Mongodb support in linkerd

[barkardk]

Hi
It states in the docs that mongodb is an SSF protocol and cannot be meshed.
I am running a meshed mongodb cluster without issues though and was wondering if the documentation is inaccurate or if there is certain instances of mongodb that are SSF that may not work even though in my case it seems meshed just fine?

❯ linkerd edges po
SRC                                   DST         SRC_NS    DST_NS    SECURED
mongodb-0                             mongodb-1   default   default   √
mongodb-0                             mongodb-2   default   default   √
mongodb-1                             mongodb-0   default   default   √
mongodb-1                             mongodb-0   default   default   √
mongodb-1                             mongodb-2   default   default   √
mongodb-2                             mongodb-0   default   default   √
mongodb-2                             mongodb-0   default   default   √
mongodb-2                             mongodb-1   default   default   √
mongodb-2                             mongodb-1   default   default   √

I have it confirmed in wireshark also

Frame 350: 367 bytes on wire (2936 bits), 367 bytes captured (2936 bits) on interface -, id 0
Linux cooked capture v1
Internet Protocol Version 4, Src: 10.0.101.22, Dst: 10.0.101.222
Transmission Control Protocol, Src Port: 27017, Dst Port: 45592, Seq: 1080, Ack: 574, Len: 299
    Source Port: 27017
    Destination Port: 45592
    [Stream index: 7]
    [TCP Segment Len: 299]
    Sequence Number: 1080    (relative sequence number)
    Sequence Number (raw): 3430941029
    [Next Sequence Number: 1379    (relative sequence number)]
    Acknowledgment Number: 574    (relative ack number)
    Acknowledgment number (raw): 2918283539
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x018 (PSH, ACK)
    Window: 849
    [Calculated window size: 849]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0xe045 [unverified]
    [Checksum Status: Unverified]
    Urgent Pointer: 0
    Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
    [SEQ/ACK analysis]
    [Timestamps]
    TCP payload (299 bytes)
Transport Layer Security
    TLSv1.2 Record Layer: Application Data Protocol: mongo
        Content Type: Application Data (23)
        Version: TLS 1.2 (0x0303)
        Length: 294
        Encrypted Application Data: c9ff22dea7645456f6c00cb1e984e68ca05a426227daebbc9ed0d64689294bef98282282…
        [Application Data Protocol: mongo]

current default of iptables in one of the mongodb pods

:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:PROXY_INIT_OUTPUT - [0:0]
:PROXY_INIT_REDIRECT - [0:0]
-A PREROUTING -m comment --comment "proxy-init/install-proxy-init-prerouting/1608042838" -j PROXY_INIT_REDIRECT
-A OUTPUT -m comment --comment "proxy-init/install-proxy-init-output/1608042838" -j PROXY_INIT_OUTPUT
-A PROXY_INIT_OUTPUT ! -d 127.0.0.1/32 -o lo -m owner --uid-owner 2102 -m comment --comment "proxy-init/redirect-non-loopback-local-traffic/1608042838" -j PROXY_INIT_REDIRECT
-A PROXY_INIT_OUTPUT -m owner --uid-owner 2102 -m comment --comment "proxy-init/ignore-proxy-user-id/1608042838" -j RETURN
-A PROXY_INIT_OUTPUT -o lo -m comment --comment "proxy-init/ignore-loopback/1608042838" -j RETURN
-A PROXY_INIT_OUTPUT -p tcp -m multiport --dports 25,443,587,3306,11211 -m comment --comment "proxy-init/ignore-port-25,443,587,3306,11211/1608042838" -j RETURN
-A PROXY_INIT_OUTPUT -p tcp -m comment --comment "proxy-init/redirect-all-outgoing-to-proxy-port/1608042838" -j REDIRECT --to-ports 4140
-A PROXY_INIT_REDIRECT -p tcp -m multiport --dports 4190,4191,25,443,587,3306,11211 -m comment --comment "proxy-init/ignore-port-4190,4191,25,443,587,3306,11211/1608042838" -j RETURN
-A PROXY_INIT_REDIRECT -p tcp -m comment --comment "proxy-init/redirect-all-incoming-to-proxy-port/1608042838" -j REDIRECT --to-ports 4143

I am using linkerd
Client version: edge-20.12.1
Server version: edge-20.12.1

mongodb
MongoDB server version: 3.4.10

Kubernetes EKS 1.16

[adleong]

I'm not familiar with the details mongodb's protocol but it looks like @olix0r has been speaking to you about SSF over on #5384. Does that answer your questions?

[allir]

I think this is the protocol documentation for mongodb: https://docs.mongodb.com/manual/reference/mongodb-wire-protocol/
And there it says that it is a simple request-response style protocol, and I don't find anything in that doc that implies it is SSF? (by skimming it, didn't read it thoroughly through.)

The MongoDB Wire Protocol is a simple socket-based, request-response style protocol. Clients communicate with the database server through a regular TCP/IP socket.

So as @xkbarkar points out maybe the "known SSF" documentation should be updated to not include mongodb? Unless we're missing something? :)

[adleong]

Huh. Yeah, sounds like it. Cool!

[cpretzer]

@allir thanks for testing this and for the extra detail. The original change to add mongodb is here. Unfortunately, I don't have context other than that.

Since the protocol is not SSF, then we should update the docs. Your help there is always welcome :)