evmrpc: extend admission control to the WebSocket plane

evmrpc/config/config.go

@@ -250,19 +250,26 @@ type Config struct {
 	// batched JSON-RPC call (HTTP and WebSocket). Set to 0 to disable the limit.
 	BatchResponseMaxSize int `mapstructure:"batch_response_max_size"`
 
-	// MaxRequestBodyBytes is the maximum size, in bytes, of a single HTTP
-	// JSON-RPC request body. Requests larger than this are rejected (HTTP 413)
-	// before the body is buffered or JSON-decoded. 0 uses the go-ethereum
-	// default (5 MiB).
+	// MaxRequestBodyBytes is the maximum size, in bytes, of a single HTTP (:8545)
+	// or WebSocket (:8546) JSON-RPC request/frame. HTTP requests larger than this
+	// are rejected (HTTP 413) before the body is buffered or JSON-decoded.
+	// WebSocket frames exceeding this limit are rejected by the read loop.
+	// 0 uses the go-ethereum default (5 MiB).
 	MaxRequestBodyBytes int64 `mapstructure:"max_request_body_bytes"`
 
-	// MaxConcurrentRequestBytes bounds the total size, in bytes, of HTTP
-	// JSON-RPC request bodies admitted for processing concurrently, weighted by
-	// each request's Content-Length. Requests that would exceed the budget are
-	// rejected fast (HTTP 429) before decode, capping peak memory under load.
-	// Set to 0 to disable the limit.
+	// MaxConcurrentRequestBytes bounds the total size, in bytes, of HTTP and
+	// WebSocket JSON-RPC request bodies admitted for processing concurrently
+	// (independent budgets per protocol). HTTP uses Content-Length weighting and
+	// rejects over-budget requests fast (HTTP 429). WebSocket blocks until
+	// budget frees or WSAdmissionTimeout elapses. Set to 0 to disable the limit
+	// on either protocol.
 	MaxConcurrentRequestBytes int64 `mapstructure:"max_concurrent_request_bytes"`
 
+	// WSAdmissionTimeout bounds how long a WebSocket connection waits for
+	// concurrent-byte budget to free before the next frame is read or committed.
+	// Zero or negative values use the go-ethereum default (30s).
+	WSAdmissionTimeout time.Duration `mapstructure:"ws_admission_timeout"`
+
 	// MaxOpenConnections caps the number of simultaneously accepted connections
 	// on the EVM HTTP and WebSocket listeners. The limit is applied per listener
 	// (HTTP and WS each get their own budget). Excess connections block in the
@@ -326,6 +333,7 @@ var DefaultConfig = Config{
 	BatchResponseMaxSize:      25 * 1000 * 1000,  // 25MB
 	MaxRequestBodyBytes:       5 * 1024 * 1024,   // 5 MiB (matches go-ethereum rpc default body limit)
 	MaxConcurrentRequestBytes: 128 * 1024 * 1024, // 128 MiB of request bodies admitted concurrently
+	WSAdmissionTimeout:        30 * time.Second,  // matches go-ethereum rpc defaultWSAdmissionTimeout
 	MaxOpenConnections:        2000,
 }
 
@@ -381,6 +389,7 @@ const (
 	flagBatchResponseMaxSize         = "evm.batch_response_max_size"
 	flagMaxRequestBodyBytes          = "evm.max_request_body_bytes"
 	flagMaxConcurrentRequestBytes    = "evm.max_concurrent_request_bytes"
+	flagWSAdmissionTimeout           = "evm.ws_admission_timeout"
 	flagMaxOpenConnections           = "evm.max_open_connections"
 )
 
@@ -651,6 +660,11 @@ func ReadConfig(opts servertypes.AppOptions) (Config, error) {
 			return cfg, err
 		}
 	}
+	if v := opts.Get(flagWSAdmissionTimeout); v != nil {
+		if cfg.WSAdmissionTimeout, err = cast.ToDurationE(v); err != nil {
+			return cfg, err
+		}
+	}
 	if v := opts.Get(flagMaxOpenConnections); v != nil {
 		if cfg.MaxOpenConnections, err = cast.ToIntE(v); err != nil {
 			return cfg, err
@@ -916,17 +930,23 @@ batch_request_limit = {{ .EVM.BatchRequestLimit }}
 # batched JSON-RPC call (HTTP and WebSocket). Set to 0 to disable the limit.
 batch_response_max_size = {{ .EVM.BatchResponseMaxSize }}
 
