Commit Graph

1341 Commits

Author SHA1 Message Date
Dhia Ayachi fe820d561a
Upgrade ubi image to 9.4 (#21750)
* upgrade go to 1.23.1, upgrade ubi image to 9.4

* add changelog

* revert go version upgrade
2024-09-17 11:48:02 -04:00
Phil Renaud d315ff1df8
[ui] Pin ansi-html to 0.0.8 (#21735)
Pin ansi-html to 0.0.8
2024-09-16 11:22:00 -04:00
Phil Renaud f924a017b2
[ui] Codemirror resolution pinned in package.json (#21715)
Codemirror pinned
2024-09-13 20:32:02 +00:00
Michael Zalimeni c40eecf8f9
security: update alpine base image to 3.20 (#21729)
* security: update alpine base image to 3.20

* security: update scan config to remove old triage exceptions
2024-09-13 19:02:11 +00:00
Phil Renaud de281cbfb7
[ui] codemirror lint removal (#21726)
* ui: remove json linting dependency

* Remove modes from codemirror change hooks

* Modes and line numbers re-added, linting still removed, old underscore removed

* Changelog added

---------

Co-authored-by: dduzgun-security <deniz.duzgun@hashicorp.com>
2024-09-13 13:59:40 -04:00
Phil Renaud 9bab2ed939
[ui] Markdown-it pinned (#21717)
Markdown-it pinned
2024-09-12 18:15:12 -04:00
Phil Renaud 0cc0fa7188
[ui] Simple url sanitization for get-env and document.cookie (#21711)
Simple url sanitization for get-env and document.cookie
2024-09-12 12:27:22 -04:00
John Maguire a3ac555a5e
[NET-10952] fix cluster dns lookup family to gracefully handle ipv6 (#21703)
* update jwks cluster creation to gracefully handle ipv6

* update unit tests for dns lookup family

* Add changelog
2024-09-12 15:37:36 +00:00
sarahalsmiller 320b708b9f
Bump Envoy, remove support for unsupported versions (#21616)
* bump envoy

* changelog

* drop breaking change note

* update docs

* udpate port tests
2024-09-12 15:32:18 +00:00
Phil Renaud 35ffb312b0
[ui] Pin a newer version of Braces (#21710)
Pin a newer version of Braces
2024-09-11 16:24:58 -04:00
sarahalsmiller 07fae7bb0b
[Security] Fix XSS Vulnerability where content-type header wasn't explicitly set (#21704)
* explicitly add content-type anywhere possible and add middleware to set and warn

* added tests, fixed typo

* clean up unused constants

* changelog

* fix call order in middleware
2024-09-11 14:23:21 -05:00
Anita Akaeze 7653ffb0a5
security: Upgrade Go to 1.22.7 (#21705)
* security: Upgrade Go to 1.22.7

* add changelog
2024-09-10 15:07:05 -07:00
R.B. Boyer 3e6f1c1fe1
remove v2 tenancy, catalog, and mesh (#21592)
* remove v2 tenancy, catalog, and mesh

- Inline the v2tenancy experiment to false

- Inline the resource-apis experiment to false

- Inline the hcp-v2-resource-apis experiment to false

- Remove ACL policy templates and rule language changes related to
  workload identities (a v2-only concept) (e.g. identity and
  identity_prefix)

- Update the gRPC endpoint used by consul-dataplane to no longer respond
  specially for v2

- Remove stray v2 references scattered throughout the DNS v1.5 newer
  implementation.

* changelog

* go mod tidy on consul containers

* lint fixes from ENT

---------

Co-authored-by: John Murret <john.murret@hashicorp.com>
2024-09-05 08:50:46 -06:00
Deniz Onur Duzgun 64683180f3
security(deps): bump aws-sdk-go to v1.55.5 (#21684)
* security(deps): bump aws-sdk-go to v1.55.5

* add changelog

* edit changelog
2024-08-29 17:04:51 +00:00
Nitya Dhanushkodi ed738a6f98
fix: use Envoy's default for validate_clusters to fix breaking routes when some backend clusters don't exist (#21587) 2024-08-19 22:39:28 -07:00
John Maguire 1fa428552b
[NET-10719] Fix cluster generation for jwt clusters for external jwt providers (#21604)
* Fix cluster generation for jwt clusters for external jwt providers

* add changelog
2024-08-14 15:41:02 -04:00
sarahalsmiller 929d602dbb
ui: Upgrade d3 packages to update color dependency (#21588)
* upgrade d3 packages to update color dependency

