MM-14617 Dependency upgrades and adding modules support. (#10517)

* Dependency upgrades and adding modules support.

* Commenting out file tests playload verification portion.

* Fixing viper.

* Fixing hclog.

vendor/github.com/hashicorp/go-plugin/client.go

@@ -5,6 +5,8 @@ import (
 	"context"
 	"crypto/subtle"
 	"crypto/tls"
+	"crypto/x509"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"hash"
@@ -19,7 +21,6 @@ import (
 	"sync"
 	"sync/atomic"
 	"time"
-	"unicode"
 
 	hclog "github.com/hashicorp/go-hclog"
 )
@@ -72,7 +73,6 @@ var (
 type Client struct {
 	config            *ClientConfig
 	exited            bool
-	doneLogging       chan struct{}
 	l                 sync.Mutex
 	address           net.Addr
 	process           *os.Process
@@ -80,7 +80,16 @@ type Client struct {
 	protocol          Protocol
 	logger            hclog.Logger
 	doneCtx           context.Context
+	ctxCancel         context.CancelFunc
 	negotiatedVersion int
+
+	// clientWaitGroup is used to manage the lifecycle of the plugin management
+	// goroutines.
+	clientWaitGroup sync.WaitGroup
+
+	// processKilled is used for testing only, to flag when the process was
+	// forcefully killed.
+	processKilled bool
 }
 
 // NegotiatedVersion returns the protocol version negotiated with the server.
@@ -170,6 +179,29 @@ type ClientConfig struct {
 	// Logger is the logger that the client will used. If none is provided,
 	// it will default to hclog's default logger.
 	Logger hclog.Logger
+
+	// AutoMTLS has the client and server automatically negotiate mTLS for
+	// transport authentication. This ensures that only the original client will
+	// be allowed to connect to the server, and all other connections will be
+	// rejected. The client will also refuse to connect to any server that isn't
+	// the original instance started by the client.
+	//
+	// In this mode of operation, the client generates a one-time use tls
+	// certificate, sends the public x.509 certificate to the new server, and
+	// the server generates a one-time use tls certificate, and sends the public
+	// x.509 certificate back to the client. These are used to authenticate all
+	// rpc connections between the client and server.
+	//
+	// Setting AutoMTLS to true implies that the server must support the
+	// protocol, and correctly negotiate the tls certificates, or a connection
+	// failure will result.
+	//
+	// The client should not set TLSConfig, nor should the server set a
+	// TLSProvider, because AutoMTLS implies that a new certificate and tls
+	// configuration will be generated at startup.
+	//
+	// You cannot Reattach to a server with this option enabled.
+	AutoMTLS bool
 }
 
 // ReattachConfig is used to configure a client to reattach to an
@@ -344,6 +376,14 @@ func (c *Client) Exited() bool {
 	return c.exited
 }
 
+// killed is used in tests to check if a process failed to exit gracefully, and
+// needed to be killed.
+func (c *Client) killed() bool {
+	c.l.Lock()
+	defer c.l.Unlock()
+	return c.processKilled
+}
+
 // End the executing subprocess (if it is running) and perform any cleanup
 // tasks necessary such as capturing any remaining logs and so on.
 //
@@ -355,7 +395,6 @@ func (c *Client) Kill() {
 	c.l.Lock()
 	process := c.process
 	addr := c.address
-	doneCh := c.doneLogging
 	c.l.Unlock()
 
 	// If there is no process, there is nothing to kill.
@@ -364,11 +403,14 @@ func (c *Client) Kill() {
 	}
 
 	defer func() {
+		// Wait for the all client goroutines to finish.
+		c.clientWaitGroup.Wait()
+
 		// Make sure there is no reference to the old process after it has been
 		// killed.
 		c.l.Lock()
-		defer c.l.Unlock()
 		c.process = nil
+		c.l.Unlock()
 	}()
 
 	// We need to check for address here. It is possible that the plugin
@@ -391,6 +433,8 @@ func (c *Client) Kill() {
 				// kill in a moment anyways.
 				c.logger.Warn("error closing client during Kill", "err", err)
 			}
+		} else {
+			c.logger.Error("client", "error", err)
 		}
 	}
 
@@ -399,21 +443,20 @@ func (c *Client) Kill() {
 	// doneCh which would be closed if the process exits.
 	if graceful {
 		select {
-		case <-doneCh:
-			// FIXME: this is never reached under normal circumstances, because
-			// the plugin process is never signaled to exit. We can reach this
-			// if the child process exited abnormally before the Kill call.
+		case <-c.doneCtx.Done():
+			c.logger.Debug("plugin exited")
 			return
-		case <-time.After(250 * time.Millisecond):
-			c.logger.Warn("plugin failed to exit gracefully")
+		case <-time.After(2 * time.Second):
 		}
 	}
 
 	// If graceful exiting failed, just kill it
+	c.logger.Warn("plugin failed to exit gracefully")
 	process.Kill()
 
-	// Wait for the client to finish logging so we have a complete log
-	<-doneCh
+	c.l.Lock()
+	c.processKilled = true
+	c.l.Unlock()
 }
 
 // Starts the underlying subprocess, communicating with it to negotiate
@@ -432,7 +475,7 @@ func (c *Client) Start() (addr net.Addr, err error) {
 
 	// If one of cmd or reattach isn't set, then it is an error. We wrap
 	// this in a {} for scoping reasons, and hopeful that the escape
-	// analysis will pop the stock here.
+	// analysis will pop the stack here.
 	{
 		cmdSet := c.config.Cmd != nil
 		attachSet := c.config.Reattach != nil
@@ -446,59 +489,8 @@ func (c *Client) Start() (addr net.Addr, err error) {
 		}
 	}
 
-	// Create the logging channel for when we kill
-	c.doneLogging = make(chan struct{})
-	// Create a context for when we kill
-	var ctxCancel context.CancelFunc
-	c.doneCtx, ctxCancel = context.WithCancel(context.Background())
-
 	if c.config.Reattach != nil {
-		// Verify the process still exists. If not, then it is an error
-		p, err := os.FindProcess(c.config.Reattach.Pid)
-		if err != nil {
-			return nil, err
-		}
-
-		// Attempt to connect to the addr since on Unix systems FindProcess
-		// doesn't actually return an error if it can't find the process.
-		conn, err := net.Dial(
-			c.config.Reattach.Addr.Network(),
-			c.config.Reattach.Addr.String())
-		if err != nil {
-			p.Kill()
-			return nil, ErrProcessNotFound
-		}
-		conn.Close()
-
-		// Goroutine to mark exit status
-		go func(pid int) {
-			// ensure the context is cancelled when we're done
-			defer ctxCancel()
-			// Wait for the process to die
-			pidWait(pid)
-
-			// Log so we can see it
-			c.logger.Debug("reattached plugin process exited")
-
-			// Mark it
-			c.l.Lock()
-			defer c.l.Unlock()
-			c.exited = true
-
-			// Close the logging channel since that doesn't work on reattach
-			close(c.doneLogging)
-		}(p.Pid)
-
-		// Set the address and process
-		c.address = c.config.Reattach.Addr
-		c.process = p
-		c.protocol = c.config.Reattach.Protocol
-		if c.protocol == "" {
-			// Default the protocol to net/rpc for backwards compatibility
-			c.protocol = ProtocolNetRPC
-		}
-
-		return c.address, nil
+		return c.reattach()
 	}
 
