config_check_test.go

// Copyright 2018-2024 The NATS Authors
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package server

import (
"errors"
"fmt"
"strings"
"testing"
)

funcTestConfigCheck(t*testing.T) {
tests:= []struct {
// name is the name of the test.
namestring

// config is content of the configuration file.
configstring

// warningErr is an error that does not prevent server from starting.
warningErrerror

// errorLine is the location of the error.
errorLineint

// errorPos is the position of the error.
errorPosint

// warning errors also include a reason optionally.
reasonstring

// newDefaultErr is a configuration error that includes source of error.
errerror
 }{
 {
name: "when unknown field is used at top level",
config: `
 monitor = "127.0.0.1:4442"
 `,
err: errors.New(`unknown field "monitor"`),
errorLine: 2,
errorPos: 17,
 },
 {
name: "when default permissions are used at top level",
config: `
 "default_permissions" {
 publish = ["_SANDBOX.>"]
 subscribe = ["_SANDBOX.>"]
 }
 `,
err: errors.New(`unknown field "default_permissions"`),
errorLine: 2,
errorPos: 18,
 },
 {
name: "when authorization config is empty",
config: `
 authorization = {
 }
 `,
err: nil,
 },
 {
name: "when authorization config has unknown fields",
config: `
 authorization = {
 foo = "bar"
 }
 `,
err: errors.New(`unknown field "foo"`),
errorLine: 3,
errorPos: 5,
 },
 {
name: "when authorization config has unknown fields",
config: `
 port = 4222

 authorization = {
 user = "hello"
 foo = "bar"
 password = "world"
 }

 `,
err: errors.New(`unknown field "foo"`),
errorLine: 6,
errorPos: 5,
 },
 {
name: "when user authorization config has unknown fields",
config: `
 authorization = {
 users = [
 {
 user = "foo"
 pass = "bar"
 token = "quux"
 }
 ]
 }
 `,
err: errors.New(`unknown field "token"`),
errorLine: 7,
errorPos: 9,
 },
 {
name: "when user authorization permissions config has unknown fields",
config: `
 authorization {
 permissions {
 subscribe = {}
 inboxes = {}
 publish = {}
 }
 }
 `,
err: errors.New(`Unknown field "inboxes" parsing permissions`),
errorLine: 5,
errorPos: 7,
 },
 {
name: "when user authorization permissions config has unknown fields within allow or deny",
config: `
 authorization {
 permissions {
 subscribe = {
 allow = ["hello", "world"]
 deny = ["foo", "bar"]
 denied = "_INBOX.>"
 }
 publish = {}
 }
 }
 `,
err: errors.New(`Unknown field name "denied" parsing subject permissions, only 'allow' or 'deny' are permitted`),
errorLine: 7,
errorPos: 9,
 },
 {
name: "when user authorization permissions config has unknown fields within allow or deny",
config: `
 authorization {
 permissions {
 publish = {
 allow = ["hello", "world"]
 deny = ["foo", "bar"]
 allowed = "_INBOX.>"
 }
 subscribe = {}
 }
 }
 `,
err: errors.New(`Unknown field name "allowed" parsing subject permissions, only 'allow' or 'deny' are permitted`),
errorLine: 7,
errorPos: 9,
 },
 {
name: "when user authorization permissions config has unknown fields using arrays",
config: `
 authorization {

 default_permissions {
 subscribe = ["a"]
 publish = ["b"]
 inboxes = ["c"]
 }

 users = [
 {
 user = "foo"
 pass = "bar"
 }
 ]
 }
 `,
err: errors.New(`Unknown field "inboxes" parsing permissions`),
errorLine: 7,
errorPos: 6,
 },
 {
name: "when user authorization permissions config has unknown fields using strings",
config: `
 authorization {

 default_permissions {
 subscribe = "a"
 requests = "b"
 publish = "c"
 }

 users = [
 {
 user = "foo"
 pass = "bar"
 }
 ]
 }
 `,
err: errors.New(`Unknown field "requests" parsing permissions`),
errorLine: 6,
errorPos: 6,
 },
 {
name: "when user authorization permissions config is empty",
config: `
 authorization = {
 users = [
 {
 user = "foo", pass = "bar", permissions = {
 }
 }
 ]
 }
 `,
err: nil,
 },
 {
name: "when unknown permissions are included in user config",
config: `
 authorization = {
 users = [
 {
 user = "foo", pass = "bar", permissions {
 inboxes = true
 }
 }
 ]
 }
 `,
err: errors.New(`Unknown field "inboxes" parsing permissions`),
errorLine: 6,
errorPos: 11,
 },
 {
name: "when clustering config is empty",
config: `
 cluster = {
 }
 `,

