[jira] [Comment Edited] (DISPATCH-975) Policy has no provision for limiting user message size

["Charles E. Rolke (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/DISPATCH-975?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16949668#comment-16949668 ] 

Charles E. Rolke edited comment on DISPATCH-975 at 4/15/20, 3:17 PM:
---------------------------------------------------------------------

h3. This feature adds:

|| policy || ||
| maxMessageSize       | The maximum size in bytes of AMQP message transfers allowed for this router. This limit is applied to transfers over user connections and to transfers from edge routers to interior routers. It is not applied to interrouter connections. This limit may be overridden by vhost or by vhost user group settings. A value of zero disables this limit. |
| maxMessageSizeDenied | total number of transfer denials across all vhosts and all connections |

|| vhost || ||
| maxMessageSize     | Optional maximum size in bytes of AMQP message transfers allowed for connections to this vhost. This limit overrides the policy maxMessageSize value and may be overridden by vhost user group settings. A value of zero disables this limit. |

|| vhostUserGroupSettings || ||
| maxMessageSize       | Optional maximum size in bytes of AMQP message transfers allowed for connections created by users in this group. This limit overrides the policy and vhost maxMessageSize values. A value of zero disables this limit. |

|| vhostStats || ||
| maxMessageSizeDenied | total number of transfer denials for this vhost across all connections |

h3. Other considerations

* Interior interrouter connections are never subject to size limits.

* Messages to an interior router from an edge router are subject to the interior router size limits.

* Message size for maxMessageSize purposes is calculated to be the number of AMQP octets in the Annotated Message. This includes the header, delivery-annotations, message-annotations, properties, application-properties, application-data, and footer sections. Administrators and users must be aware that a "message" consisting a single character string (the application-data) will be much larger over the wire after properties and annotations have been inserted.

h3. Implementation

When a message exceeds max size then:
    
* Disposition of rejected is returned to the sender for that delivery.
* Copies of the message being delivered through the router network are aborted.
* The connection to the sender is closed with:

    condition:   "amqp:connection:forced"
    description: "Message size exceeded"



was (Author: chug):
h3. This proposal adds:

|| Vhost || ||
| maxSenderMessageSize     | maximum message size in bytes users may send into the router network |
| maxReceiverMessageSize  | maximum message size in bytes users may receive from the router network |

|| vhostUserGroupSettings || ||
| maxSenderMessageSize       | optional override for Vhost maxSenderMessageSize |
| maxReceiverMessageSize     | optional override for Vhost maxReceiverMessageSize |

|| vhostStats || ||
| maxSenderSizeDenied     | number of ingress messages denied by max message size |
| maxReceiverSizeDenied   | number of egress messages denied by max message size |

|| Policy ||  ||
| messageSizeDenied       | count of ingress and egress denials due to message size exceeding max allowed |

h3. Other considerations

* Separate limits are specified for messages being injected into the router network and for messages being received from the router network.
* Interrouter connections are never subject to size limits.
* Connectors may specify a policyVhost to enforce the Vhost max message sizes
* What is the *size* of a message? An AMQP message may have seven sections only one of which is the user application data. If, say, one wishes to limit a user's payload strings to by 1,000 bytes then the policy max size must be somewhat larger to account for message overhead. Message overhead includes delivery- and message-annotations, message properties, application-properties, and the message footer. At a minimum about 50 (decimal) bytes of overhead are included in the message size calculation. These bytes are not part of the main message payload application data.
** There is no limit to the size of the message overhead sections. For this reason their content must be included in the max size limit equations.
** Note that message annotation bytes injected by qdrouterd to carry message routing information are *not* counted in the message size calculation.

h3. Implementation details

* Policy size checks will be enforced in qd_message_send and qd_message_receive
** When qd_message_receive detects a message coming in that is "too big" then outgoing copies of the message are aborted and the incoming message is set to 'discard'.
** When qd_message_send detects a message going out that is "too big" then it aborts the outgoing message the same was as if the incoming message had been aborted.
* Aborted outgoing messages may cut off the only destination for an incoming message. In that case the incoming message will set to 'discard'.


> Policy has no provision for limiting user message size
> ------------------------------------------------------
>
>                 Key: DISPATCH-975
>                 URL: https://issues.apache.org/jira/browse/DISPATCH-975
>             Project: Qpid Dispatch
>          Issue Type: Bug
>            Reporter: Charles E. Rolke
>            Assignee: Charles E. Rolke
>            Priority: Major
>




--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org