fix: harden gRPC HTTP/2 stream limits

[GuipaiQigong111]

Summary

• upgrade grpc-java from 1.81.0 to 1.83.0
• consume Netty 4.2.15.Final from grpc-java 1.83.0 instead of overriding Netty through a separate BOM
• retain Netty's 4.1 pooled allocator behavior during the initial 4.2 rollout
• enforce the configured concurrent-stream limit on grpc-java's server-side HTTP/2 connection before the client acknowledges server SETTINGS
• use a finite default of 100 concurrent calls per connection and migrate legacy explicit 0 to that secure default
• add real Netty handler and raw-socket RpcService regression coverage

Root cause

grpc-java constructs DefaultHttp2Connection, its encoder, and its decoder directly instead of using Netty's Http2ConnectionHandlerBuilder. It advertises SETTINGS_MAX_CONCURRENT_STREAMS, but Netty normally applies that setting to connection.remote().maxActiveStreams() only after the peer acknowledges it.

Netty's fixed builder applies the limit immediately, but grpc-java bypasses that builder. java-tron therefore installs a small plaintext protocol-negotiator wrapper that applies the same validated value before delegating handler installation:

grpcHandler.connection().remote().maxActiveStreams(maxConcurrentStreams);

The compatibility shim is tracked by grpc-java#12930 and can be removed after grpc-java performs equivalent server-side enforcement.

Dependency selection

• grpc-java 1.83.0 declares Netty 4.2.15.Final
• CVE-2026-47244 / GHSA-5x3r-wrvg-rp6q is patched in Netty 4.2.15.Final
• CVE-2026-50560 / GHSA-563q-j3cm-6jxm is patched in Netty 4.2.15.Final

The standalone nettyVersion and netty-bom declaration have been removed. The resolved runtime classpath contains 13 Netty modules, all at 4.2.15.Final, with no Netty 4.1.x or mixed 4.2.x versions.

Netty 4.2 split its former codec artifact into smaller modules. java-tron's backup server directly uses the protobuf frame codec, which is not a grpc-netty transitive dependency, so netty-codec-protobuf is declared explicitly at the same 4.2.15.Final version. Its protobuf-java and javanano transitives remain excluded.

The macOS/ARM64 protoc-gen-grpc-java version is aligned to 1.83.0, as required by the existing build configuration. grpc-java 1.83.0 resolves protobuf-java 3.25.9 and its corresponding dependency updates.

Netty 4.2 allocator migration

Netty 4.2 changes the default allocator from pooled to adaptive. Following Netty's staged migration guidance, both java-tron VM option files explicitly set -Dio.netty.allocator.type=pooled. The adaptive allocator can be evaluated separately with representative load and soak testing.

The gRPC version is defined once in the root Gradle extension and reused by runtime dependencies and the ARM/macOS code generator. Obsolete gRPC 1.81.0 and Netty 4.1.132.Final verification entries have been removed.

Configuration impact

node.rpc.maxConcurrentCallsPerConnection now defaults to 100.

Previous releases treated an explicit value of 0 as unlimited. This PR maps 0 to the secure default of 100 and logs a startup migration warning. Operators that require more than 100 concurrent calls on one connection must configure an explicit positive value. Negative values now fail during configuration parsing with a clear parameter error.

Validation on target branch

Passed locally after applying the change to fix/discard-unknown-fields-for-p2p-messages:

• resolved all 13 Netty runtime modules to 4.2.15.Final
• verified the assembled distribution contains -Dio.netty.allocator.type=pooled
• ./gradlew :common:test --tests org.tron.core.config.args.NodeConfigTest
• gRPC limiter and raw-socket RpcServiceHttp2SecurityTest
• target-branch KeepAliveMessageTest and MessageUnknownFieldTest
• ./gradlew :framework:checkstyleMain :framework:checkstyleTest :framework:assemble :protocol:assemble

The branch is one squashed commit ahead of fix/discard-unknown-fields-for-p2p-messages.

[halibobo1205]

please add guava:33.6.0-jre.pom sha256

[halibobo1205]

IllegalArgumentException exception = assertThrows(
IllegalArgumentException.class,
() -> GrpcNettyMaxConcurrentStreamsLimiter.newPlaintextNegotiator(limit));
assertEquals("maxConcurrentStreams must be positive", exception.getMessage());

[halibobo1205]

gRPC version 1.83.0 is still duplicated in build.gradle and protocol/build.gradle. Define grpcVersion once in the root ext block and use it for both the runtime dependencies and ARM/macOS code generator.

[halibobo1205]

The Netty 4.2 allocator migration has not been addressed. The upgrade implicitly changes Netty’s default allocator from pooled to adaptive, but the PR neither pins io.netty.allocator.type=pooled nor provides representative load or soak-test results for the adaptive allocator. Netty recommends retaining the pooled allocator during the initial 4.2 rollout and evaluating adaptive allocation separately. See the Netty 4.2 Migration Guide.

[halibobo1205]

Obsolete verification entries remain, including gRPC 1.81.0 and Netty 4.1.132.Final. This does not affect the resolved runtime classpath, but it does not satisfy the earlier requirement to clean up expired verification metadata.

[halibobo1205]

gradle/verification-metadata.xml is missing guava-parent:33.6.0-jre.pom (and guava-33.6.0-jre.pom).
grpc-core/grpc-api 1.83.0 pull guava:33.6.0-android

[waynercheung]

LGTM