this document.

Outside contributions

• This pull request is based on an issue that a maintainer has accepted (see Before Opening a Pull Request).
• I have read and agree to the CONTRIBUTING document.
• I have read and agree to the AI Policy document. I understand that failure to comply with the guidelines will lead to rejection of the pull request.

Summary by CodeRabbit

• New Features

  • Improved Bitswap handling for inbound wantlists with bounded concurrent processing and response queuing.
  • Added safeguards to limit oversized wantlists and manage high request volumes reliably.
  • Outbound Bitswap responses are now dispatched through the service event loop.

• Documentation

  • Expanded documentation for the Bitswap message buffer limit.

• Bug Fixes

  • Improved responsiveness by moving inbound request processing off the main networking loop.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: c6876e4b-dd85-4b1c-8baa-53238314dc15

📥 Commits

Reviewing files that changed from the base of the PR and between 7b6e9d8 and 8f36e10.

📒 Files selected for processing (2)

• .config/forest.dic
• src/libp2p/service.rs

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• filecoin-project/lotus (manual)

🚧 Files skipped from review as they are similar to previous changes (2)

• src/libp2p/service.rs
• .config/forest.dic

---

Walkthrough

Changes

Bitswap serving flow

Layer / File(s)	Summary
Bounded serve infrastructure src/libp2p_bitswap/request_manager.rs, src/libp2p_bitswap/internals/codec.rs	BitswapRequestManager limits wantlist size, concurrent blocking serves, and queued responses. MAX_BUF_SIZE has crate-module visibility and specification documentation.
Deferred inbound request handling src/libp2p_bitswap/internals/event_handlers.rs, src/libp2p_bitswap/behaviour.rs	Inbound requests are collected and served outside the swarm loop. Store types now satisfy the bounds required by blocking tasks.
Serve response dispatch src/libp2p/service.rs, src/libp2p_bitswap/tests/request_manager.rs	The service event loop and test swarm loop consume deferred responses and send them to the relevant peer and CID.

Dictionary update

Layer / File(s)	Summary
Forest dictionary entries .config/forest.dic	The dictionary changes its first entry from 293 to 294 and adds wantlist/S.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: hanabi1224, eclesiomelojunior

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: limiting Bitswap requests to reduce denial-of-service risk.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bitswap-limit

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch bitswap-limit

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.10%. Comparing base (a379991) to head (8f36e10).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/libp2p/service.rs	0.00%	8 Missing ⚠️
src/libp2p_bitswap/request_manager.rs	90.19%	5 Missing ⚠️

Additional details and impacted files

Files with missing lines	Coverage Δ
src/libp2p_bitswap/behaviour.rs	91.04% <100.00%> (ø)
src/libp2p_bitswap/internals/codec.rs	100.00% <ø> (ø)
src/libp2p_bitswap/internals/event_handlers.rs	89.47% <100.00%> (-0.19%)	⬇️
src/libp2p_bitswap/request_manager.rs	81.04% <90.19%> (+2.26%)	⬆️
src/libp2p/service.rs	12.97% <0.00%> (-0.18%)	⬇️

... and 8 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a379991...8f36e10. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.config/forest.dic:
- Line 288: Reorder the entries in .config/forest.dic using case-insensitive
alphabetical order, placing wantlist/S before WASM so the repository dictionary
check passes.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: cf935e3b-5db6-4216-904b-fac1990b5c03

📥 Commits

Reviewing files that changed from the base of the PR and between a379991 and 7b6e9d8.

📒 Files selected for processing (7)

• .config/forest.dic
• src/libp2p/service.rs
• src/libp2p_bitswap/behaviour.rs
• src/libp2p_bitswap/internals/codec.rs
• src/libp2p_bitswap/internals/event_handlers.rs
• src/libp2p_bitswap/request_manager.rs
• src/libp2p_bitswap/tests/request_manager.rs

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• filecoin-project/lotus (manual)