 	if c.config.VersionedPlugins == nil {
@@ -527,15 +519,19 @@ func (c *Client) Start() (addr net.Addr, err error) {
 		fmt.Sprintf("PLUGIN_PROTOCOL_VERSIONS=%s", strings.Join(versionStrings, ",")),
 	}
 
-	stdout_r, stdout_w := io.Pipe()
-	stderr_r, stderr_w := io.Pipe()
-
 	cmd := c.config.Cmd
 	cmd.Env = append(cmd.Env, os.Environ()...)
 	cmd.Env = append(cmd.Env, env...)
 	cmd.Stdin = os.Stdin
-	cmd.Stderr = stderr_w
-	cmd.Stdout = stdout_w
+
+	cmdStdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, err
+	}
+	cmdStderr, err := cmd.StderrPipe()
+	if err != nil {
+		return nil, err
+	}
 
 	if c.config.SecureConfig != nil {
 		if ok, err := c.config.SecureConfig.Check(cmd.Path); err != nil {
@@ -545,6 +541,29 @@ func (c *Client) Start() (addr net.Addr, err error) {
 		}
 	}
 
+	// Setup a temporary certificate for client/server mtls, and send the public
+	// certificate to the plugin.
+	if c.config.AutoMTLS {
+		c.logger.Info("configuring client automatic mTLS")
+		certPEM, keyPEM, err := generateCert()
+		if err != nil {
+			c.logger.Error("failed to generate client certificate", "error", err)
+			return nil, err
+		}
+		cert, err := tls.X509KeyPair(certPEM, keyPEM)
+		if err != nil {
+			c.logger.Error("failed to parse client certificate", "error", err)
+			return nil, err
+		}
+
+		cmd.Env = append(cmd.Env, fmt.Sprintf("PLUGIN_CLIENT_CERT=%s", certPEM))
+
+		c.config.TLSConfig = &tls.Config{
+			Certificates: []tls.Certificate{cert},
+			ServerName:   "localhost",
+		}
+	}
+
 	c.logger.Debug("starting plugin", "path", cmd.Path, "args", cmd.Args)
 	err = cmd.Start()
 	if err != nil {
@@ -568,23 +587,27 @@ func (c *Client) Start() (addr net.Addr, err error) {
 		}
 	}()
 
-	// Start goroutine to wait for process to exit
-	exitCh := make(chan struct{})
-	go func() {
-		// Make sure we close the write end of our stderr/stdout so
-		// that the readers send EOF properly.
-		defer stderr_w.Close()
-		defer stdout_w.Close()
+	// Create a context for when we kill
+	c.doneCtx, c.ctxCancel = context.WithCancel(context.Background())
 
+	c.clientWaitGroup.Add(1)
+	go func() {
 		// ensure the context is cancelled when we're done
-		defer ctxCancel()
+		defer c.ctxCancel()
+
+		defer c.clientWaitGroup.Done()
+
+		// get the cmd info early, since the process information will be removed
+		// in Kill.
+		pid := c.process.Pid
+		path := cmd.Path
 
 		// Wait for the command to end.
 		err := cmd.Wait()
 
 		debugMsgArgs := []interface{}{
-			"path", cmd.Path,
-			"pid", c.process.Pid,
+			"path", path,
+			"pid", pid,
 		}
 		if err != nil {
 			debugMsgArgs = append(debugMsgArgs,
@@ -595,9 +618,6 @@ func (c *Client) Start() (addr net.Addr, err error) {
 		c.logger.Debug("plugin process exited", debugMsgArgs...)
 		os.Stderr.Sync()
 
-		// Mark that we exited
-		close(exitCh)
-
 		// Set that we exited, which takes a lock
 		c.l.Lock()
 		defer c.l.Unlock()
@@ -605,32 +625,33 @@ func (c *Client) Start() (addr net.Addr, err error) {
 	}()
 
 	// Start goroutine that logs the stderr
-	go c.logStderr(stderr_r)
+	c.clientWaitGroup.Add(1)
+	// logStderr calls Done()
+	go c.logStderr(cmdStderr)
 
 	// Start a goroutine that is going to be reading the lines
 	// out of stdout
-	linesCh := make(chan []byte)
+	linesCh := make(chan string)
+	c.clientWaitGroup.Add(1)
 	go func() {
+		defer c.clientWaitGroup.Done()
 		defer close(linesCh)
 
-		buf := bufio.NewReader(stdout_r)
-		for {
-			line, err := buf.ReadBytes('\n')
-			if line != nil {
-				linesCh <- line
-			}
-
-			if err == io.EOF {
-				return
-			}
+		scanner := bufio.NewScanner(cmdStdout)
+		for scanner.Scan() {
+			linesCh <- scanner.Text()
 		}
 	}()
 
 	// Make sure after we exit we read the lines from stdout forever
-	// so they don't block since it is an io.Pipe
+	// so they don't block since it is a pipe.
+	// The scanner goroutine above will close this, but track it with a wait
+	// group for completeness.
+	c.clientWaitGroup.Add(1)
 	defer func() {
 		go func() {
-			for _ = range linesCh {
+			defer c.clientWaitGroup.Done()
+			for range linesCh {
 			}
 		}()
 	}()
@@ -643,12 +664,12 @@ func (c *Client) Start() (addr net.Addr, err error) {
 	select {
 	case <-timeout:
 		err = errors.New("timeout while waiting for plugin to start")
-	case <-exitCh:
+	case <-c.doneCtx.Done():
 		err = errors.New("plugin exited before we could connect")
-	case lineBytes := <-linesCh:
+	case line := <-linesCh:
 		// Trim the line and split by "|" in order to get the parts of
 		// the output.
-		line := strings.TrimSpace(string(lineBytes))
+		line = strings.TrimSpace(line)
 		parts := strings.SplitN(line, "|", 6)
 		if len(parts) < 4 {
 			err = fmt.Errorf(
@@ -718,12 +739,95 @@ func (c *Client) Start() (addr net.Addr, err error) {
 			return addr, err
 		}
 
