rebase: bump github.com/hashicorp/vault/api from 1.2.0 to 1.3.0

Bumps [github.com/hashicorp/vault/api](https://github.com/hashicorp/vault) from 1.2.0 to 1.3.0.
- [Release notes](https://github.com/hashicorp/vault/releases)
- [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/vault/compare/v1.2.0...v1.3.0)

---
updated-dependencies:
- dependency-name: github.com/hashicorp/vault/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

vendor/github.com/hashicorp/go-immutable-radix/.travis.yml

@@ -1,3 +0,0 @@
-language: go
-go:
-  - tip

vendor/github.com/hashicorp/go-immutable-radix/CHANGELOG.md

@@ -1,3 +1,17 @@
+# UNRELEASED
+
+# 1.3.0 (September 17th, 2020)
+
+FEATURES
+
+* Add reverse tree traversal [[GH-30](https://github.com/hashicorp/go-immutable-radix/pull/30)]
+
+# 1.2.0 (March 18th, 2020)
+
+FEATURES
+
+* Adds a `Clone` method to `Txn` allowing transactions to be split either into two independently mutable trees. [[GH-26](https://github.com/hashicorp/go-immutable-radix/pull/26)]
+
 # 1.1.0 (May 22nd, 2019)
 
 FEATURES

vendor/github.com/hashicorp/go-immutable-radix/README.md

@@ -1,4 +1,4 @@
-go-immutable-radix [![Build Status](https://travis-ci.org/hashicorp/go-immutable-radix.png)](https://travis-ci.org/hashicorp/go-immutable-radix)
+go-immutable-radix [![CircleCI](https://circleci.com/gh/hashicorp/go-immutable-radix/tree/master.svg?style=svg)](https://circleci.com/gh/hashicorp/go-immutable-radix/tree/master)
 =========
 
 Provides the `iradix` package that implements an immutable [radix tree](http://en.wikipedia.org/wiki/Radix_tree).

vendor/github.com/hashicorp/go-immutable-radix/iradix.go

@@ -86,6 +86,20 @@ func (t *Tree) Txn() *Txn {
 	return txn
 }
 
+// Clone makes an independent copy of the transaction. The new transaction
+// does not track any nodes and has TrackMutate turned off. The cloned transaction will contain any uncommitted writes in the original transaction but further mutations to either will be independent and result in different radix trees on Commit. A cloned transaction may be passed to another goroutine and mutated there independently however each transaction may only be mutated in a single thread.
+func (t *Txn) Clone() *Txn {
+	// reset the writable node cache to avoid leaking future writes into the clone
+	t.writable = nil
+
+	txn := &Txn{
+		root: t.root,
+		snap: t.snap,
+		size: t.size,
+	}
+	return txn
+}
+
 // TrackMutate can be used to toggle if mutations are tracked. If this is enabled
 // then notifications will be issued for affected internal nodes and leaves when
 // the transaction is committed.

vendor/github.com/hashicorp/go-immutable-radix/iter.go

@@ -20,7 +20,7 @@ func (i *Iterator) SeekPrefixWatch(prefix []byte) (watch <-chan struct{}) {
 	watch = n.mutateCh
 	search := prefix
 	for {
-		// Check for key exhaution
+		// Check for key exhaustion
 		if len(search) == 0 {
 			i.node = n
 			return
@@ -60,10 +60,13 @@ func (i *Iterator) recurseMin(n *Node) *Node {
 	if n.leaf != nil {
 		return n
 	}
-	if len(n.edges) > 0 {
+	nEdges := len(n.edges)
+	if nEdges > 1 {
 		// Add all the other edges to the stack (the min node will be added as
 		// we recurse)
 		i.stack = append(i.stack, n.edges[1:])
+	}
+	if nEdges > 0 {
 		return i.recurseMin(n.edges[0].node)
 	}
 	// Shouldn't be possible
@@ -77,16 +80,32 @@ func (i *Iterator) recurseMin(n *Node) *Node {
 func (i *Iterator) SeekLowerBound(key []byte) {
 	// Wipe the stack. Unlike Prefix iteration, we need to build the stack as we
 	// go because we need only a subset of edges of many nodes in the path to the
-	// leaf with the lower bound.
+	// leaf with the lower bound. Note that the iterator will still recurse into
+	// children that we don't traverse on the way to the reverse lower bound as it
+	// walks the stack.
 	i.stack = []edges{}
+	// i.node starts off in the common case as pointing to the root node of the
+	// tree. By the time we return we have either found a lower bound and setup
+	// the stack to traverse all larger keys, or we have not and the stack and
+	// node should both be nil to prevent the iterator from assuming it is just
+	// iterating the whole tree from the root node. Either way this needs to end
+	// up as nil so just set it here.
 	n := i.node
+	i.node = nil
 	search := key
 
 	found := func(n *Node) {
-		i.node = n
 		i.stack = append(i.stack, edges{edge{node: n}})
 	}
 
+	findMin := func(n *Node) {
+		n = i.recurseMin(n)
+		if n != nil {
+			found(n)
+			return
+		}
+	}
+
 	for {
 		// Compare current prefix with the search key's same-length prefix.
 		var prefixCmp int
@@ -100,10 +119,7 @@ func (i *Iterator) SeekLowerBound(key []byte) {
 			// Prefix is larger, that means the lower bound is greater than the search
 			// and from now on we need to follow the minimum path to the smallest
 			// leaf under this subtree.
-			n = i.recurseMin(n)
-			if n != nil {
-				found(n)
-			}
+			findMin(n)
 			return
 		}
 
@@ -115,27 +131,29 @@ func (i *Iterator) SeekLowerBound(key []byte) {
 		}
 
 		// Prefix is equal, we are still heading for an exact match. If this is a
-		// leaf we're done.
-		if n.leaf != nil {
-			if bytes.Compare(n.leaf.key, key) < 0 {
-				i.node = nil
-				return
-			}
+		// leaf and an exact match we're done.
+		if n.leaf != nil && bytes.Equal(n.leaf.key, key) {
 			found(n)
 			return
 		}
 
-		// Consume the search prefix
-		if len(n.prefix) > len(search) {
-			search = []byte{}
-		} else {
-			search = search[len(n.prefix):]
+		// Consume the search prefix if the current node has one. Note that this is
+		// safe because if n.prefix is longer than the search slice prefixCmp would
+		// have been > 0 above and the method would have already returned.
+		search = search[len(n.prefix):]
+
+		if len(search) == 0 {
+			// We've exhausted the search key, but the current node is not an exact
+			// match or not a leaf. That means that the leaf value if it exists, and
+			// all child nodes must be strictly greater, the smallest key in this
+			// subtree must be the lower bound.
+			findMin(n)
+			return
 		}
 
 		// Otherwise, take the lower bound next edge.
 		idx, lbNode := n.getLowerBoundEdge(search[0])
 		if lbNode == nil {
-			i.node = nil
 			return
 		}
 
@@ -144,7 +162,6 @@ func (i *Iterator) SeekLowerBound(key []byte) {
 			i.stack = append(i.stack, n.edges[idx+1:])
 		}
 
-		i.node = lbNode
 		// Recurse
 		n = lbNode
 	}
@@ -155,7 +172,7 @@ func (i *Iterator) Next() ([]byte, interface{}, bool) {
 	// Initialize our stack if needed
 	if i.stack == nil && i.node != nil {
 		i.stack = []edges{
-			edges{
+			{
 				edge{node: i.node},
 			},
 		}

vendor/github.com/hashicorp/go-immutable-radix/node.go

@@ -211,6 +211,12 @@ func (n *Node) Iterator() *Iterator {
 	return &Iterator{node: n}
 }
 
+// ReverseIterator is used to return an iterator at
+// the given node to walk the tree backwards
+func (n *Node) ReverseIterator() *ReverseIterator {
+	return NewReverseIterator(n)
+}
+
 // rawIterator is used to return a raw iterator at the given node to walk the
 // tree.
 func (n *Node) rawIterator() *rawIterator {
@@ -224,6 +230,11 @@ func (n *Node) Walk(fn WalkFn) {
 	recursiveWalk(n, fn)
 }
 
+// WalkBackwards is used to walk the tree in reverse order
+func (n *Node) WalkBackwards(fn WalkFn) {
+	reverseRecursiveWalk(n, fn)
+}
+
 // WalkPrefix is used to walk the tree under a prefix
 func (n *Node) WalkPrefix(prefix []byte, fn WalkFn) {
 	search := prefix
@@ -302,3 +313,22 @@ func recursiveWalk(n *Node, fn WalkFn) bool {
 	}
 	return false
 }
+
+// reverseRecursiveWalk is used to do a reverse pre-order
+// walk of a node recursively. Returns true if the walk
+// should be aborted
+func reverseRecursiveWalk(n *Node, fn WalkFn) bool {
+	// Visit the leaf values if any
+	if n.leaf != nil && fn(n.leaf.key, n.leaf.val) {
+		return true
+	}
+
+	// Recurse on the children in reverse order
+	for i := len(n.edges) - 1; i >= 0; i-- {
+		e := n.edges[i]
+		if reverseRecursiveWalk(e.node, fn) {
+			return true
+		}
+	}
+	return false
+}

vendor/github.com/hashicorp/go-immutable-radix/raw_iter.go

@@ -41,7 +41,7 @@ func (i *rawIterator) Next() {
 	// Initialize our stack if needed.
 	if i.stack == nil && i.node != nil {
 		i.stack = []rawStackEntry{
-			rawStackEntry{
+			{
 				edges: edges{
 					edge{node: i.node},
 				},

vendor/github.com/hashicorp/go-immutable-radix/reverse_iter.go

@@ -0,0 +1,239 @@
+package iradix
+
+import (
+	"bytes"
+)
+
+// ReverseIterator is used to iterate over a set of nodes
+// in reverse in-order
+type ReverseIterator struct {
+	i *Iterator
+
+	// expandedParents stores the set of parent nodes whose relevant children have
+	// already been pushed into the stack. This can happen during seek or during
+	// iteration.
+	//
+	// Unlike forward iteration we need to recurse into children before we can
+	// output the value stored in an internal leaf since all children are greater.
+	// We use this to track whether we have already ensured all the children are
+	// in the stack.
+	expandedParents map[*Node]struct{}
+}
+
+// NewReverseIterator returns a new ReverseIterator at a node
+func NewReverseIterator(n *Node) *ReverseIterator {
+	return &ReverseIterator{
+		i: &Iterator{node: n},
+	}
+}
+
+// SeekPrefixWatch is used to seek the iterator to a given prefix
+// and returns the watch channel of the finest granularity
+func (ri *ReverseIterator) SeekPrefixWatch(prefix []byte) (watch <-chan struct{}) {
+	return ri.i.SeekPrefixWatch(prefix)
+}
+
+// SeekPrefix is used to seek the iterator to a given prefix
+func (ri *ReverseIterator) SeekPrefix(prefix []byte) {
+	ri.i.SeekPrefixWatch(prefix)
+}
+
+// SeekReverseLowerBound is used to seek the iterator to the largest key that is
+// lower or equal to the given key. There is no watch variant as it's hard to
+// predict based on the radix structure which node(s) changes might affect the
+// result.
+func (ri *ReverseIterator) SeekReverseLowerBound(key []byte) {
+	// Wipe the stack. Unlike Prefix iteration, we need to build the stack as we
+	// go because we need only a subset of edges of many nodes in the path to the
+	// leaf with the lower bound. Note that the iterator will still recurse into
+	// children that we don't traverse on the way to the reverse lower bound as it
+	// walks the stack.
+	ri.i.stack = []edges{}
+	// ri.i.node starts off in the common case as pointing to the root node of the
+	// tree. By the time we return we have either found a lower bound and setup
+	// the stack to traverse all larger keys, or we have not and the stack and
+	// node should both be nil to prevent the iterator from assuming it is just
+	// iterating the whole tree from the root node. Either way this needs to end
+	// up as nil so just set it here.
+	n := ri.i.node
+	ri.i.node = nil
+	search := key
+
+	if ri.expandedParents == nil {
+		ri.expandedParents = make(map[*Node]struct{})
+	}
+
+	found := func(n *Node) {
+		ri.i.stack = append(ri.i.stack, edges{edge{node: n}})
+		// We need to mark this node as expanded in advance too otherwise the
+		// iterator will attempt to walk all of its children even though they are
+		// greater than the lower bound we have found. We've expanded it in the
+		// sense that all of its children that we want to walk are already in the
+		// stack (i.e. none of them).
+		ri.expandedParents[n] = struct{}{}
+	}
+
+	for {
+		// Compare current prefix with the search key's same-length prefix.
+		var prefixCmp int
+		if len(n.prefix) < len(search) {
+			prefixCmp = bytes.Compare(n.prefix, search[0:len(n.prefix)])
+		} else {
+			prefixCmp = bytes.Compare(n.prefix, search)
+		}
+
+		if prefixCmp < 0 {
+			// Prefix is smaller than search prefix, that means there is no exact
+			// match for the search key. But we are looking in reverse, so the reverse
+			// lower bound will be the largest leaf under this subtree, since it is
+			// the value that would come right before the current search key if it
+			// were in the tree. So we need to follow the maximum path in this subtree
+			// to find it. Note that this is exactly what the iterator will already do
+			// if it finds a node in the stack that has _not_ been marked as expanded
+			// so in this one case we don't call `found` and instead let the iterator
+			// do the expansion and recursion through all the children.
+			ri.i.stack = append(ri.i.stack, edges{edge{node: n}})
+			return
+		}
+
+		if prefixCmp > 0 {
+			// Prefix is larger than search prefix, or there is no prefix but we've
+			// also exhausted the search key. Either way, that means there is no
+			// reverse lower bound since nothing comes before our current search
+			// prefix.
+			return
+		}
+
+		// If this is a leaf, something needs to happen! Note that if it's a leaf
+		// and prefixCmp was zero (which it must be to get here) then the leaf value
+		// is either an exact match for the search, or it's lower. It can't be
+		// greater.
+		if n.isLeaf() {
+
+			// Firstly, if it's an exact match, we're done!
+			if bytes.Equal(n.leaf.key, key) {
+				found(n)
+				return
+			}
+
+			// It's not so this node's leaf value must be lower and could still be a
+			// valid contender for reverse lower bound.
+
+			// If it has no children then we are also done.
+			if len(n.edges) == 0 {
+				// This leaf is the lower bound.
+				found(n)
+				return
+			}
+
+			// Finally, this leaf is internal (has children) so we'll keep searching,
+			// but we need to add it to the iterator's stack since it has a leaf value
+			// that needs to be iterated over. It needs to be added to the stack
+			// before its children below as it comes first.
+			ri.i.stack = append(ri.i.stack, edges{edge{node: n}})
+			// We also need to mark it as expanded since we'll be adding any of its
+			// relevant children below and so don't want the iterator to re-add them
+			// on its way back up the stack.
+			ri.expandedParents[n] = struct{}{}
+		}
+
+		// Consume the search prefix. Note that this is safe because if n.prefix is
+		// longer than the search slice prefixCmp would have been > 0 above and the
+		// method would have already returned.
+		search = search[len(n.prefix):]
+
+		if len(search) == 0 {
+			// We've exhausted the search key but we are not at a leaf. That means all
+			// children are greater than the search key so a reverse lower bound
+			// doesn't exist in this subtree. Note that there might still be one in
+			// the whole radix tree by following a different path somewhere further
+			// up. If that's the case then the iterator's stack will contain all the
+			// smaller nodes already and Previous will walk through them correctly.
+			return
+		}
+
+		// Otherwise, take the lower bound next edge.
+		idx, lbNode := n.getLowerBoundEdge(search[0])
+
+		// From here, we need to update the stack with all values lower than
+		// the lower bound edge. Since getLowerBoundEdge() returns -1 when the
+		// search prefix is larger than all edges, we need to place idx at the
+		// last edge index so they can all be place in the stack, since they
+		// come before our search prefix.
+		if idx == -1 {
+			idx = len(n.edges)
+		}
+
+		// Create stack edges for the all strictly lower edges in this node.
+		if len(n.edges[:idx]) > 0 {
+			ri.i.stack = append(ri.i.stack, n.edges[:idx])
+		}
+
+		// Exit if there's no lower bound edge. The stack will have the previous
+		// nodes already.
+		if lbNode == nil {
+			return
+		}
+
+		// Recurse
+		n = lbNode
+	}
+}
+
+// Previous returns the previous node in reverse order
+func (ri *ReverseIterator) Previous() ([]byte, interface{}, bool) {
+	// Initialize our stack if needed
+	if ri.i.stack == nil && ri.i.node != nil {
+		ri.i.stack = []edges{
+			{
+				edge{node: ri.i.node},
+			},
+		}
+	}
+
+	if ri.expandedParents == nil {
+		ri.expandedParents = make(map[*Node]struct{})
+	}
+
+	for len(ri.i.stack) > 0 {
+		// Inspect the last element of the stack
+		n := len(ri.i.stack)
+		last := ri.i.stack[n-1]
+		m := len(last)
+		elem := last[m-1].node
+
+		_, alreadyExpanded := ri.expandedParents[elem]
+
+		// If this is an internal node and we've not seen it already, we need to
+		// leave it in the stack so we can return its possible leaf value _after_
+		// we've recursed through all its children.
+		if len(elem.edges) > 0 && !alreadyExpanded {
+			// record that we've seen this node!
+			ri.expandedParents[elem] = struct{}{}
+			// push child edges onto stack and skip the rest of the loop to recurse
+			// into the largest one.
+			ri.i.stack = append(ri.i.stack, elem.edges)
+			continue
+		}
+
+		// Remove the node from the stack
+		if m > 1 {
+			ri.i.stack[n-1] = last[:m-1]
+		} else {
+			ri.i.stack = ri.i.stack[:n-1]
+		}
+		// We don't need this state any more as it's no longer in the stack so we
+		// won't visit it again
+		if alreadyExpanded {
+			delete(ri.expandedParents, elem)
+		}
+
+		// If this is a leaf, return it
+		if elem.leaf != nil {
+			return elem.leaf.key, elem.leaf.val, true
+		}
+
+		// it's not a leaf so keep walking the stack to find the previous leaf
+	}
+	return nil, nil, false
+}