* yarn package bump

* deps moved into devdeps

---------

Co-authored-by: Phil Renaud <phil@riotindustries.com>
2024-08-12 09:52:16 -04:00
John Maguire c0faddbe1f
[NET-10246] use correct enterprise meta for service name for LinkedService (#21382)
* use correct enterprise meta for service name for LinkedService

* add changelog
2024-07-10 10:55:53 -04:00
Nathan Coleman 8d2370da76
[NET-10290] Update ENVOY_VERSIONS (#21524)
* [NET-10290] Update ENVOY_VERSIONS

* Add changelog entry

* Link to CVE for more info in changelog entry

Co-authored-by: Deniz Onur Duzgun <59659739+dduzgun-security@users.noreply.github.com>

---------

Co-authored-by: Deniz Onur Duzgun <59659739+dduzgun-security@users.noreply.github.com>
2024-07-08 18:59:51 -04:00
Phil Renaud dce6241869
[ui] File-specified deps for consul-ui (#21378)
* Namespaced and file-specified deps

* Pinning to a specific version of tailwind and setting config for js packages to come from npmjs

* Pin glob instead of reverting tailwind or any other (grand)parent dependency

* ember-cli-build fixed path resolution for now-namespaced submodules

* Dropping the namespace prefix and relying on relative pathing
2024-07-08 16:36:29 -04:00
Dan Stough a251f8ad80
fix(dns): spam ttl logs for prepared queries (#21381) 2024-07-08 10:34:00 -04:00
Dan Stough 763cd0bffb
fix(txn): validate verbs (#21519)
* fix(txn): validate verbs

* changelog
2024-07-05 14:51:20 -04:00
sarahalsmiller f3649e16a7
NET-10288-Bump-go-to-resolve-CVE-2024-24791 (#21507)
* bump go version

* changelog

* Update .changelog/21507.txt

* Update go.mod

Co-authored-by: Deniz Onur Duzgun <59659739+dduzgun-security@users.noreply.github.com>

* go mod tidy

---------

Co-authored-by: Deniz Onur Duzgun <59659739+dduzgun-security@users.noreply.github.com>
2024-07-03 12:47:20 -05:00
sarahalsmiller 6f31bfebbe
Update retryable-http-client to resolve CVE-2024-6104 (#21384)
* update retryable-http-client

* changelog
2024-07-02 10:12:13 -05:00
Dan Stough a4a3aec567
fix(dns): bug with standard lookup tags not working; SRV questions returning duplicate hostnames (#21361) 2024-06-25 13:42:25 -04:00
sarahalsmiller c18c911ac8
[Security] Close cross scripting vulnerability (#21342)
* close vulnerability

* add changelog
2024-06-17 13:54:37 -04:00
Deniz Onur Duzgun 7a19d2e7a4
security: fix AliasCheck panic (#21339)
* security: fix AliasCheck panic

* add changelog
2024-06-14 11:03:10 -04:00
sarahalsmiller 2cdc387bd3
Bump Envoy Versions (#21277)
* update envoy versions

* add changelog

* update nightly integrations
2024-06-10 15:29:26 +00:00
Dhia Ayachi 2631ec843a
update go version to 1.22.4 (#21265)
* update go version to 1.22.4

* add changelog
2024-06-06 10:46:05 -04:00
Deniz Onur Duzgun 68a7648d14
security: resolve incorrect type conversions (#21251)
* security: resolve incorrect type conversions

* add changelog

* fix more incorrect type conversions
2024-06-04 21:55:53 +00:00
John Murret 11bcf521ae
dns v2 - both empty string and default should be allowed for namespace and partition in CE (#21230)
* dns v2 - both empty string and default should be allowed for namespace and partition in Ce

* add changelog

* use default partition constant

* use constants in validation.

---------

Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
2024-05-28 16:20:59 -06:00
Dan Stough cf1c030043
feat: update supported envoy to 1.29 (#21142) 2024-05-24 13:26:07 -04:00
Dhia Ayachi 1f4caaedf2
upgrade deep-copy version, upgrade go to 1.22.3 (#21113)
* upgrade deep-copy version, upgrade go to 1.22.3

* add changelog
2024-05-16 13:40:15 -04:00
Michael Zalimeni f56405e745
security: Upgrade Go to 1.21.10 (#21074)
This resolves CVE-2024-24787 and CVE-2024-24788.
2024-05-09 11:11:01 -04:00
Michael Zalimeni 86b0818c1f
[NET-8601] security: upgrade vault/api to remove go-jose.v2 (#20910)
security: upgrade vault/api to remove go-jose.v2

This dependency has an open vulnerability (GO-2024-2631), and is no
longer needed by the latest `vault/api`. This is a follow-up to the
upgrade of `go-jose/v3` in this repository to make all our dependencies
consolidate on v3.