+		// See if we have a TLS certificate from the server.
+		// Checking if the length is > 50 rules out catching the unused "extra"
+		// data returned from some older implementations.
+		if len(parts) >= 6 && len(parts[5]) > 50 {
+			err := c.loadServerCert(parts[5])
+			if err != nil {
+				return nil, fmt.Errorf("error parsing server cert: %s", err)
+			}
+		}
 	}
 
 	c.address = addr
 	return
 }
 
+// loadServerCert is used by AutoMTLS to read an x.509 cert returned by the
+// server, and load it as the RootCA for the client TLSConfig.
+func (c *Client) loadServerCert(cert string) error {
+	certPool := x509.NewCertPool()
+
+	asn1, err := base64.RawStdEncoding.DecodeString(cert)
+	if err != nil {
+		return err
+	}
+
+	x509Cert, err := x509.ParseCertificate([]byte(asn1))
+	if err != nil {
+		return err
+	}
+
+	certPool.AddCert(x509Cert)
+
+	c.config.TLSConfig.RootCAs = certPool
+	return nil
+}
+
+func (c *Client) reattach() (net.Addr, error) {
+	// Verify the process still exists. If not, then it is an error
+	p, err := os.FindProcess(c.config.Reattach.Pid)
+	if err != nil {
+		return nil, err
+	}
+
+	// Attempt to connect to the addr since on Unix systems FindProcess
+	// doesn't actually return an error if it can't find the process.
+	conn, err := net.Dial(
+		c.config.Reattach.Addr.Network(),
+		c.config.Reattach.Addr.String())
+	if err != nil {
+		p.Kill()
+		return nil, ErrProcessNotFound
+	}
+	conn.Close()
+
+	// Create a context for when we kill
+	c.doneCtx, c.ctxCancel = context.WithCancel(context.Background())
+
+	c.clientWaitGroup.Add(1)
+	// Goroutine to mark exit status
+	go func(pid int) {
+		defer c.clientWaitGroup.Done()
+
+		// ensure the context is cancelled when we're done
+		defer c.ctxCancel()
+
+		// Wait for the process to die
+		pidWait(pid)
+
+		// Log so we can see it
+		c.logger.Debug("reattached plugin process exited")
+
+		// Mark it
+		c.l.Lock()
+		defer c.l.Unlock()
+		c.exited = true
+	}(p.Pid)
+
+	// Set the address and process
+	c.address = c.config.Reattach.Addr
+	c.process = p
+	c.protocol = c.config.Reattach.Protocol
+	if c.protocol == "" {
+		// Default the protocol to net/rpc for backwards compatibility
+		c.protocol = ProtocolNetRPC
+	}
+
+	return c.address, nil
+}
+
 // checkProtoVersion returns the negotiated version and PluginSet.
 // This returns an error if the server returned an incompatible protocol
 // version, or an invalid handshake response.
@@ -828,44 +932,84 @@ func (c *Client) dialer(_ string, timeout time.Duration) (net.Conn, error) {
 	return conn, nil
 }
 
+var stdErrBufferSize = 64 * 1024
+
 func (c *Client) logStderr(r io.Reader) {
-	bufR := bufio.NewReader(r)
+	defer c.clientWaitGroup.Done()
 	l := c.logger.Named(filepath.Base(c.config.Cmd.Path))
 
+	reader := bufio.NewReaderSize(r, stdErrBufferSize)
+	// continuation indicates the previous line was a prefix
+	continuation := false
+
 	for {
-		line, err := bufR.ReadString('\n')
-		if line != "" {
-			c.config.Stderr.Write([]byte(line))
-			line = strings.TrimRightFunc(line, unicode.IsSpace)
+		line, isPrefix, err := reader.ReadLine()
+		switch {
+		case err == io.EOF:
+			return
+		case err != nil:
+			l.Error("reading plugin stderr", "error", err)
+			return
+		}
 
-			entry, err := parseJSON(line)
-			// If output is not JSON format, print directly to Debug
-			if err != nil {
+		c.config.Stderr.Write(line)
+
+		// The line was longer than our max token size, so it's likely
+		// incomplete and won't unmarshal.
+		if isPrefix || continuation {
+			l.Debug(string(line))
+
+			// if we're finishing a continued line, add the newline back in
+			if !isPrefix {
+				c.config.Stderr.Write([]byte{'\n'})
+			}
+
+			continuation = isPrefix
+			continue
+		}
+
+		c.config.Stderr.Write([]byte{'\n'})
+
+		entry, err := parseJSON(line)
+		// If output is not JSON format, print directly to Debug
+		if err != nil {
+			// Attempt to infer the desired log level from the commonly used
+			// string prefixes
+			switch line := string(line); {
+			case strings.HasPrefix("[TRACE]", line):
+				l.Trace(line)
+			case strings.HasPrefix("[DEBUG]", line):
 				l.Debug(line)
-			} else {
-				out := flattenKVPairs(entry.KVPairs)
+			case strings.HasPrefix("[INFO]", line):
+				l.Info(line)
+			case strings.HasPrefix("[WARN]", line):
+				l.Warn(line)
+			case strings.HasPrefix("[ERROR]", line):
+				l.Error(line)
+			default:
+				l.Debug(line)
+			}
+		} else {
+			out := flattenKVPairs(entry.KVPairs)
 
-				out = append(out, "timestamp", entry.Timestamp.Format(hclog.TimeFormat))
-				switch hclog.LevelFromString(entry.Level) {
-				case hclog.Trace:
-					l.Trace(entry.Message, out...)
-				case hclog.Debug:
-					l.Debug(entry.Message, out...)
-				case hclog.Info:
-					l.Info(entry.Message, out...)
-				case hclog.Warn:
-					l.Warn(entry.Message, out...)
-				case hclog.Error:
-					l.Error(entry.Message, out...)
-				}
+			out = append(out, "timestamp", entry.Timestamp.Format(hclog.TimeFormat))
+			switch hclog.LevelFromString(entry.Level) {
+			case hclog.Trace:
+				l.Trace(entry.Message, out...)
+			case hclog.Debug:
+				l.Debug(entry.Message, out...)
+			case hclog.Info:
+				l.Info(entry.Message, out...)
+			case hclog.Warn:
+				l.Warn(entry.Message, out...)
+			case hclog.Error:
+				l.Error(entry.Message, out...)
+			default:
+				// if there was no log level, it's likely this is unexpected
+				// json from something other than hclog, and we should output
+				// it verbatim.
+				l.Debug(string(line))
 			}
 		}
-
-		if err == io.EOF {
-			break
-		}
 	}
-
-	// Flag that we've completed logging for others
-	close(c.doneLogging)
 }

