Merge remote-tracking branch 'origin/master' into node_health_should_…

…change_service_index

CHANGELOG.md

@@ -5,6 +5,7 @@ IMPROVEMENTS:
 * agent: Blocking queries on service-specific health and catalog endpoints now return a per-service `X-Consul-Index` improving watch performance on very busy clusters. [[GH-3890](https://github.com/hashicorp/consul/issues/3890)]. **Note this may break blocking clients that relied on undocumented implementation details** as noted in the [upgrade docs](https://github.com/hashicorp/consul/blob/master/website/source/docs/upgrading.html.md#upgrade-from-version-106-to-higher).
 * agent: All endpoints now respond to OPTIONS requests. [[GH-3885](https://github.com/hashicorp/consul/issues/3885)]
 * dns: Introduced a new config param to limit the number of A/AAAA records returned. [[GH-3940](https://github.com/hashicorp/consul/issues/3940)]
+* agent: supported TLS cipher suites updated to include newer options, [[GH-3962](https://github.com/hashicorp/consul/pull/3962)]
 
 BUG FIXES:
 

INTERNALS.md

@@ -38,7 +38,7 @@ The components in this section are only used by Consul servers.
 | --------- | -------- |
 | [agent/consul](https://github.com/hashicorp/consul/tree/master/agent/consul) | This is where the Consul server object is defined, and the top-level `consul` package has all of the functionality that's used by server agents. This includes things like the internal RPC endpoints. |
 | [agent/consul/fsm](https://github.com/hashicorp/consul/tree/master/agent/consul/fsm), [agent/consul/state](https://github.com/hashicorp/consul/tree/master/agent/consul/state) | These components make up Consul's finite state machine (updated by the Raft consensus algorithm) and backed by the state store (based on immutable radix trees). All updates of Consul's consistent state is handled by the finite state machine, and all read queries to the Consul servers are serviced by the state store's data structures. |
-| [agent/consul/autopulot](https://github.com/hashicorp/consul/tree/master/agent/consul/autopilot) | This contains a package of functions that provide Consul's [Autopilot](https://www.consul.io/docs/guides/autopilot.html) features. |
+| [agent/consul/autopilot](https://github.com/hashicorp/consul/tree/master/agent/consul/autopilot) | This contains a package of functions that provide Consul's [Autopilot](https://www.consul.io/docs/guides/autopilot.html) features. |
 
 ### Other Components
 

acl/acl.go

@@ -96,7 +96,7 @@ type ACL interface {
 	// functions can be used.
 	OperatorWrite() bool
 
-	// PrepardQueryRead determines if a specific prepared query can be read
+	// PreparedQueryRead determines if a specific prepared query can be read
 	// to show its contents (this is not used for execution).
 	PreparedQueryRead(string) bool
 

acl/errors.go

@@ -37,7 +37,7 @@ func IsErrNotFound(err error) bool {
 	return err != nil && strings.Contains(err.Error(), errNotFound)
 }
 
-// IsErrRootDenied checks if the given error messge is comparable to
+// IsErrRootDenied checks if the given error message is comparable to
 // ErrRootDenied.
 func IsErrRootDenied(err error) bool {
 	return err != nil && strings.Contains(err.Error(), errRootDenied)

agent/ae/ae.go

@@ -47,7 +47,7 @@ type SyncState interface {
 // The state is synchronized on a regular basis or on demand when either
 // the state has changed or a new Consul server has joined the cluster.
 //
-// The regular state sychronization provides a self-healing mechanism
+// The regular state synchronization provides a self-healing mechanism
 // for the cluster which is also called anti-entropy.
 type StateSyncer struct {
 	// State contains the data that needs to be synchronized.

agent/agent.go

@@ -1204,7 +1204,7 @@ func (a *Agent) ShutdownAgent() error {
 }
 
 // ShutdownEndpoints terminates the HTTP and DNS servers. Should be
-// preceeded by ShutdownAgent.
+// preceded by ShutdownAgent.
 func (a *Agent) ShutdownEndpoints() {
 	a.shutdownLock.Lock()
 	defer a.shutdownLock.Unlock()
@@ -1400,7 +1400,7 @@ func (a *Agent) reapServicesInternal() {
 		}
 
 		// See if there's a timeout.
-		// todo(fs): this looks fishy... why is there anoter data structure in the agent with its own lock?
+		// todo(fs): this looks fishy... why is there another data structure in the agent with its own lock?
 		a.checkLock.Lock()
 		timeout := a.checkReapAfter[checkID]
 		a.checkLock.Unlock()

agent/agent_endpoint.go

@@ -506,7 +506,7 @@ func (s *HTTPServer) AgentRegisterService(resp http.ResponseWriter, req *http.Re
 	}
 
 	// Check the service address here and in the catalog RPC endpoint
-	// since service registration isn't sychronous.
+	// since service registration isn't synchronous.
 	if ipaddr.IsAny(args.Address) {
 		resp.WriteHeader(http.StatusBadRequest)
 		fmt.Fprintf(resp, "Invalid service address")

agent/agent_endpoint_test.go

@@ -1228,7 +1228,7 @@ func TestAgent_RegisterService(t *testing.T) {
 		t.Fatalf("bad: %v", obj)
 	}
 
-	// Ensure the servie
+	// Ensure the service
 	if _, ok := a.State.Services()["test"]; !ok {
 		t.Fatalf("missing test service")
 	}

agent/config/builder.go

@@ -1163,7 +1163,7 @@ func (b *Builder) expandFirstAddr(name string, s *string) net.Addr {
 	return addrs[0]
 }
 
-// expandFirstIP exapnds the go-sockaddr template in s and returns the
+// expandFirstIP expands the go-sockaddr template in s and returns the
 // first address if it is not a unix socket address. If the template
 // expands to multiple addresses an error is set and nil is returned.
 func (b *Builder) expandFirstIP(name string, s *string) *net.IPAddr {

agent/config/runtime.go

@@ -181,7 +181,7 @@ type RuntimeConfig struct {
 	// AutopilotUpgradeVersionTag is the node tag to use for version info when
 	// performing upgrade migrations. If left blank, the Consul version will be used.
 	//
-	// (Entrprise-only)
+	// (Enterprise-only)
 	//
 	// hcl: autopilot { upgrade_version_tag = string }
 	AutopilotUpgradeVersionTag string
@@ -322,7 +322,7 @@ type RuntimeConfig struct {
 	// metric management is enabled.
 	// Default: none
 	//
-	// hcl: telemetry { circonous_api_token = string }
+	// hcl: telemetry { circonus_api_token = string }
 	TelemetryCirconusAPIToken string
 
 	// TelemetryCirconusAPIURL is the base URL to use for contacting the Circonus API.
@@ -359,7 +359,7 @@ type RuntimeConfig struct {
 
 	// TelemetryCirconusCheckForceMetricActivation will force enabling metrics, as they are encountered,
 	// if the metric already exists and is NOT active. If check management is enabled, the default
-	// behavior is to add new metrics as they are encoutered. If the metric already exists in the
+	// behavior is to add new metrics as they are encountered. If the metric already exists in the
 	// check, it will *NOT* be activated. This setting overrides that behavior.
 	// Default: "false"
 	//
@@ -1060,7 +1060,7 @@ type RuntimeConfig struct {
 	//     name = string
 	//     tags = []string
 	//     address = string
-	//     check = { check definiton }
+	//     check = { check definition }
 	//     checks = [ { check definition}, ... ]
 	//     token = string
 	//     enable_tag_override = (true|false)
@@ -1107,23 +1107,28 @@ type RuntimeConfig struct {
 	//
 	// The values should be a list of the following values:
 	//
-	//   TLS_RSA_WITH_RC4_128_SHA
-	//   TLS_RSA_WITH_3DES_EDE_CBC_SHA
-	//   TLS_RSA_WITH_AES_128_CBC_SHA
-	//   TLS_RSA_WITH_AES_256_CBC_SHA
-	//   TLS_RSA_WITH_AES_128_GCM_SHA256
-	//   TLS_RSA_WITH_AES_256_GCM_SHA384
-	//   TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
-	//   TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
-	//   TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
-	//   TLS_ECDHE_RSA_WITH_RC4_128_SHA
-	//   TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
-	//   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
-	//   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+	//   TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+	//   TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
 	//   TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 	//   TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
 	//   TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 	//   TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+	//   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+	//   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+	//   TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
+	//   TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
+	//   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+	//   TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
+	//   TLS_RSA_WITH_AES_128_GCM_SHA256
+	//   TLS_RSA_WITH_AES_256_GCM_SHA384
+	//   TLS_RSA_WITH_AES_128_CBC_SHA256
+	//   TLS_RSA_WITH_AES_128_CBC_SHA
+	//   TLS_RSA_WITH_AES_256_CBC_SHA
+	//   TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
+	//   TLS_RSA_WITH_3DES_EDE_CBC_SHA
+	//   TLS_RSA_WITH_RC4_128_SHA
+	//   TLS_ECDHE_RSA_WITH_RC4_128_SHA
+	//   TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
 	//
 	// todo(fs): IMHO, we should also support the raw 0xNNNN values from
 	// todo(fs): https://golang.org/pkg/crypto/tls/#pkg-constants

