Skip to content

Commit ccd14ad

Browse files
kozlovickozlovic
committed
Include Nkey in remote identity matching
Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
1 parent 1f9c7bc commit ccd14ad

File tree

4 files changed

+161
-5
lines changed

4 files changed

+161
-5
lines changed

‎server/opts.go‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -331,17 +331,24 @@ func generateRemoteLeafOptsName(r *RemoteLeafOpts, redacted bool) string {
331331
if acc == _EMPTY_ {
332332
acc = globalAccountName
333333
}
334-
var creds string
334+
var optional string
335+
// There could be Credentials or NKey, not both (would be caught as a misconfig)
335336
if c := r.Credentials; c != _EMPTY_ {
336-
creds = fmt.Sprintf(", credentials=%q", c)
337+
optional = fmt.Sprintf(", credentials=%q", c)
338+
} else if nk := r.Nkey; nk != _EMPTY_ {
339+
if redacted {
340+
optional = ", nkey=\"[REDACTED]\""
341+
} else {
342+
optional = fmt.Sprintf(", nkey=%q", nk)
343+
}
337344
}
338345
var urls []*url.URL
339346
if redacted {
340347
urls = redactURLList(r.URLs)
341348
} else {
342349
urls = r.URLs
343350
}
344-
return fmt.Sprintf("urls=%q, account=%q%s", urls, acc, creds)
351+
return fmt.Sprintf("urls=%q, account=%q%s", urls, acc, optional)
345352
}
346353

347354
// JSLimitOpts are active limits for the meta cluster

‎server/opts_test.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4506,6 +4506,8 @@ func TestOptionsRemoteLeafNodeName(t *testing.T) {
45064506
// With unredacted versions of the URLs
45074507
urls := []*url.URL{u1, u2}
45084508
safeURLs := redactURLList(urls)
4509+
// Some Nkey
4510+
nkey := "SUACJN3OSKWWPQXME4JUNFJ3PARXPO657GGNWNU7PK7G3AUQQYHLW26XH4"
45094511
for _, test := range []struct {
45104512
name string
45114513
input *RemoteLeafOpts
@@ -4535,6 +4537,14 @@ func TestOptionsRemoteLeafNodeName(t *testing.T) {
45354537
fmt.Sprintf("urls=%q, account=%q, credentials=%q", urls, globalAccountName, "credsfile"),
45364538
fmt.Sprintf("urls=%q, account=%q, credentials=%q", safeURLs, globalAccountName, "credsfile"),
45374539
},
4540+
{
4541+
"url with nkey", &RemoteLeafOpts{
4542+
URLs: []*url.URL{u1, u2},
4543+
Nkey: nkey,
4544+
},
4545+
fmt.Sprintf("urls=%q, account=%q, nkey=%q", urls, globalAccountName, nkey),
4546+
fmt.Sprintf("urls=%q, account=%q, nkey=%q", safeURLs, globalAccountName, "[REDACTED]"),
4547+
},
45384548
{
45394549
"url with account and credentials", &RemoteLeafOpts{
45404550
URLs: []*url.URL{u1, u2},
@@ -4544,6 +4554,15 @@ func TestOptionsRemoteLeafNodeName(t *testing.T) {
45444554
fmt.Sprintf("urls=%q, account=%q, credentials=%q", urls, "A", "credsfile"),
45454555
fmt.Sprintf("urls=%q, account=%q, credentials=%q", safeURLs, "A", "credsfile"),
45464556
},
4557+
{
4558+
"url with account and nkey", &RemoteLeafOpts{
4559+
URLs: []*url.URL{u1, u2},
4560+
LocalAccount: "A",
4561+
Nkey: nkey,
4562+
},
4563+
fmt.Sprintf("urls=%q, account=%q, nkey=%q", urls, "A", nkey),
4564+
fmt.Sprintf("urls=%q, account=%q, nkey=%q", safeURLs, "A", "[REDACTED]"),
4565+
},
45474566
} {
45484567
t.Run(test.name, func(t *testing.T) {
45494568
name := test.input.name()

‎server/reload.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -960,7 +960,6 @@ forLoop:
960960
err := checkConfigsEqual(lrc.RemoteLeafOpts, rlo, []string{
961961
"Compression",
962962
"Disabled",
963-
"LocalAccount",
964963
"TLS",
965964
"TLSHandshakeFirst",
966965
"TLSConfig",

