Skip to content

Commit 5d479e8

Browse files
author
Ashesh Vidyut
committed
Merge branch 'asheshvidyut/NET-3865' of github.com:hashicorp/consul into asheshvidyut/NET-3865
2 parents 3631708 + c461f59 commit 5d479e8

File tree

51 files changed

+1518
-205
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+1518
-205
lines changed

‎.changelog/17609.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
```release-note:bug
2+
gateways: Fixed a bug in API gateways where binding a route that only targets a service imported from a peer results
3+
in the programmed gateway having no routes.
4+
```

‎.changelog/_5669.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:improvement
2+
audit-logging: **(Enterprise only)** enable error response and request body logging
3+
```

‎.changelog/_5740.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:feature
2+
api: (Enterprise only) Add `POST /v1/operator/audit-hash` endpoint to calculate the hash of the data used by the audit log hash function and salt.
3+
```

‎.changelog/_5750.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:feature
2+
cli: (Enterprise only) Add a new `consul operator audit hash` command to retrieve and compare the hash of the data used by the audit log hash function and salt.
3+
```

.github/workflows/nightly-test-1.12.x.yaml renamed to .github/workflows/nightly-test-1.16.x.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
# Copyright (c) HashiCorp, Inc.
22
# SPDX-License-Identifier: MPL-2.0
33

4-
name: Nightly Test 1.12.x
4+
name: Nightly Test 1.16.x
55
on:
66
schedule:
77
- cron: '0 4 * * *'
88
workflow_dispatch: {}
99

1010
env:
1111
EMBER_PARTITION_TOTAL: 4 # Has to be changed in tandem with the matrix.partition
12-
BRANCH: "release/1.12.x"
13-
BRANCH_NAME: "release-1.12.x" # Used for naming artifacts
12+
BRANCH: "release/1.16.x"
13+
BRANCH_NAME: "release-1.16.x" # Used for naming artifacts
1414

1515
jobs:
1616
frontend-test-workspace-node:

‎agent/agent.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1621,7 +1621,18 @@ func (a *Agent) RPC(ctx context.Context, method string, args interface{}, reply
16211621
method = e + "." + p[1]
16221622
}
16231623
}
1624+
1625+
// audit log only on consul clients
1626+
_, ok := a.delegate.(*consul.Client)
1627+
if ok {
1628+
a.writeAuditRPCEvent(method, "OperationStart")
1629+
}
1630+
16241631
a.endpointsLock.RUnlock()
1632+
1633+
defer func() {
1634+
a.writeAuditRPCEvent(method, "OperationComplete")
1635+
}()
16251636
return a.delegate.RPC(ctx, method, args, reply)
16261637
}
16271638

‎agent/agent_endpoint_test.go‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1822,7 +1822,7 @@ func TestAgent_ReloadDoesNotTriggerWatch(t *testing.T) {
18221822
for i := 1; i < 7; i++ {
18231823
contents, err := os.ReadFile(tmpFile)
18241824
if err != nil {
1825-
t.Fatalf("should be able to read file, but had: %#v", err)
1825+
r.Fatalf("should be able to read file, but had: %#v", err)
18261826
}
18271827
contentsStr = string(contents)
18281828
if contentsStr != "" {
@@ -1909,14 +1909,14 @@ func TestAgent_ReloadDoesNotTriggerWatch(t *testing.T) {
19091909
ensureNothingCritical(r, "red-is-dead")
19101910

19111911
if err := a.reloadConfigInternal(cfg2); err != nil {
1912-
t.Fatalf("got error %v want nil", err)
