Vault SDK/Custom Auth Plugin — RemotePort in Client Connection Always Returns 0

[jrx]

Describe the Bug
When implementing a Vault authentication plugin, the RemoteAddr field correctly reflects the IP address of the Vault client. However, the RemotePort field always returns 0, regardless of the client's actual port.

This makes it impossible to implement functionality that distinguishes between privileged and unprivileged client ports, even though the RemotePort field is present in the API.

Steps to Reproduce

1. Clone HashiCorp's [Vault auth plugin example](https://github.com/hashicorp/vault-auth-plugin-example.git).
2. Modify the plugin code to include logging for req.Connection.RemotePort, as shown below:

func (b *backend) pathAuthLogin(_ context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
    b.Logger().Info("login requested :)")

    if req.Connection == nil {
        b.Logger().Error("connection is nil")
    } else {
        b.Logger().Info("connection details",
            "remoteAddr", req.Connection.RemoteAddr,
            "remotePort", req.Connection.RemotePort)
    }

    if req.Connection.RemotePort >= 1024 {
        b.Logger().Error("unprivileged port", "err", logical.ErrPermissionDenied.Error())
        return nil, logical.ErrPermissionDenied
    }

    password := d.Get("password").(string)

    [...]
}

3. Build and test the plugin using ./docker-test.sh.
4. Check the logs with docker logs $(docker ps -lq). The logs will show remotePort=0, e.g.:

2024-12-13T08:53:13.428Z [INFO]  auth.example-auth-plugin.auth_example-auth-plugin_647ba2e9.example-auth-plugin.vault-auth-plugin-example: login requested :): timestamp=2024-12-13T08:53:13.428Z
2024-12-13T08:53:13.428Z [INFO]  auth.example-auth-plugin.auth_example-auth-plugin_647ba2e9.example-auth-plugin.vault-auth-plugin-example: connection details: remoteAddr=192.168.127.1 remotePort=0 timestamp=2024-12-13T08:53:13.428Z

Expected Behavior
The RemotePort field should reflect the actual ephemeral port used by the Vault client, similar to how it is captured in Vault audit logs. For example, an expected output might show:

"request": {
    "remote_address": "10.0.101.5",
    "remote_port": 56946
}

This would allow developers to differentiate between privileged (≤1023) and unprivileged (≥1024) ports.

Environment

• Vault Server Version: hashicorp/vault:latest (1.18.2)
• Configuration: Generated via ./docker-test.sh. Relevant portion shown below:

docker run --rm -d -p 8200:8200 --name vaultplg \
    -v "$(pwd)/$tmpdir/data":/data \
    -v $(pwd):/example \
    --cap-add=IPC_LOCK \
    -e 'VAULT_LOCAL_CONFIG=
{
  "backend": {"file": {"path": "/data"}},
  "listener": [{"tcp": {"address": "0.0.0.0:8200", "tls_disable": true}}],
  "plugin_directory": "/example",
  "log_level": "debug",
  "disable_mlock": true,
  "api_addr": "http://localhost:8200"
}' hashicorp/vault server

Additional Notes