consul

Commit Graph

Author	SHA1	Message	Date
Daniel Nephin	bb7fb21004	Fix godoc comment Co-authored-by: Freddy <freddygv@users.noreply.github.com>	3 years ago
Daniel Nephin	81bb5f33eb	Merge pull request #10618 from hashicorp/dnephin/docs-add-deprecation-version-grpc-port docs: add deprecation version for ports.grpc settings	3 years ago
R.B. Boyer	20feb42d3a	xds: ensure single L7 deny intention with default deny policy does not result in allow action (CVE-2021-36213) (#10619 )	3 years ago
hc-github-team-consul-core	58807668bd	auto-updated agent/uiserver/bindata_assetfs.go from commit `0762da3a6`	3 years ago
John Cowen	0762da3a62	ui: [BUGFIX] Ensure we use the ns query param name when requesting permissions (#10608 ) Previously when namespaces were enabled, we weren't requesting permission for the actively selected namespace, and instead always checking the permissions for the default namespace. This commit ensures we request permissions for the actively selected namespace.	3 years ago
Giulio Micheloni	814ef6b103	acl: fix error type into a string type for serialization issue acl_endpoint_test.go:507: Error Trace: acl_endpoint_test.go:507 retry.go:148 retry.go:149 retry.go:103 acl_endpoint_test.go:504 Error: Received unexpected error: codec.decoder: decodeValue: Cannot decode non-nil codec value into nil error (1 methods) Test: TestACLEndpoint_ReplicationStatus	3 years ago
freddygv	b4c5c58c9b	Add TODOs about partition handling	3 years ago
freddygv	5a82656510	Update golden files	3 years ago
freddygv	47da00d3c7	Validate SANs for passthrough clusters and failovers	3 years ago
freddygv	5454147c09	Update golden files to account for SAN validation	3 years ago
freddygv	a6d3fe90b1	Validate Subject Alternative Name for upstreams These changes ensure that the identity of services dialed is cryptographically verified. For all upstreams we validate against SPIFFE IDs in the format used by Consul's service mesh: spiffe://<trust-domain>/ns/<namespace>/dc/<datacenter>/svc/<service>	3 years ago
Daniel Nephin	fa47c04065	Fix a data race in TestACLResolver_Client By setting the hash when we create the policy. ``` WARNING: DATA RACE Read at 0x00c0028b4b10 by goroutine 1182: github.com/hashicorp/consul/agent/structs.(ACLPolicy).SetHash() /home/daniel/pers/code/consul/agent/structs/acl.go:701 +0x40d github.com/hashicorp/consul/agent/structs.ACLPolicies.resolveWithCache() /home/daniel/pers/code/consul/agent/structs/acl.go:779 +0xfe github.com/hashicorp/consul/agent/structs.ACLPolicies.Compile() /home/daniel/pers/code/consul/agent/structs/acl.go:809 +0xf1 github.com/hashicorp/consul/agent/consul.(ACLResolver).ResolveTokenToIdentityAndAuthorizer() /home/daniel/pers/code/consul/agent/consul/acl.go:1226 +0x6ef github.com/hashicorp/consul/agent/consul.resolveTokenAsync() /home/daniel/pers/code/consul/agent/consul/acl_test.go:66 +0x5c Previous write at 0x00c0028b4b10 by goroutine 1509: github.com/hashicorp/consul/agent/structs.(ACLPolicy).SetHash() /home/daniel/pers/code/consul/agent/structs/acl.go:730 +0x3a8 github.com/hashicorp/consul/agent/structs.ACLPolicies.resolveWithCache() /home/daniel/pers/code/consul/agent/structs/acl.go:779 +0xfe github.com/hashicorp/consul/agent/structs.ACLPolicies.Compile() /home/daniel/pers/code/consul/agent/structs/acl.go:809 +0xf1 github.com/hashicorp/consul/agent/consul.(ACLResolver).ResolveTokenToIdentityAndAuthorizer() /home/daniel/pers/code/consul/agent/consul/acl.go:1226 +0x6ef github.com/hashicorp/consul/agent/consul.resolveTokenAsync() /home/daniel/pers/code/consul/agent/consul/acl_test.go:66 +0x5c Goroutine 1182 (running) created at: github.com/hashicorp/consul/agent/consul.TestACLResolver_Client.func4() /home/daniel/pers/code/consul/agent/consul/acl_test.go:1669 +0x459 testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 Goroutine 1509 (running) created at: github.com/hashicorp/consul/agent/consul.TestACLResolver_Client.func4() /home/daniel/pers/code/consul/agent/consul/acl_test.go:1668 +0x415 testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 ```	3 years ago
