'Read Single Audit Request Header Api' is case sensitive and works for lowercase header values only

[rajanadar]

Environment:

• Vault Version: 0.9.0
• Operating System/Architecture: Windows 10/64 bit

Vault Config File:

backend "file" {
path = "d:\vault\file_backend"
}

listener "tcp" {
address = "127.0.0.1:8200"
tls_disable = 1
}

Startup Log Output:
==> WARNING: mlock not supported on this system!

An mlockall(2)-like syscall to prevent memory from being
swapped to disk is not supported on this system. Running
Vault on an mlockall(2) enabled system is much more secure.

==> Vault server configuration:

                 Cgo: disabled
          Listener 1: tcp (addr: "127.0.0.1:8200", cluster address: "127.0.0.1:8201", tls: "disabled")
           Log Level: info
               Mlock: supported: false, enabled: false
             Storage: file
             Version: Vault v0.9.0
         Version Sha: bdac1854478538052ba5b7ec9a9ec688d35a3335

==> Vault server started! Log data will stream in below:

Expected Behavior:
Http 200 Ok from the API with the response payload containing the single audit header details. (name and hmac, wrapped in a secret)

Http Header names are case insensitive as per https://tools.ietf.org/html/rfc7230#section-3.2 and https://tools.ietf.org/html/rfc7540#section-8.1.2

Actual Behavior:
Http 400: {
"errors": [
"Could not find header in config"
]
}

Steps to Reproduce:

• Startup Vault server.
• Create a audit header named "X-Forwarded-For" (PUT on /sys/config/auditing/request-headers/X-Forwarded-For)
• Retrieve the header using a Http GET on /sys/config/auditing/request-headers/X-Forwarded-For
• You'll see the Http 400 error.
• If you now try, /sys/config/auditing/request-headers/x-forwarded-for (all lower case header name) then the response is successful and you see the header details.
• The response should be successful agnostic of the case. Right now, it is not even the case, we used to create the header.

Important Factoids:
Nothing special. Just the normal PUT and GET Apis.

References: