66 Commits

Author SHA1 Message Date
Jaime Piña
e12181cb83 Return not ready for connection reason
Currently, we use ReadyForConnections in server tests to wait for the
server to be ready. However, when this fails we don't get a clue about
why it failed.

This change adds a new unexported method called readyForConnections that
returns an error describing which check failed. The exported
ReadyForConnections version works exactly as before. The unexported
version gets used in internal tests only.
2021-04-20 11:45:08 -07:00
Ivan Kozlovic
6e1205b660 Cleanup some tests + GetTLSConnectionState() race fix
Missing defers

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
2021-04-15 11:37:43 -06:00
Jaime Piña
d929ee1348 Check errors when removing test directories and files
Currently in tests, we have calls to os.Remove and os.RemoveAll where we
don't check the returned error. This hides useful error messages when
tests fail to run, such as "too many open files".

This change checks for more filesystem related errors and calls t.Fatal
if there is an error.
2021-04-07 11:09:47 -07:00
Derek Collison
2d521471fd Flush to make sure it gets processed
Signed-off-by: Derek Collison <derek@nats.io>
2021-03-13 16:28:25 -05:00
Derek Collison
aeef06b677 Merge pull request #1900 from nats-io/stepdown
Allow meta leader stepdown.
2021-02-08 17:01:48 -07:00
Derek Collison
ad0f10fb5c Allow metaleader stepdown.
Allow easy way to put authorization on system account and still use $G.

Signed-off-by: Derek Collison <derek@nats.io>
2021-02-08 15:01:23 -08:00
Ivan Kozlovic
8af8cf4e67 Remap subject only for service imports
Also optimized a test that was taking too long to run.

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
2021-02-08 14:41:33 -07:00
Jaime Piña
71b842520b Prevent non-exported messages from leaking into importer account (#1891)
* Add account isolation tests config & jwt

* Set the shadow subscription static subject
2021-02-08 14:07:18 -05:00
Matthias Hanel
3799b90011 [Adding] support for account_token_position (#1874)
This change does 4 things:
Refactor to only have one function to validate imports.
Have this function support the jwt field account_token_position.
For completeness make this value configurable as well.
unit tests.

Signed-off-by: Matthias Hanel <mh@synadia.com>
2021-02-01 19:51:36 -05:00
Matthias Hanel
592a6447a7 [Added] support for wildcard services and import remapping by JWT.
Imports in JWT where extended to contain a new filed LocalSubject.
This Change pulls the new JWT library version in.
It was needed as prefix did not exist in the JWT library and the
original field could not be used. The field To has been deprecated.

When LocalSubject is set, service imports can be configured the same way
they are in config. Meaning, no reversal due to the type.

This change also ensures that wildcard references in transforms are only
set in To/LocalSubject. Before, for services, $1 would have to be set in Subject.

Signed-off-by: Matthias Hanel <mh@synadia.com>
2021-01-04 14:11:36 -05:00
Ivan Kozlovic
ce5f9d6683 Fixed some flappers
Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
2020-12-11 17:30:33 -07:00
Derek Collison
a1c1ead39d Enable JetStream streams and consumer access to be exported to another account
Signed-off-by: Derek Collison <derek@nats.io>
2020-11-20 10:17:16 -08:00
Matthias Hanel
f83280ccaf Fixed account update issue where signing key (and thus issuer) changes
Fix error and remove print from test.

Signed-off-by: Matthias Hanel <mh@synadia.com>
2020-10-19 18:42:10 -04:00
Derek Collison
4af434e586 Allow mapping destinations to be parsed as singles and not force array syntax
Signed-off-by: Derek Collison <derek@nats.io>
2020-10-17 08:21:02 -07:00
Derek Collison
5f5ceb4668 Allow cluster filters for mappings, changed accountz for mappings
Signed-off-by: Derek Collison <derek@nats.io>
2020-10-16 16:53:14 -07:00
Derek Collison
047600750a Make sure mappings to 0% turn off all traffic
Signed-off-by: Derek Collison <derek@nats.io>
2020-10-16 14:23:47 -07:00
Derek Collison
04ffe3b00e Allow mapping destinations that introduce message loss (debugging, chaos monkey)
Signed-off-by: Derek Collison <derek@nats.io>
2020-10-15 20:03:44 -07:00
Derek Collison
d0201d8b15 Added support for mappings in Accountz
Signed-off-by: Derek Collison <derek@nats.io>
2020-10-15 19:14:58 -07:00
Derek Collison
6faf07d583 Account subject mappings and full wildcard support for exports/imports
The mappings enable traffic shaping functionality.
Also added a subject transform which can match any subject and transform to a new one, even re-ordering partial wildcards.

