-
Notifications
You must be signed in to change notification settings - Fork 4.1k
server: cockroach connect does not negotiate peers across NAT properly #61238
Copy link
Copy link
Open
Labels
A-authenticationPertains to authn subsystemsPertains to authn subsystemsA-securityA-server-networkingPertains to network addressing,routing,initializationPertains to network addressing,routing,initializationC-bugCode not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.T-server-and-securityDB Server & SecurityDB Server & Security
Description
Part of #60632
During the initial handshake, the trust leader receives the address of each peer as part of the trust handshake.
However, each peer populates the acknowledgement for the challenge using its listening address, not its advertised address.
So if the connection is happening across a NAT boundary, the trust leader will be unable to connect back to its the trusted peers.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
A-authenticationPertains to authn subsystemsPertains to authn subsystemsA-securityA-server-networkingPertains to network addressing,routing,initializationPertains to network addressing,routing,initializationC-bugCode not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.T-server-and-securityDB Server & SecurityDB Server & Security