Commit Graph

170 Commits

Author SHA1 Message Date
Kent 'picat' Gruber 2e84559d4b Merge pull request #10030 from hashicorp/fix-ent-audit-log-bypass
Add synthetic enterprise entry for CVE-2021-28156
2021-04-15 16:14:39 +00:00
Kent 'picat' Gruber dc937c9532 Merge pull request #10023 from hashicorp/fix-raw-kv-xss
Add content type headers to raw KV responses
2021-04-15 13:44:02 +00:00
Daniel Nephin 04d3575f11 Merge pull request #10025 from hashicorp/dnephin/fix-snapshot-auth-methods
snapshot: fix saving of auth methods
2021-04-14 21:19:24 +00:00
Daniel Nephin 01998aeaf0 Merge pull request #10014 from hashicorp/dnephin/changelog
Add changelog for enterprise change
2021-04-14 18:10:15 +00:00
Matt Keeler 72aee1d8c4 Move static token resolution into the ACLResolver (#10013) 2021-04-14 16:40:12 +00:00
Freddy 7b88faca15 Merge pull request #9042 from lawliet89/tg-rewrite 2021-04-08 12:59:22 -06:00
Paul Banks bb985743e9 cache: Fix bug where connection errors can cause early cache expiry (#9979)
Fixes a cache bug where TTL is not updated while a value isn't changing or cache entry is returning fetch errors.
2021-04-08 10:11:46 +00:00
Paul Banks 78c1528c48 cache: fix bug where TTLs were ignored leading to leaked memory in client agents (#9978)
* Fix bug in cache where TTLs are effectively ignored

This mostly affects streaming since streaming will immediately return from Fetch calls when the state is Closed on eviction which causes the race condition every time.

However this also affects all other cache types if the fetch call happens to return between the eviction and then next time around the Get loop by any client.

There is a separate bug that allows cache items to be evicted even when there are active clients which is the trigger here.

* Add changelog entry

* Update .changelog/9978.txt
2021-04-08 10:09:29 +00:00
R.B. Boyer 0efdb9f0b5
[1.9.x] command: when generating envoy bootstrap configs to stdout do not mix informational logs into the json (#9984)
Backport of #9980 to `1.9.x`

Conflicts:
- just the generated golden command/ files
2021-04-07 15:00:19 -05:00
R.B. Boyer 8df30a4ded
[1.9.x] api: ensure v1/health/ingress/:service endpoint works properly when streaming is enabled (#9968)
Backport of #9967 to 1.9.x
2021-04-05 13:23:15 -05:00
Mike Morris 830a70f3f4 changelog: fixup release-note formatting (#9960)
so these changelog entries will be parsed successfully
2021-04-01 14:32:56 +00:00
Daniel Nephin 5e3825d9a7 Merge pull request #9923 from hashicorp/dnephin/fix-ui-config
http: fix a bug that would cause runtimeConfig to be cached
2021-03-25 16:29:01 +00:00
John Cowen ec3ce63ed2 ui: Ensure intention form cancel button works (#9901)
* ui: Ensure intention form cancel button works

By adding `@action` decorators to the actions called form within the
template
2021-03-19 15:15:23 +00:00
John Cowen 1e7ebb0978 ui: CSP Improvements (#9847)
* Configure ember-auto-import so we can use a stricter CSP

* Create a fake filesystem using JSON to avoid inline scripts in index

We used to have inline scripts in index.html in order to support embers
filepath fingerprinting and our configurable rootURL.

Instead of using inline scripts we use application/json plus a JSON blob
to create a fake filesystem JSON blob/hash/map to hold all of the
rootURL'ed fingerprinted file paths which we can then retrive later in
non-inline scripts.

We move our inlined polyfills script into the init.js external script,
and we move the CodeMirror syntax highlighting configuration inline
script into the main app itself - into the already existing CodeMirror
initializer (this has been moved so we can lookup a service located
document using ember's DI container)

* Set a strict-ish CSP policy during development
2021-03-17 10:47:11 +00:00
Matt Keeler c2afc01702 AutopilotServerHealth now handles the 429 status code (#8599)
AutopilotServerHealthy now handles the 429 status code

Previously we would error out and not parse the response. Now either a 200 or 429 status code are considered expected statuses and will result in the method returning the reply allowing API consumers to not only see if the system is healthy or not but which server is unhealthy.
2021-03-12 14:41:25 +00:00
Daniel Nephin 7e663ef039 Merge pull request #9851 from panascais-forks/fix-wan-ipv6-key
Fix advertise_addr_wan_ipv6 configuration key
2021-03-10 16:59:23 +00:00
Daniel Nephin 30b4dd1bcf Merge pull request #9683 from hashicorp/dnephin/fix-zombie-service-dereg
local: use agent token to deregister services
2021-03-05 21:47:24 +00:00
John Cowen ef3f6d5e3f ui: Remove any trailing fullstop/period DNS characters from Gateways UI API (#9752)
Previous to this commit, the API response would include Gateway
Addresses in the form `domain.name.:8080`, which due to the addition of
the port is probably not the expected response.