Daniel Nephin	414ce3f09b	Update serf To pick up data race fixes	3 years ago
Daniel Nephin	a0ca381037	agent: remove deprecated call in a test	3 years ago
Daniel Nephin	678014de1d	agent: fix a data race in a test The test was modifying a pointer to a struct that had been passed to another goroutine. Instead create a new struct to modify. ``` WARNING: DATA RACE Write at 0x00c01407c3c0 by goroutine 832: github.com/hashicorp/consul/agent.TestServiceManager_PersistService_API() /home/daniel/pers/code/consul/agent/service_manager_test.go:446 +0x1d86 testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 Previous read at 0x00c01407c3c0 by goroutine 938: reflect.typedmemmove() /usr/lib/go/src/runtime/mbarrier.go:177 +0x0 reflect.Value.Set() /usr/lib/go/src/reflect/value.go:1569 +0x13b github.com/mitchellh/copystructure.(walker).Primitive() /home/daniel/go/pkg/mod/github.com/mitchellh/copystructure@v1.0.0/copystructure.go:289 +0x190 github.com/mitchellh/reflectwalk.walkPrimitive() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:252 +0x31b github.com/mitchellh/reflectwalk.walk() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:179 +0x24d github.com/mitchellh/reflectwalk.walkStruct() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:386 +0x4ec github.com/mitchellh/reflectwalk.walk() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:188 +0x656 github.com/mitchellh/reflectwalk.walkStruct() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:386 +0x4ec github.com/mitchellh/reflectwalk.walk() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:188 +0x656 github.com/mitchellh/reflectwalk.Walk() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:92 +0x164 github.com/mitchellh/copystructure.Config.Copy() /home/daniel/go/pkg/mod/github.com/mitchellh/copystructure@v1.0.0/copystructure.go:69 +0xe7 github.com/mitchellh/copystructure.Copy() /home/daniel/go/pkg/mod/github.com/mitchellh/copystructure@v1.0.0/copystructure.go:13 +0x84 github.com/hashicorp/consul/agent.mergeServiceConfig() /home/daniel/pers/code/consul/agent/service_manager.go:362 +0x56 github.com/hashicorp/consul/agent.(serviceConfigWatch).handleUpdate() /home/daniel/pers/code/consul/agent/service_manager.go:279 +0x250 github.com/hashicorp/consul/agent.(serviceConfigWatch).runWatch() /home/daniel/pers/code/consul/agent/service_manager.go:246 +0x2d4 Goroutine 832 (running) created at: testing.(T).Run() /usr/lib/go/src/testing/testing.go:1238 +0x5d7 testing.runTests.func1() /usr/lib/go/src/testing/testing.go:1511 +0xa6 testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 testing.runTests() /usr/lib/go/src/testing/testing.go:1509 +0x612 testing.(M).Run() /usr/lib/go/src/testing/testing.go:1417 +0x3b3 main.main() _testmain.go:1181 +0x236 Goroutine 938 (running) created at: github.com/hashicorp/consul/agent.(serviceConfigWatch).start() /home/daniel/pers/code/consul/agent/service_manager.go:223 +0x4e4 github.com/hashicorp/consul/agent.(ServiceManager).AddService() /home/daniel/pers/code/consul/agent/service_manager.go:98 +0x344 github.com/hashicorp/consul/agent.(Agent).addServiceLocked() /home/daniel/pers/code/consul/agent/agent.go:1942 +0x2e4 github.com/hashicorp/consul/agent.(*Agent).AddService() /home/daniel/pers/code/consul/agent/agent.go:1929 +0x337 github.com/hashicorp/consul/agent.TestServiceManager_PersistService_API() /home/daniel/pers/code/consul/agent/service_manager_test.go:400 +0x17c4 testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 ```	3 years ago
Daniel Nephin	0acfc2c65b	agent: fix a data race in DNS tests The dnsConfig pulled from the atomic.Value is a pointer, so modifying it in place creates a data race. Use the exported ReloadConfig interface instead.	3 years ago
Daniel Nephin	970f5d78ec	agent: fix two data race in agent tests The LogOutput io.Writer used by TestAgent must allow concurrent reads and writes, and a bytes.Buffer does not allow this. The bytes.Buffer must be wrapped with a lock to make this safe.	3 years ago
