consul: fail badly if an unsupported type is passed to the ACL filter

consul/acl.go

@@ -2,6 +2,7 @@ package consul
 
 import (
 	"errors"
+	"fmt"
 	"log"
 	"os"
 	"strings"
@@ -355,6 +356,9 @@ func (s *Server) filterACL(token string, subj interface{}) error {
 
 	case *structs.IndexedNodeDump:
 		filt.filterNodeDump(&v.Dump)
+
+	default:
+		panic(fmt.Errorf("Unhandled type passed to ACL filter: %#v", subj))
 	}
 
 	return nil

consul/acl_test.go

@@ -861,6 +861,23 @@ func TestACL_filterNodeDump(t *testing.T) {
 	}
 }
 
+func TestACL_unhandledFilterType(t *testing.T) {
+	defer func(t *testing.T) {
+		if recover() == nil {
+			t.Fatalf("should panic")
+		}
+	}(t)
+
+	// Create the server
+	dir, token, srv, client := testACLFilterServer(t)
+	defer os.RemoveAll(dir)
+	defer srv.Shutdown()
+	defer client.Close()
+
+	// Pass an unhandled type into the ACL filter.
+	srv.filterACL(token, &structs.HealthCheck{})
+}
+
 var testACLPolicy = `
 key "" {
 	policy = "deny"

consul/catalog_endpoint.go

@@ -126,7 +126,7 @@ func (c *Catalog) ListNodes(args *structs.DCSpecificRequest, reply *structs.Inde
 		state.QueryTables("Nodes"),
 		func() error {
 			reply.Index, reply.Nodes = state.Nodes()
-			return c.srv.filterACL(args.Token, reply)
+			return nil
 		})
 }