-# max_request_body_bytes is the maximum size, in bytes, of a single HTTP
-# JSON-RPC request body. Larger requests are rejected (HTTP 413) before the body
-# is buffered or JSON-decoded. Set to 0 to use the default (5 MiB).
+# max_request_body_bytes is the maximum size, in bytes, of a single HTTP (:8545)
+# or WebSocket (:8546) JSON-RPC request/frame. HTTP larger requests are rejected
+# (HTTP 413) before decode; WS frames exceeding this limit are rejected by the
+# read loop. Set to 0 to use the default (5 MiB).
 max_request_body_bytes = {{ .EVM.MaxRequestBodyBytes }}
 
-# max_concurrent_request_bytes bounds the total size, in bytes, of HTTP JSON-RPC
-# request bodies admitted for processing concurrently (weighted by each request's
-# Content-Length). Requests that would exceed the budget are rejected fast
-# (HTTP 429) before decode, capping peak memory under load. Set to 0 to disable.
+# max_concurrent_request_bytes bounds total request bytes admitted concurrently
+# on HTTP (:8545) and WebSocket (:8546) (independent budgets per protocol). HTTP
+# rejects over-budget requests fast (HTTP 429); WS blocks until budget frees or
+# ws_admission_timeout elapses. Set to 0 to disable on either protocol.
 max_concurrent_request_bytes = {{ .EVM.MaxConcurrentRequestBytes }}
 
+# ws_admission_timeout bounds how long a WebSocket connection waits for
+# concurrent-byte budget before the next frame is read or committed. Zero or
+# negative values use the go-ethereum default (30s).
+ws_admission_timeout = "{{ .EVM.WSAdmissionTimeout }}"
+
 # max_open_connections caps the number of simultaneously accepted connections on
 # the EVM HTTP and WebSocket listeners. Set to 0 to disable the limit.
 max_open_connections = {{ .EVM.MaxOpenConnections }}

evmrpc/config/config_test.go

@@ -48,6 +48,7 @@ type opts struct {
 	batchResponseMaxSize         interface{}
 	maxRequestBodyBytes          interface{}
 	maxConcurrentRequestBytes    interface{}
+	wsAdmissionTimeout           interface{}
 	maxOpenConnections           interface{}
 	maxTraceStructLogBytes       interface{}
 	traceAllowedTracers          interface{}
@@ -189,6 +190,9 @@ func (o *opts) Get(k string) interface{} {
 	if k == "evm.max_concurrent_request_bytes" {
 		return o.maxConcurrentRequestBytes
 	}
+	if k == "evm.ws_admission_timeout" {
+		return o.wsAdmissionTimeout
+	}
 	if k == "evm.max_open_connections" {
 		return o.maxOpenConnections
 	}
@@ -252,6 +256,7 @@ func getDefaultOpts() opts {
 		25 * 1000 * 1000,
 		int64(5 * 1024 * 1024),
 		int64(128 * 1024 * 1024),
+		30 * time.Second,
 		2000,
 		uint64(256 * 1024 * 1024),
 		[]string{"callTracer", "prestateTracer"},
@@ -519,15 +524,18 @@ func TestReadConfigRequestSizeLimits(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, config.DefaultConfig.MaxRequestBodyBytes, cfg.MaxRequestBodyBytes)
 	require.Equal(t, config.DefaultConfig.MaxConcurrentRequestBytes, cfg.MaxConcurrentRequestBytes)
+	require.Equal(t, config.DefaultConfig.WSAdmissionTimeout, cfg.WSAdmissionTimeout)
 