err: nil,
 },
 {
name: "when unknown option is in clustering config",
config: `
 # NATS Server Configuration
 port = 4222

 cluster = {

 port = 6222

 foo = "bar"

 authorization {
 user = "hello"
 pass = "world"
 }

 }
 `,

err: errors.New(`unknown field "foo"`),
errorLine: 9,
errorPos: 5,
 },
 {
name: "when unknown option is in clustering authorization config",
config: `
 cluster = {
 authorization {
 foo = "bar"
 }
 }
 `,

err: errors.New(`unknown field "foo"`),
errorLine: 4,
errorPos: 7,
 },
 {
name: "when unknown option is in tls config",
config: `
 tls = {
 hello = "world"
 }
 `,
err: errors.New(`error parsing tls config, unknown field "hello"`),
errorLine: 3,
errorPos: 5,
 },
 {
name: "when unknown option is in cluster tls config",
config: `
 cluster {
 tls = {
 foo = "bar"
 }
 }
 `,
err: errors.New(`error parsing tls config, unknown field "foo"`),
errorLine: 4,
errorPos: 7,
 },
 {
name: "when using cipher suites in the TLS config",
config: `
 tls = {
 cipher_suites: [
 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
 ]
 preferences = []
 }
 `,
err: errors.New(`error parsing tls config, unknown field "preferences"`),
errorLine: 7,
errorPos: 7,
 },
 {
name: "when using curve preferences in the TLS config",
config: `
 tls = {
 curve_preferences: [
 "CurveP256",
 "CurveP384",
 "CurveP521"
 ]
 suites = []
 }
 `,
err: errors.New(`error parsing tls config, unknown field "suites"`),
errorLine: 8,
errorPos: 7,
 },
 {
name: "when using curve preferences in the TLS config",
config: `
 tls = {
 curve_preferences: [
 "CurveP5210000"
 ]
 }
 `,
err: errors.New(`unrecognized curve preference CurveP5210000`),
errorLine: 4,
errorPos: 5,
 },
 {
name: "verify_cert_and_check_known_urls not support for clients",
config: `
 tls = {
 cert_file: "configs/certs/server.pem"
 key_file: "configs/certs/key.pem"
 verify_cert_and_check_known_urls: true
 }
 `,
err: errors.New("verify_cert_and_check_known_urls not supported in this context"),
errorLine: 5,
errorPos: 10,
 },
 {
name: "when unknown option is in cluster config with defined routes",
config: `
 cluster {
 port = 6222
 routes = [
 nats://127.0.0.1:6222
 ]
 peers = []
 }
 `,
err: errors.New(`unknown field "peers"`),
errorLine: 7,
errorPos: 5,
 },
 {
name: "when used as variable in authorization block it should not be considered as unknown field",
config: `
 # listen: 127.0.0.1:-1
 listen: 127.0.0.1:4222

 authorization {
 # Superuser can do anything.
 super_user = {
 publish = ">"
 subscribe = ">"
 }

 # Can do requests on foo or bar, and subscribe to anything
 # that is a response to an _INBOX.
 #
 # Notice that authorization filters can be singletons or arrays.
 req_pub_user = {
 publish = ["req.foo", "req.bar"]
 subscribe = "_INBOX.>"
 }

 # Setup a default user that can subscribe to anything, but has
 # no publish capabilities.
 default_user = {
 subscribe = "PUBLIC.>"
 }

 unused = "hello"

 # Default permissions if none presented. e.g. susan below.
 default_permissions: $default_user

 # Users listed with persmissions.
 users = [
 {user: alice, password: foo, permissions: $super_user}
 {user: bob, password: bar, permissions: $req_pub_user}
 {user: susan, password: baz}
 ]
 }
 `,
err: errors.New(`unknown field "unused"`),
errorLine: 27,
errorPos: 5,
 },
 {
name: "when used as variable in top level config it should not be considered as unknown field",
config: `
 monitoring_port = 8222

 http_port = $monitoring_port

 port = 4222
 `,
err: nil,
 },
 {
name: "when used as variable in cluster config it should not be considered as unknown field",
config: `
 cluster {
 clustering_port = 6222
 port = $clustering_port
 }
 `,
err: nil,
 },
 {
name: "when setting permissions within cluster authorization block",
config: `
 cluster {
 authorization {
 permissions = {
 publish = { allow = ["foo", "bar"] }
 }
 }

 permissions = {
 publish = { deny = ["foo", "bar"] }
 }
 }
 `,
warningErr: errors.New(`invalid use of field "authorization"`),
errorLine: 3,
errorPos: 5,
reason: `setting "permissions" within cluster authorization block is deprecated`,
 },
 {
name: "when write deadline is used with deprecated usage",
config: `
 write_deadline = 100
 `,
warningErr: errors.New(`invalid use of field "write_deadline"`),
errorLine: 2,
errorPos: 17,
reason: `write_deadline should be converted to a duration`,
 },
/////////////////////
// ACCOUNTS //
/////////////////////
 {
name: "when accounts block is correctly configured",
config: `
 http_port = 8222

 accounts {

 #
 # synadia > nats.io, cncf
 #
 synadia {
 # SAADJL5XAEM6BDYSWDTGVILJVY54CQXZM5ZLG4FRUAKB62HWRTPNSGXOHA
 nkey = "AC5GRL36RQV7MJ2GT6WQSCKDKJKYTK4T2LGLWJ2SEJKRDHFOQQWGGFQL"

 users [
 {
 # SUAEL6RU3BSDAFKOHNTEOK5Q6FTM5FTAMWVIKBET6FHPO4JRII3CYELVNM
 nkey = "UCARKS2E3KVB7YORL2DG34XLT7PUCOL2SVM7YXV6ETHLW6Z46UUJ2VZ3"
 }
 ]

 exports = [
 { service: "synadia.requests", accounts: [nats, cncf] }
 ]
 }

 #
 # nats < synadia
 #
 nats {
 # SUAJTM55JH4BNYDA22DMDZJSRBRKVDGSLYK2HDIOCM3LPWCDXIDV5Q4CIE
 nkey = "ADRZ42QBM7SXQDXXTSVWT2WLLFYOQGAFC4TO6WOAXHEKQHIXR4HFYJDS"

 users [
 {
 # SUADZTYQAKTY5NQM7XRB5XR3C24M6ROGZLBZ6P5HJJSSOFUGC5YXOOECOM
 nkey = "UD6AYQSOIN2IN5OGC6VQZCR4H3UFMIOXSW6NNS6N53CLJA4PB56CEJJI"
 }
 ]

 imports = [
 # This account has to send requests to 'nats.requests' subject
 { service: { account: "synadia", subject: "synadia.requests" }, to: "nats.requests" }
 ]
 }

 #
 # cncf < synadia
 #
 cncf {
 # SAAFHDZX7SGZ2SWHPS22JRPPK5WX44NPLNXQHR5C5RIF6QRI3U65VFY6C4
 nkey = "AD4YRVUJF2KASKPGRMNXTYKIYSCB3IHHB4Y2ME6B2PDIV5QJ23C2ZRIT"

 users [
 {
 # SUAKINP3Z2BPUXWOFSW2FZC7TFJCMMU7DHKP2C62IJQUDASOCDSTDTRMJQ
 nkey = "UB57IEMPG4KOTPFV5A66QKE2HZ3XBXFHVRCCVMJEWKECMVN2HSH3VTSJ"
 }
 ]

 imports = [
 # This account has to send requests to 'synadia.requests' subject
 { service: { account: "synadia", subject: "synadia.requests" } }
 ]
 }
 }
 `,
err: nil,
 },
 {
name: "when nkey is invalid within accounts block",
config: `
 accounts {

 #
 # synadia > nats.io, cncf
 #
 synadia {
 # SAADJL5XAEM6BDYSWDTGVILJVY54CQXZM5ZLG4FRUAKB62HWRTPNSGXOHA
 nkey = "AC5GRL36RQV7MJ2GT6WQSCKDKJKYTK4T2LGLWJ2SEJKRDHFOQQWGGFQL"

 users [
 {
 # SUAEL6RU3BSDAFKOHNTEOK5Q6FTM5FTAMWVIKBET6FHPO4JRII3CYELVNM
 nkey = "SCARKS2E3KVB7YORL2DG34XLT7PUCOL2SVM7YXV6ETHLW6Z46UUJ2VZ3"
 }
 ]

 exports = [
 { service: "synadia.requests", accounts: [nats, cncf] }
 ]
 }

 #
 # nats < synadia
 #
 nats {
 # SUAJTM55JH4BNYDA22DMDZJSRBRKVDGSLYK2HDIOCM3LPWCDXIDV5Q4CIE
 nkey = "ADRZ42QBM7SXQDXXTSVWT2WLLFYOQGAFC4TO6WOAXHEKQHIXR4HFYJDS"

 users [
 {
 # SUADZTYQAKTY5NQM7XRB5XR3C24M6ROGZLBZ6P5HJJSSOFUGC5YXOOECOM
 nkey = "UD6AYQSOIN2IN5OGC6VQZCR4H3UFMIOXSW6NNS6N53CLJA4PB56CEJJI"
 }
 ]

 imports = [
 # This account has to send requests to 'nats.requests' subject
 { service: { account: "synadia", subject: "synadia.requests" }, to: "nats.requests" }
 ]
 }