vendor/github.com/hashicorp/go-plugin/README.md

@@ -141,11 +141,6 @@ This plugin system will give host processes a system for constraining
 versions. This is in addition to the protocol versioning already present
 which is more for larger underlying changes.
 
-**Plugin fetching.** We will integrate with [go-getter](https://github.com/hashicorp/go-getter)
-to support automatic download + install of plugins. Paired with cryptographically
-secure plugins (above), we can make this a safe operation for an amazing
-user experience.
-
 ## What About Shared Libraries?
 
 When we started using plugins (late 2012, early 2013), plugins over RPC

vendor/github.com/hashicorp/go-plugin/client.go

@@ -22,7 +22,8 @@ import (
 	"sync/atomic"
 	"time"
 
-	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-hclog"
+	"google.golang.org/grpc"
 )
 
 // If this is 1, then we've called CleanupClients. This can be used
@@ -159,11 +160,8 @@ type ClientConfig struct {
 
 	// SyncStdout, SyncStderr can be set to override the
 	// respective os.Std* values in the plugin. Care should be taken to
-	// avoid races here. If these are nil, then this will automatically be
-	// hooked up to os.Stdin, Stdout, and Stderr, respectively.
-	//
-	// If the default values (nil) are used, then this package will not
-	// sync any of these streams.
+	// avoid races here. If these are nil, then this will be set to
+	// ioutil.Discard.
 	SyncStdout io.Writer
 	SyncStderr io.Writer
 
@@ -206,15 +204,27 @@ type ClientConfig struct {
 	//
 	// You cannot Reattach to a server with this option enabled.
 	AutoMTLS bool
+
+	// GRPCDialOptions allows plugin users to pass custom grpc.DialOption
+	// to create gRPC connections. This only affects plugins using the gRPC
+	// protocol.
+	GRPCDialOptions []grpc.DialOption
 }
 
 // ReattachConfig is used to configure a client to reattach to an
 // already-running plugin process. You can retrieve this information by
 // calling ReattachConfig on Client.
 type ReattachConfig struct {
-	Protocol Protocol
-	Addr     net.Addr
-	Pid      int
+	Protocol        Protocol
+	ProtocolVersion int
+	Addr            net.Addr
+	Pid             int
+
+	// Test is set to true if this is reattaching to to a plugin in "test mode"
+	// (see ServeConfig.Test). In this mode, client.Kill will NOT kill the
+	// process and instead will rely on the plugin to terminate itself. This
+	// should not be used in non-test environments.
+	Test bool
 }
 
 // SecureConfig is used to configure a client to verify the integrity of an
@@ -690,14 +700,14 @@ func (c *Client) Start() (addr net.Addr, err error) {
 
 		// Check the core protocol. Wrapped in a {} for scoping.
 		{
-			var coreProtocol int64
-			coreProtocol, err = strconv.ParseInt(parts[0], 10, 0)
+			var coreProtocol int
+			coreProtocol, err = strconv.Atoi(parts[0])
 			if err != nil {
 				err = fmt.Errorf("Error parsing core protocol version: %s", err)
 				return
 			}
 
-			if int(coreProtocol) != CoreProtocolVersion {
+			if coreProtocol != CoreProtocolVersion {
 				err = fmt.Errorf("Incompatible core API version with plugin. "+
 					"Plugin version: %s, Core version: %d\n\n"+
 					"To fix this, the plugin usually only needs to be recompiled.\n"+
@@ -788,7 +798,10 @@ func (c *Client) reattach() (net.Addr, error) {
 	// Verify the process still exists. If not, then it is an error
 	p, err := os.FindProcess(c.config.Reattach.Pid)
 	if err != nil {
-		return nil, err
+		// On Unix systems, FindProcess never returns an error.
+		// On Windows, for non-existent pids it returns:
+		// os.SyscallError - 'OpenProcess: the paremter is incorrect'
+		return nil, ErrProcessNotFound
 	}
 
 	// Attempt to connect to the addr since on Unix systems FindProcess
@@ -825,15 +838,25 @@ func (c *Client) reattach() (net.Addr, error) {
 		c.exited = true
 	}(p.Pid)
 
-	// Set the address and process
+	// Set the address and protocol
 	c.address = c.config.Reattach.Addr
-	c.process = p
 	c.protocol = c.config.Reattach.Protocol
 	if c.protocol == "" {
 		// Default the protocol to net/rpc for backwards compatibility
 		c.protocol = ProtocolNetRPC
 	}
 
+	if c.config.Reattach.Test {
+		c.negotiatedVersion = c.config.Reattach.ProtocolVersion
+	}
+
+	// If we're in test mode, we do NOT set the process. This avoids the
+	// process being killed (the only purpose we have for c.process), since
+	// in test mode the process is responsible for exiting on its own.
+	if !c.config.Reattach.Test {
+		c.process = p
+	}
+
 	return c.address, nil
 }
 

vendor/github.com/hashicorp/go-plugin/go.mod

@@ -1,17 +1,15 @@
 module github.com/hashicorp/go-plugin
 
+go 1.13
+
 require (
-	github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b // indirect
-	github.com/golang/protobuf v1.2.0
-	github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd
+	github.com/golang/protobuf v1.3.4
+	github.com/hashicorp/go-hclog v0.14.1
 	github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb
+	github.com/jhump/protoreflect v1.6.0
 	github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77
 	github.com/oklog/run v1.0.0
 	github.com/stretchr/testify v1.3.0 // indirect
-	golang.org/x/net v0.0.0-20180826012351-8a410e7b638d
-	golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 // indirect
-	golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc // indirect
-	golang.org/x/text v0.3.0 // indirect
-	google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 // indirect
-	google.golang.org/grpc v1.14.0
+	golang.org/x/net v0.0.0-20190311183353-d8887717615a
+	google.golang.org/grpc v1.27.1
 )

vendor/github.com/hashicorp/go-plugin/go.sum

@@ -1,31 +1,87 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd h1:rNuUHR+CvK1IS89MMtcF0EpcVMZtjKfPRp4MEmt/aTs=
-github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9uLqI8l75knNv3lV1kA55veR+WUPSiKIWcQHudI=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.4 h1:87PNWwrRvUSnqS4dlcBU/ftvOIBep4sYuBLlh6rX2wk=
+github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/google/go-cmp v0.2.0 h1:+dTQ8DZQJz0Mb/HjFlkptS1FeQ4cWSnN941F8aEG4SQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/hashicorp/go-hclog v0.14.1 h1:nQcJDQwIAGnmoUWp8ubocEX40cCml/17YkF6csQLReU=
+github.com/hashicorp/go-hclog v0.14.1/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb h1:b5rjCoWHc7eqmAS4/qyk21ZsHyb6Mxv/jykxvNTkU4M=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
+github.com/jhump/protoreflect v1.6.0 h1:h5jfMVslIg6l29nsMs0D8Wj17RDVdNYti0vDN/PZZoE=
+github.com/jhump/protoreflect v1.6.0/go.mod h1:eaTn3RZAmMBcV0fifFvlm6VHNz3wSkYyXYWUh7ymB74=
+github.com/mattn/go-colorable v0.1.4 h1:snbPLB8fVfU9iwbbo30TPtbLRzwWu6aJS6Xh4eaaviA=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.10 h1:qxFzApOv4WsAL965uUPIsXzAKCZxN2p9UqdhFS4ZW10=
+github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
 github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77 h1:7GoSOOW2jpsfkntVKaS2rAr1TJqfcxotyaUcuxoZSzg=
 github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
 github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d h1:g9qWBGx4puODJTMVyoPrpoxPFgVGd+z1DZwjfRu4d0I=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 h1:YUO/7uOKsKeq9UokNS62b8FYywz3ker1l1vDZRCRefw=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc h1:WiYx1rIFmx8c0mXAFtv5D/mHyKe1+jmuP7PViuwqwuQ=
-golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a h1:oWX7TPOiFAMXLq8o0ikBYfCJVlRHBcsciT5bXOrH628=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a h1:1BGLXjeY4akVXGgbC9HugT3Jv3hCI0z56oJR5vAMgBU=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20191008105621-543471e840be h1:QAcqgptGM8IQBC9K/RC4o+O9YmqEm0diQn9QmZw/0mU=
+golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20170818010345-ee236bd376b0/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 h1:Nw54tB0rB7hY/N0NQvRW8DG4Yk3Q6T9cu9RcFQDu1tc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/grpc v1.14.0 h1:ArxJuB1NWfPY6r9Gp9gqwplT0Ge7nqv9msgu03lHLmo=
-google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55 h1:gSJIx1SDwno+2ElGhA4+qG2zF97qiUzTM+rQ0klBOcE=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.27.1 h1:zvIju4sqAGvwKspUQOhwnpcqSbzi7/H6QomNNjTL4sk=
+google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=

vendor/github.com/hashicorp/go-plugin/grpc_client.go

@@ -14,9 +14,9 @@ import (
 	"google.golang.org/grpc/health/grpc_health_v1"
 )
 
-func dialGRPCConn(tls *tls.Config, dialer func(string, time.Duration) (net.Conn, error)) (*grpc.ClientConn, error) {
+func dialGRPCConn(tls *tls.Config, dialer func(string, time.Duration) (net.Conn, error), dialOpts ...grpc.DialOption) (*grpc.ClientConn, error) {
 	// Build dialing options.
-	opts := make([]grpc.DialOption, 0, 5)
+	opts := make([]grpc.DialOption, 0)
 
 	// We use a custom dialer so that we can connect over unix domain sockets.
 	opts = append(opts, grpc.WithDialer(dialer))
@@ -37,6 +37,8 @@ func dialGRPCConn(tls *tls.Config, dialer func(string, time.Duration) (net.Conn,
 		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(math.MaxInt32)),
 		grpc.WithDefaultCallOptions(grpc.MaxCallSendMsgSize(math.MaxInt32)))
 
+	// Add our custom options if we have any
+	opts = append(opts, dialOpts...)
 
 	// Connect. Note the first parameter is unused because we use a custom
 	// dialer that has the state to see the address.
@@ -51,7 +53,7 @@ func dialGRPCConn(tls *tls.Config, dialer func(string, time.Duration) (net.Conn,
 // newGRPCClient creates a new GRPCClient. The Client argument is expected
 // to be successfully started already with a lock held.
 func newGRPCClient(doneCtx context.Context, c *Client) (*GRPCClient, error) {
-	conn, err := dialGRPCConn(c.config.TLSConfig, c.dialer)
+	conn, err := dialGRPCConn(c.config.TLSConfig, c.dialer, c.config.GRPCDialOptions...)
 	if err != nil {
 		return nil, err
 	}
@@ -62,6 +64,13 @@ func newGRPCClient(doneCtx context.Context, c *Client) (*GRPCClient, error) {
 	go broker.Run()
 	go brokerGRPCClient.StartStream()
 
+	// Start the stdio client
+	stdioClient, err := newGRPCStdioClient(doneCtx, c.logger.Named("stdio"), conn)
+	if err != nil {
+		return nil, err
+	}
+	go stdioClient.Run(c.config.SyncStdout, c.config.SyncStderr)
+
 	cl := &GRPCClient{
 		Conn:       conn,
 		Plugins:    c.config.Plugins,

vendor/github.com/hashicorp/go-plugin/grpc_server.go

@@ -14,6 +14,7 @@ import (
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/health"
 	"google.golang.org/grpc/health/grpc_health_v1"
+	"google.golang.org/grpc/reflection"
 )
 
 // GRPCServiceName is the name of the service that the health check should
@@ -51,9 +52,10 @@ type GRPCServer struct {
 	Stdout io.Reader
 	Stderr io.Reader
 
-	config GRPCServerConfig
-	server *grpc.Server
-	broker *GRPCBroker
+	config      GRPCServerConfig
+	server      *grpc.Server
+	broker      *GRPCBroker
+	stdioServer *grpcStdioServer
 
 	logger hclog.Logger
 }
@@ -73,6 +75,9 @@ func (s *GRPCServer) Init() error {
 		GRPCServiceName, grpc_health_v1.HealthCheckResponse_SERVING)
 	grpc_health_v1.RegisterHealthServer(s.server, healthCheck)
 
+	// Register the reflection service
+	reflection.Register(s.server)
+
 	// Register the broker service
 	brokerServer := newGRPCBrokerServer()
 	plugin.RegisterGRPCBrokerServer(s.server, brokerServer)
@@ -80,11 +85,13 @@ func (s *GRPCServer) Init() error {
 	go s.broker.Run()
 
 	// Register the controller
-	controllerServer := &grpcControllerServer{
-		server: s,
-	}
+	controllerServer := &grpcControllerServer{server: s}
 	plugin.RegisterGRPCControllerServer(s.server, controllerServer)
 