 	// Custom values (including 0 to use default / disable) flow through.
 	o := getDefaultOpts()
 	o.maxRequestBodyBytes = int64(1024)
 	o.maxConcurrentRequestBytes = int64(0)
+	o.wsAdmissionTimeout = 10 * time.Second
 	cfg, err = config.ReadConfig(&o)
 	require.NoError(t, err)
 	require.Equal(t, int64(1024), cfg.MaxRequestBodyBytes)
 	require.Equal(t, int64(0), cfg.MaxConcurrentRequestBytes)
+	require.Equal(t, 10*time.Second, cfg.WSAdmissionTimeout)
 }
 
 func TestReadConfigMaxOpenConnections(t *testing.T) {

evmrpc/metrics.go

@@ -18,6 +18,9 @@ const (
 	errorClassKey   = "error_class"
 	jsonrpcCodeKey  = "jsonrpc_code"
 	rejectReasonKey = "reason"
+	protocolKey     = "protocol"
+	protocolHTTP    = "http"
+	protocolWS      = "ws"
 	// reject reason values for requestRejectedCount.
 	rejectReasonOversize = "oversize" // body exceeded max_request_body_bytes
 	rejectReasonBusy     = "busy"     // max_concurrent_request_bytes budget exhausted
@@ -76,7 +79,7 @@ var (
 		)),
 		requestRejectedCount: must(rpcTelemetryMeter.Int64Counter(
 			"evmrpc_requests_rejected_total",
-			metric.WithDescription("Number of HTTP JSON-RPC requests rejected by pre-decode admission control (labeled by reason)"),
+			metric.WithDescription("Number of JSON-RPC requests rejected by admission control (labeled by protocol and reason)"),
 			metric.WithUnit("{count}"),
 		)),
 	}
@@ -166,13 +169,19 @@ func recordHistoricalDebugTraceAttempt(ctx context.Context, endpoint, connection
 	)
 }
 
-// recordRequestRejected counts an HTTP JSON-RPC request dropped by pre-decode
-// admission control. reason is one of rejectReasonOversize / rejectReasonBusy.
-// No endpoint dimension is recorded: the rejection happens before the JSON-RPC
-// method is decoded, so it is not yet known.
 func recordRequestRejected(ctx context.Context, reason string) {
 	metrics.requestRejectedCount.Add(ctx, 1,
 		metric.WithAttributes(
+			attribute.String(protocolKey, protocolHTTP),
+			attribute.String(rejectReasonKey, reason),
+		),
+	)
+}
+
+func recordWSAdmissionRejected(ctx context.Context, reason string) {
+	metrics.requestRejectedCount.Add(ctx, 1,
+		metric.WithAttributes(
+			attribute.String(protocolKey, protocolWS),
 			attribute.String(rejectReasonKey, reason),
 		),
 	)

evmrpc/request_limiter.go

@@ -11,6 +11,13 @@ import (
 // max_request_body_bytes is left at 0 ("use the default").
 const defaultMaxRequestBodyBytes int64 = 5 * 1024 * 1024
 
+func effectiveMaxRequestBodyBytes(max int64) int64 {
+	if max <= 0 {
+		return defaultMaxRequestBodyBytes
+	}
+	return max
+}
+
 // requestSizeLimiter is an HTTP middleware that bounds peak decode-time memory by
 // admitting JSON-RPC requests *before* the body is buffered or decoded. It enforces:
 //
@@ -34,9 +41,7 @@ type requestSizeLimiter struct {
 // global budget. If a positive budget is smaller than maxBody it is raised to maxBody
 // so that a single maximum-size request can always be admitted.
 func newRequestSizeLimiter(inner http.Handler, maxBody, maxConcurrentBytes int64) http.Handler {
-	if maxBody <= 0 {
-		maxBody = defaultMaxRequestBodyBytes
-	}
+	maxBody = effectiveMaxRequestBodyBytes(maxBody)
 	l := &requestSizeLimiter{inner: inner, maxBody: maxBody}
 	if maxConcurrentBytes > 0 {
 		if maxConcurrentBytes < maxBody {

evmrpc/request_limiter_test.go

@@ -58,6 +58,7 @@ func TestRequestSizeLimiter(t *testing.T) {
 	})
 