agent/config/runtime_test.go

@@ -2581,7 +2581,7 @@ func TestFullConfig(t *testing.T) {
 				"statsd_address": "drce87cy",
 				"statsite_address": "HpFwKB8R"
 			},
-			"tls_cipher_suites": "TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+			"tls_cipher_suites": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
 			"tls_min_version": "pAOWafkR",
 			"tls_prefer_server_cipher_suites": true,
 			"translate_wan_addrs": true,
@@ -3017,7 +3017,7 @@ func TestFullConfig(t *testing.T) {
 				statsd_address = "drce87cy"
 				statsite_address = "HpFwKB8R"
 			}
-			tls_cipher_suites = "TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA"
+			tls_cipher_suites = "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
 			tls_min_version = "pAOWafkR"
 			tls_prefer_server_cipher_suites = true
 			translate_wan_addrs = true
@@ -3575,7 +3575,7 @@ func TestFullConfig(t *testing.T) {
 		TelemetryMetricsPrefix:                      "ftO6DySn",
 		TelemetryStatsdAddr:                         "drce87cy",
 		TelemetryStatsiteAddr:                       "HpFwKB8R",
-		TLSCipherSuites:                             []uint16{tls.TLS_RSA_WITH_RC4_128_SHA, tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA},
+		TLSCipherSuites:                             []uint16{tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384},
 		TLSMinVersion:                               "pAOWafkR",
 		TLSPreferServerCipherSuites:                 true,
 		TaggedAddresses: map[string]string{
@@ -3703,7 +3703,7 @@ func nonZero(name string, uniq map[interface{}]string, v interface{}) error {
 
 	isUnique := func(v interface{}) error {
 		if other := uniq[v]; other != "" {
-			return fmt.Errorf("%q and %q both use vaule %q", name, other, v)
+			return fmt.Errorf("%q and %q both use value %q", name, other, v)
 		}
 		uniq[v] = name
 		return nil

agent/consul/acl_replication.go

@@ -255,7 +255,7 @@ func (s *Server) IsACLReplicationEnabled() bool {
 
 // updateACLReplicationStatus safely updates the ACL replication status.
 func (s *Server) updateACLReplicationStatus(status structs.ACLReplicationStatus) {
-	// Fixup the times to shed some useless precision to ease formattting,
+	// Fixup the times to shed some useless precision to ease formatting,
 	// and always report UTC.
 	status.LastError = status.LastError.Round(time.Second).UTC()
 	status.LastSuccess = status.LastSuccess.Round(time.Second).UTC()

agent/consul/catalog_endpoint.go

@@ -59,7 +59,7 @@ func (c *Catalog) Register(args *structs.RegisterRequest, reply *struct{}) error
 		}
 
 		// Check the service address here and in the agent endpoint
-		// since service registration isn't sychronous.
+		// since service registration isn't synchronous.
 		if ipaddr.IsAny(args.Service.Address) {
 			return fmt.Errorf("Invalid service address")
 		}

agent/consul/leader_test.go

@@ -441,7 +441,7 @@ func TestLeader_Reconcile_Races(t *testing.T) {
 	})
 
