More Mount Conflict Detection

Ensure that we are not creating a "submount" underneath an already
existing mountpoint. This (hopefully) fixes hashicorp#2878

vault/router.go

@@ -60,6 +60,22 @@ func (r *Router) Mount(backend logical.Backend, prefix string, mountEntry *Mount
 	if existing, _, ok := r.root.LongestPrefix(prefix); ok && existing != "" {
 		return fmt.Errorf("cannot mount under existing mount '%s'", existing)
 	}
+	// If this is a secret backend, check to see if the prefix conflicts
+	// with an existing mountpoint
+	if prefix != "" {
+		var existing string = ""
+		fn := func(existing_path string, _v interface{}) bool {
+			if strings.HasPrefix(existing_path, prefix) {
+				existing = existing_path
+				return true
+			}
+			return false
+		}
+		r.root.WalkPrefix(prefix, fn)
+		if existing != "" {
+			return fmt.Errorf("cannot mount under existing mount '%s'", existing)
+		}
+	}
 
 	// Build the paths
 	paths := backend.SpecialPaths()

vault/router_test.go

@@ -98,6 +98,21 @@ func TestRouter_Mount(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
+	meUUID, err = uuid.GenerateUUID()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	subMountEntry := &MountEntry{
+		Path: "prod/",
+		UUID: meUUID,
+	}
+
+	err = r.Mount(n, "prod/", subMountEntry, view)
+	if !strings.Contains(err.Error(), "cannot mount under existing mount") {
+		t.Fatalf("err: %v", err)
+	}
+
 	if path := r.MatchingMount("prod/aws/foo"); path != "prod/aws/" {
 		t.Fatalf("bad: %s", path)
 	}