What happens
http_source answers 200 to two kinds of body that Iggy refuses to store:
- An empty body.
IggyMessage::new refuses it with InvalidMessagePayloadLength.
- A body over
MAX_PAYLOAD_SIZE (64,000,000 bytes). max_body_size_bytes accepts values up to MAX_BODY_SIZE_BYTES_LIMIT (67,108,864), so a config above 64,000,000 lets these through. IggyMessage::new refuses them with TooBigMessagePayload.
The runtime cannot build that message, so it sends nothing from the batch and NACKs it. http_source keeps the batch and replays it first on every poll, so the batch can never succeed.
Why it matters
On master, five NACKs stop the poll task. The listener keeps answering 200 until the bridge fills, and the restart that recovers the connector drops everything in the bridge. With #4269, which turns the NACK limit off for http_source, the batch replays forever instead, and /health stays 200.
One empty POST that passes authentication is enough, with default limits. The on_nack doc says the connector refuses bad input at the door. For these two cases it does not.
Fix
enqueue answers 400 {"error":"empty body"} for an empty body, before anything is queued.MAX_BODY_SIZE_BYTES_LIMIT becomes MAX_PAYLOAD_SIZE, so every body the handlers accept can be stored, and an oversize body gets the existing 413. A config with max_body_size_bytes above 64,000,000 now fails open(). Such a config can already stall the source.- Correct the
on_nack doc and the README tables to match.
Provenance
Found while reviewing #4269: #4269 (comment). The code came in with #3798.
Contribution
What happens
http_source answers 200 to two kinds of body that Iggy refuses to store:
IggyMessage::newrefuses it withInvalidMessagePayloadLength.MAX_PAYLOAD_SIZE(64,000,000 bytes).max_body_size_bytesaccepts values up toMAX_BODY_SIZE_BYTES_LIMIT(67,108,864), so a config above 64,000,000 lets these through.IggyMessage::newrefuses them withTooBigMessagePayload.The runtime cannot build that message, so it sends nothing from the batch and NACKs it. http_source keeps the batch and replays it first on every poll, so the batch can never succeed.
Why it matters
On master, five NACKs stop the poll task. The listener keeps answering 200 until the bridge fills, and the restart that recovers the connector drops everything in the bridge. With #4269, which turns the NACK limit off for http_source, the batch replays forever instead, and
/healthstays 200.One empty POST that passes authentication is enough, with default limits. The
on_nackdoc says the connector refuses bad input at the door. For these two cases it does not.Fix
enqueueanswers 400{"error":"empty body"}for an empty body, before anything is queued.MAX_BODY_SIZE_BYTES_LIMITbecomesMAX_PAYLOAD_SIZE, so every body the handlers accept can be stored, and an oversize body gets the existing 413. A config withmax_body_size_bytesabove 64,000,000 now failsopen(). Such a config can already stall the source.on_nackdoc and the README tables to match.Provenance
Found while reviewing #4269: #4269 (comment). The code came in with #3798.
Contribution