Limit extracted data size from genesis.tar.bz2 and snapshot.tar.bz2

[mvines]

As a DoS attack an RPC node could potentially serve up a genesis.tar.bz2 or snapshot.tar.bz2 that fills the disk of the victim validator, by building a file full of 0s or some other content that compresses very well.

[mvines]

@ryoqun - can you take this one please?

[ryoqun]

@ryoqun - can you take this one please?

Sure!

I think this attack is one of those zip bomb attacks.

[ryoqun]

@sakridge I think this fix will be really tiny but it would mildly conflict with split multi-file snapshot download you're working on now?

[sakridge]

@ryoqun shouldn't be a problem, I think the conflict will be small.

[sakridge]

With the --trusted-validator feature limited snapshot fetch to certain nodes, maybe this is lower priority?

[mvines]

The tarballs are still downloaded from any rando RPC node, so they can still blow up the disk before the actual contents (genesis/snapshot hash) can be approved or rejected