choria-legacy/go-network-broker

The Choria Network Broker

go-network-broker's Issues

update to nats 2.1.2

https://github.com/nats-io/nats-server/releases/tag/v2.1.2

update gnatsd to 1.4.1

https://github.com/nats-io/gnatsd/releases/tag/v1.4.1

remove dead varz update code

support leaf nodes

We need to support https://nats-io.github.io/docs/leafnodes/

These are used in scenarios where you wish to jump across auth domains, so in our use for example a new node without any authentication tokens - like one in provisioning - would connect to a leaf node and join an account specific to provisioning so there is a hard separation.

This will let us configure a provisioning broker with relaxed/no auth and have it form part of a specifically chosen account where provisioner run.

This should be the specific aim for this so we might only support a subset of the leaf node features at first.

support overriding build TLS setting for client port

This is to allow a binary built with TLS disabled to be used for brokers with or without TLS when required. For 99% of people this will not be used at all

upate gnatsd to 1.3.0

https://github.com/nats-io/gnatsd/releases/tag/v1.3.0

NetworkAllowedClientHosts option is excluding all other servers from responding

While testing the NetworkAllowedClientHosts option, I found that node discovery was only returning the nodes listed in the option, where it should have returned all the other servers.

Traced it back to this error message: NATS client on broker_host encountered an error: nats: Permissions Violation for Publish to \"mcollective.reply.fqdn.bc1d24...\"

Seems that default publish perms are too strict when NetworkAllowedClientHosts option is enabled.

support gateway nodes

We need to support https://nats-io.github.io/docs/gateways/

These are used to create a local cluster in a remote DC that in turn connects to a central cluster. All nodes connected to that cluster is visible to the super cluster. Good for big sites that do not want to send all their traffic to a local and good for isolating traffic to scaling clusters. We need to support these 2 use cases specifically.

Should set reject_unknown by default

expose leaf nodes count as a stat

varz now has a Leafs we should expose that to prometheus

update prometheus client

As per choria-io/go-choria#492

upgrade to latest nats

https://github.com/nats-io/nats-server/releases/tag/v2.0.4

look at exposing leafnode stats to prometheus (see changelog), investigate revokes,

Use TLS timeout configuration option

In choria-legacy/go-config#20 , an option was added to configure TLS timeouts on the broker. Let's hook that option up to the timeout value

Remove go-choria dependency

Relates to choria-io/go-choria#617

update to NATS 2.0.0

support a nats 2.0 file store on disk

This should support storing account files on disk and should have a way to know when these files change and notify the nats broker that it has

This means writing an AccountResolver and setting it into the embedded nats using SetAccountResolver

Relates to choria-io/go-choria#612

on gateways and leafs support custom TLS

gateways especially but potentially leaf nodes too will come with often different TLS CAs, for example you would have 2 DCs each DC with their own CA and you want to connect them together, in this case you might have a CA for intra DC links or just assign the links to use the CA of the receiving DC.

All of this will require TLS configs on a per leaf/gateway remote basis

support limiting clients to a allow list of ips

It would be good to limit where clients can connect from, should support ips and subnets both v6 and 4.

blocked by nats-io/nats-server#832 but in POC this is roughly whats needed should that ticket be resolved

package network

import (
	"github.com/nats-io/gnatsd/server"
)

type IPAuth struct {
	allowList []string
}

// by default we let everyone do whatever they like, choria doesnt really
// care for the security of the network when correctly deployed
//
// however when a ip list is set we deny the ability to publish to the request
// targets for anyone but clients
func (a *IPAuth) Check(c server.ClientAuthentication) (verified bool) {
	user := a.createUser(c)

	if !a.remoteInClientAllowList(c) {
		user.Permissions.Publish = &server.SubjectPermission{
			Deny: []string{
				"*.broadcast.agent.*",
				"*.node.*",
			},
		}
	}

	c.RegisterUser(user)

	return true
}

// todo subnets
func (a *IPAuth) remoteInClientAllowList(c server.ClientAuthentication) bool {
	if len(a.allowList) == 0 {
		return true
	}

	remote := c.RemoteAddress()
	if remote == nil {
		return false
	}

	rip := remote.IP.String()
	for _, allowed := range a.allowList {
		if rip == allowed {
			return true
		}
	}

	return false
}

func (a *IPAuth) createUser(c server.ClientAuthentication) *server.User {
	opts := c.GetOpts()

	return &server.User{
		Username:    opts.Username,
		Password:    opts.Password,
		Permissions: &server.Permissions{},
	}
}

update gnatsd to 1.2.0

support enabling system accounts and events

Choria broker uses weak ciphers and is vulnerable to the sweet32 attack