‎server/reload_test.go‎

Lines changed: 132 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6539,6 +6539,22 @@ func TestConfigReloadGetLeafNodeOptionsChanges(t *testing.T) {
65396539
LocalAccount: "A",
65406540
}
65416541

6542+
addedRemoteDueToDifferentAccount := &RemoteLeafOpts{
6543+
URLs: []*url.URL{u},
6544+
Compression: CompressionOpts{Mode: CompressionS2Fast},
6545+
LocalAccount: "A",
6546+
}
6547+
addedRemoteDueToDifferentCreds := &RemoteLeafOpts{
6548+
URLs: []*url.URL{u},
6549+
Compression: CompressionOpts{Mode: CompressionS2Fast},
6550+
Credentials: "credsfile",
6551+
}
6552+
addedRemoteDueToDifferentNkey := &RemoteLeafOpts{
6553+
URLs: []*url.URL{u},
6554+
Compression: CompressionOpts{Mode: CompressionS2Fast},
6555+
Credentials: "SUACJN3OSKWWPQXME4JUNFJ3PARXPO657GGNWNU7PK7G3AUQQYHLW26XH4",
6556+
}
6557+
65426558
acc1 := &Account{Name: "A1"}
65436559
acc2 := &Account{Name: "A2"}
65446560

@@ -6919,6 +6935,81 @@ func TestConfigReloadGetLeafNodeOptionsChanges(t *testing.T) {
69196935
},
69206936
_EMPTY_,
69216937
},
6938+
{
6939+
"remote added due to different account",
6940+
func() (*Server, *LeafNodeOpts, *LeafNodeOpts) {
6941+
ts := &Server{}
6942+
ts.leafRemoteCfgs = maps.Clone(s.leafRemoteCfgs)
6943+
old := &LeafNodeOpts{
6944+
Users: []*User{{Username: "a", Password: "pwd"}},
6945+
Compression: CompressionOpts{Mode: CompressionS2Fast},
6946+
Remotes: []*RemoteLeafOpts{remote},
6947+
}
6948+
new := &LeafNodeOpts{
6949+
Users: []*User{{Username: "a", Password: "pwd"}},
6950+
Compression: CompressionOpts{Mode: CompressionS2Fast},
6951+
// At the same time, change tls first for the LeafNodeOpts block.
6952+
TLSHandshakeFirst: true,
6953+
Remotes: []*RemoteLeafOpts{addedRemoteDueToDifferentAccount},
6954+
}
6955+
return ts, old, new
6956+
},
6957+
&leafNodeOption{
6958+
tlsFirstChanged: true,
6959+
added: []*RemoteLeafOpts{addedRemoteDueToDifferentAccount},
6960+
},
6961+
_EMPTY_,
6962+
},
6963+
{
6964+
"remote added due to different creds",
6965+
func() (*Server, *LeafNodeOpts, *LeafNodeOpts) {
6966+
ts := &Server{}
6967+
ts.leafRemoteCfgs = maps.Clone(s.leafRemoteCfgs)
6968+
old := &LeafNodeOpts{
6969+
Users: []*User{{Username: "a", Password: "pwd"}},
6970+
Compression: CompressionOpts{Mode: CompressionS2Fast},
6971+
Remotes: []*RemoteLeafOpts{remote},
6972+
}
6973+
new := &LeafNodeOpts{
6974+
Users: []*User{{Username: "a", Password: "pwd"}},
6975+
Compression: CompressionOpts{Mode: CompressionS2Fast},
6976+
// At the same time, change tls first for the LeafNodeOpts block.
6977+
TLSHandshakeFirst: true,
6978+
Remotes: []*RemoteLeafOpts{addedRemoteDueToDifferentCreds},
6979+
}
6980+
return ts, old, new
6981+
},
6982+
&leafNodeOption{
6983+
tlsFirstChanged: true,
6984+
added: []*RemoteLeafOpts{addedRemoteDueToDifferentCreds},
6985+
},
6986+
_EMPTY_,
6987+
},
6988+
{
6989+
"remote added due to different nkey",
6990+
func() (*Server, *LeafNodeOpts, *LeafNodeOpts) {
6991+
ts := &Server{}
6992+
ts.leafRemoteCfgs = maps.Clone(s.leafRemoteCfgs)
6993+
old := &LeafNodeOpts{
6994+
Users: []*User{{Username: "a", Password: "pwd"}},
6995+
Compression: CompressionOpts{Mode: CompressionS2Fast},
6996+
Remotes: []*RemoteLeafOpts{remote},
6997+
}
6998+
new := &LeafNodeOpts{
6999+
Users: []*User{{Username: "a", Password: "pwd"}},
7000+
Compression: CompressionOpts{Mode: CompressionS2Fast},
7001+
// At the same time, change tls first for the LeafNodeOpts block.
7002+
TLSHandshakeFirst: true,
7003+
Remotes: []*RemoteLeafOpts{addedRemoteDueToDifferentNkey},
7004+
}
7005+
return ts, old, new
7006+
},
7007+
&leafNodeOption{
7008+
tlsFirstChanged: true,
7009+
added: []*RemoteLeafOpts{addedRemoteDueToDifferentNkey},
7010+
},
7011+
_EMPTY_,
7012+
},
69227013
} {
69237014
t.Run(test.name, func(t *testing.T) {
69247015
s, old, new := test.genCfg()
@@ -7122,7 +7213,7 @@ func TestConfigReloadAddRemoveRemoteLeafNodes(t *testing.T) {
71227213
accA := fmt.Sprintf(remoteTmpl, "A")
71237214
accB := fmt.Sprintf(remoteTmpl, "B")
71247215
accC := fmt.Sprintf(remoteTmpl, "C")
7125-
conf2 := createConfFile(t, []byte(fmt.Sprintf(tmpl2, accA, _EMPTY_, _EMPTY_)))
7216+
conf2 := createConfFile(t, fmt.Appendf(nil, tmpl2, accA, _EMPTY_, _EMPTY_))
71267217
s2, _ := RunServerWithConfig(conf2)
71277218
defer s2.Shutdown()
71287219

@@ -7168,6 +7259,46 @@ func TestConfigReloadAddRemoveRemoteLeafNodes(t *testing.T) {
71687259
checkLeafs(nil)
71697260
}
71707261

7262+
func TestConfigReloadRemoteLeafNodeNkeyChange(t *testing.T) {
7263+
conf1 := createConfFile(t, []byte(`
7264+
listen: "127.0.0.1:-1"
7265+
server_name: "A"
7266+
leaf {
7267+
listen: 127.0.0.1:-1
7268+
authorization: { nkey: UCSTG5CRF5GEJERAFKUUYRODGABTBVWY2NPE4GGKRQVQOH74PIAKTVKO }
7269+
}
7270+
`))
7271+
s1, o1 := RunServerWithConfig(conf1)
7272+
defer s1.Shutdown()
7273+
7274+
tmpl2 := `
7275+
listen: "127.0.0.1:-1"
7276+
server_name: "B"
7277+
leaf {
7278+
reconnect_interval: "50ms"
7279+
remotes: [
7280+
{
7281+
url: "nats-leaf://127.0.0.1:%d"
7282+
nkey: %s
7283+
}
7284+
]
7285+
}
7286+
`
7287+
conf2 := createConfFile(t, fmt.Appendf(nil, tmpl2, o1.LeafNode.Port,
7288+
"SUAPM67TC4RHQLKBX55NIQXSMATZDOZK6FNEOSS36CAYA7F7TY66LP4BOM"))
7289+
s2, _ := RunServerWithConfig(conf2)
7290+
defer s2.Shutdown()
7291+
7292+
// Should not be able to connect...
7293+
time.Sleep(70 * time.Millisecond)
7294+
checkLeafNodeConnectedCount(t, s2, 0)
7295+
7296+
reloadUpdateConfig(t, s2, conf2, fmt.Sprintf(tmpl2, o1.LeafNode.Port,
7297+
"SUACJN3OSKWWPQXME4JUNFJ3PARXPO657GGNWNU7PK7G3AUQQYHLW26XH4"))
7298+
7299+
checkLeafNodeConnectedCount(t, s2, 1)
7300+
}
7301+
71717302
func TestConfigReloadNoPanicOnShutdown(t *testing.T) {
71727303
tmpl := `
71737304
port: -1

0 commit comments

Comments
 (0)