vendor/github.com/hashicorp/go-plugin/go.mod

@@ -1,12 +1,16 @@
 module github.com/hashicorp/go-plugin
 
 require (
+	github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b // indirect
 	github.com/golang/protobuf v1.2.0
 	github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd
 	github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb
 	github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77
 	github.com/oklog/run v1.0.0
+	github.com/stretchr/testify v1.3.0 // indirect
 	golang.org/x/net v0.0.0-20180826012351-8a410e7b638d
+	golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 // indirect
+	golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc // indirect
 	golang.org/x/text v0.3.0 // indirect
 	google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 // indirect
 	google.golang.org/grpc v1.14.0

vendor/github.com/hashicorp/go-plugin/go.sum

@@ -1,3 +1,7 @@
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd h1:rNuUHR+CvK1IS89MMtcF0EpcVMZtjKfPRp4MEmt/aTs=
@@ -8,8 +12,17 @@ github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77 h1:
 github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
 github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d h1:g9qWBGx4puODJTMVyoPrpoxPFgVGd+z1DZwjfRu4d0I=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 h1:YUO/7uOKsKeq9UokNS62b8FYywz3ker1l1vDZRCRefw=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc h1:WiYx1rIFmx8c0mXAFtv5D/mHyKe1+jmuP7PViuwqwuQ=
+golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 h1:Nw54tB0rB7hY/N0NQvRW8DG4Yk3Q6T9cu9RcFQDu1tc=

vendor/github.com/hashicorp/go-plugin/grpc_broker.go

@@ -11,6 +11,8 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/hashicorp/go-plugin/internal/plugin"
+
 	"github.com/oklog/run"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
@@ -19,14 +21,14 @@ import (
 // streamer interface is used in the broker to send/receive connection
 // information.
 type streamer interface {
-	Send(*ConnInfo) error
-	Recv() (*ConnInfo, error)
+	Send(*plugin.ConnInfo) error
+	Recv() (*plugin.ConnInfo, error)
 	Close()
 }
 
 // sendErr is used to pass errors back during a send.
 type sendErr struct {
-	i  *ConnInfo
+	i  *plugin.ConnInfo
 	ch chan error
 }
 
@@ -38,7 +40,7 @@ type gRPCBrokerServer struct {
 	send chan *sendErr
 
 	// recv is used to receive connection info from the gRPC stream.
-	recv chan *ConnInfo
+	recv chan *plugin.ConnInfo
 
 	// quit closes down the stream.
 	quit chan struct{}
@@ -50,7 +52,7 @@ type gRPCBrokerServer struct {
 func newGRPCBrokerServer() *gRPCBrokerServer {
 	return &gRPCBrokerServer{
 		send: make(chan *sendErr),
-		recv: make(chan *ConnInfo),
+		recv: make(chan *plugin.ConnInfo),
 		quit: make(chan struct{}),
 	}
 }
@@ -58,7 +60,7 @@ func newGRPCBrokerServer() *gRPCBrokerServer {
 // StartStream implements the GRPCBrokerServer interface and will block until
 // the quit channel is closed or the context reports Done. The stream will pass
 // connection information to/from the client.
-func (s *gRPCBrokerServer) StartStream(stream GRPCBroker_StartStreamServer) error {
+func (s *gRPCBrokerServer) StartStream(stream plugin.GRPCBroker_StartStreamServer) error {
 	doneCh := stream.Context().Done()
 	defer s.Close()
 
@@ -97,7 +99,7 @@ func (s *gRPCBrokerServer) StartStream(stream GRPCBroker_StartStreamServer) erro
 
 // Send is used by the GRPCBroker to pass connection information into the stream
 // to the client.
-func (s *gRPCBrokerServer) Send(i *ConnInfo) error {
+func (s *gRPCBrokerServer) Send(i *plugin.ConnInfo) error {
 	ch := make(chan error)
 	defer close(ch)
 
@@ -115,7 +117,7 @@ func (s *gRPCBrokerServer) Send(i *ConnInfo) error {
 
 // Recv is used by the GRPCBroker to pass connection information that has been
 // sent from the client from the stream to the broker.
-func (s *gRPCBrokerServer) Recv() (*ConnInfo, error) {
+func (s *gRPCBrokerServer) Recv() (*plugin.ConnInfo, error) {
 	select {
 	case <-s.quit:
 		return nil, errors.New("broker closed")
@@ -136,13 +138,13 @@ func (s *gRPCBrokerServer) Close() {
 // streamer interfaces.
 type gRPCBrokerClientImpl struct {
 	// client is the underlying GRPC client used to make calls to the server.
-	client GRPCBrokerClient
+	client plugin.GRPCBrokerClient
 
 	// send is used to send connection info to the gRPC stream.
 	send chan *sendErr
 
 	// recv is used to receive connection info from the gRPC stream.
-	recv chan *ConnInfo
+	recv chan *plugin.ConnInfo
 
 	// quit closes down the stream.
 	quit chan struct{}
@@ -153,9 +155,9 @@ type gRPCBrokerClientImpl struct {
 
 func newGRPCBrokerClient(conn *grpc.ClientConn) *gRPCBrokerClientImpl {
 	return &gRPCBrokerClientImpl{
-		client: NewGRPCBrokerClient(conn),
+		client: plugin.NewGRPCBrokerClient(conn),
 		send:   make(chan *sendErr),
-		recv:   make(chan *ConnInfo),
+		recv:   make(chan *plugin.ConnInfo),
 		quit:   make(chan struct{}),
 	}
 }
@@ -207,7 +209,7 @@ func (s *gRPCBrokerClientImpl) StartStream() error {
 
 // Send is used by the GRPCBroker to pass connection information into the stream
 // to the plugin.
-func (s *gRPCBrokerClientImpl) Send(i *ConnInfo) error {
+func (s *gRPCBrokerClientImpl) Send(i *plugin.ConnInfo) error {
 	ch := make(chan error)
 	defer close(ch)
 
@@ -225,7 +227,7 @@ func (s *gRPCBrokerClientImpl) Send(i *ConnInfo) error {
 
 // Recv is used by the GRPCBroker to pass connection information that has been
 // sent from the plugin to the broker.
-func (s *gRPCBrokerClientImpl) Recv() (*ConnInfo, error) {
+func (s *gRPCBrokerClientImpl) Recv() (*plugin.ConnInfo, error) {
 	select {
 	case <-s.quit:
 		return nil, errors.New("broker closed")
@@ -266,7 +268,7 @@ type GRPCBroker struct {
 }
 
 type gRPCBrokerPending struct {
-	ch     chan *ConnInfo
+	ch     chan *plugin.ConnInfo
 	doneCh chan struct{}
 }
 
