Skip to content

fix(generator): panic-safety and visible drops at throttle and connection edges - #1917

Closed
blt wants to merge 2 commits into
blt/observer-hardeningfrom
blt/generator-hardening
Closed

fix(generator): panic-safety and visible drops at throttle and connection edges#1917
blt wants to merge 2 commits into
blt/observer-hardeningfrom
blt/generator-hardening

Conversation

@blt

@blt blt commented Jul 21, 2026

Copy link
Copy Markdown
Collaborator

What does this PR do?

A brief description of the change being made with this pull request.

Motivation

What inspired you to submit this pull request?

Related issues

A list of issues either fixed, containing architectural discussions, otherwise relevant
for this Pull Request.

Additional Notes

Anything else we should know when reviewing?

blt added 2 commits July 21, 2026 20:39
…tion edges

The logrotate_fs model treats a non-advancing FUSE tick from a benign scheduling
race as a no-op instead of aborting under panic=abort, per ADR-004. The tcp and
udp generators count throttle-rejected blocks in blocks_discarded instead of
dropping them with only a debug log, and label connection and request failures by
io::ErrorKind rather than the raw error string, bounding the capture accumulator
cardinality per ADR-005. The gRPC generator honors throttle rejections instead of
sending regardless. The HTTP and Splunk HEC generators each own a connection
semaphore instead of sharing a process-wide static that panicked on a second
generator.
send_hec_request parsed the target-controlled response body with
serde_json::from_slice::<HecResponse>().expect(). HecResponse is
#[serde(deny_unknown_fields)], so any non-conforming body -- an error
page, an empty body, an extra field, all routine from a real HEC target
-- panicked and, under panic=abort, killed the run. Handle the parse
error: log it, count request_failure with a bounded "response_parse"
label (ADR-005), and skip the ack send, which simply times out.

A well-formed body can also parse successfully with a null/absent ackId,
since ack_id is Option and deny_unknown_fields does not make it required.
Channel::Ack::send then fed that None to .expect() and aborted. Handle
None at the source: skip the ack, count ack_id_missing, warn. Covers all
callers, not just this path. Adds acknowledgements send tests.

Also rewrite the connection-permit match as let...else in http and
splunk_hec to satisfy clippy.

blt commented Jul 21, 2026

Copy link
Copy Markdown
Collaborator Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant