{"action":"created","comment":{"url":"https://api.github.com/repos/hashicorp/consul/pulls/comments/205874145","pull_request_review_id":141237119,"id":205874145,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIwNTg3NDE0NQ==","diff_hunk":"@@ -989,9 +994,11 @@ func (s *HTTPServer) AgentConnectProxyConfig(resp http.ResponseWriter, req *http\n \t\treturn nil, nil\n \t}\n \n-\t// Parse the token\n+\t// Parse the token - don't resolve a proxy token to a real token\n+\t// that will be done with a call to verifyProxyToken later along with\n+\t// other security relevant checks.","path":"agent/agent_endpoint.go","position":32,"original_position":29,"commit_id":"7b9751db03aa6f68e166f36443d891bb52a93e8e","original_commit_id":"195ad50f8bb0eae21f3050a95763d7f68014dfc5","user":{"login":"mkeeler","id":1641976,"node_id":"MDQ6VXNlcjE2NDE5NzY=","avatar_url":"https://avatars1.githubusercontent.com/u/1641976?v=4","gravatar_id":"","url":"https://api.github.com/users/mkeeler","html_url":"https://github.com/mkeeler","followers_url":"https://api.github.com/users/mkeeler/followers","following_url":"https://api.github.com/users/mkeeler/following{/other_user}","gists_url":"https://api.github.com/users/mkeeler/gists{/gist_id}","starred_url":"https://api.github.com/users/mkeeler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mkeeler/subscriptions","organizations_url":"https://api.github.com/users/mkeeler/orgs","repos_url":"https://api.github.com/users/mkeeler/repos","events_url":"https://api.github.com/users/mkeeler/events{/privacy}","received_events_url":"https://api.github.com/users/mkeeler/received_events","type":"User","site_admin":false},"body":"I added similar wording there too now.","created_at":"2018-07-27T19:15:22Z","updated_at":"2018-07-27T19:15:22Z","html_url":"https://github.com/hashicorp/consul/pull/4453#discussion_r205874145","pull_request_url":"https://api.github.com/repos/hashicorp/consul/pulls/4453","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/hashicorp/consul/pulls/comments/205874145"},"html":{"href":"https://github.com/hashicorp/consul/pull/4453#discussion_r205874145"},"pull_request":{"href":"https://api.github.com/repos/hashicorp/consul/pulls/4453"}},"in_reply_to_id":205738330},"pull_request":{"url":"https://api.github.com/repos/hashicorp/consul/pulls/4453","id":204179183,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA0MTc5MTgz","html_url":"https://github.com/hashicorp/consul/pull/4453","diff_url":"https://github.com/hashicorp/consul/pull/4453.diff","patch_url":"https://github.com/hashicorp/consul/pull/4453.patch","issue_url":"https://api.github.com/repos/hashicorp/consul/issues/4453","number":4453,"state":"open","locked":false,"title":"Handle resolving proxy tokens when parsing HTTP requests","user":{"login":"mkeeler","id":1641976,"node_id":"MDQ6VXNlcjE2NDE5NzY=","avatar_url":"https://avatars1.githubusercontent.com/u/1641976?v=4","gravatar_id":"","url":"https://api.github.com/users/mkeeler","html_url":"https://github.com/mkeeler","followers_url":"https://api.github.com/users/mkeeler/followers","following_url":"https://api.github.com/users/mkeeler/following{/other_user}","gists_url":"https://api.github.com/users/mkeeler/gists{/gist_id}","starred_url":"https://api.github.com/users/mkeeler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mkeeler/subscriptions","organizations_url":"https://api.github.com/users/mkeeler/orgs","repos_url":"https://api.github.com/users/mkeeler/repos","events_url":"https://api.github.com/users/mkeeler/events{/privacy}","received_events_url":"https://api.github.com/users/mkeeler/received_events","type":"User","site_admin":false},"body":"Fixes: #4441 \r\n\r\nThe underlying problem with managed proxies and ACLs was that many HTTP endpoints were not ProxyToken aware. They passed along the proxy token to the RPC endpoints on the servers which knew nothing about proxy tokens.\r\n\r\nThis PR puts proxy token -> service token translation logic into our HTTP token handling. Additionally I added the parseTokenProxyResolve to be able to disable this auto-translation in the case of a few connect specific endpoints that want to run verifyProxyToken themselves (which has a few more checks - even though they may provide only marginal benefit in the case where each service has their own ACL token).\r\n\r\nHow I tested:\r\n\r\n1. Brought up a 3 server and 1 client cluster\r\n   * Client is running consul with an additional `python -m SimpleHTTPServer 8080` running in the background to provide the \"web\" service on port 8080\r\n2. Bootstrapped ACLs (this doesn't get less painful the more I do it)\r\n3. Enabled the connect proxy for my web service on my client\r\n4. Ran `consul connect proxy -service test -upstream web:9191` on one of my consul servers (the cluster was in docker behind a nat bridge so I needed to get into the network and doing it on the server was the easiest way (although I could have done it elsewhere)\r\n5. Tried curling localhost:9191  and got a tls: bad certificate error\r\n6. Realized my policy was setup to deny by default\r\n7. Created intention to allow test -> web\r\n8. Curl localhost:9191 again and get the directory listing for where my python server was running.\r\n\r\nCurrently getting this all setup for a unit test is impractical at best and impossible at worst or I would have implemented that too.","created_at":"2018-07-26T15:23:05Z","updated_at":"2018-07-27T19:15:22Z","closed_at":null,"merged_at":null,"merge_commit_sha":"8d25c3b963237caa07ff8cf3391818115c28409c","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/hashicorp/consul/pulls/4453/commits","review_comments_url":"https://api.github.com/repos/hashicorp/consul/pulls/4453/comments","review_comment_url":"https://api.github.com/repos/hashicorp/consul/pulls/comments{/number}","comments_url":"https://api.github.com/repos/hashicorp/consul/issues/4453/comments","statuses_url":"https://api.github.com/repos/hashicorp/consul/statuses/7b9751db03aa6f68e166f36443d891bb52a93e8e","head":{"label":"hashicorp:bugfix/connect-acls","ref":"bugfix/connect-acls","sha":"7b9751db03aa6f68e166f36443d891bb52a93e8e","user":{"login":"hashicorp","id":761456,"node_id":"MDEyOk9yZ2FuaXphdGlvbjc2MTQ1Ng==","avatar_url":"https://avatars2.githubusercontent.com/u/761456?v=4","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"repo":{"id":14125254,"node_id":"MDEwOlJlcG9zaXRvcnkxNDEyNTI1NA==","name":"consul","full_name":"hashicorp/consul","owner":{"login":"hashicorp","id":761456,"node_id":"MDEyOk9yZ2FuaXphdGlvbjc2MTQ1Ng==","avatar_url":"https://avatars2.githubusercontent.com/u/761456?v=4","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/hashicorp/consul","description":"Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.","fork":false,"url":"https://api.github.com/repos/hashicorp/consul","forks_url":"https://api.github.com/repos/hashicorp/consul/forks","keys_url":"https://api.github.com/repos/hashicorp/consul/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hashicorp/consul/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hashicorp/consul/teams","hooks_url":"https://api.github.com/repos/hashicorp/consul/hooks","issue_events_url":"https://api.github.com/repos/hashicorp/consul/issues/events{/number}","events_url":"https://api.github.com/repos/hashicorp/consul/events","assignees_url":"https://api.github.com/repos/hashicorp/consul/assignees{/user}","branches_url":"https://api.github.com/repos/hashicorp/consul/branches{/branch}","tags_url":"https://api.github.com/repos/hashicorp/consul/tags","blobs_url":"https://api.github.com/repos/hashicorp/consul/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/consul/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/consul/git/refs{/sha}","trees_url":"https://api.github.com/repos/hashicorp/consul/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hashicorp/consul/statuses/{sha}","languages_url":"https://api.github.com/repos/hashicorp/consul/languages","stargazers_url":"https://api.github.com/repos/hashicorp/consul/stargazers","contributors_url":"https://api.github.com/repos/hashicorp/consul/contributors","subscribers_url":"https://api.github.com/repos/hashicorp/consul/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/consul/subscription","commits_url":"https://api.github.com/repos/hashicorp/consul/commits{/sha}","git_commits_url":"https://api.github.com/repos/hashicorp/consul/git/commits{/sha}","comments_url":"https://api.github.com/repos/hashicorp/consul/comments{/number}","issue_comment_url":"https://api.github.com/repos/hashicorp/consul/issues/comments{/number}","contents_url":"https://api.github.com/repos/hashicorp/consul/contents/{+path}","compare_url":"https://api.github.com/repos/hashicorp/consul/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hashicorp/consul/merges","archive_url":"https://api.github.com/repos/hashicorp/consul/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hashicorp/consul/downloads","issues_url":"https://api.github.com/repos/hashicorp/consul/issues{/number}","pulls_url":"https://api.github.com/repos/hashicorp/consul/pulls{/number}","milestones_url":"https://api.github.com/repos/hashicorp/consul/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/consul/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hashicorp/consul/labels{/name}","releases_url":"https://api.github.com/repos/hashicorp/consul/releases{/id}","deployments_url":"https://api.github.com/repos/hashicorp/consul/deployments","created_at":"2013-11-04T22:15:27Z","updated_at":"2018-07-27T18:13:07Z","pushed_at":"2018-07-27T19:13:39Z","git_url":"git://github.com/hashicorp/consul.git","ssh_url":"git@github.com:hashicorp/consul.git","clone_url":"https://github.com/hashicorp/consul.git","svn_url":"https://github.com/hashicorp/consul","homepage":"https://www.consul.io/","size":60191,"stargazers_count":12914,"watchers_count":12914,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":2274,"mirror_url":null,"archived":false,"open_issues_count":433,"license":{"key":"mpl-2.0","name":"Mozilla Public License 