This commit rightTrims any `.` characters from the end of the domain
before formatting the address to include the port resulting in
`domain.name:8080`
2021-02-25 09:36:37 +00:00
R.B. Boyer cbd3b98682 connect: if the token given to the vault provider returns no data avoid a panic (#9806)
Improves #9800
2021-02-22 20:09:21 +00:00
R.B. Boyer 0fa96a2fa8 xds: only try to create an ipv6 expose checks listener if ipv6 is supported by the kernel (#9765)
Fixes #9311

This only fails if the kernel has ipv6 hard-disabled. It is not sufficient to merely not provide an ipv6 address for a network interface.
2021-02-19 20:39:21 +00:00
Daniel Nephin 5a8fc428bd Merge pull request #9772 from hashicorp/streamin-fix-bad-cached-snapshot
streaming: fix snapshot cache bug
2021-02-16 20:28:33 +00:00
John Cowen ab4dfbd1e2 ui: [BUGFIX] Ensure we show the correct count of instances for each node (#9749)
* Add MeshServiceInstances property to node model

* Use MeshServiceInstances property

* Make sure we show the 'No * checks' if Checks.length is zero
2021-02-11 11:37:08 +00:00
John Cowen 16c74e4b10 ui: [BUGFIX] Replace all replaceAll with split.join for older browsers without replaceAll (#9715)
* ui: replace all `replaceAll` with split.join

* Use a div instead of fieldset for flex-box reasons
2021-02-11 09:50:23 +00:00
Chris Piraino db8cc8624b Log replication warnings when no error suppression is defined (#9320)
* Log replication warnings when no error suppression is defined

* Add changelog file
2021-02-10 23:32:04 +00:00
R.B. Boyer dd277b8ca8
connect: update supported envoy point releases to 1.16.2, 1.15.3, 1.14.6, 1.13.7 (#9737) (#9753) 2021-02-10 13:28:12 -06:00
R.B. Boyer 1b01d6f9f8
connect: connect CA Roots in the primary datacenter should use a SigningKeyID derived from their local intermediate (#9428) (#9733)
1.9.x backport of #9428
2021-02-09 16:55:11 -06:00
Matt Keeler 975c196f7c Stop background refresh of cached data for requests that result in ACL not found errors (#9738) 2021-02-09 15:16:35 +00:00
Freddy 760c28a2df Avoid potential proxycfg/xDS deadlock using non-blocking send 2021-02-08 23:18:32 +00:00
R.B. Boyer 17effdeb28 xds: prevent LDS flaps in mesh gateways due to unstable datacenter lists (#9651)
Also fix a similar issue in Terminating Gateways that was masked by an overzealous test.
2021-02-08 16:20:32 +00:00
R.B. Boyer cab795ecc3 xds: deduplicate mesh gateway listeners in a stable way (#9650)
In a situation where the mesh gateway is configured to bind to multiple
network interfaces, we use a feature called 'tagged addresses'.
Sometimes an address is duplicated across multiple tags such as 'lan'
and 'lan_ipv4'.

There is code to deduplicate these things when creating envoy listeners,
but that code doesn't ensure that the same tag wins every time. If the
winning tag flaps between xDS discovery requests it will cause the
listener to be drained and replaced.
2021-02-05 22:28:52 +00:00
John Cowen fa0edd2a2d chore: changelog for 9660 (#9668) 2021-01-29 16:09:14 +00:00
R.B. Boyer fa9b61ba15 server: use the presense of stored federation state data as a sign that we already activated the federation state feature flag (#9519)
This way we only have to wait for the serf barrier to pass once before
we can make use of federation state APIs Without this patch every
restart needs to re-compute the change.
2021-01-28 16:35:19 +00:00
Matt Keeler ab1e689c4a Upgrade raft-autopilot and wait for autopilot it to stop when revoking leadership (#9644)
Fixes: 9626
2021-01-27 16:15:37 +00:00
Hans Hasselberg a625d8f11b Add flags to support CA generation for Connect (#9585) 2021-01-27 07:55:24 +00:00
Matt Keeler a608eec72c Add changelog entry for change to the temporary client license duration (#9642) 2021-01-26 21:15:47 +00:00
R.B. Boyer f25a21960e server: initialize mgw-wanfed to use local gateways more on startup (#9528)
Fixes #9342
2021-01-25 23:31:21 +00:00
John Cowen 3ae91e064c ui: Search/filtering 'Filtered by:' search status (#9442)
Adds a 'status' for the filtering/searching in the UI, without this its not super clear that you are filtering a recordset due to the menu selections being hidden once closed. You can also use the pills in this status view to delete individual filters.
2021-01-25 18:16:09 +00:00
R.B. Boyer 30c3af893a server: add OSS stubs supporting validation of source namespaces in service-intentions config entries (#9527) 2021-01-25 17:28:19 +00:00
R.B. Boyer 5fe99cc2bd server: when wan federating via mesh gateways only do heuristic primary DC bypass on the leader (#9366)
Fixes #9341
2021-01-22 16:07:06 +00:00
John Cowen cdb1730a21 Fix -ui-content-path without regex (#9569)
* Add templating to inject JSON into an application/json script tag