+	// Register the stdio service
+	s.stdioServer = newGRPCStdioServer(s.logger, s.Stdout, s.Stderr)
+	plugin.RegisterGRPCStdioServer(s.server, s.stdioServer)
+
 	// Register all our plugins onto the gRPC server.
 	for k, raw := range s.Plugins {
 		p, ok := raw.(GRPCPlugin)

vendor/github.com/hashicorp/go-plugin/grpc_stdio.go

@@ -0,0 +1,207 @@
+package plugin
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"io"
+
+	empty "github.com/golang/protobuf/ptypes/empty"
+	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin/internal/plugin"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// grpcStdioBuffer is the buffer size we try to fill when sending a chunk of
+// stdio data. This is currently 1 KB for no reason other than that seems like
+// enough (stdio data isn't that common) and is fairly low.
+const grpcStdioBuffer = 1 * 1024
+
+// grpcStdioServer implements the Stdio service and streams stdiout/stderr.
+type grpcStdioServer struct {
+	stdoutCh <-chan []byte
+	stderrCh <-chan []byte
+}
+
+// newGRPCStdioServer creates a new grpcStdioServer and starts the stream
+// copying for the given out and err readers.
+//
+// This must only be called ONCE per srcOut, srcErr.
+func newGRPCStdioServer(log hclog.Logger, srcOut, srcErr io.Reader) *grpcStdioServer {
+	stdoutCh := make(chan []byte)
+	stderrCh := make(chan []byte)
+
+	// Begin copying the streams
+	go copyChan(log, stdoutCh, srcOut)
+	go copyChan(log, stderrCh, srcErr)
+
+	// Construct our server
+	return &grpcStdioServer{
+		stdoutCh: stdoutCh,
+		stderrCh: stderrCh,
+	}
+}
+
+// StreamStdio streams our stdout/err as the response.
+func (s *grpcStdioServer) StreamStdio(
+	_ *empty.Empty,
+	srv plugin.GRPCStdio_StreamStdioServer,
+) error {
+	// Share the same data value between runs. Sending this over the wire
+	// marshals it so we can reuse this.
+	var data plugin.StdioData
+
+	for {
+		// Read our data
+		select {
+		case data.Data = <-s.stdoutCh:
+			data.Channel = plugin.StdioData_STDOUT
+
+		case data.Data = <-s.stderrCh:
+			data.Channel = plugin.StdioData_STDERR
+
+		case <-srv.Context().Done():
+			return nil
+		}
+
+		// Not sure if this is possible, but if we somehow got here and
+		// we didn't populate any data at all, then just continue.
+		if len(data.Data) == 0 {
+			continue
+		}
+
+		// Send our data to the client.
+		if err := srv.Send(&data); err != nil {
+			return err
+		}
+	}
+}
+
+// grpcStdioClient wraps the stdio service as a client to copy
+// the stdio data to output writers.
+type grpcStdioClient struct {
+	log         hclog.Logger
+	stdioClient plugin.GRPCStdio_StreamStdioClient
+}
+
+// newGRPCStdioClient creates a grpcStdioClient. This will perform the
+// initial connection to the stdio service. If the stdio service is unavailable
+// then this will be a no-op. This allows this to work without error for
+// plugins that don't support this.
+func newGRPCStdioClient(
+	ctx context.Context,
+	log hclog.Logger,
+	conn *grpc.ClientConn,
+) (*grpcStdioClient, error) {
+	client := plugin.NewGRPCStdioClient(conn)
+
+	// Connect immediately to the endpoint
+	stdioClient, err := client.StreamStdio(ctx, &empty.Empty{})
+
+	// If we get an Unavailable or Unimplemented error, this means that the plugin isn't
+	// updated and linking to the latest version of go-plugin that supports
+	// this. We fall back to the previous behavior of just not syncing anything.
+	if status.Code(err) == codes.Unavailable || status.Code(err) == codes.Unimplemented {
+		log.Warn("stdio service not available, stdout/stderr syncing unavailable")
+		stdioClient = nil
+		err = nil
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	return &grpcStdioClient{
+		log:         log,
+		stdioClient: stdioClient,
+	}, nil
+}
+
+// Run starts the loop that receives stdio data and writes it to the given
+// writers. This blocks and should be run in a goroutine.
+func (c *grpcStdioClient) Run(stdout, stderr io.Writer) {
+	// This will be nil if stdio is not supported by the plugin
+	if c.stdioClient == nil {
+		c.log.Warn("stdio service unavailable, run will do nothing")
+		return
+	}
+
+	for {
+		c.log.Trace("waiting for stdio data")
+		data, err := c.stdioClient.Recv()
+		if err != nil {
+			if err == io.EOF ||
+				status.Code(err) == codes.Unavailable ||
+				status.Code(err) == codes.Canceled ||
+				status.Code(err) == codes.Unimplemented ||
+				err == context.Canceled {
+				c.log.Debug("received EOF, stopping recv loop", "err", err)
+				return
+			}
+
+			c.log.Error("error receiving data", "err", err)
+			return
+		}
+
+		// Determine our output writer based on channel
+		var w io.Writer
+		switch data.Channel {
+		case plugin.StdioData_STDOUT:
+			w = stdout
+
+		case plugin.StdioData_STDERR:
+			w = stderr
+
+		default:
+			c.log.Warn("unknown channel, dropping", "channel", data.Channel)
+			continue
+		}
+
+		// Write! In the event of an error we just continue.
+		if c.log.IsTrace() {
+			c.log.Trace("received data", "channel", data.Channel.String(), "len", len(data.Data))
+		}
+		if _, err := io.Copy(w, bytes.NewReader(data.Data)); err != nil {
+			c.log.Error("failed to copy all bytes", "err", err)
+		}
+	}
+}
+
+// copyChan copies an io.Reader into a channel.
+func copyChan(log hclog.Logger, dst chan<- []byte, src io.Reader) {
+	bufsrc := bufio.NewReader(src)
+
+	for {
+		// Make our data buffer. We allocate a new one per loop iteration
+		// so that we can send it over the channel.
+		var data [1024]byte
+
+		// Read the data, this will block until data is available
+		n, err := bufsrc.Read(data[:])
+
+		// We have to check if we have data BEFORE err != nil. The bufio
+		// docs guarantee n == 0 on EOF but its better to be safe here.
+		if n > 0 {
+			// We have data! Send it on the channel. This will block if there
+			// is no reader on the other side. We expect that go-plugin will
+			// connect immediately to the stdio server to drain this so we want
+			// this block to happen for backpressure.
+			dst <- data[:n]
+		}
+
+		// If we hit EOF we're done copying
+		if err == io.EOF {
+			log.Debug("stdio EOF, exiting copy loop")
+			return
+		}
+
+		// Any other error we just exit the loop. We don't expect there to
+		// be errors since our use case for this is reading/writing from
+		// a in-process pipe (os.Pipe).
+		if err != nil {
+			log.Warn("error copying stdio data, stopping copy", "err", err)
+			return
+		}
+	}
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go

@@ -1,3 +1,3 @@
-//go:generate protoc -I ./ ./grpc_broker.proto ./grpc_controller.proto --go_out=plugins=grpc:.
+//go:generate protoc -I ./ ./grpc_broker.proto ./grpc_controller.proto ./grpc_stdio.proto --go_out=plugins=grpc:.
 
 package plugin

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.pb.go

@@ -3,12 +3,13 @@
 
 package plugin
 
+import proto "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
 import (
-	fmt "fmt"
-	proto "github.com/golang/protobuf/proto"
 	context "golang.org/x/net/context"
 	grpc "google.golang.org/grpc"
-	math "math"
 )
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -35,17 +36,16 @@ func (m *ConnInfo) Reset()         { *m = ConnInfo{} }
 func (m *ConnInfo) String() string { return proto.CompactTextString(m) }
 func (*ConnInfo) ProtoMessage()    {}
 func (*ConnInfo) Descriptor() ([]byte, []int) {
-	return fileDescriptor_802e9beed3ec3b28, []int{0}
+	return fileDescriptor_grpc_broker_3322b07398605250, []int{0}
 }
-
 func (m *ConnInfo) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ConnInfo.Unmarshal(m, b)
 }
 func (m *ConnInfo) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
 	return xxx_messageInfo_ConnInfo.Marshal(b, m, deterministic)
 }
-func (m *ConnInfo) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_ConnInfo.Merge(m, src)
+func (dst *ConnInfo) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ConnInfo.Merge(dst, src)
 }
 func (m *ConnInfo) XXX_Size() int {
 	return xxx_messageInfo_ConnInfo.Size(m)
@@ -81,23 +81,6 @@ func init() {
 	proto.RegisterType((*ConnInfo)(nil), "plugin.ConnInfo")
 }
 
-func init() { proto.RegisterFile("grpc_broker.proto", fileDescriptor_802e9beed3ec3b28) }
-
-var fileDescriptor_802e9beed3ec3b28 = []byte{
-	// 175 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4c, 0x2f, 0x2a, 0x48,
-	0x8e, 0x4f, 0x2a, 0xca, 0xcf, 0x4e, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x62, 0x2b,
-	0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x8a, 0xe5, 0xe2, 0x70, 0xce, 0xcf, 0xcb, 0xf3, 0xcc, 0x4b,
-	0xcb, 0x17, 0x92, 0xe5, 0xe2, 0x2a, 0x4e, 0x2d, 0x2a, 0xcb, 0x4c, 0x4e, 0x8d, 0xcf, 0x4c, 0x91,
-	0x60, 0x54, 0x60, 0xd4, 0xe0, 0x0d, 0xe2, 0x84, 0x8a, 0x78, 0xa6, 0x08, 0x49, 0x70, 0xb1, 0xe7,
-	0xa5, 0x96, 0x94, 0xe7, 0x17, 0x65, 0x4b, 0x30, 0x29, 0x30, 0x6a, 0x70, 0x06, 0xc1, 0xb8, 0x20,
-	0x99, 0xc4, 0x94, 0x94, 0xa2, 0xd4, 0xe2, 0x62, 0x09, 0x66, 0x88, 0x0c, 0x94, 0x6b, 0xe4, 0xcc,
-	0xc5, 0xe5, 0x1e, 0x14, 0xe0, 0xec, 0x04, 0xb6, 0x5a, 0xc8, 0x94, 0x8b, 0x3b, 0xb8, 0x24, 0xb1,
-	0xa8, 0x24, 0xb8, 0xa4, 0x28, 0x35, 0x31, 0x57, 0x48, 0x40, 0x0f, 0xe2, 0x08, 0x3d, 0x98, 0x0b,
-	0xa4, 0x30, 0x44, 0x34, 0x18, 0x0d, 0x18, 0x9d, 0x38, 0xa2, 0xa0, 0xae, 0x4d, 0x62, 0x03, 0x3b,
-	0xde, 0x18, 0x10, 0x00, 0x00, 0xff, 0xff, 0x10, 0x15, 0x39, 0x47, 0xd1, 0x00, 0x00, 0x00,
-}
-
 // Reference imports to suppress errors if they are not otherwise used.
 var _ context.Context
 var _ grpc.ClientConn
@@ -201,3 +184,20 @@ var _GRPCBroker_serviceDesc = grpc.ServiceDesc{
 	},
 	Metadata: "grpc_broker.proto",
 }
+
+func init() { proto.RegisterFile("grpc_broker.proto", fileDescriptor_grpc_broker_3322b07398605250) }
+
+var fileDescriptor_grpc_broker_3322b07398605250 = []byte{
+	// 175 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4c, 0x2f, 0x2a, 0x48,
+	0x8e, 0x4f, 0x2a, 0xca, 0xcf, 0x4e, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x62, 0x2b,
+	0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x8a, 0xe5, 0xe2, 0x70, 0xce, 0xcf, 0xcb, 0xf3, 0xcc, 0x4b,
+	0xcb, 0x17, 0x92, 0xe5, 0xe2, 0x2a, 0x4e, 0x2d, 0x2a, 0xcb, 0x4c, 0x4e, 0x8d, 0xcf, 0x4c, 0x91,
+	0x60, 0x54, 0x60, 0xd4, 0xe0, 0x0d, 0xe2, 0x84, 0x8a, 0x78, 0xa6, 0x08, 0x49, 0x70, 0xb1, 0xe7,
+	0xa5, 0x96, 0x94, 0xe7, 0x17, 0x65, 0x4b, 0x30, 0x29, 0x30, 0x6a, 0x70, 0x06, 0xc1, 0xb8, 0x20,
+	0x99, 0xc4, 0x94, 0x94, 0xa2, 0xd4, 0xe2, 0x62, 0x09, 0x66, 0x88, 0x0c, 0x94, 0x6b, 0xe4, 0xcc,
+	0xc5, 0xe5, 0x1e, 0x14, 0xe0, 0xec, 0x04, 0xb6, 0x5a, 0xc8, 0x94, 0x8b, 0x3b, 0xb8, 0x24, 0xb1,
+	0xa8, 0x24, 0xb8, 0xa4, 0x28, 0x35, 0x31, 0x57, 0x48, 0x40, 0x0f, 0xe2, 0x08, 0x3d, 0x98, 0x0b,
+	0xa4, 0x30, 0x44, 0x34, 0x18, 0x0d, 0x18, 0x9d, 0x38, 0xa2, 0xa0, 0xae, 0x4d, 0x62, 0x03, 0x3b,
+	0xde, 0x18, 0x10, 0x00, 0x00, 0xff, 0xff, 0x10, 0x15, 0x39, 0x47, 0xd1, 0x00, 0x00, 0x00,
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.proto

@@ -11,5 +11,3 @@ message ConnInfo {
 service GRPCBroker {
     rpc StartStream(stream ConnInfo) returns (stream ConnInfo);
 }
-
-

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go

@@ -3,12 +3,13 @@
 
 package plugin
 
+import proto "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
 import (
-	fmt "fmt"
-	proto "github.com/golang/protobuf/proto"
 	context "golang.org/x/net/context"
 	grpc "google.golang.org/grpc"
-	math "math"
 )
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -32,17 +33,16 @@ func (m *Empty) Reset()         { *m = Empty{} }
 func (m *Empty) String() string { return proto.CompactTextString(m) }
 func (*Empty) ProtoMessage()    {}
 func (*Empty) Descriptor() ([]byte, []int) {
-	return fileDescriptor_23c2c7e42feab570, []int{0}
+	return fileDescriptor_grpc_controller_08f8296ef6d80436, []int{0}
 }
-
 func (m *Empty) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Empty.Unmarshal(m, b)
 }
 func (m *Empty) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
 	return xxx_messageInfo_Empty.Marshal(b, m, deterministic)
 }
-func (m *Empty) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_Empty.Merge(m, src)
+func (dst *Empty) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_Empty.Merge(dst, src)
 }
 func (m *Empty) XXX_Size() int {
 	return xxx_messageInfo_Empty.Size(m)
@@ -57,19 +57,6 @@ func init() {
 	proto.RegisterType((*Empty)(nil), "plugin.Empty")
 }
 
-func init() { proto.RegisterFile("grpc_controller.proto", fileDescriptor_23c2c7e42feab570) }
-
-var fileDescriptor_23c2c7e42feab570 = []byte{
-	// 108 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4d, 0x2f, 0x2a, 0x48,
-	0x8e, 0x4f, 0xce, 0xcf, 0x2b, 0x29, 0xca, 0xcf, 0xc9, 0x49, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f,
-	0xc9, 0x17, 0x62, 0x2b, 0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x62, 0xe7, 0x62, 0x75, 0xcd, 0x2d,
-	0x28, 0xa9, 0x34, 0xb2, 0xe2, 0xe2, 0x73, 0x0f, 0x0a, 0x70, 0x76, 0x86, 0x2b, 0x14, 0xd2, 0xe0,
-	0xe2, 0x08, 0xce, 0x28, 0x2d, 0x49, 0xc9, 0x2f, 0xcf, 0x13, 0xe2, 0xd5, 0x83, 0xa8, 0xd7, 0x03,
-	0x2b, 0x96, 0x42, 0xe5, 0x3a, 0x71, 0x44, 0x41, 0x8d, 0x4b, 0x62, 0x03, 0x9b, 0x6e, 0x0c, 0x08,
-	0x00, 0x00, 0xff, 0xff, 0xab, 0x7c, 0x27, 0xe5, 0x76, 0x00, 0x00, 0x00,
-}
-
 // Reference imports to suppress errors if they are not otherwise used.
 var _ context.Context
 var _ grpc.ClientConn
@@ -141,3 +128,18 @@ var _GRPCController_serviceDesc = grpc.ServiceDesc{
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "grpc_controller.proto",
 }
+
+func init() {
+	proto.RegisterFile("grpc_controller.proto", fileDescriptor_grpc_controller_08f8296ef6d80436)
+}
+
+var fileDescriptor_grpc_controller_08f8296ef6d80436 = []byte{
+	// 108 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4d, 0x2f, 0x2a, 0x48,
+	0x8e, 0x4f, 0xce, 0xcf, 0x2b, 0x29, 0xca, 0xcf, 0xc9, 0x49, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f,
+	0xc9, 0x17, 0x62, 0x2b, 0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x62, 0xe7, 0x62, 0x75, 0xcd, 0x2d,
+	0x28, 0xa9, 0x34, 0xb2, 0xe2, 0xe2, 0x73, 0x0f, 0x0a, 0x70, 0x76, 0x86, 0x2b, 0x14, 0xd2, 0xe0,
+	0xe2, 0x08, 0xce, 0x28, 0x2d, 0x49, 0xc9, 0x2f, 0xcf, 0x13, 0xe2, 0xd5, 0x83, 0xa8, 0xd7, 0x03,
+	0x2b, 0x96, 0x42, 0xe5, 0x3a, 0x71, 0x44, 0x41, 0x8d, 0x4b, 0x62, 0x03, 0x9b, 0x6e, 0x0c, 0x08,
+	0x00, 0x00, 0xff, 0xff, 0xab, 0x7c, 0x27, 0xe5, 0x76, 0x00, 0x00, 0x00,
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.pb.go

