* backport of commit 1367b1b7

* backport of commit 6dd8c727

* backport of commit 5aaace49

* backport of commit 2fe8249e

* backport of commit 9bfd5dad

* backport of commit 301e4e21

* backport of commit 819fab9f

* backport of commit eb214409

* backport of commit a4ec1e35

* backport of commit fe71e4f9

* backport of commit 5f8c1c5b



* backport of commit 8b4d7613989227fd35656838ad0791fa94001a86

* backport of commit 03139a5af72fb52054155f7462cd55ed2c617f48

* backport of commit 0e18f29d4c75598e6aa5826587eb2be1ee895d47

* backport of commit 4b5d5a9930f794c669869a520fdb32693afeb79c

---------

Co-authored-by: David Yu <dyu@hashicorp.com>

NET-7813 - DNS : SERVFAIL when resolving PTR records

Co-authored-by: John Murret <john.murret@hashicorp.com>

Backport of [NET-6741] make: Add target for updating dependencies across all modules into release/1.17.x (#20685)

backport of commit 6f0e24cd



Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>

* backport of commit ded3c9fa

* backport of commit f6ce7c35



---------

Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>
Co-authored-by: David Yu <dyu@hashicorp.com>

security: Bump Envoy versions to address CVEs

backport of commit fe05f529



Co-authored-by: cskh <hui.kang@hashicorp.com>

* backport of commit 6c31fd76

* backport of commit 8620e735



---------

Co-authored-by: skpratt <sarah.pratt@hashicorp.com>

Backport of docs: Add legacy api gateway deprecation to Consul release notes into release/1.17.x (#20575)

* backport of commit 610892e6



* backport of commit a14018b6a8202d2b91fd275fe9e63f17193f189a

* backport of commit aebdd6b473d9d43aff2b003b76b80b0fccde617f

---------

Co-authored-by: David Yu <dyu@hashicorp.com>

* backport of commit 1668a314

* backport of commit d33eda97



* Backport DeliverLatest func.

---------

Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>

Backport of [CC-7434] Skip collecting data directory metrics in dev mode into release/1.17.x (#20528)

* backport of commit 5d591bbd

* backport of commit cdfb10b4



---------

Co-authored-by: Melissa Kam <mkam@hashicorp.com>

Fix audit-log encoding issue (CC-7337) (#20345)

* add changes

* added changelog

* change update

* CE chnages

* Removed gzip size fix

* fix changelog

* Update .changelog/20345.txt



* Adding comments

---------

Co-authored-by: Ashesh Vidyut <134911583+absolutelightning@users.noreply.github.com>
Co-authored-by: Abhishek Sahu <abhishek.sahu@hashicorp.com>
Co-authored-by: Hans Hasselberg <hans@hashicorp.com>
Co-authored-by: srahul3 <rahulsharma@hashicorp.com>

Exported services CLI and docs (#20331)

* Exported services CLI and docs

* Changelog added

* Added format option for pretty print

* Update command/exportedservices/exported_services.go



* Addressing PR comments, moving the command under services category

* Add consumer peer and partition filter

* Adding bexpr filter, change format of data

---------

Co-authored-by: Ashesh Vidyut <134911583+absolutelightning@users.noreply.github.com>

* backport of commit b5c6c1da

* backport of commit 1b7dbd7e



---------

Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>

backport of commit ae15d431

backport of commit 0ddd1cde



Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>

* backport of commit 3885ff70

* backport of commit 97501c91

* backport of commit 5330e755

* backport of commit 1ff82ed2



---------

Co-authored-by: natemollica-dev <57850649+natemollica-nm@users.noreply.github.com>
Co-authored-by: natemollica-dev <nathan.mollica@hashicorp.com>

Add known issue for GH-20360.

Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>

backport of commit d5005719



Co-authored-by: Blake Covarrubias <blake@covarrubi.as>

Fix SAN matching on terminating gateways (#20417)

Fixes issue: hashicorp/consul#20360

A regression was introduced in hashicorp/consul#19954 where the SAN validation
matching was reduced from 4 potential types down to just the URI.

Terminating gateways will need to match on many fields depending on user
configuration, since they make egress calls outside of the cluster. Having more
than one matcher behaves like an OR operation, where any match is sufficient to
pass the certificate validation. To maintain backwards compatibility with the
old untyped `match_subject_alt_names` Envoy behavior, we should match on all 4
enum types.

https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#enum-extensions-transport-sockets-tls-v3-subjectaltnamematcher-santype



Co-authored-by: Derek Menteer <105233703+hashi-derek@users.noreply.github.com>

* backport of commit af986988

* backport of commit e96bb5f6

* backport of commit d3fa2d62

backport of commit 166d922b



Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>

* backport of commit e479655d47b67667b1ef3c598f282b819829ad16

* backport of commit 34585f645a1c1c4ed394b6b644d401b40ddb04a7

---------

Co-authored-by: Krastin Krastev <krastin@hashicorp.com>

backport of commit eb31f025



Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>

Change logging of registered v2 resource endpoints to add /api prefix (#20352)

* Change logging of registered v2 resource endpoints to add /api prefix

Previous:

    agent.http: Registered resource endpoint: endpoint=/demo/v1/executive

New:

    agent.http: Registered resource endpoint: endpoint=/api/demo/v1/executive

This reduces confusion when attempting to call the APIs after looking at
the logs.

* update mod file for new versions

* update version to 1.17.3-dev

* update changelog

* update go.mod's

backport of commit ad1d4f30dee9f25950249cad55eccdb65bf74f2b

Co-authored-by: Krastin Krastev <krastin@hashicorp.com>

NET-5824 Exported services api (#20015)

* Exported services api implemented

* Tests added, refactored code

* Adding server tests

* changelog added

* Proto gen added

* Adding codegen changes

* changing url, response object

* Fixing lint error by having namespace and partition directly

* Tests changes

* refactoring tests

* Simplified uniqueness logic for exported services, sorted the response in order of service name

* Fix lint errors, refactored code

backport of commit 1b458c488339198d2af180b3ba427aa81e74bbab

Co-authored-by: Lord-Y <Lord-Y@users.noreply.github.com>

Deflake the catalog v2beta1 integration tests (#20278)

Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com>

backport of commit fd527e7e



Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>

Backport of security: disable Vault secret scans due to false positives into release/1.17.x (#20274)

backport of commit 20ee3373



Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>

Backport of Fix to not create a watch to `Internal.ServiceDump` when mesh gateway is not used into release/1.17.x (#20268)

This add a fix to properly verify the gateway mode before creating a watch specific to mesh gateways. This watch have a high performance cost and when mesh gateways are not used is not used.

This also adds an optimization to only return the nodes when watching the Internal.ServiceDump RPC to avoid unnecessary disco chain compilation. As watches in proxy config only need the nodes.

* backport of commit b0ce20b5
* backport of commit 3d4bde00
* backport of commit b2c77246
* backport of commit e7ab4d41
* backport of commit d00d9c5d
* backport of commit b2db3d5e
* backport of commit 50fb45ac
* backport of commit 7b41a61c
* backport of commit 2fa0e0a6
* backport of commit 88849c90
* backport of commit 4ac54f10
* backport of commit 2a9dfc37



---------

Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>

NET-3860 - [Supportability] consul troubleshoot CLI for verifying ports (#18329)

* init

* udp

* added support for custom port

* removed grpc

* rename constants

* removed udp

* added change log

* fix synopsis

* pr comment chagnes

* make private

* added tests

* added one more test case

* defer close results channel

* removed unwanted comment

* licence update

* updated docs

* fix indent

* fix path

* example update

* Update website/content/commands/troubleshoot/ports.mdx



* Update website/content/commands/troubleshoot/ports.mdx



* Update command/troubleshoot/ports/troubleshoot_ports.go



* Update website/content/commands/troubleshoot/ports.mdx



* Update website/content/commands/troubleshoot/index.mdx



* Update command/troubleshoot/ports/troubleshoot_ports.go



* Update command/troubleshoot/ports/troubleshoot_ports.go



* Update website/content/commands/troubleshoot/ports.mdx



* Update website/content/commands/troubleshoot/ports.mdx



* Update website/content/commands/troubleshoot/ports.mdx



* pr comment resolved

---------

Co-authored-by: Ashesh Vidyut <134911583+absolutelightning@users.noreply.github.com>
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>

Backport of check error in TestDNSCycleRecursorCheckAllFail before asserting response to stop panic in CI. into release/1.17.x (#20235)

* no-op commit due to failed cherry-picking

* check error in TestDNSCycleRecursorCheckAllFail before asserting response to stop panic in CI. (#20231)

---------

Co-authored-by: temp <temp@hashicorp.com>
Co-authored-by: John Murret <john.murret@hashicorp.com>

backport of commit 9816a74b



Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>