@@ -288,7 +290,7 @@ func (b *GRPCBroker) Accept(id uint32) (net.Listener, error) {
 		return nil, err
 	}
 
-	err = b.streamer.Send(&ConnInfo{
+	err = b.streamer.Send(&plugin.ConnInfo{
 		ServiceId: id,
 		Network:   listener.Addr().Network(),
 		Address:   listener.Addr().String(),
@@ -363,7 +365,7 @@ func (b *GRPCBroker) Close() error {
 
 // Dial opens a connection by ID.
 func (b *GRPCBroker) Dial(id uint32) (conn *grpc.ClientConn, err error) {
-	var c *ConnInfo
+	var c *plugin.ConnInfo
 
 	// Open the stream
 	p := b.getStream(id)
@@ -433,7 +435,7 @@ func (m *GRPCBroker) getStream(id uint32) *gRPCBrokerPending {
 	}
 
 	m.streams[id] = &gRPCBrokerPending{
-		ch:     make(chan *ConnInfo, 1),
+		ch:     make(chan *plugin.ConnInfo, 1),
 		doneCh: make(chan struct{}),
 	}
 	return m.streams[id]

vendor/github.com/hashicorp/go-plugin/grpc_client.go

@@ -6,6 +6,7 @@ import (
 	"net"
 	"time"
 
+	"github.com/hashicorp/go-plugin/internal/plugin"
 	"golang.org/x/net/context"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
@@ -16,12 +17,9 @@ func dialGRPCConn(tls *tls.Config, dialer func(string, time.Duration) (net.Conn,
 	// Build dialing options.
 	opts := make([]grpc.DialOption, 0, 5)
 
-	// We use a custom dialer so that we can connect over unix domain sockets
+	// We use a custom dialer so that we can connect over unix domain sockets.
 	opts = append(opts, grpc.WithDialer(dialer))
 
-	// go-plugin expects to block the connection
-	opts = append(opts, grpc.WithBlock())
-
 	// Fail right away
 	opts = append(opts, grpc.FailOnNonTempDialError(true))
 
@@ -58,12 +56,15 @@ func newGRPCClient(doneCtx context.Context, c *Client) (*GRPCClient, error) {
 	go broker.Run()
 	go brokerGRPCClient.StartStream()
 
-	return &GRPCClient{
-		Conn:    conn,
-		Plugins: c.config.Plugins,
-		doneCtx: doneCtx,
-		broker:  broker,
-	}, nil
+	cl := &GRPCClient{
+		Conn:       conn,
+		Plugins:    c.config.Plugins,
+		doneCtx:    doneCtx,
+		broker:     broker,
+		controller: plugin.NewGRPCControllerClient(conn),
+	}
+
+	return cl, nil
 }
 
 // GRPCClient connects to a GRPCServer over gRPC to dispense plugin types.
@@ -73,11 +74,14 @@ type GRPCClient struct {
 
 	doneCtx context.Context
 	broker  *GRPCBroker
+
+	controller plugin.GRPCControllerClient
 }
 
 // ClientProtocol impl.
 func (c *GRPCClient) Close() error {
 	c.broker.Close()
+	c.controller.Shutdown(c.doneCtx, &plugin.Empty{})
 	return c.Conn.Close()
 }
 

vendor/github.com/hashicorp/go-plugin/grpc_controller.go

@@ -0,0 +1,23 @@
+package plugin
+
+import (
+	"context"
+
+	"github.com/hashicorp/go-plugin/internal/plugin"
+)
+
+// GRPCControllerServer handles shutdown calls to terminate the server when the
+// plugin client is closed.
+type grpcControllerServer struct {
+	server *GRPCServer
+}
+
+// Shutdown stops the grpc server. It first will attempt a graceful stop, then a
+// full stop on the server.
+func (s *grpcControllerServer) Shutdown(ctx context.Context, _ *plugin.Empty) (*plugin.Empty, error) {
+	resp := &plugin.Empty{}
+
+	// TODO: figure out why GracefullStop doesn't work.
+	s.server.Stop()
+	return resp, nil
+}

vendor/github.com/hashicorp/go-plugin/grpc_server.go

@@ -8,6 +8,8 @@ import (
 	"io"
 	"net"
 
+	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin/internal/plugin"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/health"
@@ -52,6 +54,8 @@ type GRPCServer struct {
 	config GRPCServerConfig
 	server *grpc.Server
 	broker *GRPCBroker
+
+	logger hclog.Logger
 }
 
 // ServerProtocol impl.
@@ -71,10 +75,16 @@ func (s *GRPCServer) Init() error {
 
 	// Register the broker service
 	brokerServer := newGRPCBrokerServer()
-	RegisterGRPCBrokerServer(s.server, brokerServer)
+	plugin.RegisterGRPCBrokerServer(s.server, brokerServer)
 	s.broker = newGRPCBroker(brokerServer, s.TLS)
 	go s.broker.Run()
 
+	// Register the controller
+	controllerServer := &grpcControllerServer{
+		server: s,
+	}
+	plugin.RegisterGRPCControllerServer(s.server, controllerServer)
+
 	// Register all our plugins onto the gRPC server.
 	for k, raw := range s.Plugins {
 		p, ok := raw.(GRPCPlugin)
@@ -83,7 +93,7 @@ func (s *GRPCServer) Init() error {
 		}
 
 		if err := p.GRPCServer(s.broker, s.server); err != nil {
-			return fmt.Errorf("error registring %q: %s", k, err)
+			return fmt.Errorf("error registering %q: %s", k, err)
 		}
 	}
 
@@ -117,11 +127,11 @@ func (s *GRPCServer) Config() string {
 }
 
 func (s *GRPCServer) Serve(lis net.Listener) {
-	// Start serving in a goroutine
-	go s.server.Serve(lis)
-
-	// Wait until graceful completion
-	<-s.DoneCh
+	defer close(s.DoneCh)
+	err := s.server.Serve(lis)
+	if err != nil {
+		s.logger.Error("grpc server", "error", err)
+	}
 }
 
 // GRPCServerConfig is the extra configuration passed along for consumers

vendor/github.com/hashicorp/go-plugin/internal/plugin/gen.go

@@ -0,0 +1,3 @@
+//go:generate protoc -I ./ ./grpc_broker.proto ./grpc_controller.proto --go_out=plugins=grpc:.
+
+package plugin

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.pb.go

@@ -1,24 +1,14 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // source: grpc_broker.proto
 
-/*
-Package plugin is a generated protocol buffer package.
-
-It is generated from these files:
-	grpc_broker.proto
-
-It has these top-level messages:
-	ConnInfo
-*/
 package plugin
 