@@ -0,0 +1,233 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: grpc_stdio.proto
+
+package plugin
+
+import proto "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+import empty "github.com/golang/protobuf/ptypes/empty"
+
+import (
+	context "golang.org/x/net/context"
+	grpc "google.golang.org/grpc"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+
+type StdioData_Channel int32
+
+const (
+	StdioData_INVALID StdioData_Channel = 0
+	StdioData_STDOUT  StdioData_Channel = 1
+	StdioData_STDERR  StdioData_Channel = 2
+)
+
+var StdioData_Channel_name = map[int32]string{
+	0: "INVALID",
+	1: "STDOUT",
+	2: "STDERR",
+}
+var StdioData_Channel_value = map[string]int32{
+	"INVALID": 0,
+	"STDOUT":  1,
+	"STDERR":  2,
+}
+
+func (x StdioData_Channel) String() string {
+	return proto.EnumName(StdioData_Channel_name, int32(x))
+}
+func (StdioData_Channel) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptor_grpc_stdio_db2934322ca63bd5, []int{0, 0}
+}
+
+// StdioData is a single chunk of stdout or stderr data that is streamed
+// from GRPCStdio.
+type StdioData struct {
+	Channel              StdioData_Channel `protobuf:"varint,1,opt,name=channel,proto3,enum=plugin.StdioData_Channel" json:"channel,omitempty"`
+	Data                 []byte            `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
+	XXX_unrecognized     []byte            `json:"-"`
+	XXX_sizecache        int32             `json:"-"`
+}
+
+func (m *StdioData) Reset()         { *m = StdioData{} }
+func (m *StdioData) String() string { return proto.CompactTextString(m) }
+func (*StdioData) ProtoMessage()    {}
+func (*StdioData) Descriptor() ([]byte, []int) {
+	return fileDescriptor_grpc_stdio_db2934322ca63bd5, []int{0}
+}
+func (m *StdioData) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_StdioData.Unmarshal(m, b)
+}
+func (m *StdioData) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_StdioData.Marshal(b, m, deterministic)
+}
+func (dst *StdioData) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_StdioData.Merge(dst, src)
+}
+func (m *StdioData) XXX_Size() int {
+	return xxx_messageInfo_StdioData.Size(m)
+}
+func (m *StdioData) XXX_DiscardUnknown() {
+	xxx_messageInfo_StdioData.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_StdioData proto.InternalMessageInfo
+
+func (m *StdioData) GetChannel() StdioData_Channel {
+	if m != nil {
+		return m.Channel
+	}
+	return StdioData_INVALID
+}
+
+func (m *StdioData) GetData() []byte {
+	if m != nil {
+		return m.Data
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterType((*StdioData)(nil), "plugin.StdioData")
+	proto.RegisterEnum("plugin.StdioData_Channel", StdioData_Channel_name, StdioData_Channel_value)
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// GRPCStdioClient is the client API for GRPCStdio service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type GRPCStdioClient interface {
+	// StreamStdio returns a stream that contains all the stdout/stderr.
+	// This RPC endpoint must only be called ONCE. Once stdio data is consumed
+	// it is not sent again.
+	//
+	// Callers should connect early to prevent blocking on the plugin process.
+	StreamStdio(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (GRPCStdio_StreamStdioClient, error)
+}
+
+type gRPCStdioClient struct {
+	cc *grpc.ClientConn
+}
+
+func NewGRPCStdioClient(cc *grpc.ClientConn) GRPCStdioClient {
+	return &gRPCStdioClient{cc}
+}
+
+func (c *gRPCStdioClient) StreamStdio(ctx context.Context, in *empty.Empty, opts ...grpc.CallOption) (GRPCStdio_StreamStdioClient, error) {
+	stream, err := c.cc.NewStream(ctx, &_GRPCStdio_serviceDesc.Streams[0], "/plugin.GRPCStdio/StreamStdio", opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &gRPCStdioStreamStdioClient{stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type GRPCStdio_StreamStdioClient interface {
+	Recv() (*StdioData, error)
+	grpc.ClientStream
+}
+
+type gRPCStdioStreamStdioClient struct {
+	grpc.ClientStream
+}
+
+func (x *gRPCStdioStreamStdioClient) Recv() (*StdioData, error) {
+	m := new(StdioData)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// GRPCStdioServer is the server API for GRPCStdio service.
+type GRPCStdioServer interface {
+	// StreamStdio returns a stream that contains all the stdout/stderr.
+	// This RPC endpoint must only be called ONCE. Once stdio data is consumed
+	// it is not sent again.
+	//
+	// Callers should connect early to prevent blocking on the plugin process.
+	StreamStdio(*empty.Empty, GRPCStdio_StreamStdioServer) error
+}
+
+func RegisterGRPCStdioServer(s *grpc.Server, srv GRPCStdioServer) {
+	s.RegisterService(&_GRPCStdio_serviceDesc, srv)
+}
+
+func _GRPCStdio_StreamStdio_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(empty.Empty)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(GRPCStdioServer).StreamStdio(m, &gRPCStdioStreamStdioServer{stream})
+}
+
+type GRPCStdio_StreamStdioServer interface {
+	Send(*StdioData) error
+	grpc.ServerStream
+}
+
+type gRPCStdioStreamStdioServer struct {
+	grpc.ServerStream
+}
+
+func (x *gRPCStdioStreamStdioServer) Send(m *StdioData) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+var _GRPCStdio_serviceDesc = grpc.ServiceDesc{
+	ServiceName: "plugin.GRPCStdio",
+	HandlerType: (*GRPCStdioServer)(nil),
+	Methods:     []grpc.MethodDesc{},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "StreamStdio",
+			Handler:       _GRPCStdio_StreamStdio_Handler,
+			ServerStreams: true,
+		},
+	},
+	Metadata: "grpc_stdio.proto",
+}
+
+func init() { proto.RegisterFile("grpc_stdio.proto", fileDescriptor_grpc_stdio_db2934322ca63bd5) }
+
+var fileDescriptor_grpc_stdio_db2934322ca63bd5 = []byte{
+	// 221 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x48, 0x2f, 0x2a, 0x48,
+	0x8e, 0x2f, 0x2e, 0x49, 0xc9, 0xcc, 0xd7, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x62, 0x2b, 0xc8,
+	0x29, 0x4d, 0xcf, 0xcc, 0x93, 0x92, 0x4e, 0xcf, 0xcf, 0x4f, 0xcf, 0x49, 0xd5, 0x07, 0x8b, 0x26,
+	0x95, 0xa6, 0xe9, 0xa7, 0xe6, 0x16, 0x94, 0x54, 0x42, 0x14, 0x29, 0xb5, 0x30, 0x72, 0x71, 0x06,
+	0x83, 0x34, 0xb9, 0x24, 0x96, 0x24, 0x0a, 0x19, 0x73, 0xb1, 0x27, 0x67, 0x24, 0xe6, 0xe5, 0xa5,
+	0xe6, 0x48, 0x30, 0x2a, 0x30, 0x6a, 0xf0, 0x19, 0x49, 0xea, 0x41, 0x0c, 0xd1, 0x83, 0xab, 0xd1,
+	0x73, 0x86, 0x28, 0x08, 0x82, 0xa9, 0x14, 0x12, 0xe2, 0x62, 0x49, 0x49, 0x2c, 0x49, 0x94, 0x60,
+	0x52, 0x60, 0xd4, 0xe0, 0x09, 0x02, 0xb3, 0x95, 0xf4, 0xb8, 0xd8, 0xa1, 0xea, 0x84, 0xb8, 0xb9,
+	0xd8, 0x3d, 0xfd, 0xc2, 0x1c, 0x7d, 0x3c, 0x5d, 0x04, 0x18, 0x84, 0xb8, 0xb8, 0xd8, 0x82, 0x43,
+	0x5c, 0xfc, 0x43, 0x43, 0x04, 0x18, 0xa1, 0x6c, 0xd7, 0xa0, 0x20, 0x01, 0x26, 0x23, 0x77, 0x2e,
+	0x4e, 0xf7, 0xa0, 0x00, 0x67, 0xb0, 0x2d, 0x42, 0x56, 0x5c, 0xdc, 0xc1, 0x25, 0x45, 0xa9, 0x89,
+	0xb9, 0x10, 0xae, 0x98, 0x1e, 0xc4, 0x03, 0x7a, 0x30, 0x0f, 0xe8, 0xb9, 0x82, 0x3c, 0x20, 0x25,
+	0x88, 0xe1, 0x36, 0x03, 0x46, 0x27, 0x8e, 0x28, 0xa8, 0xb7, 0x93, 0xd8, 0xc0, 0xca, 0x8d, 0x01,
+	0x01, 0x00, 0x00, 0xff, 0xff, 0x5d, 0xbb, 0xe0, 0x69, 0x19, 0x01, 0x00, 0x00,
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_stdio.proto

@@ -0,0 +1,30 @@
+syntax = "proto3";
+package plugin;
+option go_package = "plugin";
+
+import "google/protobuf/empty.proto";
+
+// GRPCStdio is a service that is automatically run by the plugin process
+// to stream any stdout/err data so that it can be mirrored on the plugin
+// host side.
+service GRPCStdio {
+  // StreamStdio returns a stream that contains all the stdout/stderr.
+  // This RPC endpoint must only be called ONCE. Once stdio data is consumed
+  // it is not sent again.
+  //
+  // Callers should connect early to prevent blocking on the plugin process.
+  rpc StreamStdio(google.protobuf.Empty) returns (stream StdioData);
+}
+
+// StdioData is a single chunk of stdout or stderr data that is streamed
+// from GRPCStdio.
+message StdioData {
+  enum Channel {
+    INVALID = 0;
+    STDOUT = 1;
+    STDERR = 2;
+  }
+
+  Channel channel = 1;
+  bytes data = 2;
+}

vendor/github.com/hashicorp/go-plugin/process_windows.go

@@ -19,6 +19,7 @@ func _pidAlive(pid int) bool {
 	if err != nil {
 		return false
 	}
+	defer syscall.CloseHandle(h)
 
 	var ec uint32
 	if e := syscall.GetExitCodeProcess(h, &ec); e != nil {

vendor/github.com/hashicorp/go-plugin/server.go

@@ -1,13 +1,14 @@
 package plugin
 
 import (
+	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"io"
 	"io/ioutil"
-	"log"
 	"net"
 	"os"
 	"os/signal"
@@ -15,10 +16,8 @@ import (
 	"sort"
 	"strconv"
 	"strings"
-	"sync/atomic"
-
-	"github.com/hashicorp/go-hclog"
 
+	hclog "github.com/hashicorp/go-hclog"
 	"google.golang.org/grpc"
 )
 
@@ -85,6 +84,51 @@ type ServeConfig struct {
 	// Logger is used to pass a logger into the server. If none is provided the
 	// server will create a default logger.
 	Logger hclog.Logger
+
+	// Test, if non-nil, will put plugin serving into "test mode". This is
+	// meant to be used as part of `go test` within a plugin's codebase to
+	// launch the plugin in-process and output a ReattachConfig.
+	//
+	// This changes the behavior of the server in a number of ways to
+	// accomodate the expectation of running in-process:
+	//
+	//   * The handshake cookie is not validated.
+	//   * Stdout/stderr will receive plugin reads and writes
+	//   * Connection information will not be sent to stdout
+	//
+	Test *ServeTestConfig
+}
+
+// ServeTestConfig configures plugin serving for test mode. See ServeConfig.Test.
+type ServeTestConfig struct {
+	// Context, if set, will force the plugin serving to end when cancelled.
+	// This is only a test configuration because the non-test configuration
+	// expects to take over the process and therefore end on an interrupt or
+	// kill signal. For tests, we need to kill the plugin serving routinely
+	// and this provides a way to do so.
+	//
+	// If you want to wait for the plugin process to close before moving on,
+	// you can wait on CloseCh.
+	Context context.Context
+
+	// If this channel is non-nil, we will send the ReattachConfig via
+	// this channel. This can be encoded (via JSON recommended) to the
+	// plugin client to attach to this plugin.
+	ReattachConfigCh chan<- *ReattachConfig
+
+	// CloseCh, if non-nil, will be closed when serving exits. This can be
+	// used along with Context to determine when the server is fully shut down.
+	// If this is not set, you can still use Context on its own, but note there
+	// may be a period of time between canceling the context and the plugin
+	// server being shut down.
+	CloseCh chan<- struct{}
+
+	// SyncStdio, if true, will enable the client side "SyncStdout/Stderr"
+	// functionality to work. This defaults to false because the implementation
+	// of making this work within test environments is particularly messy
+	// and SyncStdio functionality is fairly rare, so we default to the simple
+	// scenario.
+	SyncStdio bool
 }
 
 // protocolVersion determines the protocol version and plugin set to be used by
@@ -169,35 +213,52 @@ func protocolVersion(opts *ServeConfig) (int, Protocol, PluginSet) {
 // Serve serves the plugins given by ServeConfig.
 //
 // Serve doesn't return until the plugin is done being executed. Any
-// errors will be outputted to os.Stderr.
+// fixable errors will be output to os.Stderr and the process will
+// exit with a status code of 1. Serve will panic for unexpected
+// conditions where a user's fix is unknown.
 //
 // This is the method that plugins should call in their main() functions.
 func Serve(opts *ServeConfig) {
-	// Validate the handshake config
-	if opts.MagicCookieKey == "" || opts.MagicCookieValue == "" {
-		fmt.Fprintf(os.Stderr,
-			"Misconfigured ServeConfig given to serve this plugin: no magic cookie\n"+
-				"key or value was set. Please notify the plugin author and report\n"+
-				"this as a bug.\n")
-		os.Exit(1)
-	}
+	exitCode := -1
+	// We use this to trigger an `os.Exit` so that we can execute our other
+	// deferred functions. In test mode, we just output the err to stderr
+	// and return.
+	defer func() {
+		if opts.Test == nil && exitCode >= 0 {
+			os.Exit(exitCode)
+		}
 
-	// First check the cookie
-	if os.Getenv(opts.MagicCookieKey) != opts.MagicCookieValue {
-		fmt.Fprintf(os.Stderr,
-			"This binary is a plugin. These are not meant to be executed directly.\n"+
-				"Please execute the program that consumes these plugins, which will\n"+
-				"load any plugins automatically\n")
-		os.Exit(1)
+		if opts.Test != nil && opts.Test.CloseCh != nil {
+			close(opts.Test.CloseCh)
+		}
+	}()
+
+	if opts.Test == nil {
+		// Validate the handshake config
+		if opts.MagicCookieKey == "" || opts.MagicCookieValue == "" {
+			fmt.Fprintf(os.Stderr,
+				"Misconfigured ServeConfig given to serve this plugin: no magic cookie\n"+
+					"key or value was set. Please notify the plugin author and report\n"+
+					"this as a bug.\n")
+			exitCode = 1
+			return
+		}
+
+		// First check the cookie
+		if os.Getenv(opts.MagicCookieKey) != opts.MagicCookieValue {
+			fmt.Fprintf(os.Stderr,
+				"This binary is a plugin. These are not meant to be executed directly.\n"+
+					"Please execute the program that consumes these plugins, which will\n"+
+					"load any plugins automatically\n")
+			exitCode = 1
+			return
+		}
 	}
 
