kozlovic
commented
2 years ago @JH7 Thank you for the detailed report, but not only I cannot reproduce, but the log that you attached above does not match your description, meaning that from the log we see that the last produced message ('test3') goes only to CLIENT:
2022/05/06 08:37:21.809382 [TRC] 172.19.0.1:53962 - cid:25 - "v1.13.0:go:NATS CLI Version 0.0.28" - <<- [PUB orders.client.stream.entry 5]
2022/05/06 08:37:21.809393 [TRC] 172.19.0.1:53962 - cid:25 - "v1.13.0:go:NATS CLI Version 0.0.28" - <<- MSG_PAYLOAD: ["test3"]is sent to only this client:
2022/05/06 08:37:21.809463 [TRC] 172.19.0.1:53954 - cid:23 - "v1.13.0:go:NATS CLI Version 0.0.28" - ->> [MSG orders.client.stream.entry 1 5]which cid:23 correspond to your CLIENT, not CLIENT2:
2022/05/06 08:37:14.088585 [TRC] 172.19.0.1:53954 - cid:23 - <<- [CONNECT {"verbose":false,"pedantic":false,"user":"client","pass":"[REDACTED]","tls_required":false,"name":"NATS CLI Version 0.0.28","lang":"go","version":"1.13.0","protocol":1,"echo":true,"headers":true,"no_responders":true}]
2022/05/06 08:37:14.088624 [TRC] 172.19.0.1:53954 - cid:23 - "v1.13.0:go:NATS CLI Version 0.0.28" - <<- [PING]
2022/05/06 08:37:14.088626 [TRC] 172.19.0.1:53954 - cid:23 - "v1.13.0:go:NATS CLI Version 0.0.28" - ->> [PONG]
2022/05/06 08:37:14.088962 [TRC] 172.19.0.1:53954 - cid:23 - "v1.13.0:go:NATS CLI Version 0.0.28" - <<- [SUB orders.> 1]
2022/05/06 08:37:14.088986 [DBG] 172.19.0.1:53954 - cid:23 - "v1.13.0:go:NATS CLI Version 0.0.28" - Creating import subscription on "orders.client.stream.>" from account "PUBLIC"Did you miss some steps? (by the way, the steps from the log do not really match the steps described in the report, but I have tried both and in no case I can reproduce CLIENT2 getting the message at the same time than CLIENT).
JH7
Defect
nats-server -DVoutputVersions of
nats-serverand affected client libraries used:nats-server: 2.8.2 (also tested with current nightly build) nats-cli: 0.0.28
OS/Container environment:
Windows 10 (WSL2) 4.19.128-microsoft-standard; Ubuntu 20.04.3 LTS Docker Desktop 4.7.2, Engine 20.10.14, Compose 1.29.2
Steps or code to reproduce the issue:
config:
clientwithnats --user client --password client sub 'orders.>'and forclient2withnats --user client2 --password client2 sub 'orders.>'seperatelyPUBLICaccount:nats --user public --password public pub 'orders.client.stream.entry' 'test1'CLIENTaccount subscription receives the message, while theCLIENT2account does not (this is correct behavior)CLIENTandCLIENT2accounts:nats --user client --password client stream create orders '--subjects=orders.*.stream.entry' --retention=work --max-consumers=-1 --max-msgs-per-subject=-1 --max-msgs=-1 --max-bytes=-1 --max-age=-1 --max-msg-size=-1 --storage=file --discard=old --replicas=1 --dupe-window="2m0s" --no-allow-rollup --no-deny-delete --no-deny-purgeandnats --user client2 --password client2 stream create orders '--subjects=orders.*.stream.entry' --retention=work --max-consumers=-1 --max-msgs-per-subject=-1 --max-msgs=-1 --max-bytes=-1 --max-age=-1 --max-msg-size=-1 --storage=file --discard=old --replicas=1 --dupe-window="2m0s" --no-allow-rollup --no-deny-delete --no-deny-purgePUBLICagain:nats --user public --password public pub 'orders.client.stream.entry' 'test2'Expected result:
The message shows up in the
ordersstream of accountCLIENTonly and not on theordersstream of accountCLIENT2. I check this via runningnats --user client --password client stream info ordersand observing the message count.Actual result:
Both streams in both accounts contain the test message. With my current understanding of accounts, this should not happen, even though both streams listen on the same subject. Since the config for these accounts explicitly imports only one subject, only messages of that subject should be able to reach the stream in this particular account (as it is the case with "normal" subscriptions).
The reason why changing the streams' subjects to
orders.client.stream.entryororders.client2.stream.entryrespectively is not the solution here is that a malicious user could just (re-)create a stream withorders.*.stream.entryand hence would be able to receive all messages.Log: