Add last remote WAL bits

logical/request.go

@@ -84,6 +84,10 @@ type Request struct {
 
 	// WrapInfo contains requested response wrapping parameters
 	WrapInfo *RequestWrapInfo `json:"wrap_info" structs:"wrap_info" mapstructure:"wrap_info"`
+
+	// For replication, contains the last WAL on the remote side after handling
+	// the request, used for best-effort avoidance of stale read-after-write
+	lastRemoteWAL uint64
 }
 
 // Get returns a data field and guards for nil Data
@@ -105,6 +109,14 @@ func (r *Request) GoString() string {
 	return fmt.Sprintf("*%#v", *r)
 }
 
+func (r *Request) LastRemoteWAL() uint64 {
+	return r.lastRemoteWAL
+}
+
+func (r *Request) SetLastRemoteWAL(last uint64) {
+	r.lastRemoteWAL = last
+}
+
 // RenewRequest creates the structure of the renew request.
 func RenewRequest(
 	path string, secret *Secret, data map[string]interface{}) *Request {

vault/core.go

@@ -91,6 +91,7 @@ var (
 	enterprisePreSeal    = enterprisePreSealImpl
 	startReplication     = startReplicationImpl
 	stopReplication      = stopReplicationImpl
+	LastRemoteWAL        = lastRemoteWALImpl
 )
 
 // ReloadFunc are functions that are called when a reload is requested.
@@ -1732,3 +1733,7 @@ func (c *Core) BarrierKeyLength() (min, max int) {
 func (c *Core) AuditedHeadersConfig() *AuditedHeadersConfig {
 	return c.auditedHeaders
 }
+
+func (c *Core) lastRemoteWALImpl() uint64 {
+	return 0
+}

vault/router.go

@@ -306,6 +306,9 @@ func (r *Router) routeCommon(req *logical.Request, existenceCheck bool) (*logica
 		req.ClientToken = clientToken
 		req.WrapInfo = wrapInfo
 		req.Headers = headers
+		// This is only set in one place, after routing, so should never be set
+		// by a backend
+		req.SetLastRemoteWAL(0)
 	}()
 
 	// Invoke the backend