 	// negotiate the version and plugins
 	// start with default version in the handshake config
 	protoVersion, protoType, pluginSet := protocolVersion(opts)
 
-	// Logging goes to the original stderr
-	log.SetOutput(os.Stderr)
-
 	logger := opts.Logger
 	if logger == nil {
 		// internal logger to os.Stderr
@@ -208,19 +269,6 @@ func Serve(opts *ServeConfig) {
 		})
 	}
 
-	// Create our new stdout, stderr files. These will override our built-in
-	// stdout/stderr so that it works across the stream boundary.
-	stdout_r, stdout_w, err := os.Pipe()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error preparing plugin: %s\n", err)
-		os.Exit(1)
-	}
-	stderr_r, stderr_w, err := os.Pipe()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error preparing plugin: %s\n", err)
-		os.Exit(1)
-	}
-
 	// Register a listener so we can accept a connection
 	listener, err := serverListener()
 	if err != nil {
@@ -281,6 +329,33 @@ func Serve(opts *ServeConfig) {
 	// Create the channel to tell us when we're done
 	doneCh := make(chan struct{})
 
+	// Create our new stdout, stderr files. These will override our built-in
+	// stdout/stderr so that it works across the stream boundary.
+	var stdout_r, stderr_r io.Reader
+	stdout_r, stdout_w, err := os.Pipe()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error preparing plugin: %s\n", err)
+		os.Exit(1)
+	}
+	stderr_r, stderr_w, err := os.Pipe()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error preparing plugin: %s\n", err)
+		os.Exit(1)
+	}
+
+	// If we're in test mode, we tee off the reader and write the data
+	// as-is to our normal Stdout and Stderr so that they continue working
+	// while stdio works. This is because in test mode, we assume we're running
+	// in `go test` or some equivalent and we want output to go to standard
+	// locations.
+	if opts.Test != nil {
+		// TODO(mitchellh): This isn't super ideal because a TeeReader
+		// only works if the reader side is actively read. If we never
+		// connect via a plugin client, the output still gets swallowed.
+		stdout_r = io.TeeReader(stdout_r, os.Stdout)
+		stderr_r = io.TeeReader(stderr_r, os.Stderr)
+	}
+
 	// Build the server type
 	var server ServerProtocol
 	switch protoType {
@@ -323,35 +398,97 @@ func Serve(opts *ServeConfig) {
 
 	logger.Debug("plugin address", "network", listener.Addr().Network(), "address", listener.Addr().String())
 
-	// Output the address and service name to stdout so that the client can bring it up.
-	fmt.Printf("%d|%d|%s|%s|%s|%s\n",
-		CoreProtocolVersion,
-		protoVersion,
-		listener.Addr().Network(),
-		listener.Addr().String(),
-		protoType,
-		serverCert)
-	os.Stdout.Sync()
-
-	// Eat the interrupts
-	ch := make(chan os.Signal, 1)
-	signal.Notify(ch, os.Interrupt)
-	go func() {
-		var count int32 = 0
-		for {
-			<-ch
-			newCount := atomic.AddInt32(&count, 1)
-			logger.Debug("plugin received interrupt signal, ignoring", "count", newCount)
+	// Output the address and service name to stdout so that the client can
+	// bring it up. In test mode, we don't do this because clients will
+	// attach via a reattach config.
+	if opts.Test == nil {
+		fmt.Printf("%d|%d|%s|%s|%s|%s\n",
+			CoreProtocolVersion,
+			protoVersion,
+			listener.Addr().Network(),
+			listener.Addr().String(),
+			protoType,
+			serverCert)
+		os.Stdout.Sync()
+	} else if ch := opts.Test.ReattachConfigCh; ch != nil {
+		// Send back the reattach config that can be used. This isn't
+		// quite ready if they connect immediately but the client should
+		// retry a few times.
+		ch <- &ReattachConfig{
+			Protocol:        protoType,
+			ProtocolVersion: protoVersion,
+			Addr:            listener.Addr(),
+			Pid:             os.Getpid(),
+			Test:            true,
 		}
-	}()
+	}
 
-	// Set our new out, err
-	os.Stdout = stdout_w
-	os.Stderr = stderr_w
+	// Eat the interrupts. In test mode we disable this so that go test
+	// can be cancelled properly.
+	if opts.Test == nil {
+		ch := make(chan os.Signal, 1)
+		signal.Notify(ch, os.Interrupt)
+		go func() {
+			count := 0
+			for {
+				<-ch
+				count++
+				logger.Trace("plugin received interrupt signal, ignoring", "count", count)
+			}
+		}()
+	}
+
+	// Set our stdout, stderr to the stdio stream that clients can retrieve
+	// using ClientConfig.SyncStdout/err. We only do this for non-test mode
+	// or if the test mode explicitly requests it.
+	//
+	// In test mode, we use a multiwriter so that the data continues going
+	// to the normal stdout/stderr so output can show up in test logs. We
+	// also send to the stdio stream so that clients can continue working
+	// if they depend on that.
+	if opts.Test == nil || opts.Test.SyncStdio {
+		if opts.Test != nil {
+			// In test mode we need to maintain the original values so we can
+			// reset it.
+			defer func(out, err *os.File) {
+				os.Stdout = out
+				os.Stderr = err
+			}(os.Stdout, os.Stderr)
+		}
+		os.Stdout = stdout_w
+		os.Stderr = stderr_w
+	}
 
 	// Accept connections and wait for completion
 	go server.Serve(listener)
-	<-doneCh
+
+	ctx := context.Background()
+	if opts.Test != nil && opts.Test.Context != nil {
+		ctx = opts.Test.Context
+	}
+	select {
+	case <-ctx.Done():
+		// Cancellation. We can stop the server by closing the listener.
+		// This isn't graceful at all but this is currently only used by
+		// tests and its our only way to stop.
+		listener.Close()
+
+		// If this is a grpc server, then we also ask the server itself to
+		// end which will kill all connections. There isn't an easy way to do
+		// this for net/rpc currently but net/rpc is more and more unused.
+		if s, ok := server.(*GRPCServer); ok {
+			s.Stop()
+		}
+
+		// Wait for the server itself to shut down
+		<-doneCh
+
+	case <-doneCh:
+		// Note that given the documentation of Serve we should probably be
+		// setting exitCode = 0 and using os.Exit here. That's how it used to
+		// work before extracting this library. However, for years we've done
+		// this so we'll keep this functionality.
+	}
 }
 
 func serverListener() (net.Listener, error) {
@@ -390,7 +527,7 @@ func serverListener_tcp() (net.Listener, error) {
 	}
 
 	if minPort > maxPort {
-		return nil, fmt.Errorf("ENV_MIN_PORT value of %d is greater than PLUGIN_MAX_PORT value of %d", minPort, maxPort)
+		return nil, fmt.Errorf("PLUGIN_MIN_PORT value of %d is greater than PLUGIN_MAX_PORT value of %d", minPort, maxPort)
 	}
 
 	for port := minPort; port <= maxPort; port++ {

vendor/github.com/hashicorp/go-plugin/testing.go

@@ -7,9 +7,9 @@ import (
 	"net"
 	"net/rpc"
 
-	"github.com/mitchellh/go-testing-interface"
 	hclog "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-plugin/internal/plugin"
+	"github.com/mitchellh/go-testing-interface"
 	"google.golang.org/grpc"
 )
 

vendor/github.com/hashicorp/go-secure-stdlib/mlock/LICENSE

@@ -0,0 +1,363 @@
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. "Contributor"
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+
+     means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the terms of
+        a Secondary License.
+
+1.6. "Executable Form"
+
+     means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+
+     means a work that combines Covered Software with other material, in a
+     separate file or files, that is not Covered Software.
+
+1.8. "License"
+
+     means this document.
+
+1.9. "Licensable"
+
+     means having the right to grant, to the maximum extent possible, whether
+     at the time of the initial grant or subsequently, any and all of the
+     rights conveyed by this License.
+
+1.10. "Modifications"
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+
+      means any patent claim(s), including without limitation, method,
+      process, and apparatus claims, in any patent Licensable by such
+      Contributor that would be infringed, but for the grant of the License,
+      by the making, using, selling, offering for sale, having made, import,
+      or transfer of either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+
+      means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, "You" includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, "control" means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or
+        as part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its
+        Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution
+     become effective for each Contribution on the date the Contributor first
+     distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under
+     this License. No additional rights or licenses will be implied from the
+     distribution or licensing of Covered Software under this License.
+     Notwithstanding Section 2.1(b) above, no patent license is granted by a
+     Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party's
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of
+        its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks,
+     or logos of any Contributor (except as may be necessary to comply with
+     the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this
+     License (see Section 10.2) or under the terms of a Secondary License (if
+     permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its
+     Contributions are its original creation(s) or it has sufficient rights to
+     grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under
+     applicable copyright doctrines of fair use, fair dealing, or other
+     equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under
+     the terms of this License. You must inform recipients that the Source
+     Code Form of the Covered Software is governed by the terms of this
+     License, and how they can obtain a copy of this License. You may not
+     attempt to alter or restrict the recipients' rights in the Source Code
+     Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this
+        License, or sublicense it under different terms, provided that the
+        license for the Executable Form does not attempt to limit or alter the
+        recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for
+     the Covered Software. If the Larger Work is a combination of Covered
+     Software with a work governed by one or more Secondary Licenses, and the
+     Covered Software is not Incompatible With Secondary Licenses, this
+     License permits You to additionally distribute such Covered Software
+     under the terms of such Secondary License(s), so that the recipient of
+     the Larger Work may, at their option, further distribute the Covered
+     Software under the terms of either this License or such Secondary
+     License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices
+     (including copyright notices, patent notices, disclaimers of warranty, or
+     limitations of liability) contained within the Source Code Form of the
+     Covered Software, except that You may alter any license notices to the
+     extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on
+     behalf of any Contributor. You must make it absolutely clear that any
+     such warranty, support, indemnity, or liability obligation is offered by
+     You alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute,
+   judicial order, or regulation then You must: (a) comply with the terms of
+   this License to the maximum extent possible; and (b) describe the
+   limitations and the code they affect. Such description must be placed in a
+   text file included with all distributions of the Covered Software under
+   this License. Except to the extent prohibited by statute or regulation,
+   such description must be sufficiently detailed for a recipient of ordinary
+   skill to be able to understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing
+     basis, if such Contributor fails to notify You of the non-compliance by
+     some reasonable means prior to 60 days after You have come back into
+     compliance. Moreover, Your grants from a particular Contributor are
+     reinstated on an ongoing basis if such Contributor notifies You of the
+     non-compliance by some reasonable means, this is the first time You have
+     received notice of non-compliance with this License from such
+     Contributor, and You become compliant prior to 30 days after Your receipt
+     of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions,
+     counter-claims, and cross-claims) alleging that a Contributor Version
+     directly or indirectly infringes any patent, then the rights granted to
+     You by any and all Contributors for the Covered Software under Section
+     2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an "as is" basis,
+   without warranty of any kind, either expressed, implied, or statutory,
+   including, without limitation, warranties that the Covered Software is free
+   of defects, merchantable, fit for a particular purpose or non-infringing.
+   The entire risk as to the quality and performance of the Covered Software
+   is with You. Should any Covered Software prove defective in any respect,
+   You (not any Contributor) assume the cost of any necessary servicing,
+   repair, or correction. This disclaimer of warranty constitutes an essential
+   part of this License. No use of  any Covered Software is authorized under
+   this License except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from
+   such party's negligence to the extent applicable law prohibits such
+   limitation. Some jurisdictions do not allow the exclusion or limitation of
+   incidental or consequential damages, so this exclusion and limitation may
+   not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts
+   of a jurisdiction where the defendant maintains its principal place of
+   business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions. Nothing
+   in this Section shall prevent a party's ability to bring cross-claims or
+   counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides that
+   the language of a contract shall be construed against the drafter shall not
+   be used to construe this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version
+      of the License under which You originally received the Covered Software,
+      or under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a
+      modified version of this License if you rename the license and remove
+      any references to the name of the license steward (except to note that
+      such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+      Licenses If You choose to distribute Source Code Form that is
+      Incompatible With Secondary Licenses under the terms of this version of
+      the License, the notice described in Exhibit B of this License must be
+      attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file,
+then You may include the notice in a location (such as a LICENSE file in a
+relevant directory) where a recipient would be likely to look for such a
+notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+      This Source Code Form is "Incompatible
+      With Secondary Licenses", as defined by
+      the Mozilla Public License, v. 2.0.
+

vendor/github.com/hashicorp/go-secure-stdlib/mlock/go.mod

@@ -0,0 +1,5 @@
+module github.com/hashicorp/go-secure-stdlib/mlock
+
+go 1.16
+
+require golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c

vendor/github.com/hashicorp/go-secure-stdlib/mlock/go.sum

@@ -0,0 +1,2 @@
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c h1:F1jZWGFhYfh0Ci55sIpILtKKK8p3i2/krTr0H1rg74I=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

vendor/github.com/hashicorp/vault/api/auth.go

@@ -1,11 +1,46 @@
 package api
 
+import (
+	"context"
+	"fmt"
+)
+
 // Auth is used to perform credential backend related operations.
 type Auth struct {
 	c *Client
 }
 
+type AuthMethod interface {
+	Login(ctx context.Context, client *Client) (*Secret, error)
+}
+
 // Auth is used to return the client for credential-backend API calls.
 func (c *Client) Auth() *Auth {
 	return &Auth{c: c}
 }
+
+// Login sets up the required request body for login requests to the given auth
+// method's /login API endpoint, and then performs a write to it. After a
+// successful login, this method will automatically set the client's token to
+// the login response's ClientToken as well.
+//
+// The Secret returned is the authentication secret, which if desired can be
+// passed as input to the NewLifetimeWatcher method in order to start
+// automatically renewing the token.
+func (a *Auth) Login(ctx context.Context, authMethod AuthMethod) (*Secret, error) {
+	if authMethod == nil {
+		return nil, fmt.Errorf("no auth method provided for login")
+	}
+
+	authSecret, err := authMethod.Login(ctx, a.c)
+	if err != nil {
+		return nil, fmt.Errorf("unable to log in to auth method: %w", err)
+	}
+	if authSecret == nil || authSecret.Auth == nil || authSecret.Auth.ClientToken == "" {
+		return nil, fmt.Errorf("login response from auth method did not return client token")
+	}
+
+	a.c.SetToken(authSecret.Auth.ClientToken)
+
+	return authSecret, nil
+}

vendor/github.com/hashicorp/vault/api/go.mod

@@ -16,7 +16,7 @@ require (
 	github.com/hashicorp/go-rootcerts v1.0.2
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1
 	github.com/hashicorp/hcl v1.0.0
-	github.com/hashicorp/vault/sdk v0.2.1
+	github.com/hashicorp/vault/sdk v0.3.0
 	github.com/mitchellh/mapstructure v1.4.2
 	golang.org/x/net v0.0.0-20210226172049-e18ecbb05110
 	golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1

vendor/github.com/hashicorp/vault/sdk/helper/certutil/helpers.go

@@ -3,6 +3,7 @@ package certutil
 import (
 	"bytes"
 	"crypto"
+	"crypto/dsa"
 	"crypto/ecdsa"
 	"crypto/ed25519"
 	"crypto/elliptic"
@@ -164,6 +165,10 @@ func ParsePEMBundle(pemBundle string) (*ParsedCertBundle, error) {
 				parsedBundle.PrivateKey = signer
 				parsedBundle.PrivateKeyType = ECPrivateKey
 				parsedBundle.PrivateKeyBytes = pemBlock.Bytes
+			case ed25519.PrivateKey:
+				parsedBundle.PrivateKey = signer
+				parsedBundle.PrivateKeyType = Ed25519PrivateKey
+				parsedBundle.PrivateKeyBytes = pemBlock.Bytes
 			}
 		} else if certificates, err := x509.ParseCertificates(pemBlock.Bytes); err == nil {
 			certPath = append(certPath, &CertBlock{
@@ -217,6 +222,17 @@ func generatePrivateKey(keyType string, keyBits int, container ParsedPrivateKeyC
 