2.0","spdx_id":"MPL-2.0","url":"https://api.github.com/licenses/mpl-2.0","node_id":"MDc6TGljZW5zZTE0"},"forks":2274,"open_issues":433,"watchers":12914,"default_branch":"master"}},"base":{"label":"hashicorp:master","ref":"master","sha":"8cdba9611d4cda22691fb5715872e2fa538bb389","user":{"login":"hashicorp","id":761456,"node_id":"MDEyOk9yZ2FuaXphdGlvbjc2MTQ1Ng==","avatar_url":"https://avatars2.githubusercontent.com/u/761456?v=4","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"repo":{"id":14125254,"node_id":"MDEwOlJlcG9zaXRvcnkxNDEyNTI1NA==","name":"consul","full_name":"hashicorp/consul","owner":{"login":"hashicorp","id":761456,"node_id":"MDEyOk9yZ2FuaXphdGlvbjc2MTQ1Ng==","avatar_url":"https://avatars2.githubusercontent.com/u/761456?v=4","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/hashicorp/consul","description":"Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.","fork":false,"url":"https://api.github.com/repos/hashicorp/consul","forks_url":"https://api.github.com/repos/hashicorp/consul/forks","keys_url":"https://api.github.com/repos/hashicorp/consul/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hashicorp/consul/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hashicorp/consul/teams","hooks_url":"https://api.github.com/repos/hashicorp/consul/hooks","issue_events_url":"https://api.github.com/repos/hashicorp/consul/issues/events{/number}","events_url":"https://api.github.com/repos/hashicorp/consul/events","assignees_url":"https://api.github.com/repos/hashicorp/consul/assignees{/user}","branches_url":"https://api.github.com/repos/hashicorp/consul/branches{/branch}","tags_url":"https://api.github.com/repos/hashicorp/consul/tags","blobs_url":"https://api.github.com/repos/hashicorp/consul/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/consul/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/consul/git/refs{/sha}","trees_url":"https://api.github.com/repos/hashicorp/consul/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hashicorp/consul/statuses/{sha}","languages_url":"https://api.github.com/repos/hashicorp/consul/languages","stargazers_url":"https://api.github.com/repos/hashicorp/consul/stargazers","contributors_url":"https://api.github.com/repos/hashicorp/consul/contributors","subscribers_url":"https://api.github.com/repos/hashicorp/consul/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/consul/subscription","commits_url":"https://api.github.com/repos/hashicorp/consul/commits{/sha}","git_commits_url":"https://api.github.com/repos/hashicorp/consul/git/commits{/sha}","comments_url":"https://api.github.com/repos/hashicorp/consul/comments{/number}","issue_comment_url":"https://api.github.com/repos/hashicorp/consul/issues/comments{/number}","contents_url":"https://api.github.com/repos/hashicorp/consul/contents/{+path}","compare_url":"https://api.github.com/repos/hashicorp/consul/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hashicorp/consul/merges","archive_url":"https://api.github.com/repos/hashicorp/consul/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hashicorp/consul/downloads","issues_url":"https://api.github.com/repos/hashicorp/consul/issues{/number}","pulls_url":"https://api.github.com/repos/hashicorp/consul/pulls{/number}","milestones_url":"https://api.github.com/repos/hashicorp/consul/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/consul/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hashicorp/consul/labels{/name}","releases_url":"https://api.github.com/repos/hashicorp/consul/releases{/id}","deployments_url":"https://api.github.com/repos/hashicorp/consul/deployments","created_at":"2013-11-04T22:15:27Z","updated_at":"2018-07-27T18:13:07Z","pushed_at":"2018-07-27T19:13:39Z","git_url":"git://github.com/hashicorp/consul.git","ssh_url":"git@github.com:hashicorp/consul.git","clone_url":"https://github.com/hashicorp/consul.git","svn_url":"https://github.com/hashicorp/consul","homepage":"https://www.consul.io/","size":60191,"stargazers_count":12914,"watchers_count":12914,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":2274,"mirror_url":null,"archived":false,"open_issues_count":433,"license":{"key":"mpl-2.0","name":"Mozilla Public License 2.0","spdx_id":"MPL-2.0","url":"https://api.github.com/licenses/mpl-2.0","node_id":"MDc6TGljZW5zZTE0"},"forks":2274,"open_issues":433,"watchers":12914,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/hashicorp/consul/pulls/4453"},"html":{"href":"https://github.com/hashicorp/consul/pull/4453"},"issue":{"href":"https://api.github.com/repos/hashicorp/consul/issues/4453"},"comments":{"href":"https://api.github.com/repos/hashicorp/consul/issues/4453/comments"},"review_comments":{"href":"https://api.github.com/repos/hashicorp/consul/pulls/4453/comments"},"review_comment":{"href":"https://api.github.com/repos/hashicorp/consul/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/hashicorp/consul/pulls/4453/commits"},"statuses":{"href":"https://api.github.com/repos/hashicorp/consul/statuses/7b9751db03aa6f68e166f36443d891bb52a93e8e"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"mkeeler"}}