Skip to content

Commit

Permalink
backport of commit 3976217 (#24241)
Browse files Browse the repository at this point in the history
Co-authored-by: Peter Wilson <[email protected]>
  • Loading branch information
hc-github-team-secure-vault-core and Peter Wilson authored Nov 22, 2023
1 parent e155227 commit 25a4d1a
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 1 deletion.
3 changes: 3 additions & 0 deletions changelog/24238.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:bug
core/audit: Audit logging a Vault response will now use a 5 second context timeout, separate from the original request.
```
19 changes: 18 additions & 1 deletion vault/audit_broker.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ import (
"sync"
"time"

"github.com/hashicorp/vault/helper/namespace"

"github.com/hashicorp/vault/internal/observability/event"

metrics "github.com/armon/go-metrics"
Expand Down Expand Up @@ -297,7 +299,22 @@ func (a *AuditBroker) LogResponse(ctx context.Context, in *logical.LogInput, hea

e.Data = in

status, err := a.broker.Send(ctx, eventlogger.EventType(event.AuditType.String()), e)
// In cases where we are trying to audit the response, we detach
// ourselves from the original context (keeping only the namespace).
// This is so that we get a fair run at writing audit entries if Vault
// Took up a lot of time handling the request before audit (response)
// is triggered. Pipeline nodes may check for a cancelled context and
// refuse to process the nodes further.
ns, err := namespace.FromContext(ctx)
if err != nil {
retErr = multierror.Append(retErr, fmt.Errorf("namespace missing from context: %w", err))
return retErr.ErrorOrNil()
}

auditContext, auditCancel := context.WithTimeout(context.Background(), 5*time.Second)
defer auditCancel()
auditContext = namespace.ContextWithNamespace(auditContext, ns)
status, err := a.broker.Send(auditContext, eventlogger.EventType(event.AuditType.String()), e)
if err != nil {
retErr = multierror.Append(retErr, multierror.Append(err, status.Warnings...))
}
Expand Down

0 comments on commit 25a4d1a

Please sign in to comment.