199 Commits (b372840be0cfbbbc193b5ffc690bb52984df0027)

Author	SHA1	Message	Date
Freddy	e3e31375c8	Merge pull request #10622 from hashicorp/vuln/validate-sans-1.10	3 years ago
freddygv	803df59268	Fixup prepared query ns defaulting	3 years ago
R.B. Boyer	104ee65e17	xds: ensure single L7 deny intention with default deny policy does not result in allow action (CVE-2021-36213) (#10619)	3 years ago
freddygv	0bf181ae55	Update golden files	3 years ago
freddygv	8e4ca495d5	Validate SANs for passthrough clusters and failovers	3 years ago
freddygv	faac20cd40	Update golden files to account for SAN validation	3 years ago
freddygv	bdacb71d22	Validate Subject Alternative Name for upstreams ... These changes ensure that the identity of services dialed is cryptographically verified. For all upstreams we validate against SPIFFE IDs in the format used by Consul's service mesh: spiffe://<trust-domain>/ns/<namespace>/dc/<datacenter>/svc/<service>	3 years ago
Dhia Ayachi	543928d707	Format certificates properly (rfc7468) with a trailing new line (#10411) ... * trim carriage return from certificates when inserting rootCA in the inMemDB * format rootCA properly when returning the CA on the connect CA endpoint * Fix linter warnings * Fix providers to trim certs before returning it * trim newlines on write when possible * add changelog * make sure all provider return a trailing newline after the root and intermediate certs * Fix endpoint to return trailing new line * Fix failing test with vault provider * make test more robust * make sure all provider return a trailing newline after the leaf certs * Check for suffix before removing newline and use function * Add comment to consul provider * Update change log Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * fix typo * simplify code callflow Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * extract requireNewLine as shared func * remove dependency to testify in testing file * remove extra newline in vault provider * Add cert newline fix to envoy xds * remove new line from mock provider * Remove adding a new line from provider and fix it when the cert is read * Add a comment to explain the fix * Add missing for leaf certs * fix missing new line * fix missing new line in leaf certs * remove extra new line in test * updage changelog Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * fix in vault provider and when reading cache (RPC call) * fix AWS provider * fix failing test in the provider * remove comments and empty lines * add check for empty cert in test * fix linter warnings * add new line for leaf and private key * use string concat instead of Sprintf * fix new lines for leaf signing * preallocate slice and remove append * Add new line to `SignIntermediate` and `CrossSignCA` Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
R.B. Boyer	6441b4b2c7	xds: fix flaky protocol tests (#10410)	3 years ago
Freddy	fc86420955	Merge pull request #10404 from hashicorp/ingress-stats	3 years ago
R.B. Boyer	0958f1dc3c	xds: adding more delta protocol tests (#10398) ... Fixes #10125	3 years ago
R.B. Boyer	f72774618d	xds: ensure that dependent xDS resources are reconfigured during primary type warming (#10381) ... Updates to a cluster will clear the associated endpoints, and updates to a listener will clear the associated routes. Update the incremental xDS logic to account for this implicit cleanup so that we can finish warming the clusters and listeners. Fixes #10379	4 years ago
Freddy	645e406ca0	Rename CatalogDestinationsOnly (#10397) ... CatalogDestinationsOnly is a passthrough that would enable dialing addresses outside of Consul's catalog. However, when this flag is set to true only _connect_ endpoints for services can be dialed. This flag is being renamed to signal that non-Connect endpoints can't be dialed by transparent proxies when the value is set to true.	4 years ago
Freddy	168073c4dc	Add flag for transparent proxies to dial individual instances (#10329)	4 years ago
Freddy	f0fe3cf4a6	Revert "Avoid adding original_dst filter when not needed" (#10365)	4 years ago
Freddy	f1ab78757e	Ensure passthrough clusters can be created (#10301)	4 years ago
Freddy	a2dcb9621d	Avoid adding original_dst filter when not needed (#10302)	4 years ago
R.B. Boyer	4025a6349a	xds: emit a labeled gauge of connected xDS streams by version (#10243) ... Fixes #10099	4 years ago
R.B. Boyer	88a8656e13	connect: update supported envoy versions to 1.18.3, 1.17.3, 1.16.4, and 1.15.5 (#10231)	4 years ago