-import proto "github.com/golang/protobuf/proto"
-import fmt "fmt"
-import math "math"
-
 import (
+	fmt "fmt"
+	proto "github.com/golang/protobuf/proto"
 	context "golang.org/x/net/context"
 	grpc "google.golang.org/grpc"
+	math "math"
 )
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -33,15 +23,38 @@ var _ = math.Inf
 const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 
 type ConnInfo struct {
-	ServiceId uint32 `protobuf:"varint,1,opt,name=service_id,json=serviceId" json:"service_id,omitempty"`
-	Network   string `protobuf:"bytes,2,opt,name=network" json:"network,omitempty"`
-	Address   string `protobuf:"bytes,3,opt,name=address" json:"address,omitempty"`
+	ServiceId            uint32   `protobuf:"varint,1,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"`
+	Network              string   `protobuf:"bytes,2,opt,name=network,proto3" json:"network,omitempty"`
+	Address              string   `protobuf:"bytes,3,opt,name=address,proto3" json:"address,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
-func (m *ConnInfo) Reset()                    { *m = ConnInfo{} }
-func (m *ConnInfo) String() string            { return proto.CompactTextString(m) }
-func (*ConnInfo) ProtoMessage()               {}
-func (*ConnInfo) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
+func (m *ConnInfo) Reset()         { *m = ConnInfo{} }
+func (m *ConnInfo) String() string { return proto.CompactTextString(m) }
+func (*ConnInfo) ProtoMessage()    {}
+func (*ConnInfo) Descriptor() ([]byte, []int) {
+	return fileDescriptor_802e9beed3ec3b28, []int{0}
+}
+
+func (m *ConnInfo) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ConnInfo.Unmarshal(m, b)
+}
+func (m *ConnInfo) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ConnInfo.Marshal(b, m, deterministic)
+}
+func (m *ConnInfo) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ConnInfo.Merge(m, src)
+}
+func (m *ConnInfo) XXX_Size() int {
+	return xxx_messageInfo_ConnInfo.Size(m)
+}
+func (m *ConnInfo) XXX_DiscardUnknown() {
+	xxx_messageInfo_ConnInfo.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ConnInfo proto.InternalMessageInfo
 
 func (m *ConnInfo) GetServiceId() uint32 {
 	if m != nil {
@@ -68,6 +81,23 @@ func init() {
 	proto.RegisterType((*ConnInfo)(nil), "plugin.ConnInfo")
 }
 
+func init() { proto.RegisterFile("grpc_broker.proto", fileDescriptor_802e9beed3ec3b28) }
+
+var fileDescriptor_802e9beed3ec3b28 = []byte{
+	// 175 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4c, 0x2f, 0x2a, 0x48,
+	0x8e, 0x4f, 0x2a, 0xca, 0xcf, 0x4e, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x62, 0x2b,
+	0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x8a, 0xe5, 0xe2, 0x70, 0xce, 0xcf, 0xcb, 0xf3, 0xcc, 0x4b,
+	0xcb, 0x17, 0x92, 0xe5, 0xe2, 0x2a, 0x4e, 0x2d, 0x2a, 0xcb, 0x4c, 0x4e, 0x8d, 0xcf, 0x4c, 0x91,
+	0x60, 0x54, 0x60, 0xd4, 0xe0, 0x0d, 0xe2, 0x84, 0x8a, 0x78, 0xa6, 0x08, 0x49, 0x70, 0xb1, 0xe7,
+	0xa5, 0x96, 0x94, 0xe7, 0x17, 0x65, 0x4b, 0x30, 0x29, 0x30, 0x6a, 0x70, 0x06, 0xc1, 0xb8, 0x20,
+	0x99, 0xc4, 0x94, 0x94, 0xa2, 0xd4, 0xe2, 0x62, 0x09, 0x66, 0x88, 0x0c, 0x94, 0x6b, 0xe4, 0xcc,
+	0xc5, 0xe5, 0x1e, 0x14, 0xe0, 0xec, 0x04, 0xb6, 0x5a, 0xc8, 0x94, 0x8b, 0x3b, 0xb8, 0x24, 0xb1,
+	0xa8, 0x24, 0xb8, 0xa4, 0x28, 0x35, 0x31, 0x57, 0x48, 0x40, 0x0f, 0xe2, 0x08, 0x3d, 0x98, 0x0b,
+	0xa4, 0x30, 0x44, 0x34, 0x18, 0x0d, 0x18, 0x9d, 0x38, 0xa2, 0xa0, 0xae, 0x4d, 0x62, 0x03, 0x3b,
+	0xde, 0x18, 0x10, 0x00, 0x00, 0xff, 0xff, 0x10, 0x15, 0x39, 0x47, 0xd1, 0x00, 0x00, 0x00,
+}
+
 // Reference imports to suppress errors if they are not otherwise used.
 var _ context.Context
 var _ grpc.ClientConn
@@ -76,8 +106,9 @@ var _ grpc.ClientConn
 // is compatible with the grpc package it is being compiled against.
 const _ = grpc.SupportPackageIsVersion4
 
-// Client API for GRPCBroker service
-
+// GRPCBrokerClient is the client API for GRPCBroker service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
 type GRPCBrokerClient interface {
 	StartStream(ctx context.Context, opts ...grpc.CallOption) (GRPCBroker_StartStreamClient, error)
 }
@@ -91,7 +122,7 @@ func NewGRPCBrokerClient(cc *grpc.ClientConn) GRPCBrokerClient {
 }
 
 func (c *gRPCBrokerClient) StartStream(ctx context.Context, opts ...grpc.CallOption) (GRPCBroker_StartStreamClient, error) {
-	stream, err := grpc.NewClientStream(ctx, &_GRPCBroker_serviceDesc.Streams[0], c.cc, "/plugin.GRPCBroker/StartStream", opts...)
+	stream, err := c.cc.NewStream(ctx, &_GRPCBroker_serviceDesc.Streams[0], "/plugin.GRPCBroker/StartStream", opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -121,8 +152,7 @@ func (x *gRPCBrokerStartStreamClient) Recv() (*ConnInfo, error) {
 	return m, nil
 }
 