1912+
r.Fatalf("got error %v want nil", err)
19131913
}
19141914

19151915
// We check that reload does not go to critical
19161916
ensureNothingCritical(r, "red-is-dead")
19171917
ensureNothingCritical(r, "testing-agent-reload-001")
19181918

1919-
require.NoError(t, a.updateTTLCheck(checkID, api.HealthPassing, "testing-agent-reload-002"))
1919+
require.NoError(r, a.updateTTLCheck(checkID, api.HealthPassing, "testing-agent-reload-002"))
19201920

19211921
ensureNothingCritical(r, "red-is-dead")
19221922
})
@@ -2926,7 +2926,7 @@ func TestAgent_RegisterCheck_ACLDeny(t *testing.T) {
29262926
req, _ := http.NewRequest("PUT", "/v1/agent/check/register", jsonReader(nodeCheck))
29272927
resp := httptest.NewRecorder()
29282928
a.srv.h.ServeHTTP(resp, req)
2929-
require.Equal(t, http.StatusForbidden, resp.Code)
2929+
require.Equal(r, http.StatusForbidden, resp.Code)
29302930
})
29312931
})
29322932

@@ -2936,7 +2936,7 @@ func TestAgent_RegisterCheck_ACLDeny(t *testing.T) {
29362936
req.Header.Add("X-Consul-Token", svcToken.SecretID)
29372937
resp := httptest.NewRecorder()
29382938
a.srv.h.ServeHTTP(resp, req)
2939-
require.Equal(t, http.StatusForbidden, resp.Code)
2939+
require.Equal(r, http.StatusForbidden, resp.Code)
29402940
})
29412941
})
29422942

@@ -2946,7 +2946,7 @@ func TestAgent_RegisterCheck_ACLDeny(t *testing.T) {
29462946
req.Header.Add("X-Consul-Token", nodeToken.SecretID)
29472947
resp := httptest.NewRecorder()
29482948
a.srv.h.ServeHTTP(resp, req)
2949-
require.Equal(t, http.StatusOK, resp.Code)
2949+
require.Equal(r, http.StatusOK, resp.Code)
29502950
})
29512951
})
29522952

@@ -2955,7 +2955,7 @@ func TestAgent_RegisterCheck_ACLDeny(t *testing.T) {
29552955
req, _ := http.NewRequest("PUT", "/v1/agent/check/register", jsonReader(svcCheck))
29562956
resp := httptest.NewRecorder()
29572957
a.srv.h.ServeHTTP(resp, req)
2958-
require.Equal(t, http.StatusForbidden, resp.Code)
2958+
require.Equal(r, http.StatusForbidden, resp.Code)
29592959
})
29602960
})
29612961

@@ -2965,7 +2965,7 @@ func TestAgent_RegisterCheck_ACLDeny(t *testing.T) {
29652965
req.Header.Add("X-Consul-Token", nodeToken.SecretID)
29662966
resp := httptest.NewRecorder()
29672967
a.srv.h.ServeHTTP(resp, req)
2968-
require.Equal(t, http.StatusForbidden, resp.Code)
2968+
require.Equal(r, http.StatusForbidden, resp.Code)
29692969
})
29702970
})
29712971

@@ -2975,7 +2975,7 @@ func TestAgent_RegisterCheck_ACLDeny(t *testing.T) {
29752975
req.Header.Add("X-Consul-Token", svcToken.SecretID)
29762976
resp := httptest.NewRecorder()
29772977
a.srv.h.ServeHTTP(resp, req)
2978-
require.Equal(t, http.StatusOK, resp.Code)
2978+
require.Equal(r, http.StatusOK, resp.Code)
29792979
})
29802980
})
29812981
}
@@ -5976,17 +5976,17 @@ func TestAgent_Monitor(t *testing.T) {
59765976
res := httptest.NewRecorder()
59775977
a.srv.h.ServeHTTP(res, registerReq)
59785978
if http.StatusOK != res.Code {
5979-
t.Fatalf("expected 200 but got %v", res.Code)
5979+
r.Fatalf("expected 200 but got %v", res.Code)
59805980
}
59815981

59825982
// Wait until we have received some type of logging output
5983-
require.Eventually(t, func() bool {
5983+
require.Eventually(r, func() bool {
59845984
return len(resp.Body.Bytes()) > 0
59855985
}, 3*time.Second, 100*time.Millisecond)