 	t.Run("zero maxBody uses default cap", func(t *testing.T) {
+		require.Equal(t, defaultMaxRequestBodyBytes, effectiveMaxRequestBodyBytes(0))
 		l, ok := newRequestSizeLimiter(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}), 0, 0).(*requestSizeLimiter)
 		require.True(t, ok)
 		require.Equal(t, defaultMaxRequestBodyBytes, l.maxBody)

evmrpc/rpcstack.go

@@ -53,9 +53,10 @@ type HTTPConfig struct {
 
 // WsConfig is the JSON-RPC/Websocket configuration
 type WsConfig struct {
-	Origins []string
-	Modules []string
-	prefix  string // path prefix on which to mount ws handler
+	Origins            []string
+	Modules            []string
+	prefix             string // path prefix on which to mount ws handler
+	wsAdmissionTimeout time.Duration
 	RPCEndpointConfig
 }
 
@@ -381,7 +382,20 @@ func (h *HTTPServer) EnableWS(apis []rpc.API, config WsConfig) error {
 	// Create RPC server and handler.
 	srv := rpc.NewServer()
 	srv.SetBatchLimits(config.batchItemLimit, config.batchResponseSizeLimit)
-	srv.SetReadLimits(config.readLimit)
+	readLimit := effectiveMaxRequestBodyBytes(config.readLimit)
+	if readLimit > math.MaxInt {
+		readLimit = math.MaxInt
+	}
+	srv.SetReadLimits(readLimit)
+	// maxConcurrentRequestBytes is passed through raw; rpc.Server.recomputeWSConcurrentBudget
+	// raises it to readLimit when smaller, matching
+	// newRequestSizeLimiter’s max(budget, maxBody) rule on the HTTP protocol.
+	srv.SetWSConcurrentRequestBytes(config.maxConcurrentRequestBytes)
+	srv.SetWSAdmissionTimeout(config.wsAdmissionTimeout)
+	srv.SetWSAdmissionEventHook(func(reason string) {
+		// Hook carries no request context, and the fork's own connCtx is context.Background() too.
+		recordWSAdmissionRejected(context.Background(), reason)
+	})
 	logger.Info("Registering apis for evm websocket")
 	if err := RegisterApis(apis, config.Modules, srv); err != nil {
 		return err

evmrpc/sei_legacy_http.go

@@ -29,10 +29,7 @@ func wrapSeiLegacyHTTP(inner http.Handler, allowlist map[string]struct{}, maxBod
 	if allowlist == nil {
 		return inner
 	}
-	if maxBody <= 0 {
-		maxBody = defaultMaxRequestBodyBytes
-	}
-	return &seiLegacyHTTPGate{inner: inner, allowlist: allowlist, maxBody: maxBody}
+	return &seiLegacyHTTPGate{inner: inner, allowlist: allowlist, maxBody: effectiveMaxRequestBodyBytes(maxBody)}
 }
 
 type seiLegacyHTTPGate struct {

evmrpc/server.go

@@ -24,7 +24,6 @@ var ConnectionTypeWS ConnectionType = "websocket"
 var ConnectionTypeHTTP ConnectionType = "http"
 
 const LocalAddress = "0.0.0.0"
-const DefaultWebsocketMaxMessageSize = 10 * 1024 * 1024
 
 type EVMServer interface {
 	Start() error
@@ -339,7 +338,9 @@ func NewEVMWebSocketServer(
 	}
 
 	wsConfig := WsConfig{Origins: strings.Split(config.WSOrigins, ",")}
-	wsConfig.readLimit = DefaultWebsocketMaxMessageSize
+	wsConfig.readLimit = config.MaxRequestBodyBytes
+	wsConfig.maxConcurrentRequestBytes = config.MaxConcurrentRequestBytes
+	wsConfig.wsAdmissionTimeout = config.WSAdmissionTimeout
 	wsConfig.batchItemLimit = config.BatchRequestLimit
 	wsConfig.batchResponseSizeLimit = config.BatchResponseMaxSize
 	if err := httpServer.EnableWS(apis, wsConfig); err != nil {