Signed-off-by: Derek Collison <derek@nats.io>
2020-10-15 10:26:25 -07:00
Ivan Kozlovic
df9d5f5fd9 Accepting route warns if remote server has same name
Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
2020-10-08 17:59:33 -06:00
Matthias Hanel
e1350a05f3 Emit latency traces when sampling is set to headers
Latency reports will include the header(s) responsible for the trace
Updated ADR to have it reflect implementation

Signed-off-by: Matthias Hanel <mh@synadia.com>
2020-08-21 20:01:11 -04:00
Ivan Kozlovic
22833c8d1a Fix sysSubscribe races
Made changes to processSub() to accept subscription properties,
including the icb callback so that it is set prior to add the
subscription to the account's sublist, which prevent races.
Fixed some other racy conditions, notably in addServiceImportSub()

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
2020-08-03 14:59:00 -06:00
Matthias Hanel
cf6fcda75c Added default_permissions to accounts and account jwt
Signed-off-by: Matthias Hanel <mh@synadia.com>
2020-06-02 16:06:01 -04:00
Derek Collison
2bd7553c71 System Account on by default.
Most of the changes are to turn it off for tests that were watching subscriptions and such.

Signed-off-by: Derek Collison <derek@nats.io>
2020-05-29 17:56:45 -07:00
Derek Collison
ea5e5bd364 Services rewrite #2
This contains a rewrite to the services layer for exporting and importing. The code this merges to already had a first significant rewrite that moved from special interest processing to plain subscriptions.

This code changes the prior version's dealing with reverse mapping which was based mostly on thresholds and manual pruning, with some sporadic timer usage. This version uses the jetstream branch's code that understands interest and failed deliveries. So this code is much more tuned to reacting to interest changes. It also removes thresholds and goes only by interest changes or expirations based around a new service export property, response thresholds. This allows a service provider to provide semantics on how long a response should take at a maximum.

This commit also introduces formal support for service export streamed and chunked response types send an empty message to signify EOF.

This commit also includes additions to the service latency tracking such that errors are now sent, not only successful interactions. We have added a Status field and an optional Error fields to ServiceLatency.

We support the following Status codes, these are directly from HTTP.

400 Bad Request (request did not have a reply subject)
408 Request Timeout (when system detects request interest went away, old request style to make dependable)..
503 Service Unavailable (no service responders running)
504 Service Timeout (The new response threshold expired)

Signed-off-by: Derek Collison <derek@nats.io>
2020-05-19 14:26:46 -07:00
Derek Collison
df774e44b0 Rework how service imports are handled to avoid performance hits
Signed-off-by: Derek Collison <derek@nats.io>
2020-05-19 14:18:34 -07:00
Derek Collison
7d5fddee7e Fix for test
Signed-off-by: Derek Collison <derek@nats.io>
2020-05-19 14:16:03 -07:00
Derek Collison
34ce97bb8c Added support for wildcards for service imports
Signed-off-by: Derek Collison <derek@nats.io>
2020-05-19 14:16:03 -07:00
Derek Collison
47c28b2fb0 JetStream major refactor for name changes.
MsgSet -> Stream
Observable -> Consumer

Signed-off-by: Derek Collison <derek@nats.io>
2020-05-19 14:16:03 -07:00
Ivan Kozlovic
947798231b [UPDATED] TCP Write and SlowConsumer handling
- All writes will now be done by the writeLoop, unless when the
  writeLoop has not been started yet (likely in connection init).
- Slow consumers for non CLIENT connections will be reported but
  not failed. The idea is that routes, gateway, etc.. connections
  should stay connected as much as possible. However if a flush
  operation times out and no data at all has been written, the
  connection will be closed (regardless of type).
- Slow consumers due to max pending is only for CLIENT connections.
  This allows sending of SUBs through routes, etc.. to not have
  to be chunked.
- The backpressure to CLIENT connections is increased (up to 1sec)
  based on the sub's connection pending bytes level.
- Connection is flushed on close from the writeLoop as to not block
  the "fast path".

Some tests have been fixed and adapted since now closeConnection()
is not flushing/closing/removing connection in place.

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
2019-12-31 15:06:27 -07:00
Derek Collison
a2ebf08593 Should allow multiple stream imports on same subject
Signed-off-by: Derek Collison <derek@nats.io>
2019-12-14 17:06:14 -08:00
Ivan Kozlovic
1b2754475b Refactor async client tests
Updated all tests that use "async" clients.
- start the writeLoop (this is in preparation for changes in the
  server that will not do send-in-place for some protocols, such
  as PING, etc..)
- Added missing defers in several tests
- fixed an issue in client.go where test was wrong possibly causing
  a panic.
- Had to skip a test for now since it would fail without server code
  change.

The next step will be ensure that all protocols are sent through
the writeLoop and that the data is properly flushed on close (important
for -ERR for instance).

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
2019-12-12 11:58:24 -07:00
Derek Collison
6ad8287bbe Introduced wildcard handling of _R_ mapped replies.
We had too much special processing, so reduced to a single wildcard
which will propagate across routes and gateways and is consistent
with gateway handling of globally routed subjects and timeouts.

Signed-off-by: Derek Collison <derek@nats.io>
2019-11-16 12:50:53 -08:00
Derek Collison
13f217635f Wait on requestor RTT when tracking latency.
If a client RTT for a requestor is longer than a service RTT, the requestor latency was often zero.
We now wait for the RTT (if zero) before sending out the metric.

