vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-nats-auth: refuse an auth request the server did not seal

Browse source 
Every nats-server this module starts renders `auth_callout.xkey` or does
not start, and the responder serves only that server, in the same
container and generation. A request without `Nats-Server-Xkey` therefore
comes from no supported server, so the plaintext framing is gone: such a
request is logged at warn and gets no reply, and the server that sent it
times out the connect as a denial. A signed denial would have had to go
out unsealed, which is the path this removes.

Also scopes two claims to what is true: the xkey's public half is read by
the swarm-nats-auth policy only, and the metadata-delete gap in the
replace-key procedure is about the two xkey paths, not all of
`secret/metadata/`.
This commit is contained in:
atlas 2026-10-05 22:46:52 +02:00 • committed by mara
commit 923554cd62
5 changed files with 78 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

6
swarm-nats-auth/README.md
View file

@ -37,9 +37,9 @@ not part of the path that runs.
The server seals each auth request to the callout xkey and names its own
public xkey in the `Nats-Server-Xkey` header; the responder opens the request
with the xkey's seed and seals its reply to that header's key. It answers a
request with no header in plaintext, which is what a server with no xkey
configured reads.
with the xkey's seed and seals its reply to that header's key. The responder
logs a warning for a request with no header, or one that doesn't open, and
sends no reply: the server it serves always seals, so no server waits on one.
The seed is in the swarm secret store, and the responder reads it before it
connects to the queue: a responder without it doesn't start. The