 #
 # cncf < synadia
 #
 cncf {
 # SAAFHDZX7SGZ2SWHPS22JRPPK5WX44NPLNXQHR5C5RIF6QRI3U65VFY6C4
 nkey = "AD4YRVUJF2KASKPGRMNXTYKIYSCB3IHHB4Y2ME6B2PDIV5QJ23C2ZRIT"

 users [
 {
 # SUAKINP3Z2BPUXWOFSW2FZC7TFJCMMU7DHKP2C62IJQUDASOCDSTDTRMJQ
 nkey = "UB57IEMPG4KOTPFV5A66QKE2HZ3XBXFHVRCCVMJEWKECMVN2HSH3VTSJ"
 }
 ]

 imports = [
 # This account has to send requests to 'synadia.requests' subject
 { service: { account: "synadia", subject: "synadia.requests" } }
 ]
 }
 }
 `,
err: errors.New(`Not a valid public nkey for a user`),
errorLine: 14,
errorPos: 11,
 },
 {
name: "when accounts block has unknown fields",
config: `
 http_port = 8222

 accounts {
 foo = "bar"
 }`,
err: errors.New(`Expected map entries for accounts`),
errorLine: 5,
errorPos: 19,
 },
 {
name: "when accounts has a referenced config variable within same block",
config: `
 accounts {
 PERMISSIONS = {
 publish = {
 allow = ["foo","bar"]
 deny = ["quux"]
 }
 }

 synadia {
 nkey = "AC5GRL36RQV7MJ2GT6WQSCKDKJKYTK4T2LGLWJ2SEJKRDHFOQQWGGFQL"

 users [
 {
 nkey = "UCARKS2E3KVB7YORL2DG34XLT7PUCOL2SVM7YXV6ETHLW6Z46UUJ2VZ3"
 permissions = $PERMISSIONS
 }
 ]
 exports = [
 { stream: "synadia.>" }
 ]
 }
 }`,
err: nil,
 },
 {
name: "when accounts has an unreferenced config variables within same block",
config: `
 accounts {
 PERMISSIONS = {
 publish = {
 allow = ["foo","bar"]
 deny = ["quux"]
 }
 }

 synadia {
 nkey = "AC5GRL36RQV7MJ2GT6WQSCKDKJKYTK4T2LGLWJ2SEJKRDHFOQQWGGFQL"

 users [
 {
 nkey = "UCARKS2E3KVB7YORL2DG34XLT7PUCOL2SVM7YXV6ETHLW6Z46UUJ2VZ3"
 }
 ]
 exports = [
 { stream: "synadia.>" }
 ]
 }
 }`,
err: errors.New(`unknown field "publish"`),
errorLine: 4,
errorPos: 5,
 },
 {
name: "when accounts block defines a global account",
config: `
 http_port = 8222

 accounts {
 $G = {
 }
 }
 `,
err: errors.New(`"$G" is a Reserved Account`),
errorLine: 5,
errorPos: 19,
 },
 {
name: "when accounts block uses an invalid public key",
config: `
 accounts {
 synadia = {
 nkey = "invalid"
 }
 }
 `,
err: errors.New(`Not a valid public nkey for an account: "invalid"`),
errorLine: 4,
errorPos: 21,
 },
 {
name: "when accounts list includes reserved account",
config: `
 port = 4222

 accounts = [foo, bar, "$G"]

 http_port = 8222
 `,
err: errors.New(`"$G" is a Reserved Account`),
errorLine: 4,
errorPos: 26,
 },
 {
name: "when accounts list includes a dupe entry",
config: `
 port = 4222

 accounts = [foo, bar, bar]

 http_port = 8222
 `,
err: errors.New(`Duplicate Account Entry: bar`),
errorLine: 4,
errorPos: 25,
 },
 {
name: "when accounts block includes a dupe user",
config: `
 port = 4222

 accounts = {
 nats {
 users = [
 { user: "foo", pass: "bar" },
 { user: "hello", pass: "world" },
 { user: "foo", pass: "bar" }
 ]
 }
 }

 http_port = 8222
 `,
err: errors.New(`Duplicate user "foo" detected`),
errorLine: 6,
errorPos: 21,
 },
 {
name: "when accounts block imports are not a list",
config: `
 port = 4222