Signed-off-by: Derek Collison <derek@nats.io>
2019-10-31 08:02:45 -07:00
Derek Collison
9192a1f43c Fix for panic on #1159, do not allow wildcards in stream import prefix
Signed-off-by: Derek Collison <derek@nats.io>
2019-10-16 10:29:13 -07:00
Ivan Kozlovic
3600accb79 [FIXED] Reject duplicate service import "to" subject
Report error from configuration parsing, and also return error
in AddServiceImport() (and its variants).

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
2019-09-20 16:30:13 -06:00
Ivan Kozlovic
15201a19cd Fixed a lock inversion issue with account
In updateRouteSubscriptionMap(), when a queue sub is added/removed,
the code locks the account and then the route to send the update.
However, when a route is accepted and the subs are sent, the
opposite (locking wise) occurs. The route is locked, then the account.

This lock inversion is possible because a route is registered (added
to the server's map) and then the subs are sent.

Use a special lock to protect the send, but don't hold the acc.mu
lock while getting the route's lock.

The tests that were created for the original missed queue updates
issue, namely TestClusterLeaksSubscriptions() and
TestQueueSubWeightOrderMultipleConnections() pass with this change.

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
2019-09-13 14:30:00 -06:00
Derek Collison
67470911fe Prune remote reply tracking
Signed-off-by: Derek Collison <derek@nats.io>
2019-08-30 17:35:20 -07:00
Derek Collison
7989118c3f First pass latency tracking for exported services
Signed-off-by: Derek Collison <derek@nats.io>
2019-08-30 10:52:48 -07:00
Ivan Kozlovic
2f48ad5150 Fixed subscription close
I noticed that TestNoRaceRoutedQueueAutoUnsubscribe started to
fail a lot on Travis. Running locally I could see a 45 to 50%
failures. After investigation I realized that the issue was that
we have wrongly re-used `subscription.nm` and set to -1 on unsubscribe
however, I believe that it was possible that when subscription was
closed, the server may have already picked that consumer for a delivery
which then causes nm==-1 to be bumped to 0, which was wrong.
Commenting out the subscription.close() that sets nm to -1, I could
not get the test to fail on macOS but would still get 7% failure on
Linux VM. Adding the check to see if sub is closed in deliverMsg()
completely erase the failures, even on Linux VM.

We could still use `nm` set to -1 but check on deliverMsg(), the
same way I use the closed int32 now.

Fixed some flappers.
Updated .travis.yml to failfast if one of the command in the
`script` fails. User `set -e` and `set +e` as recommended in
https://github.com/travis-ci/travis-ci/issues/1066

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
2019-08-20 14:39:23 -06:00
Waldemar Quevedo
5c776d4363 Fix typo
Signed-off-by: Waldemar Quevedo <wally@synadia.com>
2019-08-13 19:59:28 -07:00
Derek Collison
8f5bc503e5 Add ability for cross account import services to return streams as well as singeltons.
Take into account tracking of response maps that are created and do proper cleanup.
Also fixes #1089 which was discovered while working on this.

Signed-off-by: Derek Collison <derek@nats.io>
2019-08-06 14:15:40 -07:00
Derek Collison
bfe83aff81 Make account lookup faster with sync.Map
Signed-off-by: Derek Collison <derek@nats.io>
2019-04-23 17:13:23 -07:00
Ivan Kozlovic
7c220ba700 Support for service export with wildcards
Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
2018-12-13 21:22:01 -07:00
Derek Collison
2d54fc3ee7 Account lookup failures, account and client limits, options reload.
Changed account lookup and validation failures to be more understandable by users.
Changed limits to be -1 for unlimited to match jwt pkg.

The limits changed exposed problems with options holding real objects causing issues with reload tests under race mode.
Longer term this code should be reworked such that options only hold config data, not real structs, etc.

Signed-off-by: Derek Collison <derek@nats.io>
2018-12-05 14:25:40 -08:00
Derek Collison
a2ec546850 Remove newest only
Signed-off-by: Derek Collison <derek@nats.io>
2018-12-03 06:32:32 -08:00
Derek Collison
e2ce2c0cff Change to RawURLEncoding
Signed-off-by: Derek Collison <derek@nats.io>
2018-11-29 17:04:58 -08:00
Derek Collison
6b23e40ae1 Fix for AddExport and unexport server funcs that require lock
Signed-off-by: Derek Collison <derek@nats.io>
2018-11-23 16:04:58 -08:00
Derek Collison
0ee714ce28 Add JWT support for users, accounts and import activations.
Add in trusted keys options and binary stamp
User JWT and Account fetch with AccountResolver
Account and User expiration
Account Imports/Exports w/ updates
Import activation expiration

Signed-off-by: Derek Collison <derek@nats.io>
2018-11-21 10:36:32 -08:00
Derek Collison
15bdfbb4aa Fix for #793
Signed-off-by: Derek Collison <derek@nats.io>
2018-11-07 19:50:45 -08:00