Mark Anderson	42ff449d4f	Merge pull request #9981 from hashicorp/ma/uds_upstreams ... Unix Domain Socket support for upstreams and downstreams	4 years ago
Daniel Nephin	c1d1be2a4b	Merge pull request #10155 from hashicorp/dnephin/config-entry-remove-fields ... config-entry: remove Kind and Name field from Mesh config entry	4 years ago
Freddy	2d633ed804	Fixup discovery chain handling in transparent mode (#10168) ... Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Previously we would associate the address of a discovery chain target with the discovery chain's filter chain. This was broken for a few reasons: - If the upstream is a virtual service, the client proxy has no way of dialing it because virtual services are not targets of their discovery chains. The targets are distinct services. This is addressed by watching the endpoints of all upstream services, not just their discovery chain targets. - If multiple discovery chains resolve to the same target, that would lead to multiple filter chains attempting to match on the target's virtual IP. This is addressed by only matching on the upstream's virtual IP. NOTE: this implementation requires an intention to the redirecting virtual service and not just to the final destination. This is how we can know that the virtual service is an upstream to watch. A later PR will look into traversing discovery chains when computing upstreams so that intentions are only required to the discovery chain targets.	4 years ago
Freddy	4a4a1ebff8	Only consider virtual IPs for transparent proxies (#10162) ... Initially we were loading every potential upstream address into Envoy and then routing traffic to the logical upstream service. The downside of this behavior is that traffic meant to go to a specific instance would be load balanced across ALL instances. Traffic to specific instance IPs should be forwarded to the original destination and if it's a destination in the mesh then we should ensure the appropriate certificates are used. This PR makes transparent proxying a Kubernetes-only feature for now since support for other environments requires generating virtual IPs, and Consul does not do that at the moment.	4 years ago
R.B. Boyer	145a83e436	connect: update supported envoy versions to 1.18.2, 1.17.2, 1.16.3, and 1.15.4 (#10101) ... The only thing that needed fixing up pertained to this section of the 1.18.x release notes: > grpc_stats: the default value for stats_for_all_methods is switched from true to false, in order to avoid possible memory exhaustion due to an untrusted downstream sending a large number of unique method names. The previous default value was deprecated in version 1.14.0. This only changes the behavior when the value is not set. The previous behavior can be used by setting the value to true. This behavior change by be overridden by setting runtime feature envoy.deprecated_features.grpc_stats_filter_enable_stats_for_all_methods_by_default. For now to maintain status-quo I'm explicitly setting `stats_for_all_methods=true` in all versions to avoid relying upon the default. Additionally the naming of the emitted metrics for these gRPC requests changed slightly so the integration test assertions for `case-grpc` needed adjusting.	4 years ago
R.B. Boyer	df5e55fc50	xds: ensure that all envoyproxy/go-control-plane protobuf symbols are linked into the final binary (#10131) ... This ensures that if someone does include some extension Consul does not currently make use of, that extension is actually usable. Without linking these envoy protobufs into the main binary it can't round trip the escape hatches to send them down to envoy. Whenenver the go-control-plane library is upgraded next we just have to re-run 'make envoy-library'.	4 years ago
R.B. Boyer	6a39b47448	Support Incremental xDS mode (#9855) ... This adds support for the Incremental xDS protocol when using xDS v3. This is best reviewed commit-by-commit and will not be squashed when merged. Union of all commit messages follows to give an overarching summary: xds: exclusively support incremental xDS when using xDS v3 Attempts to use SoTW via v3 will fail, much like attempts to use incremental via v2 will fail. Work around a strange older envoy behavior involving empty CDS responses over incremental xDS. xds: various cleanups and refactors that don't strictly concern the addition of incremental xDS support Dissolve the connectionInfo struct in favor of per-connection ResourceGenerators instead. Do a better job of ensuring the xds code uses a