Add max allowed response content size:

This guards against dos attacks that
might send very large responses.

Signed-off-by: Jacob Weinstock <[email protected]>

providers/rpc/http_test.go

@@ -151,3 +151,16 @@ func TestCreateRequest(t *testing.T) {
 		})
 	}
 }
+
+func TestContentSize(t *testing.T) {
+	prov := New("http://127.0.0.1/rpc", "127.0.2.1", Secrets{SHA256: {"superSecret1"}})
+	_ = prov.Open(context.Background())
+	reqPayload := RequestPayload{ID: 1, Host: "127.0.0.1", Method: PowerGetMethod}
+	req, err := prov.createRequest(context.Background(), reqPayload)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if req.ContentLength > maxContentLenAllowed {
+		t.Fatalf("unexpected content length: got: %d, want: %v", req.ContentLength, maxContentLenAllowed)
+	}
+}

providers/rpc/rpc.go

@@ -25,9 +25,10 @@ const (
 	ProviderProtocol = "http"
 
 	// defaults
-	timestampHeader = "X-BMCLIB-Timestamp"
-	signatureHeader = "X-BMCLIB-Signature"
-	contentType     = "application/json"
+	timestampHeader      = "X-BMCLIB-Timestamp"
+	signatureHeader      = "X-BMCLIB-Signature"
+	contentType          = "application/json"
+	maxContentLenAllowed = 512 << (10 * 1) // 512KB
 
 	// SHA256 is the SHA256 algorithm.
 	SHA256 Algorithm = "sha256"
@@ -326,6 +327,9 @@ func (p *Provider) process(ctx context.Context, rp RequestPayload) (ResponsePayl
 	defer resp.Body.Close()
 
 	// handle the response
+	if resp.ContentLength > maxContentLenAllowed {
+		return ResponsePayload{}, fmt.Errorf("response body is too large: %d bytes, max allowed: %d bytes", resp.ContentLength, maxContentLenAllowed)
+	}
 	respPayload, err := p.handleResponse(resp, kvs)
 	if err != nil {
 		return ResponsePayload{}, err