 	// Add in some metadata via the catalog (as if the agent synced it
-	// there). We also set the serfHealth check to failing so the reconile
+	// there). We also set the serfHealth check to failing so the reconcile
 	// will attempt to flip it back
 	req := structs.RegisterRequest{
 		Datacenter: s1.config.Datacenter,

agent/consul/server_test.go

@@ -629,7 +629,7 @@ func TestServer_globalRPCErrors(t *testing.T) {
 		t.Fatalf("should have errored")
 	}
 	if !strings.Contains(err.Error(), "Bad.Method") {
-		t.Fatalf("unexpcted error: %s", err)
+		t.Fatalf("unexpected error: %s", err)
 	}
 }
 
@@ -767,10 +767,10 @@ func TestServer_RevokeLeadershipIdempotent(t *testing.T) {
 	dir1, s1 := testServer(t)
 	defer os.RemoveAll(dir1)
 	defer s1.Shutdown()
-	
+
 	testrpc.WaitForLeader(t, s1.RPC, "dc1")
 
-	err:= s1.revokeLeadership()
+	err := s1.revokeLeadership()
 	if err != nil {
 		t.Fatal(err)
 	}

agent/consul/state/catalog_test.go

@@ -2210,10 +2210,10 @@ func ensureIndexForService(t *testing.T, s *Store, ws memdb.WatchSet, serviceNam
 	}
 }
 
-// TestIndexIndependance test that changes on a given service does not impact the
+// TestIndexIndependence test that changes on a given service does not impact the
 // index of other services. It allows to have huge benefits for watches since
 // watchers are notified ONLY when there are changes in the given service
-func TestIndexIndependance(t *testing.T) {
+func TestIndexIndependence(t *testing.T) {
 	s := testStateStore(t)
 
 	// Querying with no matches gives an empty response

agent/consul/state/delay.go

@@ -7,7 +7,7 @@ import (
 
 // Delay is used to mark certain locks as unacquirable. When a lock is
 // forcefully released (failing health check, destroyed session, etc.), it is
-// subject to the LockDelay impossed by the session. This prevents another
+// subject to the LockDelay imposed by the session. This prevents another
 // session from acquiring the lock for some period of time as a protection
 // against split-brains. This is inspired by the lock-delay in Chubby. Because
 // this relies on wall-time, we cannot assume all peers perceive time as flowing

agent/coordinate_endpoint_test.go

@@ -138,7 +138,7 @@ func TestCoordinate_Nodes(t *testing.T) {
 		t.Fatalf("bad: %v", coordinates)
 	}
 
-	// Filter on a nonexistant node segment
+	// Filter on a nonexistent node segment
 	req, _ = http.NewRequest("GET", "/v1/coordinate/nodes?segment=nope", nil)
 	resp = httptest.NewRecorder()
 	obj, err = a.srv.CoordinateNodes(resp, req)
@@ -245,7 +245,7 @@ func TestCoordinate_Node(t *testing.T) {
 		t.Fatalf("bad: %v", coordinates)
 	}
 
-	// Filter on a nonexistant node segment
+	// Filter on a nonexistent node segment
 	req, _ = http.NewRequest("GET", "/v1/coordinate/node/foo?segment=nope", nil)
 	resp = httptest.NewRecorder()
 	obj, err = a.srv.CoordinateNode(resp, req)

agent/dns_test.go

@@ -3082,7 +3082,7 @@ func TestDNS_ServiceLookup_ARecordLimits(t *testing.T) {
 		name               string
 		aRecordLimit       int
 		expectedAResults   int
-		expectedAAAAResuls int
+		expectedAAAAResults int
 		expectedSRVResults int
 		numNodesTotal      int
 		udpSize            uint16

agent/local/state.go

@@ -746,7 +746,7 @@ func (l *State) updateSyncState() error {
 // and synchronizes the changes.
 func (l *State) SyncFull() error {
 	// note that we do not acquire the lock here since the methods
-	// we are calling will do that themself.
+	// we are calling will do that themselves.
 	//
 	// Also note that we don't hold the lock for the entire operation
 	// but release it between the two calls. This is not an issue since

