Backport of VAULT-6803: fix listener issue if using proxy_protocol_behavior with deny_unauthorized for untrusted upstream connections into release/1.17.x#27608
Merged
peteski22 merged 2 commits intorelease/1.17.xfrom Jun 26, 2024
Conversation
hc-github-team-secure-vault-core
force-pushed
the
backport/peteski22/VAULT-6803/listener-proxy-behavior-bug-allow-deny/adversely-growing-insect
branch
from
5f44de7 to
a4a1a8e
Compare
github-actions
bot
added
the
hashicorp-contributed-pr
|
CI Results: |
|
Build Results: |
peteski22
approved these changes
Jun 26, 2024
peteski22
deleted the
backport/peteski22/VAULT-6803/listener-proxy-behavior-bug-allow-deny/adversely-growing-insect
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport
This PR is auto-generated from #27589 to be assessed for backporting due to the inclusion of the label backport/1.17.x.
The below text is copied from the body of the original PR.
Description
This PR corrects an issue introduced when supported was added for
PROXY v2on TCP listeners usingproxy_protocol_behavior.This issue was introduced in Vault
v1.10.0and has impacted all subsequent versions other thanv1.16.x(due to a bug parsing this config setting).Any listener configured to
deny_unauthorizedwill still close a connection when the upstream proxy is untrusted, but it will now continue to listen for connections until a valid one is found. It does this by returningErrInvalidUpstreamto the proxy library.NOTE: the issue is only present if this config setting
proxy_protocol_behavioris enabled and set todeny_unauthorized.HashiCorp checklist
getting backported to N-2, use the new style
backport/ent/x.x.x+entlabelsinstead of the old style
backport/x.x.xlabels.the normal
backport/x.x.xlabel (there should be only 1).ENT Breakage: If this PR either 1) removes a public function OR 2) changes the signatureof a public function, even if that change is in a CE file, double check that
applying the patch for this PR to the ENT repo and running tests doesn't
break any tests. Sometimes ENT only tests rely on public functions in CE
files.
in the PR description, commit message, or branch name.
RFC: If this change has an associated RFC, please link it in the description.ENT PR: If this change has an associated ENT PR, please link it in thedescription. Also, make sure the changelog is in this PR, not in your ENT PR.
Overview of commits