EVM-819 DoS on Websockets

[igorcrevar]

Description

Gorilla websocket library does not have any read limits by default.
Attacker could send a very large stream of data and trigger out of memory crash.
The polygon-edge process will be stopped by system OOM killer.
Impact
Remote denial of service. No authentication is required.Risk Breakdown
Difficulty to Exploit: Easy Weakness: CVSS2 Score:
Recommendation
Use SetReadLimit() call of gorilla library.

New server flag --websocket-read-limit is introduced. By default this value is 8192. This value specifies read limit for web socket connections.

Changes include

• Bugfix (non-breaking change that solves an issue)
• Hotfix (change that solves an urgent issue, and requires immediate attention)
• New feature (non-breaking change that adds functionality)
• Breaking change (change that is not backwards-compatible and/or changes current functionality)

Checklist

• I have assigned this PR to myself
• I have added at least 1 reviewer
• I have added the relevant labels
• I have updated the official documentation
• I have added sufficient documentation in code

Testing

• I have tested this code with the official test suite
• I have tested this code manually

Manual tests

• Start cluster
• execute this script https://gist.githubusercontent.com/gln7/5715dd75657d77ed765d9618473aecec/raw/6940f797b145da229aef433145cf705a88d5bbdf/t1.py
• the script should failed and not freeze cluster machine

[vcastellm]

LGTM