agent/router/router.go

@@ -308,7 +308,7 @@ func (r *Router) FailServer(areaID types.AreaID, s *metadata.Server) error {
 // cases this may return a best-effort unhealthy server that can be used for a
 // connection attempt. If any problem occurs with the given server, the caller
 // should feed that back to the manager associated with the server, which is
-// also returned, by calling NofifyFailedServer().
+// also returned, by calling NotifyFailedServer().
 func (r *Router) FindRoute(datacenter string) (*Manager, *metadata.Server, bool) {
 	return r.routeFn(datacenter)
 }
@@ -380,7 +380,7 @@ func (n *datacenterSorter) Less(i, j int) bool {
 	return n.Vec[i] < n.Vec[j]
 }
 
-// GetDatacentersByDeistance returns a list of datacenters known to the router,
+// GetDatacentersByDistance returns a list of datacenters known to the router,
 // sorted by median RTT from this server to the servers in each datacenter. If
 // there are multiple areas that reach a given datacenter, this will use the
 // lowest RTT for the sort.

agent/testagent.go

@@ -207,7 +207,7 @@ func (a *TestAgent) Start() *TestAgent {
 			resp := httptest.NewRecorder()
 			_, err := a.httpServers[0].AgentSelf(resp, req)
 			if err != nil || resp.Code != 200 {
-				r.Fatal(a.Name, "failed OK respose", err)
+				r.Fatal(a.Name, "failed OK response", err)
 			}
 		}
 	})
@@ -282,7 +282,7 @@ func (a *TestAgent) consulConfig() *consul.Config {
 
 // pickRandomPorts selects random ports from fixed size random blocks of
 // ports. This does not eliminate the chance for port conflict but
-// reduces it significanltly with little overhead. Furthermore, asking
+// reduces it significantly with little overhead. Furthermore, asking
 // the kernel for a random port by binding to port 0 prolongs the test
 // execution (in our case +20sec) while also not fully eliminating the
 // chance of port conflicts for concurrently executed test binaries.

agent/user_event.go

@@ -254,7 +254,7 @@ func (a *Agent) UserEvents() []*UserEvent {
 	return out
 }
 
-// LastUserEvent is used to return the lastest user event.
+// LastUserEvent is used to return the last user event.
 // This will return nil if there is no recent event.
 func (a *Agent) LastUserEvent() *UserEvent {
 	a.eventLock.RLock()

api/acl.go

@@ -5,7 +5,7 @@ import (
 )
 
 const (
-	// ACLCLientType is the client type token
+	// ACLClientType is the client type token
 	ACLClientType = "client"
 
 	// ACLManagementType is the management type token

api/api.go

@@ -137,7 +137,7 @@ type WriteOptions struct {
 	// which overrides the agent's default token.
 	Token string
 
-	// RelayFactor is used in keyring operations to cause reponses to be
+	// RelayFactor is used in keyring operations to cause responses to be
 	// relayed back to the sender through N other random nodes. Must be
 	// a value from 0 to 5 (inclusive).
 	RelayFactor uint8

api/prepared_query.go

@@ -61,7 +61,7 @@ type QueryTemplate struct {
 	Regexp string
 }
 
-// PrepatedQueryDefinition defines a complete prepared query.
+// PreparedQueryDefinition defines a complete prepared query.
 type PreparedQueryDefinition struct {
 	// ID is this UUID-based ID for the query, always generated by Consul.
 	ID string

command/kv/put/kv_put.go

@@ -94,7 +94,7 @@ func (c *cmd) Run(args []string) int {
 		}
 	}
 
-	// Session is reauired for release or acquire
+	// Session is required for release or acquire
 	if (c.release || c.acquire) && c.session == "" {
 		c.UI.Error("Error! Missing -session (required with -acquire and -release)")
 		return 1

command/monitor/monitor_test.go

@@ -12,7 +12,7 @@ import (
 	"github.com/mitchellh/cli"
 )
 
-func TestMonitorCommand_exitssOnSignalBeforeLinesArrive(t *testing.T) {
+func TestMonitorCommand_exitsOnSignalBeforeLinesArrive(t *testing.T) {
 	t.Parallel()
 	logWriter := logger.NewLogWriter(512)
 	a := &agent.TestAgent{