mirror of
https://github.com/hanzomsg/nats-server.git
synced 2026-10-30 20:27:34 +00:00
Ivan Kozlovic
0e79a62d7e
See [ADR](https://github.com/nats-io/nats-architecture-and-design/pull/361) The server will now log: ``` [11484] 2025/08/07 14:26:12.937393 [ERR] 127.0.0.1:54959 - cid:23 - proxy connection required - User "user" ``` And here is the output of subs on different system subjects: ``` $ nats sub -s nats://sys:[email protected]:4222 '$SYS.SERVER.*.CLIENT.AUTH.ERR' 14:26:06 Subscribing on $SYS.SERVER.*.CLIENT.AUTH.ERR [#1] Received on "$SYS.SERVER.NDBBGS7SKCSV7C2V64FQLG37EZ3IJT3LGT2G57KFKP6CMHAE2VTU4H2O.CLIENT.AUTH.ERR" {"type":"io.nats.server.advisory.v1.client_disconnect",...,"reason":"Proxy Required"} ``` ``` $ nats sub -s nats://sys:[email protected]:4222 '$SYS.ACCOUNT.$G.DISCONNECT' 14:26:10 Subscribing on $SYS.ACCOUNT.$G.DISCONNECT [#1] Received on "$SYS.ACCOUNT.$G.DISCONNECT" {"type":"io.nats.server.advisory.v1.client_disconnect",...,"reason":"Proxy Required"} ``` And Connz: ``` nats req -s nats://sys:[email protected]:4222 '$SYS.REQ.SERVER.NDBBGS7SKCSV7C2V64FQLG37EZ3IJT3LGT2G57KFKP6CMHAE2VTU4H2O.CONNZ' '{"state":1,"cid":23}' 14:34:16 Sending request on "$SYS.REQ.SERVER.NDBBGS7SKCSV7C2V64FQLG37EZ3IJT3LGT2G57KFKP6CMHAE2VTU4H2O.CONNZ" 14:34:16 Received with rtt 229.43µs {"server":{"name":"NDBBGS7SKCSV7C2V64FQLG37EZ3IJT3LGT2G57KFKP6CMHAE2VTU4H2O",...,"connections":[{"cid":23,"kind":"Client",...,"reason":"Proxy Required"..."}]}} ``` Signed-off-by: Ivan Kozlovic <[email protected]>
48 lines
1.4 KiB
Go
48 lines
1.4 KiB
Go
// Copyright 2018-2025 The NATS Authors
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package server
|
|
|
|
import (
|
|
crand "crypto/rand"
|
|
"encoding/base64"
|
|
)
|
|
|
|
// Raw length of the nonce challenge
|
|
const (
|
|
nonceRawLen = 11
|
|
nonceLen = 15 // base64.RawURLEncoding.EncodedLen(nonceRawLen)
|
|
)
|
|
|
|
// NonceRequired tells us if we should send a nonce.
|
|
func (s *Server) NonceRequired() bool {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
return s.nonceRequired()
|
|
}
|
|
|
|
// nonceRequired tells us if we should send a nonce.
|
|
// Lock should be held on entry.
|
|
func (s *Server) nonceRequired() bool {
|
|
return s.getOpts().AlwaysEnableNonce || len(s.nkeys) > 0 || s.trustedKeys != nil || len(s.proxiesKeyPairs) > 0
|
|
}
|
|
|
|
// Generate a nonce for INFO challenge.
|
|
// Assumes server lock is held
|
|
func (s *Server) generateNonce(n []byte) {
|
|
var raw [nonceRawLen]byte
|
|
data := raw[:]
|
|
crand.Read(data)
|
|
base64.RawURLEncoding.Encode(n, data)
|
|
}
|