diff --git a/CHANGELOG.md b/CHANGELOG.md index bdee98edf..16099045d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,54 @@ +# Release 0.23.0 + +## What's New + +* Bug fix: Fix panic in router when router is shutdown before control channel is established +* Enhancement: Add source/target router ids on link metrics. +* Security: Fabric management channel wasn't properly validating certs against the server cert chain +* Security: Router link listeners weren't properly validating certs against the server cert chain +* Security: Link listeners now validate incoming links to ensure that the link was requested by the controller and the correct router dialed +* Security: Don't allow link forwarding entries to be overriden, as link ids should be unique +* Security: Validate ctrl channel clients against controller cert chain in addition to checking cert fingerprint + +## Breaking Changes + +The link validation required a controller side and router side component. The controller will continue to work with earlier routers, but the routers with version >= 0.23.0 will need a controller with version >= 0.23.0. + +## Link Metrics Router Ids + +The link router ids will now be included as tags on the metrics. + +``` +{ + "metric": "link.latency", + "metrics": { + "link.latency.count": 322, + "link.latency.max": 844083, + "link.latency.mean": 236462.8671875, + "link.latency.min": 100560, + "link.latency.p50": 212710.5, + "link.latency.p75": 260137.75, + "link.latency.p95": 491181.89999999997, + "link.latency.p99": 820171.6299999995, + "link.latency.p999": 844083, + "link.latency.p9999": 844083, + "link.latency.std_dev": 118676.24663550049, + "link.latency.variance": 14084051515.49014 + }, + "namespace": "metrics", + "source_entity_id": "lDWL", + "source_event_id": "52f9de3e-4293-4d4f-9dc8-5c4f40b04d12", + "source_id": "4ecTdw8lG6", + "tags": { + "sourceRouterId": "CorTdA8l7", + "targetRouterId": "4ecTdw8lG6" + }, + "timestamp": "2021-11-10T18:04:32.087107445Z" +} +``` + +Note that this information is injected into the metric in the controller. If the controller doesn't know about the link, because of a controller restart, the information can't be added. + # Release 0.22.11 ## What's New diff --git a/etc/ctrl.yml b/etc/ctrl.yml index 092f193ae..78a2b0af1 100644 --- a/etc/ctrl.yml +++ b/etc/ctrl.yml @@ -134,3 +134,66 @@ mgmt: #influxdb: #url: http://localhost:8086 #database: ziti + # + + +# web - optional +# Defines webListeners that will be hosted by the controller. Each webListener can host many APIs and be bound to many +# bind points. +web: + # name - required + # Provides a name for this listener, used for logging output. Not required to be unique, but is highly suggested. + - name: all-apis-localhost + # bindPoints - required + # One or more bind points are required. A bind point specifies an interface (interface:port string) that defines + # where on the host machine the webListener will listen and the address (host:port) that should be used to + # publicly address the webListener(i.e. mydomain.com, localhost, 127.0.0.1). This public address may be used for + # incoming address resolution as well as used in responses in the API. + bindPoints: + #interface - required + # A host:port string on which network interface to listen on. 0.0.0.0 will listen on all interfaces + - interface: 127.0.0.1:1280 + # address - required + # The public address that external incoming requests will be able to resolve. Used in request processing and + # response content that requires full host:port/path addresses. + address: 127.0.0.1:1280 + # identity - optional + # Allows the webListener to have a specific identity instead of defaulting to the root `identity` section. + # identity: + # cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem + # server_cert: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem + # key: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/private/ctrl.key.pem + # ca: ${ZITI_SOURCE}/ziti/etc/ca/intermediate/certs/ca-chain.cert.pem + # options - optional + # Allows the specification of webListener level options - mainly dealing with HTTP/TLS settings. These options are + # used for all http servers started by the current webListener. + options: + # idleTimeout - optional, default 5000ms + # The maximum amount of idle time in milliseconds allowed for pipelined HTTP requests. Setting this too high + # can cause resources on the host to be consumed as clients remain connected and idle. Lowering this value + # will cause clients to reconnect on subsequent HTTPs requests. + idleTimeout: 5000ms #http timeouts, new + # readTimeout - optional, default 5000ms + # The maximum amount of time in milliseconds http servers will wait to read the first incoming requests. A higher + # value risks consuming resources on the host with clients that are acting bad faith or suffering from high latency + # or packet loss. A lower value can risk losing connections to high latency/packet loss clients. + readTimeout: 5000ms + # writeTimeout - optional, default 10000ms + # The total maximum time in milliseconds that the http server will wait for a single requests to be received and + # responded too. A higher value can allow long running requests to consume resources on the host. A lower value + # can risk ending requests before the server has a chance to respond. + writeTimeout: 100000ms + # minTLSVersion - optional, default TSL1.2 + # The minimum version of TSL to support + minTLSVersion: TLS1.2 + # maxTLSVersion - optional, default TSL1.3 + # The maximum version of TSL to support + maxTLSVersion: TLS1.3 + # apis - required + # Allows one or more APIs to be bound to this webListener + apis: + # binding - required + # Specifies an API to bind to this webListener. Built-in APIs are + # - health-checks + - binding: health-checks + options: { } diff --git a/go.mod b/go.mod index e9f60f10f..62e10e580 100644 --- a/go.mod +++ b/go.mod @@ -34,10 +34,10 @@ require ( github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19 github.com/michaelquigley/pfxlog v0.6.3 - github.com/openziti/edge v0.20.122 - github.com/openziti/fabric v0.16.125 - github.com/openziti/foundation v0.16.4 - github.com/openziti/sdk-golang v0.15.113 + github.com/openziti/edge v0.20.130 + github.com/openziti/fabric v0.16.131 + github.com/openziti/foundation v0.16.5 + github.com/openziti/sdk-golang v0.15.114 github.com/pborman/uuid v1.2.0 github.com/pkg/errors v0.9.1 github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 @@ -52,7 +52,7 @@ require ( github.com/urfave/negroni v1.0.0 github.com/valyala/fasttemplate v1.2.1 go.etcd.io/bbolt v1.3.5-0.20200615073812-232d8fc87f50 - golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d + golang.org/x/net v0.0.0-20211029224645-99673261e6eb google.golang.org/grpc v1.38.0 gopkg.in/AlecAivazis/survey.v1 v1.8.7 gopkg.in/resty.v1 v1.12.0 diff --git a/go.sum b/go.sum index b8ddc18ba..874a4c29f 100644 --- a/go.sum +++ b/go.sum @@ -66,6 +66,7 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= github.com/Jeffail/gabs v1.4.0 h1://5fYRRTq1edjfIrQGvdkcd22pkYUrHZ5YC/H2GJVAo= github.com/Jeffail/gabs v1.4.0/go.mod h1:6xMvQMK4k33lb7GUUpaAPh6nKMmemQeg5d4gn7/bOXc= +github.com/Jeffail/gabs/v2 v2.6.1/go.mod h1:xCn81vdHKxFUuWWAaD5jCTQDNPBMh5pPs9IJ+NcziBI= github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ= github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE= github.com/MichaelMure/go-term-markdown v0.1.4 h1:Ir3kBXDUtOX7dEv0EaQV8CNPpH+T7AfTh0eniMOtNcs= @@ -347,6 +348,7 @@ github.com/go-openapi/validate v0.20.1/go.mod