Scrub connection counts and limits from public API health checks

This change scrubs the current connection count and limit from the
health check return values. Hypothetically an adversary could use the
connection limit against Rabbit so this change removes that information
from the returns. Instead we log a warning when the connection limit is
reached.

Author: the-mikedavis

deps/rabbitmq_management/src/rabbit_mgmt_wm_health_check_below_node_connection_limit.erl

@@ -11,6 +11,8 @@
 -export([to_json/2, content_types_provided/2]).
 -export([variances/2]).
 
+-include_lib("kernel/include/logger.hrl").
+
 -include("rabbit_mgmt.hrl").
 -include_lib("rabbitmq_management_agent/include/rabbit_mgmt_records.hrl").
 
@@ -34,16 +36,15 @@ to_json(ReqData, Context) ->
     Limit = rabbit_misc:get_env(rabbit, connection_max, infinity),
     case ActiveConns < Limit of
         true ->
-            rabbit_mgmt_util:reply(
-              #{status => ok,
-                limit => Limit,
-                connections => ActiveConns}, ReqData, Context);
+            rabbit_mgmt_util:reply(#{status => ok}, ReqData, Context);
         false ->
+            ?LOG_WARNING(
+              "Node connection limit is reached. Active connections: ~w, "
+              "limit: ~w",
+              [ActiveConns, Limit]),
             Body = #{
                 status => failed,
-                reason => <<"node connection limit is reached">>,
-                limit => Limit,
-                connections => ActiveConns
+                reason => <<"node connection limit is reached">>
             },
             {Response, ReqData1, Context1} = rabbit_mgmt_util:reply(
                                                Body, ReqData, Context),

deps/rabbitmq_management/src/rabbit_mgmt_wm_health_check_ready_to_serve_clients.erl

@@ -16,6 +16,8 @@
 -export([to_json/2, content_types_provided/2]).
 -export([variances/2]).
 
+-include_lib("kernel/include/logger.hrl").
+
 -include("rabbit_mgmt.hrl").
 -include_lib("rabbitmq_management_agent/include/rabbit_mgmt_records.hrl").
 
@@ -33,8 +35,8 @@ content_types_provided(ReqData, Context) ->
 
 to_json(ReqData, Context) ->
     case check() of
-        {ok, Body} ->
-            rabbit_mgmt_util:reply(Body, ReqData, Context);
+        ok ->
+            rabbit_mgmt_util:reply(#{status => ok}, ReqData, Context);
         {error, Body} ->
             {Response, ReqData1, Context1} = rabbit_mgmt_util:reply(
                                                Body, ReqData, Context),
@@ -62,13 +64,14 @@ check() ->
                     Limit = rabbit_misc:get_env(rabbit, connection_max, infinity),
                     case ActiveConns < Limit of
                         true ->
-                            {ok, #{status => ok,
-                                   limit => Limit,
-                                   connections => ActiveConns}};
+                            ok;
                         false ->
+                            ?LOG_WARNING(
+                              "Node connection limit is reached. Active "
+                              "connections: ~w, limit: ~w",
+                              [ActiveConns, Limit]),
                             {error, #{status => failed,
                                       reason => <<"node connection limit is reached">>,
-                                      limit => Limit,
                                       connections => ActiveConns}}
                     end;
                 [] ->

deps/rabbitmq_management/test/rabbit_mgmt_http_health_checks_SUITE.erl

@@ -476,8 +476,6 @@ below_node_connection_limit_test(Config) ->
     Path = "/health/checks/below-node-connection-limit",
     Check0 = http_get(Config, Path, ?OK),
     ?assertEqual(<<"ok">>, maps:get(status, Check0)),
-    ?assertEqual(0, maps:get(connections, Check0)),
-    ?assertEqual(<<"infinity">>, maps:get(limit, Check0)),
 
     %% Set the connection limit low and open 'limit' connections.
     Limit = 10,
@@ -489,8 +487,6 @@ below_node_connection_limit_test(Config) ->
 
     Body0 = http_get_failed(Config, Path),
     ?assertEqual(<<"failed">>, maps:get(<<"status">>, Body0)),
-    ?assertEqual(10, maps:get(<<"limit">>, Body0)),
-    ?assertEqual(10, maps:get(<<"connections">>, Body0)),
 
     %% Clean up the connections and reset the limit.
     [catch rabbit_ct_client_helpers:close_connection(C) || C <- Connections],
@@ -519,8 +515,6 @@ ready_to_serve_clients_test(Config) ->
 
     Body1 = http_get_failed(Config, Path),
     ?assertEqual(<<"failed">>, maps:get(<<"status">>, Body1)),
-    ?assertEqual(10, maps:get(<<"limit">>, Body1)),
-    ?assertEqual(10, maps:get(<<"connections">>, Body1)),
 
     %% Clean up the connections and reset the limit.
     [catch rabbit_ct_client_helpers:close_connection(C) || C <- Connections],