 	switch keyType {
 	case "rsa":
+		// XXX: there is a false-positive CodeQL path here around keyBits;
+		// because of a default zero value in the TypeDurationSecond and
+		// TypeSignedDurationSecond cases of schema.DefaultOrZero(), it
+		// thinks it is possible to end up with < 2048 bit RSA Key here.
+		// While this is true for SSH keys, it isn't true for PKI keys
+		// due to ValidateKeyTypeLength(...) below. While we could close
+		// the report as a false-positive, enforcing a minimum keyBits size
+		// here of 2048 would ensure no other paths exist.
+		if keyBits < 2048 {
+			return errutil.InternalError{Err: fmt.Sprintf("insecure bit length for RSA private key: %d", keyBits)}
+		}
 		privateKeyType = RSAPrivateKey
 		privateKey, err = rsa.GenerateKey(randReader, keyBits)
 		if err != nil {
@@ -246,6 +262,16 @@ func generatePrivateKey(keyType string, keyBits int, container ParsedPrivateKeyC
 		if err != nil {
 			return errutil.InternalError{Err: fmt.Sprintf("error marshalling EC private key: %v", err)}
 		}
+	case "ed25519":
+		privateKeyType = Ed25519PrivateKey
+		_, privateKey, err = ed25519.GenerateKey(randReader)
+		if err != nil {
+			return errutil.InternalError{Err: fmt.Sprintf("error generating ed25519 private key: %v", err)}
+		}
+		privateKeyBytes, err = x509.MarshalPKCS8PrivateKey(privateKey.(ed25519.PrivateKey))
+		if err != nil {
+			return errutil.InternalError{Err: fmt.Sprintf("error marshalling Ed25519 private key: %v", err)}
+		}
 	default:
 		return errutil.UserError{Err: fmt.Sprintf("unknown key type: %s", keyType)}
 	}
@@ -309,7 +335,16 @@ func ComparePublicKeys(key1Iface, key2Iface crypto.PublicKey) (bool, error) {
 			return false, nil
 		}
 		return true, nil
-
+	case ed25519.PublicKey:
+		key1 := key1Iface.(ed25519.PublicKey)
+		key2, ok := key2Iface.(ed25519.PublicKey)
+		if !ok {
+			return false, fmt.Errorf("key types do not match: %T and %T", key1Iface, key2Iface)
+		}
+		if !key1.Equal(key2) {
+			return false, nil
+		}
+		return true, nil
 	default:
 		return false, fmt.Errorf("cannot compare key with type %T", key1Iface)
 	}
@@ -490,6 +525,17 @@ func StringToOid(in string) (asn1.ObjectIdentifier, error) {
 	return asn1.ObjectIdentifier(ret), nil
 }
 
+func ValidateSignatureLength(keyBits int) error {
+	switch keyBits {
+	case 256:
+	case 384:
+	case 512:
+	default:
+		return fmt.Errorf("unsupported signature algorithm: %d", keyBits)
+	}
+	return nil
+}
+
 func ValidateKeyTypeLength(keyType string, keyBits int) error {
 	switch keyType {
 	case "rsa":
@@ -510,7 +556,7 @@ func ValidateKeyTypeLength(keyType string, keyBits int) error {
 		default:
 			return fmt.Errorf("unsupported bit length for EC key: %d", keyBits)
 		}
-	case "any":
+	case "any", "ed25519":
 	default:
 		return fmt.Errorf("unknown key type %s", keyType)
 	}
@@ -598,9 +644,25 @@ func createCertificate(data *CreationBundle, randReader io.Reader) (*ParsedCertB
 	if data.SigningBundle != nil {
 		switch data.SigningBundle.PrivateKeyType {
 		case RSAPrivateKey:
-			certTemplate.SignatureAlgorithm = x509.SHA256WithRSA
+			switch data.Params.SignatureBits {
+			case 256:
+				certTemplate.SignatureAlgorithm = x509.SHA256WithRSA
+			case 384:
+				certTemplate.SignatureAlgorithm = x509.SHA384WithRSA
+			case 512:
+				certTemplate.SignatureAlgorithm = x509.SHA512WithRSA
+			}
+		case Ed25519PrivateKey:
+			certTemplate.SignatureAlgorithm = x509.PureEd25519
 		case ECPrivateKey:
-			certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA256
+			switch data.Params.SignatureBits {
+			case 256:
+				certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA256
+			case 384:
+				certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA384
+			case 512:
+				certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA512
+			}
 		}
 
 		caCert := data.SigningBundle.Certificate
@@ -618,9 +680,25 @@ func createCertificate(data *CreationBundle, randReader io.Reader) (*ParsedCertB
 
 		switch data.Params.KeyType {
 		case "rsa":
-			certTemplate.SignatureAlgorithm = x509.SHA256WithRSA
+			switch data.Params.SignatureBits {
+			case 256:
+				certTemplate.SignatureAlgorithm = x509.SHA256WithRSA
+			case 384:
+				certTemplate.SignatureAlgorithm = x509.SHA384WithRSA
+			case 512:
+				certTemplate.SignatureAlgorithm = x509.SHA512WithRSA
+			}
+		case "ed25519":
+			certTemplate.SignatureAlgorithm = x509.PureEd25519
 		case "ec":
-			certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA256
+			switch data.Params.SignatureBits {
+			case 256:
+				certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA256
+			case 384:
+				certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA384
+			case 512:
+				certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA512
+			}
 		}
 
 		certTemplate.AuthorityKeyId = subjKeyID
@@ -715,6 +793,8 @@ func createCSR(data *CreationBundle, addBasicConstraints bool, randReader io.Rea
 		csrTemplate.SignatureAlgorithm = x509.SHA256WithRSA
 	case "ec":
 		csrTemplate.SignatureAlgorithm = x509.ECDSAWithSHA256
+	case "ed25519":
+		csrTemplate.SignatureAlgorithm = x509.PureEd25519
 	}
 
 	csr, err := x509.CreateCertificateRequest(randReader, csrTemplate, result.PrivateKey)
@@ -791,9 +871,23 @@ func signCertificate(data *CreationBundle, randReader io.Reader) (*ParsedCertBun
 
 	switch data.SigningBundle.PrivateKeyType {
 	case RSAPrivateKey:
-		certTemplate.SignatureAlgorithm = x509.SHA256WithRSA
+		switch data.Params.SignatureBits {
+		case 256:
+			certTemplate.SignatureAlgorithm = x509.SHA256WithRSA
+		case 384:
+			certTemplate.SignatureAlgorithm = x509.SHA384WithRSA
+		case 512:
+			certTemplate.SignatureAlgorithm = x509.SHA512WithRSA
+		}
 	case ECPrivateKey:
-		certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA256
+		switch data.Params.SignatureBits {
+		case 256:
+			certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA256
+		case 384:
+			certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA384
+		case 512:
+			certTemplate.SignatureAlgorithm = x509.ECDSAWithSHA512
+		}
 	}
 
 	if data.Params.UseCSRValues {
@@ -920,3 +1014,22 @@ func parseCertsPEM(pemCerts []byte) ([]*x509.Certificate, error) {
 	}
 	return certs, nil
 }
+
+// GetPublicKeySize returns the key size in bits for a given arbitrary crypto.PublicKey
+// Returns -1 for an unsupported key type.
+func GetPublicKeySize(key crypto.PublicKey) int {
+	if key, ok := key.(*rsa.PublicKey); ok {
+		return key.Size() * 8
+	}
+	if key, ok := key.(*ecdsa.PublicKey); ok {
+		return key.Params().BitSize
+	}
+	if key, ok := key.(ed25519.PublicKey); ok {
+		return len(key) * 8
+	}
+	if key, ok := key.(dsa.PublicKey); ok {
+		return key.Y.BitLen()
+	}
+
+	return -1
+}

vendor/github.com/hashicorp/vault/sdk/helper/certutil/types.go

@@ -12,6 +12,7 @@ import (
 	"bytes"
 	"crypto"
 	"crypto/ecdsa"
+	"crypto/ed25519"
 	"crypto/rsa"
 	"crypto/tls"
 	"crypto/x509"
@@ -56,6 +57,7 @@ const (
 	UnknownPrivateKey PrivateKeyType = ""
 	RSAPrivateKey     PrivateKeyType = "rsa"
 	ECPrivateKey      PrivateKeyType = "ec"
+	Ed25519PrivateKey PrivateKeyType = "ed25519"
 )
 
 // TLSUsage controls whether the intended usage of a *tls.Config
@@ -185,6 +187,8 @@ func (c *CertBundle) ToParsedCertBundle() (*ParsedCertBundle, error) {
 				c.PrivateKeyType = ECPrivateKey
 			case RSAPrivateKey:
 				c.PrivateKeyType = RSAPrivateKey
+			case Ed25519PrivateKey:
+				c.PrivateKeyType = Ed25519PrivateKey
 			}
 		default:
 			return nil, errutil.UserError{Err: fmt.Sprintf("Unsupported key block type: %s", pemBlock.Type)}
@@ -290,6 +294,8 @@ func (p *ParsedCertBundle) ToCertBundle() (*CertBundle, error) {
 				block.Type = string(ECBlock)
 			case RSAPrivateKey:
 				block.Type = string(PKCS1Block)
+			case Ed25519PrivateKey:
+				block.Type = string(PKCS8Block)
 			}
 		}
 
@@ -380,7 +386,7 @@ func (p *ParsedCertBundle) getSigner() (crypto.Signer, error) {
 	case PKCS8Block:
 		if k, err := x509.ParsePKCS8PrivateKey(p.PrivateKeyBytes); err == nil {
 			switch k := k.(type) {
-			case *rsa.PrivateKey, *ecdsa.PrivateKey:
+			case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey:
 				return k.(crypto.Signer), nil
 			default:
 				return nil, errutil.UserError{Err: "Found unknown private key type in pkcs#8 wrapping"}
@@ -411,6 +417,8 @@ func getPKCS8Type(bs []byte) (PrivateKeyType, error) {
 		return ECPrivateKey, nil
 	case *rsa.PrivateKey:
 		return RSAPrivateKey, nil
+	case ed25519.PrivateKey:
+		return Ed25519PrivateKey, nil
 	default:
 		return UnknownPrivateKey, errutil.UserError{Err: "Found unknown private key type in pkcs#8 wrapping"}
 	}
@@ -443,6 +451,9 @@ func (c *CSRBundle) ToParsedCSRBundle() (*ParsedCSRBundle, error) {
 			} else if _, err := x509.ParsePKCS1PrivateKey(pemBlock.Bytes); err == nil {
 				result.PrivateKeyType = RSAPrivateKey
 				c.PrivateKeyType = "rsa"
+			} else if _, err := x509.ParsePKCS8PrivateKey(pemBlock.Bytes); err == nil {
+				result.PrivateKeyType = Ed25519PrivateKey
+				c.PrivateKeyType = "ed25519"
 			} else {
 				return nil, errutil.UserError{Err: fmt.Sprintf("Unknown private key type in bundle: %s", c.PrivateKeyType)}
 			}
@@ -491,6 +502,9 @@ func (p *ParsedCSRBundle) ToCSRBundle() (*CSRBundle, error) {
 		case ECPrivateKey:
 			result.PrivateKeyType = "ec"
 			block.Type = "EC PRIVATE KEY"
+		case Ed25519PrivateKey:
+			result.PrivateKeyType = "ed25519"
+			block.Type = "PRIVATE KEY"
 		default:
 			return nil, errutil.InternalError{Err: "Could not determine private key type when creating block"}
 		}
@@ -525,8 +539,15 @@ func (p *ParsedCSRBundle) getSigner() (crypto.Signer, error) {
 			return nil, errutil.UserError{Err: fmt.Sprintf("Unable to parse CA's private RSA key: %s", err)}
 		}
 
+	case Ed25519PrivateKey:
+		signerd, err := x509.ParsePKCS8PrivateKey(p.PrivateKeyBytes)
+		signer = signerd.(ed25519.PrivateKey)
+		if err != nil {
+			return nil, errutil.UserError{Err: fmt.Sprintf("Unable to parse CA's private Ed25519 key: %s", err)}
+		}
+
 	default:
-		return nil, errutil.UserError{Err: "Unable to determine type of private key; only RSA and EC are supported"}
+		return nil, errutil.UserError{Err: "Unable to determine type of private key; only RSA, Ed25519 and EC are supported"}
 	}
 	return signer, nil
 }
@@ -677,6 +698,7 @@ type CreationParameters struct {
 	ExtKeyUsageOIDs               []string
 	PolicyIdentifiers             []string
 	BasicConstraintsValidForNonCA bool
+	SignatureBits                 int
 
 	// Only used when signing a CA cert
 	UseCSRValues        bool

vendor/github.com/hashicorp/vault/sdk/helper/consts/error.go

@@ -7,6 +7,10 @@ var (
 	// No operation is expected to succeed before unsealing
 	ErrSealed = errors.New("Vault is sealed")
 
+	// ErrAPILocked is returned if an operation is performed when the API is
+	// locked for the request namespace.
+	ErrAPILocked = errors.New("API access to this namespace has been locked by an administrator")
+
 	// ErrStandby is returned if an operation is performed on a standby Vault.
 	// No operation is expected to succeed until active.
 	ErrStandby = errors.New("Vault is in standby mode")

vendor/github.com/hashicorp/vault/sdk/helper/consts/replication.go

@@ -148,3 +148,12 @@ func (r ReplicationState) HasState(flag ReplicationState) bool { return r&flag !
 func (r *ReplicationState) AddState(flag ReplicationState)     { *r |= flag }
 func (r *ReplicationState) ClearState(flag ReplicationState)   { *r &= ^flag }
 func (r *ReplicationState) ToggleState(flag ReplicationState)  { *r ^= flag }
+
+type HAState uint32
+
+const (
+	_ HAState = iota
+	Standby
+	PerfStandby
+	Active
+)

vendor/github.com/hashicorp/vault/sdk/helper/pluginutil/env.go

@@ -3,8 +3,8 @@ package pluginutil
 import (
 	"os"
 
+	"github.com/hashicorp/go-secure-stdlib/mlock"
 	version "github.com/hashicorp/go-version"
-	"github.com/hashicorp/vault/sdk/helper/mlock"
 )
 
 var (

vendor/github.com/hashicorp/vault/sdk/helper/strutil/strutil.go

@@ -1,480 +1,94 @@
+// DEPRECATED: this has been moved to go-secure-stdlib and will be removed
 package strutil
 
 import (
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"sort"
-	"strings"
-
-	"github.com/hashicorp/errwrap"
-	glob "github.com/ryanuber/go-glob"
+	extstrutil "github.com/hashicorp/go-secure-stdlib/strutil"
 )
 
-// StrListContainsGlob looks for a string in a list of strings and allows
-// globs.
 func StrListContainsGlob(haystack []string, needle string) bool {
-	for _, item := range haystack {
-		if glob.Glob(item, needle) {
-			return true
-		}
-	}
-	return false
+	return extstrutil.StrListContainsGlob(haystack, needle)
 }
 
-// StrListContains looks for a string in a list of strings.
 func StrListContains(haystack []string, needle string) bool {
-	for _, item := range haystack {
-		if item == needle {
-			return true
-		}
-	}
-	return false
+	return extstrutil.StrListContains(haystack, needle)
 }
 
-// StrListContainsCaseInsensitive looks for a string in a list of strings.
 func StrListContainsCaseInsensitive(haystack []string, needle string) bool {
-	for _, item := range haystack {
-		if strings.EqualFold(item, needle) {
-			return true
-		}
-	}
-	return false
+	return extstrutil.StrListContainsCaseInsensitive(haystack, needle)
 }
 
-// StrListSubset checks if a given list is a subset
-// of another set
 func StrListSubset(super, sub []string) bool {
-	for _, item := range sub {
-		if !StrListContains(super, item) {
-			return false
-		}
-	}
-	return true
+	return extstrutil.StrListSubset(super, sub)
 }
 
-// ParseDedupAndSortStrings parses a comma separated list of strings
-// into a slice of strings. The return slice will be sorted and will
-// not contain duplicate or empty items.
 func ParseDedupAndSortStrings(input string, sep string) []string {
-	input = strings.TrimSpace(input)
-	parsed := []string{}
-	if input == "" {
-		// Don't return nil
-		return parsed
-	}
-	return RemoveDuplicates(strings.Split(input, sep), false)
+	return extstrutil.ParseDedupAndSortStrings(input, sep)
 }
 
-// ParseDedupLowercaseAndSortStrings parses a comma separated list of
-// strings into a slice of strings. The return slice will be sorted and
-// will not contain duplicate or empty items. The values will be converted
-// to lower case.
 func ParseDedupLowercaseAndSortStrings(input string, sep string) []string {
-	input = strings.TrimSpace(input)
-	parsed := []string{}
-	if input == "" {
-		// Don't return nil
-		return parsed
-	}
-	return RemoveDuplicates(strings.Split(input, sep), true)
+	return extstrutil.ParseDedupLowercaseAndSortStrings(input, sep)
 }
 
-// ParseKeyValues parses a comma separated list of `<key>=<value>` tuples
-// into a map[string]string.
 func ParseKeyValues(input string, out map[string]string, sep string) error {
-	if out == nil {
-		return fmt.Errorf("'out is nil")
-	}
-
-	keyValues := ParseDedupLowercaseAndSortStrings(input, sep)
-	if len(keyValues) == 0 {
-		return nil
-	}
-
-	for _, keyValue := range keyValues {
-		shards := strings.Split(keyValue, "=")
-		if len(shards) != 2 {
-			return fmt.Errorf("invalid <key,value> format")
-		}
-
-		key := strings.TrimSpace(shards[0])
-		value := strings.TrimSpace(shards[1])
-		if key == "" || value == "" {
-			return fmt.Errorf("invalid <key,value> pair: key: %q value: %q", key, value)
-		}
-		out[key] = value
-	}
-	return nil
+	return extstrutil.ParseKeyValues(input, out, sep)
 }
 
-// ParseArbitraryKeyValues parses arbitrary <key,value> tuples. The input
-// can be one of the following:
-// * JSON string
-// * Base64 encoded JSON string
-// * Comma separated list of `<key>=<value>` pairs
-// * Base64 encoded string containing comma separated list of
-//   `<key>=<value>` pairs
-//
-// Input will be parsed into the output parameter, which should
-// be a non-nil map[string]string.
 func ParseArbitraryKeyValues(input string, out map[string]string, sep string) error {
-	input = strings.TrimSpace(input)
-	if input == "" {
-		return nil
-	}
-	if out == nil {
-		return fmt.Errorf("'out' is nil")
-	}
-
-	// Try to base64 decode the input. If successful, consider the decoded
-	// value as input.
-	inputBytes, err := base64.StdEncoding.DecodeString(input)
-	if err == nil {
-		input = string(inputBytes)
-	}
-
-	// Try to JSON unmarshal the input. If successful, consider that the
-	// metadata was supplied as JSON input.
-	err = json.Unmarshal([]byte(input), &out)
-	if err != nil {
-		// If JSON unmarshalling fails, consider that the input was
-		// supplied as a comma separated string of 'key=value' pairs.
-		if err = ParseKeyValues(input, out, sep); err != nil {
-			return errwrap.Wrapf("failed to parse the input: {{err}}", err)
-		}
-	}
-
-	// Validate the parsed input
-	for key, value := range out {
-		if key != "" && value == "" {
-			return fmt.Errorf("invalid value for key %q", key)
-		}
-	}
-
-	return nil
+	return extstrutil.ParseArbitraryKeyValues(input, out, sep)
 }
 
-// ParseStringSlice parses a `sep`-separated list of strings into a
-// []string with surrounding whitespace removed.
-//
-// The output will always be a valid slice but may be of length zero.
 func ParseStringSlice(input string, sep string) []string {
-	input = strings.TrimSpace(input)
-	if input == "" {
-		return []string{}
-	}
-
-	splitStr := strings.Split(input, sep)
-	ret := make([]string, len(splitStr))
-	for i, val := range splitStr {
-		ret[i] = strings.TrimSpace(val)
-	}
-
-	return ret
+	return extstrutil.ParseStringSlice(input, sep)
 }
 
-// ParseArbitraryStringSlice parses arbitrary string slice. The input
-// can be one of the following:
-// * JSON string
-// * Base64 encoded JSON string
-// * `sep` separated list of values
-// * Base64-encoded string containing a `sep` separated list of values
-//
-// Note that the separator is ignored if the input is found to already be in a
-// structured format (e.g., JSON)
-//
-// The output will always be a valid slice but may be of length zero.
 func ParseArbitraryStringSlice(input string, sep string) []string {
-	input = strings.TrimSpace(input)
-	if input == "" {
-		return []string{}
-	}
-
-	// Try to base64 decode the input. If successful, consider the decoded
-	// value as input.
-	inputBytes, err := base64.StdEncoding.DecodeString(input)
-	if err == nil {
-		input = string(inputBytes)
-	}
-
-	ret := []string{}
-
-	// Try to JSON unmarshal the input. If successful, consider that the
-	// metadata was supplied as JSON input.
-	err = json.Unmarshal([]byte(input), &ret)
-	if err != nil {
-		// If JSON unmarshalling fails, consider that the input was
-		// supplied as a separated string of values.
-		return ParseStringSlice(input, sep)
-	}
-
-	if ret == nil {
-		return []string{}
-	}
-
-	return ret
+	return extstrutil.ParseArbitraryStringSlice(input, sep)
 }
 
-// TrimStrings takes a slice of strings and returns a slice of strings
-// with trimmed spaces
 func TrimStrings(items []string) []string {
-	ret := make([]string, len(items))
-	for i, item := range items {
-		ret[i] = strings.TrimSpace(item)
-	}
-	return ret
+	return extstrutil.TrimStrings(items)
 }
 
-// RemoveDuplicates removes duplicate and empty elements from a slice of
-// strings. This also may convert the items in the slice to lower case and
-// returns a sorted slice.
 func RemoveDuplicates(items []string, lowercase bool) []string {
-	itemsMap := map[string]bool{}
-	for _, item := range items {
-		item = strings.TrimSpace(item)
-		if lowercase {
-			item = strings.ToLower(item)
-		}
-		if item == "" {
-			continue
-		}
-		itemsMap[item] = true
-	}
-	items = make([]string, 0, len(itemsMap))
-	for item := range itemsMap {
-		items = append(items, item)
-	}
-	sort.Strings(items)
-	return items
+	return extstrutil.RemoveDuplicates(items, lowercase)
 }
 
-// RemoveDuplicatesStable removes duplicate and empty elements from a slice of
-// strings, preserving order (and case) of the original slice.
-// In all cases, strings are compared after trimming whitespace
-// If caseInsensitive, strings will be compared after ToLower()
 func RemoveDuplicatesStable(items []string, caseInsensitive bool) []string {
-	itemsMap := make(map[string]bool, len(items))
-	deduplicated := make([]string, 0, len(items))
-
-	for _, item := range items {
-		key := strings.TrimSpace(item)
-		if caseInsensitive {
-			key = strings.ToLower(key)
-		}
-		if key == "" || itemsMap[key] {
-			continue
-		}
-		itemsMap[key] = true
-		deduplicated = append(deduplicated, item)
-	}
-	return deduplicated
+	return extstrutil.RemoveDuplicatesStable(items, caseInsensitive)
 }
 
-// RemoveEmpty removes empty elements from a slice of
-// strings
 func RemoveEmpty(items []string) []string {
-	if len(items) == 0 {
-		return items
-	}
-	itemsSlice := make([]string, 0, len(items))
-	for _, item := range items {
-		if item == "" {
-			continue
-		}
-		itemsSlice = append(itemsSlice, item)
-	}
-	return itemsSlice
+	return extstrutil.RemoveEmpty(items)
 }
 
-// EquivalentSlices checks whether the given string sets are equivalent, as in,
-// they contain the same values.
 func EquivalentSlices(a, b []string) bool {
-	if a == nil && b == nil {
-		return true
-	}
-
-	if a == nil || b == nil {
-		return false
-	}
-
-	// First we'll build maps to ensure unique values
-	mapA := map[string]bool{}
-	mapB := map[string]bool{}
-	for _, keyA := range a {
-		mapA[keyA] = true
-	}
-	for _, keyB := range b {
-		mapB[keyB] = true
-	}
-
-	// Now we'll build our checking slices
-	var sortedA, sortedB []string
-	for keyA := range mapA {
-		sortedA = append(sortedA, keyA)
-	}
-	for keyB := range mapB {
-		sortedB = append(sortedB, keyB)
-	}
-	sort.Strings(sortedA)
-	sort.Strings(sortedB)
-
-	// Finally, compare
-	if len(sortedA) != len(sortedB) {
-		return false
-	}
-
-	for i := range sortedA {
-		if sortedA[i] != sortedB[i] {
-			return false
-		}
-	}
-
-	return true
+	return extstrutil.EquivalentSlices(a, b)
 }
 
-// EqualStringMaps tests whether two map[string]string objects are equal.
-// Equal means both maps have the same sets of keys and values. This function
-// is 6-10x faster than a call to reflect.DeepEqual().
 func EqualStringMaps(a, b map[string]string) bool {
-	if len(a) != len(b) {
-		return false
-	}
-
-	for k := range a {
-		v, ok := b[k]
-		if !ok || a[k] != v {
-			return false
-		}
-	}
-
-	return true
+	return extstrutil.EqualStringMaps(a, b)
 }
 
-// StrListDelete removes the first occurrence of the given item from the slice
-// of strings if the item exists.
 func StrListDelete(s []string, d string) []string {
-	if s == nil {
-		return s
-	}
-
-	for index, element := range s {
-		if element == d {
-			return append(s[:index], s[index+1:]...)
-		}
-	}
-
-	return s
+	return extstrutil.StrListDelete(s, d)
 }
 
-// GlobbedStringsMatch compares item to val with support for a leading and/or
-// trailing wildcard '*' in item.
 func GlobbedStringsMatch(item, val string) bool {
-	if len(item) < 2 {
-		return val == item
-	}
-
-	hasPrefix := strings.HasPrefix(item, "*")
-	hasSuffix := strings.HasSuffix(item, "*")
-
-	if hasPrefix && hasSuffix {
-		return strings.Contains(val, item[1:len(item)-1])
-	} else if hasPrefix {
-		return strings.HasSuffix(val, item[1:])
-	} else if hasSuffix {
-		return strings.HasPrefix(val, item[:len(item)-1])
-	}
-
-	return val == item
+	return extstrutil.GlobbedStringsMatch(item, val)
 }
 
-// AppendIfMissing adds a string to a slice if the given string is not present
 func AppendIfMissing(slice []string, i string) []string {
-	if StrListContains(slice, i) {
-		return slice
-	}
-	return append(slice, i)
+	return extstrutil.AppendIfMissing(slice, i)
 }
 
-// MergeSlices adds an arbitrary number of slices together, uniquely
 func MergeSlices(args ...[]string) []string {
-	all := map[string]struct{}{}
-	for _, slice := range args {
-		for _, v := range slice {
-			all[v] = struct{}{}
-		}
-	}
-
-	result := make([]string, 0, len(all))
-	for k := range all {
-		result = append(result, k)
-	}
-	sort.Strings(result)
-	return result
+	return extstrutil.MergeSlices(args...)
 }
 
-// Difference returns the set difference (A - B) of the two given slices. The
-// result will also remove any duplicated values in set A regardless of whether
-// that matches any values in set B.
 func Difference(a, b []string, lowercase bool) []string {
-	if len(a) == 0 {
-		return a
-	}
-	if len(b) == 0 {
-		if !lowercase {
-			return a
-		}
-		newA := make([]string, len(a))
-		for i, v := range a {
-			newA[i] = strings.ToLower(v)
-		}
-		return newA
-	}
-
-	a = RemoveDuplicates(a, lowercase)
-	b = RemoveDuplicates(b, lowercase)
-
-	itemsMap := map[string]bool{}
-	for _, aVal := range a {
-		itemsMap[aVal] = true
-	}
-
-	// Perform difference calculation
-	for _, bVal := range b {
-		if _, ok := itemsMap[bVal]; ok {
-			itemsMap[bVal] = false
-		}
-	}
-
-	items := []string{}
-	for item, exists := range itemsMap {
-		if exists {
-			items = append(items, item)
-		}
-	}
-	sort.Strings(items)
-	return items
+	return extstrutil.Difference(a, b, lowercase)
 }
 
-// GetString attempts to retrieve a value from the provided map and assert that it is a string. If the key does not
-// exist in the map, this will return an empty string. If the key exists, but the value is not a string type, this will
-// return an error. If no map or key is provied, this will return an error
 func GetString(m map[string]interface{}, key string) (string, error) {
-	if m == nil {
-		return "", fmt.Errorf("missing map")
-	}
-	if key == "" {
-		return "", fmt.Errorf("missing key")
-	}
-
-	rawVal, ok := m[key]
-	if !ok {
-		return "", nil
-	}
-
-	str, ok := rawVal.(string)
-	if !ok {
-		return "", fmt.Errorf("invalid value at %s: is a %T", key, rawVal)
-	}
-	return str, nil
+	return extstrutil.GetString(m, key)
 }

vendor/github.com/hashicorp/vault/sdk/helper/wrapping/wrapinfo.go

@@ -17,8 +17,8 @@ type ResponseWrapInfo struct {
 	// expected expiration.
 	CreationTime time.Time `json:"creation_time" structs:"creation_time" mapstructure:"creation_time" sentinel:""`
 
-	// If the contained response is the output of a token creation call, the
-	// created token's accessor will be accessible here
+	// If the contained response is the output of a token or approle secret-id creation call, the
+	// created token's/secret-id's accessor will be accessible here
 	WrappedAccessor string `json:"wrapped_accessor" structs:"wrapped_accessor" mapstructure:"wrapped_accessor" sentinel:""`
 
 	// WrappedEntityID is the entity identifier of the caller who initiated the

vendor/github.com/hashicorp/vault/sdk/logical/error.go

@@ -47,6 +47,10 @@ var (
 	// with the data in the local node's storage, based on the provided
 	// X-Vault-Index request header.
 	ErrMissingRequiredState = errors.New("required index state not present")
+
+	// Error indicating that the requested path used to serve a purpose in older
+	// versions, but the functionality has now been removed
+	ErrPathFunctionalityRemoved = errors.New("functionality on this path has been removed")
 )
 
 type HTTPCodedError interface {

vendor/github.com/hashicorp/vault/sdk/logical/identity.pb.go

@@ -1,13 +1,12 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.25.0
-// 	protoc        v3.15.8
+// 	protoc-gen-go v1.27.1
+// 	protoc        v3.17.3
 // source: sdk/logical/identity.proto
 
 package logical
 
 import (
-	proto "github.com/golang/protobuf/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -21,28 +20,24 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
-
 type Entity struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
 	// ID is the unique identifier for the entity
-	ID string `sentinel:"" protobuf:"bytes,1,opt,name=ID,proto3" json:"ID,omitempty"`
+	ID string `protobuf:"bytes,1,opt,name=ID,proto3" json:"ID,omitempty"`
 	// Name is the human-friendly unique identifier for the entity
-	Name string `sentinel:"" protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
 	// Aliases contains thhe alias mappings for the given entity
-	Aliases []*Alias `sentinel:"" protobuf:"bytes,3,rep,name=aliases,proto3" json:"aliases,omitempty"`
+	Aliases []*Alias `protobuf:"bytes,3,rep,name=aliases,proto3" json:"aliases,omitempty"`
 	// Metadata represents the custom data tied to this entity
-	Metadata map[string]string `sentinel:"" protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Metadata map[string]string `protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 	// Disabled is true if the entity is disabled.
-	Disabled bool `sentinel:"" protobuf:"varint,5,opt,name=disabled,proto3" json:"disabled,omitempty"`
+	Disabled bool `protobuf:"varint,5,opt,name=disabled,proto3" json:"disabled,omitempty"`
 	// NamespaceID is the identifier of the namespace to which this entity
 	// belongs to.
-	NamespaceID string `sentinel:"" protobuf:"bytes,6,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
+	NamespaceID string `protobuf:"bytes,6,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
 }
 
 func (x *Entity) Reset() {
@@ -125,24 +120,30 @@ type Alias struct {
 	unknownFields protoimpl.UnknownFields
 
