feat(relay): Add a bounded deserializer for (prost) protobuffers

Cargo.lock

@@ -772,6 +772,15 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6245d59a3e82a7fc217c5828a6692dbc6dfb63a0c8c90495621f7b9d79704a0e"
 
+[[package]]
+name = "convert_case"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "affbf0190ed2caf063e3def54ff444b449371d55c58e513a95ab98eca50adb49"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "cookie"
 version = "0.18.1"
@@ -1140,7 +1149,7 @@ version = "0.99.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6edb4b64a43d977b8e99788fe3a04d483834fba1215a7e02caa415b626497f7f"
 dependencies = [
- "convert_case",
+ "convert_case 0.4.0",
  "proc-macro2",
  "quote",
  "rustc_version",
@@ -2505,6 +2514,12 @@ dependencies = [
  "spin",
 ]
 
+[[package]]
+name = "leb128"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c83bff1d572d6b9aeef67ddfc8448e4a3737909cb28e81f97c791b9018703e52"
+
 [[package]]
 name = "libbz2-rs-sys"
 version = "0.2.5"
@@ -4038,6 +4053,18 @@ dependencies = [
  "prost 0.14.4",
 ]
 
+[[package]]
+name = "proto-descriptors"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "clap",
+ "convert_case 0.11.0",
+ "prost 0.14.4",
+ "prost-types",
+ "relay-serialization",
+]
+
 [[package]]
 name = "psl"
 version = "2.1.216"
@@ -4986,6 +5013,8 @@ dependencies = [
 name = "relay-serialization"
 version = "26.7.2"
 dependencies = [
+ "leb128",
+ "prost 0.14.4",
  "serde",
  "serde_json",
 ]
@@ -5060,6 +5089,7 @@ dependencies = [
  "relay-redis",
  "relay-replays",
  "relay-sampling",
+ "relay-serialization",
  "relay-spans",
  "relay-statsd",
  "relay-system",

Cargo.toml

@@ -145,6 +145,7 @@ insta = { version = "1", features = ["json", "redactions", "ron"] }
 ipnetwork = "0.21"
 itertools = "0.14"
 json-forensics = "0.1"
+leb128 = "0.2.7"
 libc = "0.2"
 liblzma = "0.4"
 lru = "0.16"

relay-serialization/Cargo.toml

@@ -13,7 +13,9 @@ publish = false
 workspace = true
 
 [dependencies]
+prost = { workspace = true }
 serde = { workspace = true }
+leb128 = { workspace = true }
 
 [dev-dependencies]
 serde_json = { workspace = true }

relay-serialization/src/lib.rs

@@ -4,4 +4,7 @@
 
 #![warn(missing_docs)]
 
+mod meter;
+
+pub mod prost;
 pub mod serde;

relay-serialization/src/meter.rs

@@ -0,0 +1,56 @@
+//! The operation budget shared by every bounded deserializer in this crate.
+
+use std::fmt;
+
+/// A budget for the ops a single deserialization is allowed to spend.
+pub(crate) struct Meter {
+    limit: usize,
+    remaining: usize,
+    exceeded: bool,
+}
+
+impl Meter {
+    /// Creates a meter which allows spending at most `limit` operations.
+    pub fn new(limit: usize) -> Self {
+        Self {
+            limit,
+            remaining: limit,
+            exceeded: false,
+        }
+    }
+
+    /// Returns the number of ops spent.
+    pub fn spent(&self) -> usize {
+        self.limit - self.remaining
+    }
+
+    /// Returns true if we've exceeded our budget.
+    pub fn exceeded(&self) -> bool {
+        self.exceeded
+    }
+
+    /// Tries to charge `amount` operations to the budget.  If we exceed, we return an error,
+    /// set the remaining budget to 0, and mark the budget as exceeded.
+    pub fn spend(&mut self, amount: usize) -> Result<(), LimitExceeded> {
+        match self.remaining.checked_sub(amount) {
+            Some(remaining) => {
+                self.remaining = remaining;
+                Ok(())
+            }
+            None => {
+                self.remaining = 0;
+                self.exceeded = true;
+                Err(LimitExceeded)
+            }
+        }
+    }
+}
+
+/// The error produced when a [`Meter`] runs out of budget.
+pub(crate) struct LimitExceeded;
+
+impl fmt::Display for LimitExceeded {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "deserialization exceeds the operation budget")
+    }
+}

relay-serialization/src/prost/mod.rs

@@ -0,0 +1,9 @@
+//! Deserialization routines for prost.
+//! This implements a scanner to record the number of "operations" needed to decode a proto,
+//! allowing a caller to enforce a hard limit on how much work to be done.
+mod scan;
+
+pub use scan::Error;
+pub use scan::MessageDesc;
+pub use scan::decode;
+pub use scan::scan;