-// Server API for GRPCBroker service
-
+// GRPCBrokerServer is the server API for GRPCBroker service.
 type GRPCBrokerServer interface {
 	StartStream(GRPCBroker_StartStreamServer) error
 }
@@ -171,20 +201,3 @@ var _GRPCBroker_serviceDesc = grpc.ServiceDesc{
 	},
 	Metadata: "grpc_broker.proto",
 }
-
-func init() { proto.RegisterFile("grpc_broker.proto", fileDescriptor0) }
-
-var fileDescriptor0 = []byte{
-	// 170 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4c, 0x2f, 0x2a, 0x48,
-	0x8e, 0x4f, 0x2a, 0xca, 0xcf, 0x4e, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0x62, 0x2b,
-	0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x8a, 0xe5, 0xe2, 0x70, 0xce, 0xcf, 0xcb, 0xf3, 0xcc, 0x4b,
-	0xcb, 0x17, 0x92, 0xe5, 0xe2, 0x2a, 0x4e, 0x2d, 0x2a, 0xcb, 0x4c, 0x4e, 0x8d, 0xcf, 0x4c, 0x91,
-	0x60, 0x54, 0x60, 0xd4, 0xe0, 0x0d, 0xe2, 0x84, 0x8a, 0x78, 0xa6, 0x08, 0x49, 0x70, 0xb1, 0xe7,
-	0xa5, 0x96, 0x94, 0xe7, 0x17, 0x65, 0x4b, 0x30, 0x29, 0x30, 0x6a, 0x70, 0x06, 0xc1, 0xb8, 0x20,
-	0x99, 0xc4, 0x94, 0x94, 0xa2, 0xd4, 0xe2, 0x62, 0x09, 0x66, 0x88, 0x0c, 0x94, 0x6b, 0xe4, 0xcc,
-	0xc5, 0xe5, 0x1e, 0x14, 0xe0, 0xec, 0x04, 0xb6, 0x5a, 0xc8, 0x94, 0x8b, 0x3b, 0xb8, 0x24, 0xb1,
-	0xa8, 0x24, 0xb8, 0xa4, 0x28, 0x35, 0x31, 0x57, 0x48, 0x40, 0x0f, 0xe2, 0x08, 0x3d, 0x98, 0x0b,
-	0xa4, 0x30, 0x44, 0x34, 0x18, 0x0d, 0x18, 0x93, 0xd8, 0xc0, 0x4e, 0x36, 0x06, 0x04, 0x00, 0x00,
-	0xff, 0xff, 0x7b, 0x5d, 0xfb, 0xe1, 0xc7, 0x00, 0x00, 0x00,
-}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_broker.proto

@@ -1,5 +1,6 @@
 syntax = "proto3";
 package plugin;
+option go_package = "plugin";
 
 message ConnInfo {
     uint32 service_id = 1;

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.pb.go

@@ -0,0 +1,143 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: grpc_controller.proto
+
+package plugin
+
+import (
+	fmt "fmt"
+	proto "github.com/golang/protobuf/proto"
+	context "golang.org/x/net/context"
+	grpc "google.golang.org/grpc"
+	math "math"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+
+type Empty struct {
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Empty) Reset()         { *m = Empty{} }
+func (m *Empty) String() string { return proto.CompactTextString(m) }
+func (*Empty) ProtoMessage()    {}
+func (*Empty) Descriptor() ([]byte, []int) {
+	return fileDescriptor_23c2c7e42feab570, []int{0}
+}
+
+func (m *Empty) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_Empty.Unmarshal(m, b)
+}
+func (m *Empty) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_Empty.Marshal(b, m, deterministic)
+}
+func (m *Empty) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_Empty.Merge(m, src)
+}
+func (m *Empty) XXX_Size() int {
+	return xxx_messageInfo_Empty.Size(m)
+}
+func (m *Empty) XXX_DiscardUnknown() {
+	xxx_messageInfo_Empty.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Empty proto.InternalMessageInfo
+
+func init() {
+	proto.RegisterType((*Empty)(nil), "plugin.Empty")
+}
+
+func init() { proto.RegisterFile("grpc_controller.proto", fileDescriptor_23c2c7e42feab570) }
+
+var fileDescriptor_23c2c7e42feab570 = []byte{
+	// 108 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0x4d, 0x2f, 0x2a, 0x48,
+	0x8e, 0x4f, 0xce, 0xcf, 0x2b, 0x29, 0xca, 0xcf, 0xc9, 0x49, 0x2d, 0xd2, 0x2b, 0x28, 0xca, 0x2f,
+	0xc9, 0x17, 0x62, 0x2b, 0xc8, 0x29, 0x4d, 0xcf, 0xcc, 0x53, 0x62, 0xe7, 0x62, 0x75, 0xcd, 0x2d,
+	0x28, 0xa9, 0x34, 0xb2, 0xe2, 0xe2, 0x73, 0x0f, 0x0a, 0x70, 0x76, 0x86, 0x2b, 0x14, 0xd2, 0xe0,
+	0xe2, 0x08, 0xce, 0x28, 0x2d, 0x49, 0xc9, 0x2f, 0xcf, 0x13, 0xe2, 0xd5, 0x83, 0xa8, 0xd7, 0x03,
+	0x2b, 0x96, 0x42, 0xe5, 0x3a, 0x71, 0x44, 0x41, 0x8d, 0x4b, 0x62, 0x03, 0x9b, 0x6e, 0x0c, 0x08,
+	0x00, 0x00, 0xff, 0xff, 0xab, 0x7c, 0x27, 0xe5, 0x76, 0x00, 0x00, 0x00,
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// GRPCControllerClient is the client API for GRPCController service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type GRPCControllerClient interface {
+	Shutdown(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error)
+}
+
+type gRPCControllerClient struct {
+	cc *grpc.ClientConn
+}
+
+func NewGRPCControllerClient(cc *grpc.ClientConn) GRPCControllerClient {
+	return &gRPCControllerClient{cc}
+}
+
+func (c *gRPCControllerClient) Shutdown(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error) {
+	out := new(Empty)
+	err := c.cc.Invoke(ctx, "/plugin.GRPCController/Shutdown", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// GRPCControllerServer is the server API for GRPCController service.
+type GRPCControllerServer interface {
+	Shutdown(context.Context, *Empty) (*Empty, error)
+}
+
+func RegisterGRPCControllerServer(s *grpc.Server, srv GRPCControllerServer) {
+	s.RegisterService(&_GRPCController_serviceDesc, srv)
+}
+
+func _GRPCController_Shutdown_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(GRPCControllerServer).Shutdown(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/plugin.GRPCController/Shutdown",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(GRPCControllerServer).Shutdown(ctx, req.(*Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+var _GRPCController_serviceDesc = grpc.ServiceDesc{
+	ServiceName: "plugin.GRPCController",
+	HandlerType: (*GRPCControllerServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Shutdown",
+			Handler:    _GRPCController_Shutdown_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "grpc_controller.proto",
+}

vendor/github.com/hashicorp/go-plugin/internal/plugin/grpc_controller.proto

@@ -0,0 +1,11 @@
+syntax = "proto3";
+package plugin;
+option go_package = "plugin";
+
+message Empty {
+}
+
+// The GRPCController is responsible for telling the plugin server to shutdown.
+service GRPCController {
+    rpc Shutdown(Empty) returns (Empty);
+}

vendor/github.com/hashicorp/go-plugin/log_entry.go

@@ -32,11 +32,11 @@ func flattenKVPairs(kvs []*logEntryKV) []interface{} {
 }
 
 // parseJSON handles parsing JSON output
-func parseJSON(input string) (*logEntry, error) {
+func parseJSON(input []byte) (*logEntry, error) {
 	var raw map[string]interface{}
 	entry := &logEntry{}
 