 accounts = {
 nats {
 imports = true
 }
 }

 http_port = 8222
 `,
err: errors.New(`Imports should be an array, got bool`),
errorLine: 6,
errorPos: 21,
 },
 {
name: "when accounts block exports are not a list",
config: `
 port = 4222

 accounts = {
 nats {
 exports = true
 }
 }

 http_port = 8222
 `,
err: errors.New(`Exports should be an array, got bool`),
errorLine: 6,
errorPos: 21,
 },
 {
name: "when accounts block imports items are not a map",
config: `
 port = 4222

 accounts = {
 nats {
 imports = [
 false
 ]
 }
 }

 http_port = 8222
 `,
err: errors.New(`Import Items should be a map with type entry, got bool`),
errorLine: 7,
errorPos: 23,
 },
 {
name: "when accounts block export items are not a map",
config: `
 port = 4222

 accounts = {
 nats {
 exports = [
 false
 ]
 }
 }

 http_port = 8222
 `,
err: errors.New(`Export Items should be a map with type entry, got bool`),
errorLine: 7,
errorPos: 23,
 },
 {
name: "when accounts exports has a stream name that is not a string",
config: `
 port = 4222

 accounts = {
 nats {
 exports = [
 {
 stream: false
 }
 ]
 }
 }

 http_port = 8222
 `,
err: errors.New(`Expected stream name to be string, got bool`),
errorLine: 8,
errorPos: 25,
 },
 {
name: "when accounts exports has a service name that is not a string",
config: `
 accounts = {
 nats {
 exports = [
 {
 service: false
 }
 ]
 }
 }
 `,
err: errors.New(`Expected service name to be string, got bool`),
errorLine: 6,
errorPos: 25,
 },
 {
name: "when accounts imports stream without name",
config: `
 port = 4222

 accounts = {
 nats {
 imports = [
 { stream: { }}
 ]
 }
 }

 http_port = 8222
 `,
err: errors.New(`Expect an account name and a subject`),
errorLine: 7,
errorPos: 25,
 },
 {
name: "when accounts imports service without name",
config: `
 port = 4222

 accounts = {
 nats {
 imports = [
 { service: { }}
 ]
 }
 }

 http_port = 8222
 `,
err: errors.New(`Expect an account name and a subject`),
errorLine: 7,
errorPos: 25,
 },
 {
name: "when account trace destination is of the wrong type",
config: `
 accounts {
 A { trace_dest: 123 }
 }
 `,
err: errors.New(`Expected account message trace "trace_dest" to be a string or a map/struct, got int64`),
errorLine: 3,
errorPos: 23,
 },
 {
name: "when account trace destination is not a valid destination",
config: `
 accounts {
 A { trace_dest: "invalid..dest" }
 }
 `,
err: errors.New(`Trace destination "invalid..dest" is not valid`),
errorLine: 3,
errorPos: 23,
 },
 {
name: "when account trace destination is not a valid publish subject",
config: `
 accounts {
 A { trace_dest: "invalid.publish.*.subject" }
 }
 `,
err: errors.New(`Trace destination "invalid.publish.*.subject" is not valid`),
errorLine: 3,
errorPos: 23,
 },
 {
name: "when account message trace dest is wrong type",
config: `
 accounts {
 A { msg_trace: {dest: 123} }
 }
 `,
err: errors.New(`Field "dest" should be a string, got int64`),
errorLine: 3,
errorPos: 35,
 },
 {
name: "when account message trace dest is invalid",
config: `
 accounts {
 A { msg_trace: {dest: "invalid..dest"} }
 }
 `,
err: errors.New(`Trace destination "invalid..dest" is not valid`),
errorLine: 3,
errorPos: 35,
 },
 {
name: "when account message trace sampling is wrong type",
config: `
 accounts {
 A { msg_trace: {dest: "acc.dest", sampling: {wront: "type"}} }
 }
 `,
err: errors.New(`Trace destination sampling field "sampling" should be an integer or a percentage, got map[string]interface {}`),
errorLine: 3,
errorPos: 53,
 },
 {
name: "when account message trace sampling is wrong string",
config: `
 accounts {
 A { msg_trace: {dest: "acc.dest", sampling: abc%} }
 }
 `,
err: errors.New(`Invalid trace destination sampling value "abc%"`),
errorLine: 3,
errorPos: 53,
 },
 {
name: "when account message trace sampling is negative",
config: `
 accounts {
 A { msg_trace: {dest: "acc.dest", sampling: -1} }
 }
 `,
err: errors.New(`Ttrace destination sampling value -1 is invalid, needs to be [1..100]`),