From 3e5ede1d64dac6dc0912a583ad6b0a4b8ee6271f Mon Sep 17 00:00:00 2001
From: Ivan Kozlovic <ivan@synadia.com>
Date: Mon, 11 Nov 2019 17:24:35 -0700
Subject: [PATCH] Relax check on reserved GW prefix for system clients

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
---
 server/client.go     |  4 ++--
 test/gateway_test.go | 29 +++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/server/client.go b/server/client.go
index dd80f8f5..dc296314 100644
--- a/server/client.go
+++ b/server/client.go
@@ -2651,8 +2651,8 @@ func (c *client) processInboundClientMsg(msg []byte) {
 		c.traceMsg(msg)
 	}
 
-	// Check that client is not publishing on reserved $GNR. prefix
-	if hasGWRoutedReplyPrefix(c.pa.subject) {
+	// Check that client (could be here with SYSTEM) is not publishing on reserved "$GNR" prefix.
+	if c.kind == CLIENT && hasGWRoutedReplyPrefix(c.pa.subject) {
 		c.pubPermissionViolation(c.pa.subject)
 		return
 	}
diff --git a/test/gateway_test.go b/test/gateway_test.go
index 05fe196d..69dc6773 100644
--- a/test/gateway_test.go
+++ b/test/gateway_test.go
@@ -20,8 +20,10 @@ import (
 	"net"
 	"regexp"
 	"testing"
+	"time"
 
 	"github.com/nats-io/nats-server/v2/server"
+	"github.com/nats-io/nats.go"
 )
 
 func testDefaultOptionsForGateway(name string) *server.Options {
@@ -542,3 +544,30 @@ func TestGatewayErrorOnRSentFromOutbound(t *testing.T) {
 		})
 	}
 }
+
+func TestGatewaySystemConnectionAllowedToPublishOnGWPrefix(t *testing.T) {
+	sc := createSuperCluster(t, 2, 2)
+	defer sc.shutdown()
+
+	o := sc.clusters[1].opts[1]
+	url := fmt.Sprintf("nats://sys:pass@%s:%d", o.Host, o.Port)
+	nc, err := nats.Connect(url)
+	if err != nil {
+		t.Fatalf("Error on connect: %v", err)
+	}
+	defer nc.Close()
+
+	reply := nats.NewInbox()
+	sub, err := nc.SubscribeSync(reply)
+	if err != nil {
+		t.Fatalf("Error on subscribe: %v", err)
+	}
+	if err := nc.PublishRequest("$SYS.REQ.SERVER.PING", reply, nil); err != nil {
+		t.Fatalf("Failed to send request: %v", err)
+	}
+	for i := 0; i < 4; i++ {
+		if _, err := sub.NextMsg(time.Second); err != nil {
+			t.Fatalf("Expected to get a response, got %v", err)
+		}
+	}
+}