Plus an external script in order to pick it out and inject the values we
need injecting into ember's environment meta tag.

The UI still uses env style naming (CONSUL_*) but we uses the new style
JSON/golang props behind the scenes.

Co-authored-by: Paul Banks <banks@banksco.de>
2021-01-20 18:48:32 +00:00
John Cowen 4ddbe1830b ui: Changelog for #9593 (#9598) 2021-01-20 18:19:20 +00:00
Kenia 7abb8697f9 ui: Removing formatting to display LockDelay in nanoseconds (#9594)
* Removing formatting to display LockDelay in nanoseconds

* Update test

* Add changelog
2021-01-20 17:04:29 +00:00
John Cowen 56910c1be2 chore: Changelog entry for #9524 (#9595) 2021-01-20 15:45:29 +00:00
Freddy f2cfbde1b0 Update topology mapping Refs on all proxy instance deletions (#9589)
* Insert new upstream/downstream mapping to persist new Refs

* Avoid upserting mapping copy if it's a no-op

* Add test with panic repro

* Avoid deleting up/downstreams from inside memdb iterator

* Avoid deleting gateway mappings from inside memdb iterator

* Add CHANGELOG entry

* Tweak changelog entry

Co-authored-by: Paul Banks <banks@banksco.de>
2021-01-20 15:18:09 +00:00
Matt Keeler 5f3a185cb0 Merge pull request #9570 from hashicorp/bugfix/9498 2021-01-19 21:30:47 +00:00
John Cowen eb8126c895 ui: Topology intention saving improvements (#9513)
* ui: Keep track of existing intentions and use those to save changes

Previously we risked overwriting existing data in an intention if we
tried to save an intention without having loaded it first, for example
Description and Metadata would have been overwritten.

This change loads in all the intentions for an origin service so we can
pick off the one we need to save and change to ensure that we don't
overwrite any existing data.
2021-01-19 15:41:20 +00:00
Chris Piraino db3400c22d Fix bug in usage metrics when multiple service instances are changed in a single transaction (#9440)
* Fix bug in usage metrics that caused a negative count to occur

There were a couple of instances were usage metrics would do the wrong
thing and result in incorrect counts, causing the count to attempt to
decrement below zero and return an error. The usage metrics did not
account for various places where a single transaction could
delete/update/add multiple service instances at once.

We also remove the error when attempting to decrement below zero, and
instead just make sure we do not accidentally underflow the unsigned
integer. This is a more graceful failure than returning an error and not
allowing a transaction to commit.

* Add changelog
2021-01-12 21:32:29 +00:00
Michael Hofer 9ade056d98 cli: Add consul intention list command (based on PR #6825) (#9468)
This PR is based on the previous work by @snuggie12 in PR #6825. It adds the command consul intention list to list all available intentions. The list functionality for intentions seems a bit overdue as it's just very handy. The web UI cannot list intentions outside of the default namespace, and using the API is sometimes not the friendliest option. ;)

I cherry picked snuggie12's commits who did most of the heavy lifting (thanks again @snuggie12 for your great work!). The changes in the original commit mostly still worked on the current HEAD. On top of that I added support for namespaces and fixed the docs as they are managed differently today. Also the requested changes related to the "Connect" references in the original PRs have been addressed.

Fixes #5652

Co-authored-by: Matt Hoey <mhoey05@jcu.edu>
2021-01-12 20:15:29 +00:00
Pierre Souchay 2f80430304 Display a warning when rpc.enable_streaming = true is set on a client (#9530)
* Display a warning when rpc.enable_streaming = true is set on a client

This option has no effect when running as an agent

* Added warning when server starts with use_streaming_backend but without rpc.enable_streaming

* Added unit test
2021-01-08 20:23:58 +00:00
John Cowen e494019034 chore: Adds changelog entry for accessibility improvements (#9509) 2021-01-08 18:20:40 +00:00