Commit Graph

12 Commits

Author SHA1 Message Date
Ivan Kozlovic
7c59ce3dba [ADDED] Reject clients connecting to route's listen port
This happens sometimes, and the latest occurence was today:
https://github.com/nats-io/java-nats/issues/96

When it happens, there is no error but subscribers would not receive
anything, etc...

This PR uses the fact that clients set the field Lang in the CONNECT
protocol that ROUTEs do not. I have checked that all Apcera supported
clients do set Lang in the CONNECT protocol.
If we plan to add Lang for routes, we need to find another field or
use a new one, in which case that would work only for new clients
(that would need to be updated).

With this change, when the server accepts a connection on the route
port and detects that this protocol field is present, it now closes
the client connection.

The nice thing is that newer clients, when incorrectly connecting
to the route port, get from the route's INFO the list of client URLs,
which means that on the initial connect error, they are able to
subsequently connect to the proper client port, so it is transparent
to the user (which may or may not be a good thing). However, it is not
guaranteed because if the client is not setting NoRandomize to true,
the client URL is added but the array shuffled, so it is possible that
the client library does not find the correct port in the connect loop.
2017-01-24 19:46:46 -07:00
Ivan Kozlovic
ca268290a6 Perform the check on accept, not in processing CONNECT
This will protect the server from non NATS clients (telnet, etc),
or misbehaving clients that would create the tcp connection but
block before sending the CONNECT.
The drawback is that the client may or may not receive the error
message (in my tests, it was getting only between 10%-20% of times).
2016-12-01 08:48:04 -07:00
Ivan Kozlovic
6bcd324955 [FIXED] Honor max_connections setting
The max_connections config parameter was accepted but the server
would not check this limit when processing client connections.

Resolves #386
2016-11-30 18:20:12 -07:00
Ivan Kozlovic
fda5bd7ac7 [ADDED] Server sends INFO with cluster URLs to clients with support
Clients that will be at the ClientProtoInfo protocol level (or above)
will now receive an asynchronous INFO protocol when the server
they connect to adds a *new* route. This means that when the cluster
adds a new server, all clients in the cluster should now be notified
of this new addition.
2016-07-26 10:55:55 -06:00
Derek Collison
e3b5713ab9 Check for control line violations and memory attacks 2016-07-11 12:03:49 -07:00
Derek Collison
67ed61c837 fixups for PR comments 2016-06-17 09:59:39 -07:00
Derek Collison
7730fac9e2 Authorization enforcement and performance tweaks 2016-06-16 17:07:25 -07:00
Derek Collison
7237972420 support for bcrypt in cluster auth 2016-02-23 12:47:46 -08:00
Derek Collison
075529e2fe Properly handle and enforce max payload 2015-08-05 22:05:58 -07:00
Derek Collison
d21e2caf8c golint updates 2013-10-13 09:52:51 -07:00
Derek Collison
ad4e90df26 Added AuthErr 2012-12-19 17:47:39 -08:00
Derek Collison
6630efb298 first pass server 2012-11-12 14:26:38 -08:00