Support MongoDB targets - #2579
Open
chenmortal wants to merge 9 commits into
Open
chenmortal wants to merge 9 commits into
chenmortal wants to merge 9 commits into
Conversation
New protocol crate proxying OP_MSG between MongoDB clients and targets, built on the mongowire crates (wire parsing, framing, BSON, SCRAM client). Client auth is PLAIN over mandatory TLS (warpgate terminates it with the standard shared DbAuthAuthorization flow, user#target selectors); the upstream connection authenticates with the target's stored credentials via SCRAM-SHA-256. OP_QUERY is answered for the legacy hello/isMaster handshake only; OP_COMPRESSED and pre-3.6 opcodes are rejected. Integration: Protocol::Mongo, TargetMongoOptions (serde "mongodb"), MongoConfig listener (default :37017), TargetKind::Mongo, credential policy and MFA matrix entries, tls_listener wiring. Co-Authored-By: Claude Code <noreply@anthropic.com>
Admin: MongoDB in the target-kind chooser and target create defaults, the per-kind target form (host, port, username, password, auth source, TLS), protocol reference docs, target list labels, and a MongoDB row in the per-protocol credential policy editor. Gateway: target list labels and mongosh connection instructions (?authMechanism=PLAIN&tls=true with the user#target selector). Session lists show the MongoDB protocol name. Regenerated OpenAPI schemas; PortsInfo/ExternalHostsInfo gained a mongo entry so the gateway surfaces the listener port. Co-Authored-By: Claude Code <noreply@anthropic.com>
Adds the --mongo-port flag to unattended setup and an interactive "Accept MongoDB connections?" prompt (with the usual endpoint question), mirroring the MySQL/PostgreSQL flow, and copies the instance TLS certificate into the mongo listener config. Co-Authored-By: Claude Code <noreply@anthropic.com>
The client-facing leg now sniffs the first bytes of each connection: a valid MongoDB wire header means plaintext, anything else goes through the TLS handshake (its bytes are replayed into the TLS layer). This matches MongoDB's tlsMode=prefer and stops clients without ?tls=true from hanging on repeated TLS handshake failures. Plaintext connections are logged with a warning since PLAIN then sends credentials unencrypted; the target-side TLS setting keeps governing only the warpgate-to-upstream leg. UI copy updated to match. Co-Authored-By: Claude Code <noreply@anthropic.com>
An upstream "Authentication failed." on its own does not say which credential was tried; the proxy error now carries the target username and auth source so a misconfigured target is diagnosable from the log. Co-Authored-By: Claude Code <noreply@anthropic.com> )
Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-Authored-By: Claude Code <noreply@anthropic.com>
The workspace cranky profile denies clippy::expect_used, clippy::unwrap_used and clippy::indexing_slicing; parse the first-chunk header through get() into a fixed-size buffer instead. Co-Authored-By: Claude Code <noreply@anthropic.com>
Author
|
Build / Config schema check (pull_request), I've added MongoDB support to the config file, as was necessary. |
Author
|
Code scanning results / CodeQL This is a misreading — the PBKDF2-HMAC-SHA-256 here is not password storage. SCRAM-SHA-256 (RFC 7677) mandates it for computing the challenge-response proof sent to the upstream MongoDB server at auth time; it can't be swapped for argon2id because the server verifies it against its own SCRAM credentials. Warpgate's at-rest password storage is still argon2id. I've updated the comment to make this explicit. |
chenmortal
marked this pull request as draft
September 13, 2026 11:05
chenmortal
marked this pull request as ready for review
September 13, 2026 11:05
Author
|
Test / Tests (pull_request) The test job is failing due to Docker image pull access issues in the integration tests. |
Member
|
Thank you for the PR! Currently there is a large backlog so expect a delay. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2577
Description
Based on my own project mongowire (a Mongo wire protocol parser), I've implemented MongoDB protocol proxying for Warpgate, integrated it into the main Warpgate codebase, added frontend support, and completed end-to-end test verification.
...
AI Usage
Choose the level of AI involvement for this PR.
This is not to block AI contributions but rather to speed up PR review (saves time on trying to deduce the logic behind AI hallucinations).
front web
mongsh connect warpgate server
warpgate server log
mongsh command find
warpgate server log