scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-10-30 18:17:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

TCP Listener: fix bug in parsing TCP listener settings for proxy_protocol_behavior (#27459)

Browse Source 
* update code and test to support the documented config setting 'deny_unauthorized' rather than 'deny_authorized' which was incorrect

* changelog
This commit is contained in:
Peter Wilson
2024-06-12 16:30:19 +01:00
committed by GitHub
parent 2db5d6aa54
commit 12e7c77ecc
3 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
changelog/27459.txt Normal file
View File

@@ -0,0 +1,4 @@
```release-note:bug
config: Vault TCP listener config now correctly supports the documented proxy_protocol_behavior
setting of 'deny_unauthorized'
```

4
internalshared/configutil/listener.go
View File

@@ -562,9 +562,9 @@ func (l *Listener) parseProxySettings() error {
// Validation/sanity check on allowed settings for behavior. // Validation/sanity check on allowed settings for behavior.
switch l.ProxyProtocolBehavior { switch l.ProxyProtocolBehavior {
case "allow_authorized", "deny_authorized", "use_always", "": case "allow_authorized", "deny_unauthorized", "use_always", "":
// Ignore these cases, they're all valid values. // Ignore these cases, they're all valid values.
// In the case of 'allow_authorized' and 'deny_authorized', we don't need // In the case of 'allow_authorized' and 'deny_unauthorized', we don't need
// to check how many addresses we have in ProxyProtocolAuthorizedAddrs // to check how many addresses we have in ProxyProtocolAuthorizedAddrs
// as parseutil.ParseAddrs returns "one or more addresses" (or an error) // as parseutil.ParseAddrs returns "one or more addresses" (or an error)
// so we'd have returned earlier. // so we'd have returned earlier.

2
internalshared/configutil/listener_test.go
View File

@@ -529,7 +529,7 @@ func TestListener_parseProxySettings(t *testing.T) {
"behavior-deny": { "behavior-deny": {
rawProxyProtocolAuthorizedAddrs: "10.0.0.1,10.0.2.1", rawProxyProtocolAuthorizedAddrs: "10.0.0.1,10.0.2.1",
expectedNumAddrs: 2, expectedNumAddrs: 2,
proxyBehavior: "deny_authorized", proxyBehavior: "deny_unauthorized",
isErrorExpected: false, isErrorExpected: false,
}, },
} }