 	// MountType is the backend mount's type to which this identity belongs
-	MountType string `sentinel:"" protobuf:"bytes,1,opt,name=mount_type,json=mountType,proto3" json:"mount_type,omitempty"`
+	MountType string `protobuf:"bytes,1,opt,name=mount_type,json=mountType,proto3" json:"mount_type,omitempty"`
 	// MountAccessor is the identifier of the mount entry to which this
 	// identity belongs
-	MountAccessor string `sentinel:"" protobuf:"bytes,2,opt,name=mount_accessor,json=mountAccessor,proto3" json:"mount_accessor,omitempty"`
+	MountAccessor string `protobuf:"bytes,2,opt,name=mount_accessor,json=mountAccessor,proto3" json:"mount_accessor,omitempty"`
 	// Name is the identifier of this identity in its authentication source
-	Name string `sentinel:"" protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
+	Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
 	// Metadata represents the custom data tied to this alias. Fields added
 	// to it should have a low rate of change (or no change) because each
 	// change incurs a storage write, so quickly-changing fields can have
 	// a significant performance impact at scale. See the SDK's
 	// "aliasmetadata" package for a helper that eases and standardizes
 	// using this safely.
-	Metadata map[string]string `sentinel:"" protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Metadata map[string]string `protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 	// ID is the unique identifier for the alias
-	ID string `sentinel:"" protobuf:"bytes,5,opt,name=ID,proto3" json:"ID,omitempty"`
+	ID string `protobuf:"bytes,5,opt,name=ID,proto3" json:"ID,omitempty"`
 	// NamespaceID is the identifier of the namespace to which this alias
 	// belongs.
-	NamespaceID string `sentinel:"" protobuf:"bytes,6,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
+	NamespaceID string `protobuf:"bytes,6,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
+	// Custom Metadata represents the custom data tied to this alias
+	CustomMetadata map[string]string `protobuf:"bytes,7,rep,name=custom_metadata,json=customMetadata,proto3" json:"custom_metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// Local indicates if the alias only belongs to the cluster where it was
+	// created. If true, the alias will be stored in a location that are ignored
+	// by the performance replication subsystem.
+	Local bool `protobuf:"varint,8,opt,name=local,proto3" json:"local,omitempty"`
 }
 
 func (x *Alias) Reset() {
@@ -219,20 +220,34 @@ func (x *Alias) GetNamespaceID() string {
 	return ""
 }
 
+func (x *Alias) GetCustomMetadata() map[string]string {
+	if x != nil {
+		return x.CustomMetadata
+	}
+	return nil
+}
+
+func (x *Alias) GetLocal() bool {
+	if x != nil {
+		return x.Local
+	}
+	return false
+}
+
 type Group struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
 	// ID is the unique identifier for the group
-	ID string `sentinel:"" protobuf:"bytes,1,opt,name=ID,proto3" json:"ID,omitempty"`
+	ID string `protobuf:"bytes,1,opt,name=ID,proto3" json:"ID,omitempty"`
 	// Name is the human-friendly unique identifier for the group
-	Name string `sentinel:"" protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
 	// Metadata represents the custom data tied to this group
-	Metadata map[string]string `sentinel:"" protobuf:"bytes,3,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Metadata map[string]string `protobuf:"bytes,3,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 	// NamespaceID is the identifier of the namespace to which this group
 	// belongs to.
-	NamespaceID string `sentinel:"" protobuf:"bytes,4,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
+	NamespaceID string `protobuf:"bytes,4,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
 }
 
 func (x *Group) Reset() {
@@ -317,7 +332,7 @@ var file_sdk_logical_identity_proto_rawDesc = []byte{
 	0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76,
 	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x8b, 0x02, 0x0a, 0x05, 0x41, 0x6c, 0x69, 0x61, 0x73, 0x12,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xb1, 0x03, 0x0a, 0x05, 0x41, 0x6c, 0x69, 0x61, 0x73, 0x12,
 	0x1d, 0x0a, 0x0a, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20,
 	0x01, 0x28, 0x09, 0x52, 0x09, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x25,
 	0x0a, 0x0e, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72,
@@ -330,26 +345,37 @@ var file_sdk_logical_identity_proto_rawDesc = []byte{
 	0x61, 0x74, 0x61, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
 	0x02, 0x49, 0x44, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65,
 	0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73,
-	0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x1a, 0x3b, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
-	0x02, 0x38, 0x01, 0x22, 0xc5, 0x01, 0x0a, 0x05, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x0e, 0x0a,
-	0x02, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x44, 0x12, 0x12, 0x0a,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x38, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2e, 0x47, 0x72,
-	0x6f, 0x75, 0x70, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72,
-	0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x21, 0x0a, 0x0c, 0x6e,
-	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x1a, 0x3b,
-	0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
-	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
-	0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x28, 0x5a, 0x26, 0x67,
-	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
-	0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f,
-	0x67, 0x69, 0x63, 0x61, 0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0f, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d,
+	0x5f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x22, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2e, 0x41, 0x6c, 0x69, 0x61, 0x73, 0x2e,
+	0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x52, 0x0e, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x12, 0x14, 0x0a, 0x05, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x18, 0x08, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x05, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x1a, 0x3b, 0x0a, 0x0d, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x41, 0x0a, 0x13, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xc5, 0x01, 0x0a, 0x05, 0x47, 0x72,
+	0x6f, 0x75, 0x70, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x02, 0x49, 0x44, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x38, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6c, 0x6f, 0x67, 0x69,
+	0x63, 0x61, 0x6c, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69,
+	0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x49, 0x64, 0x1a, 0x3b, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x42, 0x28, 0x5a, 0x26, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f,
+	0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x33,
 }
 
 var (
@@ -364,25 +390,27 @@ func file_sdk_logical_identity_proto_rawDescGZIP() []byte {
 	return file_sdk_logical_identity_proto_rawDescData
 }
 
-var file_sdk_logical_identity_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_sdk_logical_identity_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
 var file_sdk_logical_identity_proto_goTypes = []interface{}{
 	(*Entity)(nil), // 0: logical.Entity
 	(*Alias)(nil),  // 1: logical.Alias
 	(*Group)(nil),  // 2: logical.Group
 	nil,            // 3: logical.Entity.MetadataEntry
 	nil,            // 4: logical.Alias.MetadataEntry
-	nil,            // 5: logical.Group.MetadataEntry
+	nil,            // 5: logical.Alias.CustomMetadataEntry
+	nil,            // 6: logical.Group.MetadataEntry
 }
 var file_sdk_logical_identity_proto_depIDxs = []int32{
 	1, // 0: logical.Entity.aliases:type_name -> logical.Alias
 	3, // 1: logical.Entity.metadata:type_name -> logical.Entity.MetadataEntry
 	4, // 2: logical.Alias.metadata:type_name -> logical.Alias.MetadataEntry
-	5, // 3: logical.Group.metadata:type_name -> logical.Group.MetadataEntry
-	4, // [4:4] is the sub-list for method output_type
-	4, // [4:4] is the sub-list for method input_type
-	4, // [4:4] is the sub-list for extension type_name
-	4, // [4:4] is the sub-list for extension extendee
-	0, // [0:4] is the sub-list for field type_name
+	5, // 3: logical.Alias.custom_metadata:type_name -> logical.Alias.CustomMetadataEntry
+	6, // 4: logical.Group.metadata:type_name -> logical.Group.MetadataEntry
+	5, // [5:5] is the sub-list for method output_type
+	5, // [5:5] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
 }
 
 func init() { file_sdk_logical_identity_proto_init() }
@@ -434,7 +462,7 @@ func file_sdk_logical_identity_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_sdk_logical_identity_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   7,
 			NumExtensions: 0,
 			NumServices:   0,
 		},

vendor/github.com/hashicorp/vault/sdk/logical/identity.proto

@@ -50,6 +50,14 @@ message Alias {
 	// NamespaceID is the identifier of the namespace to which this alias
 	// belongs.
 	string namespace_id = 6;
+
+	// Custom Metadata represents the custom data tied to this alias
+	map<string, string> custom_metadata = 7;
+
+	// Local indicates if the alias only belongs to the cluster where it was
+	// created. If true, the alias will be stored in a location that are ignored
+	// by the performance replication subsystem.
+	bool local = 8;
 }
 
 message Group {

vendor/github.com/hashicorp/vault/sdk/logical/logical.go

@@ -117,6 +117,10 @@ type Paths struct {
 	Root []string
 
 	// Unauthenticated are the paths that can be accessed without any auth.
+	// These can't be regular expressions, it is either exact match, a prefix
+	// match and/or a wildcard match. For prefix match, append '*' as a suffix.
+	// For a wildcard match, use '+' in the segment to match any identifier
+	// (e.g. 'foo/+/bar'). Note that '+' can't be adjacent to a non-slash.
 	Unauthenticated []string
 
 	// LocalStorage are paths (prefixes) that are local to this instance; this

vendor/github.com/hashicorp/vault/sdk/logical/plugin.pb.go

@@ -1,13 +1,12 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.25.0
-// 	protoc        v3.15.8
+// 	protoc-gen-go v1.27.1
+// 	protoc        v3.17.3
 // source: sdk/logical/plugin.proto
 
 package logical
 
 import (
-	proto "github.com/golang/protobuf/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -21,10 +20,6 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
-
 type PluginEnvironment struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache

vendor/github.com/hashicorp/vault/sdk/logical/request.go

@@ -214,6 +214,12 @@ type Request struct {
 	// in response headers; it's attached to the request rather than the response
 	// because not all requests yields non-nil responses.
 	responseState *WALState
+
+	// ClientID is the identity of the caller. If the token is associated with an
+	// entity, it will be the same as the EntityID . If the token has no entity,
+	// this will be the sha256(sorted policies + namespace) associated with the
+	// client token.
+	ClientID string `json:"client_id" structs:"client_id" mapstructure:"client_id" sentinel:""`
 }
 
 // Clone returns a deep copy of the request by using copystructure
@@ -350,6 +356,7 @@ const (
 	CreateOperation         Operation = "create"
 	ReadOperation                     = "read"
 	UpdateOperation                   = "update"
+	PatchOperation                    = "patch"
 	DeleteOperation                   = "delete"
 	ListOperation                     = "list"
 	HelpOperation                     = "help"

vendor/github.com/hashicorp/vault/sdk/logical/response.go

@@ -34,9 +34,17 @@ const (
 	// ignore errors.
 	HTTPRawBodyAlreadyJSONDecoded = "http_raw_body_already_json_decoded"
 
-	// If set, HTTPRawCacheControl will replace the default Cache-Control=no-store header
+	// If set, HTTPCacheControlHeader will replace the default Cache-Control=no-store header
 	// set by the generic wrapping handler. The value must be a string.
-	HTTPRawCacheControl = "http_raw_cache_control"
+	HTTPCacheControlHeader = "http_raw_cache_control"
+
+	// If set, HTTPPragmaHeader will set the Pragma response header.
+	// The value must be a string.
+	HTTPPragmaHeader = "http_raw_pragma"
+
+	// If set, HTTPWWWAuthenticateHeader will set the WWW-Authenticate response header.
+	// The value must be a string.
+	HTTPWWWAuthenticateHeader = "http_www_authenticate"
 )
 
 // Response is a struct that stores the response of a request.

vendor/github.com/hashicorp/vault/sdk/logical/response_util.go

@@ -17,7 +17,7 @@ import (
 func RespondErrorCommon(req *Request, resp *Response, err error) (int, error) {
 	if err == nil && (resp == nil || !resp.IsError()) {
 		switch {
-		case req.Operation == ReadOperation:
+		case req.Operation == ReadOperation, req.Operation == PatchOperation:
 			if resp == nil {
 				return http.StatusNotFound, nil
 			}
@@ -118,6 +118,8 @@ func RespondErrorCommon(req *Request, resp *Response, err error) (int, error) {
 			statusCode = http.StatusTooManyRequests
 		case errwrap.Contains(err, ErrMissingRequiredState.Error()):
 			statusCode = http.StatusPreconditionFailed
+		case errwrap.Contains(err, ErrPathFunctionalityRemoved.Error()):
+			statusCode = http.StatusNotFound
 		}
 	}
 
@@ -144,6 +146,10 @@ func AdjustErrorStatusCode(status *int, err error) {
 		*status = http.StatusServiceUnavailable
 	}
 
+	if errwrap.Contains(err, consts.ErrAPILocked.Error()) {
+		*status = http.StatusServiceUnavailable
+	}
+
 	// Adjust status code on
 	if errwrap.Contains(err, "http: request body too large") {
 		*status = http.StatusRequestEntityTooLarge

vendor/github.com/hashicorp/vault/sdk/logical/token.go

@@ -87,12 +87,18 @@ type TokenEntry struct {
 	// Which named policies should be used
 	Policies []string `json:"policies" mapstructure:"policies" structs:"policies"`
 
+	// InlinePolicy specifies ACL rules to be applied to this token entry.
+	InlinePolicy string `json:"inline_policy" mapstructure:"inline_policy" structs:"inline_policy"`
+
 	// Used for audit trails, this is something like "auth/user/login"
 	Path string `json:"path" mapstructure:"path" structs:"path"`
 
 	// Used for auditing. This could include things like "source", "user", "ip"
 	Meta map[string]string `json:"meta" mapstructure:"meta" structs:"meta" sentinel:"meta"`
 
+	// InternalMeta is used to store internal metadata. This metadata will not be audit logged or returned from lookup APIs.
+	InternalMeta map[string]string `json:"internal_meta" mapstructure:"internal_meta" structs:"internal_meta"`
+
 	// Used for operators to be able to associate with the source
 	DisplayName string `json:"display_name" mapstructure:"display_name" structs:"display_name"`
 
@@ -128,8 +134,13 @@ type TokenEntry struct {
 	CreationTimeDeprecated   int64         `json:"CreationTime" mapstructure:"CreationTime" structs:"CreationTime" sentinel:""`
 	ExplicitMaxTTLDeprecated time.Duration `json:"ExplicitMaxTTL" mapstructure:"ExplicitMaxTTL" structs:"ExplicitMaxTTL" sentinel:""`
 
+	// EntityID is the ID of the entity associated with this token.
 	EntityID string `json:"entity_id" mapstructure:"entity_id" structs:"entity_id"`
 
+	// If NoIdentityPolicies is true, the token will not inherit
+	// identity policies from the associated EntityID.
+	NoIdentityPolicies bool `json:"no_identity_policies" mapstructure:"no_identity_policies" structs:"no_identity_policies"`
+
 	// The set of CIDRs that this token can be used with
 	BoundCIDRs []*sockaddr.SockAddrMarshaler `json:"bound_cidrs" sentinel:""`
 
@@ -223,3 +234,12 @@ func (te *TokenEntry) SentinelKeys() []string {
 		"type",
 	}
 }
+
+// IsRoot returns false if the token is not root (or doesn't exist)
+func (te *TokenEntry) IsRoot() bool {
+	if te == nil {
+		return false
+	}
+
+	return len(te.Policies) == 1 && te.Policies[0] == "root"
+}

vendor/github.com/hashicorp/vault/sdk/version/version_base.go

@@ -8,7 +8,7 @@ var (
 	// Whether cgo is enabled or not; set at build time
 	CgoEnabled bool
 
-	Version           = "1.8.0"
+	Version           = "1.9.0"
 	VersionPrerelease = "dev"
 	VersionMetadata   = ""
 )