Daniel Nephin	baa2b8628e	consul: fix data race in leader CA tests Some global variables are patched to shorter values in these tests. But the goroutines that read them can outlive the test because nothing waited for them to exit. This commit adds a Wait() method to the routine manager, so that tests can wait for the goroutines to exit. This prevents the data race because the 'reset to original value' can happen after all other goroutines have stopped.	3 years ago
Dhia Ayachi	6d331691dc	add changelog entry	3 years ago
Daniel Nephin	204bf2b345	dns: correct rcode for qtype not supported A previous commit started using QueryRefuced, but that is not correct. QueryRefuced refers to the OpCode, not the query type. Instead use errNoAnswer because we have no records for that query type.	3 years ago
Dhia Ayachi	ad2065f2aa	Check response len do not exceed max Buffer size	3 years ago
Dhia Ayachi	f8f2756967	add missing test for truncate	3 years ago
Daniel Nephin	d116bda958	dns: remove network parameter from two funcs Now that trimDNSResponse is handled by the caller we don't need to pass this value around. We can remove it from both the serviceLookup struct, and two functions.	3 years ago
Daniel Nephin	42f7963252	dns: trim response immediately before the write Previously the response was being trimmed before adding the EDNS values, which could cause it to exceed the max size.	3 years ago
Daniel Nephin	436a02af31	dns: handle errors from dispatch	3 years ago
Daniel Nephin	9267b09c32	dns: error response from dispatch So that dispatch can communicate status back to the caller.	3 years ago
Daniel Nephin	68d6f1315f	dns: refactor dispatch to use an explicit return in each case In preparation for changing the return value, so that SOA, eDNS trimming and 'not found' errors can be handled in a single place.	3 years ago
Daniel Nephin	b96c8195a5	dns: small refactor to setEDNS to return early Using a guard clause instead of a long nested if. The diff is best viewed with whitespace turned off.	3 years ago
Daniel Nephin	4beff900d1	dns: remove unused method It was added in `5934f803bf` but it was never used.	3 years ago
Daniel Nephin	f31aa12cf1	dns: remove unnecessary function wrapping The dispatch function was called from a single place and did nothing but add a default value. Removing it makes code easier to trace by removing an unnecessary hop.	3 years ago
Daniel Nephin	510262b3bb	docs: add deprecation version for ports.grpc settings	3 years ago
Daniel Nephin	4a92f2d428	Merge pull request #10568 from hashicorp/dnephin/contrib-docs-config contrib: add first draft of agent configuration docs	3 years ago
Daniel Nephin	5581c86597	docs: add config options that were missing https://github.com/hashicorp/consul/pull/128 added pid_file https://github.com/hashicorp/consul/pull/1331 added disable_coordinates	3 years ago
Daniel Nephin	b93f9d8788	contrib: add first draft of agent configuration docs	3 years ago
Kyle Havlovitz	8bf7182e73	Merge pull request #10616 from hashicorp/partitions/oss-http-params oss: add partition query param parsing	3 years ago
Kyle Havlovitz	77a2f38677	http: add partition query param parsing	3 years ago
hc-github-team-consul-core	1169df0878	auto-updated agent/uiserver/bindata_assetfs.go from commit `3e80e637b`	3 years ago
John Cowen	3e80e637ba	ui: [BUGFIX] Fix KV Code Editor syntax loading (#10605 ) This commit adds a bit of string wrangling to avoid the keys in our javascript source file also being transformed. Additionally, whilst looking at this we decided that Maps are a better dictionary than javascript objects, so we moved to use those here also (but this doesn't affect the issue)	3 years ago
John Cowen	54f0cd812a	ui: Show the correct 'ACLs Disabled' page when ACLs are disabled (#10604 ) Adds 'can access ACLs' which means one of two things 1. When ACLs are disabled I can access the 'please enable ACLs' page 2. When ACLs are enabled, its the same as canRead	3 years ago