well configured logger that accurately describes the connected client. xds: pull out checkStreamACLs method in advance of a later commit xds: rewrite SoTW xDS protocol tests to use protobufs rather than hand-rolled json strings In the test we very lightly reuse some of the more boring protobuf construction helper code that is also technically under test. The important thing of the protocol tests is testing the protocol. The actual inputs and outputs are largely already handled by the xds golden output tests now so these protocol tests don't have to do double-duty. This also updates the SoTW protocol test to exclusively use xDS v2 which is the only variant of SoTW that will be supported in Consul 1.10. xds: default xds.Server.AuthCheckFrequency at use-time instead of construction-time	4 years ago
Freddy	c652580b5b	Rename "cluster" config entry to "mesh" (#10127) ... This config entry is being renamed primarily because in k8s the name cluster could be confusing given that the config entry applies across federated datacenters. Additionally, this config entry will only apply to Consul as a service mesh, so the more generic "cluster" name is not needed.	4 years ago
Freddy	439a7fce2d	Split Upstream.Identifier() so non-empty namespace is always prepended in ent (#10031)	4 years ago
R.B. Boyer	06848ce67e	fix broken golden tests	4 years ago
Freddy	55a3697b83	Merge pull request #9987 from hashicorp/remove-kube-dns-hack	4 years ago
freddygv	4e509aa768	Remove todo that was todone	4 years ago
freddygv	75edc9bc7c	Avoid nil panic when cluster config doesn't exist	4 years ago
freddygv	7bd51ff536	Replace TransparentProxy bool with ProxyMode ... This PR replaces the original boolean used to configure transparent proxy mode. It was replaced with a string mode that can be set to: - "": Empty string is the default for when the setting should be defaulted from other configuration like config entries. - "direct": Direct mode is how applications originally opted into the mesh. Proxy listeners need to be dialed directly. - "transparent": Transparent mode enables configuring Envoy as a transparent proxy. Traffic must be captured and redirected to the inbound and outbound listeners. This PR also adds a struct for transparent proxy specific configuration. Initially this is not stored as a pointer. Will revisit that decision before GA.	4 years ago
Iryna Shustava	5755c97bc7	cli: Add new `consul connect redirect-traffic` command for applying traffic redirection rules when Transparent Proxy is enabled. (#9910) ... * Add new consul connect redirect-traffic command for applying traffic redirection rules when Transparent Proxy is enabled. * Add new iptables package for applying traffic redirection rules with iptables.	4 years ago
Freddy	e385e5992f	Merge pull request #9042 from lawliet89/tg-rewrite	4 years ago
freddygv	c6d64a8078	Stable sort cidr ranges to match on	4 years ago
freddygv	02f6768cd2	Remove kube-dns resolution since clusterip will be a tagged addr	4 years ago
R.B. Boyer	499fee73b3	connect: add toggle to globally disable wildcard outbound network access when transparent proxy is enabled (#9973) ... This adds a new config entry kind "cluster" with a single special name "cluster" where this can be controlled.	4 years ago
Yong Wen Chua	409768d6e5	Merge branch 'master' of github.com:hashicorp/consul into tg-rewrite	4 years ago
freddygv	ad6c726453	Uncomment listener tests	4 years ago
freddygv	f4f45af6d0	Merge master and fix upstream config protocol defaulting	4 years ago
freddygv	9f0696528b	Rename hasChains for clarity	4 years ago
freddygv	0da8702f34	PR comments	4 years ago
freddygv	bf96d536d9	Upstreams loop is only for prepared queries and they are not CentrallyConfigured	4 years ago
freddygv	8a062e1546	Handle prepared queries in Upstreams loop and escape hatches in disco chain loop	4 years ago
freddygv	ce964f8ea5	Update xds for transparent proxy	4 years ago
freddygv	3f2489c31d	Refactor makePublicListener ... By accepting a name the function can be used for other inbound listeners, like the one for TransparentProxy.	4 years ago
freddygv	8b46d8dcbb	Restore old Envoy prefix on escape hatches ... This is done because after removing ID and NodeName from ServiceConfigRequest we will no longer know whether a request coming in is for a Consul client earlier than v1.10.	4 years ago
freddygv	e3dc2a49df	Turn Limits and PassiveHealthChecks into pointers	4 years ago
freddygv	1710ec87d2	finish moving UpstreamConfig and related fields to structs pkg	4 years ago