Also remove the recently added security scan triage block for
GO-2024-2631, which was added due to incorrect reports that
`go-jose/v3@3.0.3` was impacted; in reality, is was this indirect
client dependency (not impacted by CVE) that the scanner was flagging. A
bug report has been filed to address the incorrect reporting.
2024-05-04 00:18:51 +00:00
Deniz Onur Duzgun 3a6f2fba18
security: bump envoy version and k8s.io/apimachinery (#21017)
* security: bump envoy version

* add changelog
2024-05-02 13:36:02 -04:00
Dan Stough 03ab7367a6
feat(dataplane): allow token and tenancy information for proxied DNS (#20899)
* feat(dataplane): allow token and tenancy information for proxied DNS

* changelog
2024-04-22 14:30:43 -04:00
sarahalsmiller 08761f16c8
Net 6820 customize mesh gateway limits (#20945)
* add upstream limits to mesh gateway cluster generation

* changelog

* go mod tidy

* readd changelog data

* undo reversion from rebase

* run codegen

* Update .changelog/20945.txt

Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>

* address notes

* gofmt

* clean up

* gofmt

* Update agent/proxycfg/mesh_gateway.go

* gofmt

* nil check

---------

Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
2024-04-16 10:59:41 -05:00
Nathan Coleman 5e9f02d4be
[NET-8091] Add file-system-certificate config entry for API gateway (#20873)
* Define file-system-certificate config entry

* Collect file-system-certificate(s) referenced by api-gateway onto snapshot

* Add file-system-certificate to config entry kind allow lists

* Remove inapplicable validation

This validation makes sense for inline certificates since Consul server is holding the certificate; however, for file system certificates, Consul server never actually sees the certificate.

* Support file-system-certificate as source for listener TLS certificate

* Add more required mappings for the new config entry type

* Construct proper TLS context based on certificate kind

* Add support or SDS in xdscommon

* Remove unused param

* Adds back verification of certs for inline-certificates

* Undo tangential changes to TLS config consumption

* Remove stray curly braces

* Undo some more tangential changes

* Improve function name for generating API gateway secrets

* Add changelog entry

* Update .changelog/20873.txt

Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>

* Add some nil-checking, remove outdated TODO

* Update test assertions to include file-system-certificate

* Add documentation for file-system-certificate config entry

Add new doc to nav

* Fix grammar mistake

* Rename watchmaps, remove outdated TODO

---------

Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com>
Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>
2024-04-15 16:45:05 -04:00
Michael Zalimeni a8d08e759f
fix: consume ignored entries in CE downgrade via Ent snapshot (#20977)
This operation would previously fail due to unconsumed bytes in the
decoder buffer when reading the Ent snapshot (the first byte of the
record would be misinterpreted as a type indicator, and the remaining
bytes would fail to be deserialized or read as invalid data).

Ensure restore succeeds by decoding the ignored record as an
interface{}, which will consume the record bytes without requiring a
concrete target struct, then moving on to the next record.
2024-04-11 21:08:44 +00:00
Eric Haberkorn e231f0ee9b
Add an agent config option to diable per tenancy usage metrics. (#20976) 2024-04-11 15:20:09 -04:00
John Murret d261a987f1
update go-control-plane envoy dependency to 0.12.0 (#20973)
* update go-control-plane envoy dependency to 0.12.0

* add changelog

* go mod tidy

* fix linting issues

* add agent/grpc-internal to the list of SA1019 ignores
2024-04-10 01:23:04 +00:00
Deniz Onur Duzgun 3152ac3702
security: bump go, x/net and envoy versions (#20956)
* Bump go version

* Bump x/net

* Bump envoy version

* Add changelog

---------

Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
2024-04-08 19:18:40 +00:00
Nathan Coleman 9af713ff17
[NET-5772] Make tcp external service registered on terminating gw reachable from peered cluster (#19881)
* Include SNI + root PEMs from peered cluster on terminating gw filter chain

This allows an external service registered on a terminating gateway to be exported to and reachable from a peered cluster