John Cowen	b256313256	ui: [BUGFIX] Ensure in-folder KVs are created in the correct folder (#10569 ) When clicking to create a KV within folder name, would would be viewing a form that was a form for creating a KV in the root, which when the user clicked to save, saved the KV in the root. For the moment at least I've removed the code that strips double slashes, and whilst this isn't ideal, it looks like we've picked up one of those bugs that turns into a 'feature', and completely reworking KV to not rely on the double slashes is not really an option right now.	3 years ago
Melissa Kam	fb95d447db	Merge pull request #10614 from hashicorp/nia/docs-0.2.1 nia/docs 0.2.1	3 years ago
Giulio Micheloni	529fe737ef	acl: acl replication routine to report the last error message	3 years ago
David Yu	28087b6949	docs: Add link to learn guide on migrating ACL tokens (#10609 ) * docs: Add link to learn guide on migrating ACL tokens	3 years ago
Daniel Nephin	74fb650b6b	Merge pull request #10588 from hashicorp/dnephin/config-fix-ports-grpc config: rename `ports.grpc` to `ports.xds`	3 years ago
Daniel Nephin	b5cd2050b4	fix backwards compat for envoy command The compatv2 integration tests were failing because they use an older CLI version with a newer HTTP API. This commit restores the GRPCPort field to the DebugConfig output to allow older CIs to continue to fetch the port.	3 years ago
Daniel Nephin	233d03dbbd	Apply suggestions from code review Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Daniel Nephin	4ad80ccee3	command/envoy: stop using the DebugConfig from Self endpoint The DebugConfig in the self endpoint can change at any time. It's not a stable API. With the previous change to rename GRPCPort to XDSPort this command would have broken. This commit adds the XDSPort to a stable part of the XDS api, and changes the envoy command to read this new field. It includes support for the old API as well, in case a newer CLI is used with an older API, and adds a test for both cases.	3 years ago
Daniel Nephin	c48f26b0a6	config: update config settings and flags for ports.xds	3 years ago
Dhia Ayachi	58bd817336	check expiry date of the root/intermediate before using it to sign a leaf (#10500 ) * ca: move provider creation into CAManager This further decouples the CAManager from Server. It reduces the interface between them and removes the need for the SetLogger method on providers. * ca: move SignCertificate to CAManager To reduce the scope of Server, and keep all the CA logic together * ca: move SignCertificate to the file where it is used * auto-config: move autoConfigBackend impl off of Server Most of these methods are used exclusively for the AutoConfig RPC endpoint. This PR uses a pattern that we've used in other places as an incremental step to reducing the scope of Server. * fix linter issues * check error when `raftApplyMsgpack` * ca: move SignCertificate to CAManager To reduce the scope of Server, and keep all the CA logic together * check expiry date of the intermediate before using it to sign a leaf * fix typo in comment Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> * Fix test name * do not check cert start date * wrap error to mention it is the intermediate expired * Fix failing test * update comment Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * use shim to avoid sleep in test * add root cert validation * remove duplicate code * Revert "fix linter issues" This reverts commit `6356302b54`. * fix import issue * gofmt leader_connect_ca * add changelog entry * update error message Co-authored-by: Freddy <freddygv@users.noreply.github.com> * fix error message in test Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com>	3 years ago
R.B. Boyer	6c47efd532	connect/ca: ensure edits to the key type/bits for the connect builtin CA will regenerate the roots (#10330 ) progress on #9572	3 years ago

... 2 3 4 5 6 ...

14961 Commits (d3cebbd32cfa508e0856bf9beceb36c4af924b74) All Branches Search

14961 Commits (d3cebbd32cfa508e0856bf9beceb36c4af924b74)

All Branches