59865986

59875987
cancelFunc()
59885988
code := <-codeCh
5989-
require.Equal(t, http.StatusOK, code)
5989+
require.Equal(r, http.StatusOK, code)
59905990
got := resp.Body.String()
59915991

59925992
// Only check a substring that we are highly confident in finding
@@ -6026,11 +6026,11 @@ func TestAgent_Monitor(t *testing.T) {
60266026
res := httptest.NewRecorder()
60276027
a.srv.h.ServeHTTP(res, registerReq)
60286028
if http.StatusOK != res.Code {
6029-
t.Fatalf("expected 200 but got %v", res.Code)
6029+
r.Fatalf("expected 200 but got %v", res.Code)
60306030
}
60316031

60326032
// Wait until we have received some type of logging output
6033-
require.Eventually(t, func() bool {
6033+
require.Eventually(r, func() bool {
60346034
return len(resp.Body.Bytes()) > 0
60356035
}, 3*time.Second, 100*time.Millisecond)
60366036
cancelFunc()
@@ -6063,24 +6063,24 @@ func TestAgent_Monitor(t *testing.T) {
60636063
res := httptest.NewRecorder()
60646064
a.srv.h.ServeHTTP(res, registerReq)
60656065
if http.StatusOK != res.Code {
6066-
t.Fatalf("expected 200 but got %v", res.Code)
6066+
r.Fatalf("expected 200 but got %v", res.Code)
60676067
}
60686068

60696069
// Wait until we have received some type of logging output
6070-
require.Eventually(t, func() bool {
6070+
require.Eventually(r, func() bool {
60716071
return len(resp.Body.Bytes()) > 0
60726072
}, 3*time.Second, 100*time.Millisecond)
60736073

60746074
cancelFunc()
60756075
code := <-codeCh
6076-
require.Equal(t, http.StatusOK, code)
6076+
require.Equal(r, http.StatusOK, code)
60776077

60786078
// Each line is output as a separate JSON object, we grab the first and
60796079
// make sure it can be unmarshalled.
60806080
firstLine := bytes.Split(resp.Body.Bytes(), []byte("\n"))[0]
60816081
var output map[string]interface{}
60826082
if err := json.Unmarshal(firstLine, &output); err != nil {
6083-
t.Fatalf("err: %v", err)
6083+
r.Fatalf("err: %v", err)
60846084
}
60856085
})
60866086
})
@@ -6672,7 +6672,7 @@ func TestAgentConnectCARoots_list(t *testing.T) {
66726672

66736673
dec := json.NewDecoder(resp.Body)
66746674
value := &structs.IndexedCARoots{}
6675-
require.NoError(t, dec.Decode(value))
6675+
require.NoError(r, dec.Decode(value))
66766676
if ca.ID != value.ActiveRootID {
66776677
r.Fatalf("%s != %s", ca.ID, value.ActiveRootID)
66786678
}
@@ -7080,7 +7080,7 @@ func TestAgentConnectCALeafCert_goodNotLocal(t *testing.T) {
70807080

70817081
dec := json.NewDecoder(resp.Body)
70827082
issued2 := &structs.IssuedCert{}
7083-
require.NoError(t, dec.Decode(issued2))
7083+
require.NoError(r, dec.Decode(issued2))
70847084
if issued.CertPEM == issued2.CertPEM {
70857085
r.Fatalf("leaf has not updated")
70867086
}
@@ -7092,9 +7092,9 @@ func TestAgentConnectCALeafCert_goodNotLocal(t *testing.T) {
70927092
}
70937093

70947094
// Verify that the cert is signed by the new CA
7095-
requireLeafValidUnderCA(t, issued2, ca)
7095+
requireLeafValidUnderCA(r, issued2, ca)
70967096

7097-
require.NotEqual(t, issued, issued2)
7097+
require.NotEqual(r, issued, issued2)
70987098
})
70997099
}
71007100
}
@@ -7471,11 +7471,11 @@ func TestAgentConnectCALeafCert_secondaryDC_good(t *testing.T) {
74717471
// Try and sign again (note no index/wait arg since cache should update in