* Abstract existing logic into re-usable function

* Regenerate golden files w/ new listener logic

* Add changelog entry

* Use peering bundles that are stable across test runs
2024-04-03 12:38:09 -04:00
John Murret 39112c7a98
GH-20889 - put conditionals are hcp initialization for consul server (#20926)
* put conditionals are hcp initialization for consul server

* put more things behind configuration flags

* add changelog

* TestServer_hcpManager

* fix TestAgent_scadaProvider
2024-03-28 14:47:11 -06:00
David Yu 4259b7b33c
Update Dockerfile: bump alpine (#20897)
* Update Dockerfile: bump alpine

* Create 20897

* Rename 20897 to 20897.txt
2024-03-27 14:43:14 -07:00
Dan Stough 6026ada0c9
[CE] feat(v2dns): enable v2 dns as default (#20715)
* feat(v2dns): enable v2 dns as default

* changelog
2024-03-25 16:09:01 -04:00
Iryna Shustava d747b51dab
Handle ACL errors consistently when blocking query timeout is reached. (#20876)
Currently, when a client starts a blocking query and an ACL token expires within
that time, Consul will return ACL not found error with a 403 status code. However,
sometimes if an ACL token is invalidated at the same time as the query's deadline is reached,
Consul will instead return an empty response with a 200 status code.

This is because of the events being executed.
1. Client issues a blocking query request with timeout `t`.
2. ACL is deleted.
3. Server detects a change in ACLs and force closes the gRPC stream.
4. Client resubscribes with the same token and resets its state (view).
5. Client sees "ACL not found" error.

If ACL is deleted before step 4, the client is unaware that the stream was closed due to
an ACL error and will return an empty view (from the reset state) with the 200 status code.

To fix this problem, we introduce another state to the subsciption to indicate when a change
to ACLs has occured. If the server sees that there was an error due to ACL change, it will
re-authenticate the request and return an error if the token is no longer valid.

Fixes #20790
2024-03-22 14:59:54 -06:00
Derek Menteer ac83ac1343
Fix streaming RPCs for agentless. (#20868)
* Fix streaming RPCs for agentless.

This PR fixes an issue where cross-dc RPCs were unable to utilize
the streaming backend due to having the node name set. The result
of this was the agent-cache being utilized, which would cause high
cpu utilization and memory consumption due to the fact that it
keeps queries alive for 72 hours before purging inactive entries.

This resource consumption is compounded by the fact that each pod
in consul-k8s gets a unique token. Since the agent-cache uses the
token as a component of the key, the same query is duplicated for
each pod that is deployed.

* Add changelog.
2024-03-15 14:44:51 -05:00
Derek Menteer 0ac8ae6c3b
Fix xDS deadlock due to syncLoop termination. (#20867)
* Fix xDS deadlock due to syncLoop termination.

This fixes an issue where agentless xDS streams can deadlock permanently until
a server is restarted. When this issue occurs, no new proxies are able to
successfully connect to the server.

Effectively, the trigger for this deadlock stems from the following return
statement:
https://github.com/hashicorp/consul/blob/v1.18.0/agent/proxycfg-sources/catalog/config_source.go#L199-L202

When this happens, the entire `syncLoop()` terminates and stops consuming from
the following channel:
https://github.com/hashicorp/consul/blob/v1.18.0/agent/proxycfg-sources/catalog/config_source.go#L182-L192

Which results in the `ConfigSource.cleanup()` function never receiving a
response and holding a mutex indefinitely:
https://github.com/hashicorp/consul/blob/v1.18.0/agent/proxycfg-sources/catalog/config_source.go#L241-L247

Because this mutex is shared, it effectively deadlocks the server's ability to
process new xDS streams.

----

The fix to this issue involves removing the `chan chan struct{}` used like an
RPC-over-channels pattern and replacing it with two distinct channels:

+ `stopSyncLoopCh` - indicates that the `syncLoop()` should terminate soon.  +
`syncLoopDoneCh` - indicates that the `syncLoop()` has terminated.

Splitting these two concepts out and deferring a `close(syncLoopDoneCh)` in the
`syncLoop()` function ensures that the deadlock above should no longer occur.

We also now evict xDS connections of all proxies for the corresponding
`syncLoop()` whenever it encounters an irrecoverable error. This is done by
hoisting the new `syncLoopDoneCh` upwards so that it's visible to the xDS delta
processing. Prior to this fix, the behavior was to simply orphan them so they
would never receive catalog-registration or service-defaults updates.

* Add changelog.
2024-03-15 13:57:11 -05:00