-	err := json.Unmarshal([]byte(input), &raw)
+	err := json.Unmarshal(input, &raw)
 	if err != nil {
 		return nil, err
 	}

vendor/github.com/hashicorp/go-plugin/mtls.go

@@ -0,0 +1,73 @@
+package plugin
+
+import (
+	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"time"
+)
+
+// generateCert generates a temporary certificate for plugin authentication. The
+// certificate and private key are returns in PEM format.
+func generateCert() (cert []byte, privateKey []byte, err error) {
+	key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+	sn, err := rand.Int(rand.Reader, serialNumberLimit)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	host := "localhost"
+
+	template := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName:   host,
+			Organization: []string{"HashiCorp"},
+		},
+		DNSNames: []string{host},
+		ExtKeyUsage: []x509.ExtKeyUsage{
+			x509.ExtKeyUsageClientAuth,
+			x509.ExtKeyUsageServerAuth,
+		},
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageKeyAgreement | x509.KeyUsageCertSign,
+		BasicConstraintsValid: true,
+		SerialNumber:          sn,
+		NotBefore:             time.Now().Add(-30 * time.Second),
+		NotAfter:              time.Now().Add(262980 * time.Hour),
+		IsCA:                  true,
+	}
+
+	der, err := x509.CreateCertificate(rand.Reader, template, template, key.Public(), key)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	var certOut bytes.Buffer
+	if err := pem.Encode(&certOut, &pem.Block{Type: "CERTIFICATE", Bytes: der}); err != nil {
+		return nil, nil, err
+	}
+
+	keyBytes, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	var keyOut bytes.Buffer
+	if err := pem.Encode(&keyOut, &pem.Block{Type: "EC PRIVATE KEY", Bytes: keyBytes}); err != nil {
+		return nil, nil, err
+	}
+
+	cert = certOut.Bytes()
+	privateKey = keyOut.Bytes()
+
+	return cert, privateKey, nil
+}

vendor/github.com/hashicorp/go-plugin/server.go

@@ -2,6 +2,7 @@ package plugin
 
 import (
 	"crypto/tls"
+	"crypto/x509"
 	"encoding/base64"
 	"errors"
 	"fmt"
@@ -242,6 +243,41 @@ func Serve(opts *ServeConfig) {
 		}
 	}
 
+	var serverCert string
+	clientCert := os.Getenv("PLUGIN_CLIENT_CERT")
+	// If the client is configured using AutoMTLS, the certificate will be here,
+	// and we need to generate our own in response.
+	if tlsConfig == nil && clientCert != "" {
+		logger.Info("configuring server automatic mTLS")
+		clientCertPool := x509.NewCertPool()
+		if !clientCertPool.AppendCertsFromPEM([]byte(clientCert)) {
+			logger.Error("client cert provided but failed to parse", "cert", clientCert)
+		}
+
+		certPEM, keyPEM, err := generateCert()
+		if err != nil {
+			logger.Error("failed to generate client certificate", "error", err)
+			panic(err)
+		}
+
+		cert, err := tls.X509KeyPair(certPEM, keyPEM)
+		if err != nil {
+			logger.Error("failed to parse client certificate", "error", err)
+			panic(err)
+		}
+
+		tlsConfig = &tls.Config{
+			Certificates: []tls.Certificate{cert},
+			ClientAuth:   tls.RequireAndVerifyClientCert,
+			ClientCAs:    clientCertPool,
+			MinVersion:   tls.VersionTLS12,
+		}
+
+		// We send back the raw leaf cert data for the client rather than the
+		// PEM, since the protocol can't handle newlines.
+		serverCert = base64.RawStdEncoding.EncodeToString(cert.Certificate[0])
+	}
+
 	// Create the channel to tell us when we're done
 	doneCh := make(chan struct{})
 
@@ -272,6 +308,7 @@ func Serve(opts *ServeConfig) {
 			Stdout:  stdout_r,
 			Stderr:  stderr_r,
 			DoneCh:  doneCh,
+			logger:  logger,
 		}
 
 	default:
@@ -284,25 +321,16 @@ func Serve(opts *ServeConfig) {
 		return
 	}
 
-	// Build the extra configuration
-	extra := ""
-	if v := server.Config(); v != "" {
-		extra = base64.StdEncoding.EncodeToString([]byte(v))
-	}
-	if extra != "" {
-		extra = "|" + extra
-	}
-
 	logger.Debug("plugin address", "network", listener.Addr().Network(), "address", listener.Addr().String())
 
 	// Output the address and service name to stdout so that the client can bring it up.
-	fmt.Printf("%d|%d|%s|%s|%s%s\n",
+	fmt.Printf("%d|%d|%s|%s|%s|%s\n",
 		CoreProtocolVersion,
 		protoVersion,
 		listener.Addr().Network(),
 		listener.Addr().String(),
 		protoType,
-		extra)
+		serverCert)
 	os.Stdout.Sync()
 
 	// Eat the interrupts

vendor/github.com/hashicorp/go-plugin/testing.go

@@ -8,6 +8,8 @@ import (
 	"net/rpc"
 
 	"github.com/mitchellh/go-testing-interface"
+	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-plugin/internal/plugin"
 	"google.golang.org/grpc"
 )
 
@@ -140,9 +142,11 @@ func TestPluginGRPCConn(t testing.T, ps map[string]Plugin) (*GRPCClient, *GRPCSe
 	// Start up the server
 	server := &GRPCServer{
 		Plugins: ps,
+		DoneCh:  make(chan struct{}),
 		Server:  DefaultGRPCServer,
 		Stdout:  new(bytes.Buffer),
 		Stderr:  new(bytes.Buffer),
+		logger:  hclog.Default(),
 	}
 	if err := server.Init(); err != nil {
 		t.Fatalf("err: %s", err)
@@ -165,10 +169,11 @@ func TestPluginGRPCConn(t testing.T, ps map[string]Plugin) (*GRPCClient, *GRPCSe
 
 	// Create the client
 	client := &GRPCClient{
-		Conn:    conn,
-		Plugins: ps,
-		broker:  broker,
-		doneCtx: context.Background(),
+		Conn:       conn,
+		Plugins:    ps,
+		broker:     broker,
+		doneCtx:    context.Background(),
+		controller: plugin.NewGRPCControllerClient(conn),
 	}
 
 	return client, server