74727472
// background even if we aren't actively blocking)
74737473
a2.srv.h.ServeHTTP(resp, req)
7474-
require.Equal(t, http.StatusOK, resp.Code)
7474+
require.Equal(r, http.StatusOK, resp.Code)
74757475

74767476
dec := json.NewDecoder(resp.Body)
74777477
issued2 := &structs.IssuedCert{}
7478-
require.NoError(t, dec.Decode(issued2))
7478+
require.NoError(r, dec.Decode(issued2))
74797479
if issued.CertPEM == issued2.CertPEM {
74807480
r.Fatalf("leaf has not updated")
74817481
}
@@ -7487,9 +7487,9 @@ func TestAgentConnectCALeafCert_secondaryDC_good(t *testing.T) {
74877487
}
74887488

74897489
// Verify that the cert is signed by the new CA
7490-
requireLeafValidUnderCA(t, issued2, dc1_ca2)
7490+
requireLeafValidUnderCA(r, issued2, dc1_ca2)
74917491

7492-
require.NotEqual(t, issued, issued2)
7492+
require.NotEqual(r, issued, issued2)
74937493
})
74947494
}
74957495

@@ -7499,12 +7499,12 @@ func waitForActiveCARoot(t *testing.T, srv *HTTPHandlers, expect *structs.CARoot
74997499
resp := httptest.NewRecorder()
75007500
srv.h.ServeHTTP(resp, req)
75017501
if http.StatusOK != resp.Code {
7502-
t.Fatalf("expected 200 but got %v", resp.Code)
7502+
r.Fatalf("expected 200 but got %v", resp.Code)
75037503
}
75047504

75057505
dec := json.NewDecoder(resp.Body)
75067506
roots := &structs.IndexedCARoots{}
7507-
require.NoError(t, dec.Decode(roots))
7507+
require.NoError(r, dec.Decode(roots))
75087508

75097509
var root *structs.CARoot
75107510
for _, r := range roots.Roots {

‎agent/agent_oss.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,3 +69,7 @@ func (a *Agent) AgentEnterpriseMeta() *acl.EnterpriseMeta {
6969
func (a *Agent) registerEntCache() {}
7070

7171
func (*Agent) fillEnterpriseProxyDataSources(*proxycfg.DataSources) {}
72+
73+
func (a *Agent) writeAuditRPCEvent(_ string, _ string) interface{} {
74+
return nil
75+
}

‎agent/config/config.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -807,8 +807,9 @@ type ConfigEntries struct {
807807

808808
// Audit allows us to enable and define destinations for auditing
809809
type Audit struct {
810-
Enabled *bool `mapstructure:"enabled"`
811-
Sinks map[string]AuditSink `mapstructure:"sink"`
810+
Enabled *bool `mapstructure:"enabled"`
811+
Sinks map[string]AuditSink `mapstructure:"sink"`
812+
RPCEnabled *bool `mapstructure:"rpc_enabled"`
812813
}
813814

814815
// AuditSink can be provided multiple times to define pipelines for auditing

‎agent/consul/acl_endpoint_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ func TestACLEndpoint_ReplicationStatus(t *testing.T) {
143143
retry.Run(t, func(r *retry.R) {
144144
var status structs.ACLReplicationStatus
145145
err := msgpackrpc.CallWithCodec(codec, "ACL.ReplicationStatus", &getR, &status)
146-
require.NoError(t, err)
146+
require.NoError(r, err)
147147

148148
require.True(r, status.Enabled)
149149
require.True(r, status.Running)
@@ -220,7 +220,7 @@ func TestACLEndpoint_TokenRead(t *testing.T) {
220220
time.Sleep(200 * time.Millisecond)
221221
err := aclEp.TokenRead(&req, &resp)
222222
require.Error(r, err)
223-
require.ErrorContains(t, err, "ACL not found")
223+
require.ErrorContains(r, err, "ACL not found")
224224
require.Nil(r, resp.Token)
225225
})
226226
})

0 commit comments

Comments
 (0)