h1:b60iJT+xNNLfaQJUqLI7946tYiFEOuE github.com/go-openapi/validate v0.20.3 h1:GZPPhhKSZrE8HjB4eEkoYAZmoWA4+tCemSgINH1/vKw= github.com/go-openapi/validate v0.20.3/go.mod h1:goDdqVGiigM3jChcrYJxD2joalke3ZXeftD16byIjA4= github.com/go-resty/resty/v2 v2.1.1-0.20191201195748-d7b97669fe48/go.mod h1:dZGr0i9PLlaaTD4H/hoZIDjQ+r6xq8mgbRzHZf7f2J8= +github.com/go-resty/resty/v2 v2.7.0/go.mod h1:9PWDzw47qPphMRFfhsyk0NnSgvluHcljSMVIq3w7q0I= github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg= github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= @@ -683,7 +685,6 @@ github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyex github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI= github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE= github.com/michaelquigley/pfxlog v0.3.1/go.mod h1:pwJmJ9nN787xk9U+0z8/5nP2GMhU6GGCTfgBWGpiXaQ= -github.com/michaelquigley/pfxlog v0.6.2/go.mod h1:D2vg1tPyPdSXWWkSnGk6Fomwh5b3clwVJDUh71tq8Sk= github.com/michaelquigley/pfxlog v0.6.3 h1:/od363CtyX4z03vhzyJnfzOevXEYihGHVnLVI64a/e0= github.com/michaelquigley/pfxlog v0.6.3/go.mod h1:D2vg1tPyPdSXWWkSnGk6Fomwh5b3clwVJDUh71tq8Sk= github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4= @@ -759,16 +760,15 @@ github.com/openziti/bbolt v1.3.6-0.20210317142109-547da822475e h1:ST9+54UtCr96S5 github.com/openziti/bbolt v1.3.6-0.20210317142109-547da822475e/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ= github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k= github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo= -github.com/openziti/edge v0.20.122 h1:ima+/9ZAsV3kyrwhWb3PqeNaQNYmmZK5wlTijnWghWM= -github.com/openziti/edge v0.20.122/go.mod h1:45pv86sSuG0qv6BVCEAayH6pbciJ3VQWqMN5ZQ50mBA= -github.com/openziti/fabric v0.16.124/go.mod h1:FmFJ+1t4igiXHSAyFj2xXhpQZhCQrGdGfzN/vZ3MmtE= -github.com/openziti/fabric v0.16.125 h1:nJXtqszV4NBVkkyu/3KnqSPD9ryNpl6lvu27h7Fmu8Y= -github.com/openziti/fabric v0.16.125/go.mod h1:5tewBNJNBGa2Yi9v46oSIgmvmV/CR8MIy0uFkoahYY0= -github.com/openziti/foundation v0.16.3/go.mod h1:I2wfnrkaL5G8iWfRCvHRnPDT5PHJUcw0N9hE0s/f+b0= -github.com/openziti/foundation v0.16.4 h1:A2lrHbfDMjugxPzG1QLTN1JS7IECkoVlzU5D047aQq4= -github.com/openziti/foundation v0.16.4/go.mod h1:ZplfBuJd7oyvWc+X+Y6+nlb2yxWim8uH/r9SpYkYS+w= -github.com/openziti/sdk-golang v0.15.113 h1:ZE9Kfd9nU1KlSLTCCK3HioF6lpGZQEio3PdYJyzl12w= -github.com/openziti/sdk-golang v0.15.113/go.mod h1:R7adj9ForENBPNTOOkm/OIm2kz01cwO1C/ZzQSaMC0c= +github.com/openziti/edge v0.20.130 h1:cCpdxC1RxeKTWydmMysaFJfgJ2JOFhUNn9k+Cd5NypE= +github.com/openziti/edge v0.20.130/go.mod h1:WKDpaCrD6fobQUJiax+xZytZNNac05Hzb/WlmcOyd5k= +github.com/openziti/fabric v0.16.130/go.mod h1:VjebpM2+/hCq95y5uhfL+riUojKd/fWLj5xp4iI75ws= +github.com/openziti/fabric v0.16.131 h1:/e9dlEGcQxAmMYmZnJKTf7Vac97FtA4xQbkkB08umzE= +github.com/openziti/fabric v0.16.131/go.mod h1:VjebpM2+/hCq95y5uhfL+riUojKd/fWLj5xp4iI75ws= +github.com/openziti/foundation v0.16.5 h1:qbAip1Qn5wzmpPxo7aCBLVt0zGvwVKRN+vGPGl51Wxc= +github.com/openziti/foundation v0.16.5/go.mod h1:ZplfBuJd7oyvWc+X+Y6+nlb2yxWim8uH/r9SpYkYS+w= +github.com/openziti/sdk-golang v0.15.114 h1:Sm80QSguke75XQkN4961WdSE6BxZifYz8o2U/GzzWxA= +github.com/openziti/sdk-golang v0.15.114/go.mod h1:q+7Fi27flFfyizwy9tjZ0CZ/WMBlyJefdFu7F7TB0bo= github.com/oracle/oci-go-sdk v24.2.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888= github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI= github.com/orcaman/concurrent-map v0.0.0-20210106121528-16402b402231 h1:fa50YL1pzKW+1SsBnJDOHppJN9stOEwS+CRWyUtyYGU= @@ -1142,8 +1142,9 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1Kcs5dz7/ng1VjMUvfKvpfy+jM= golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk= golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d h1:20cMwl2fHAzkJMEA+8J4JgqBQcQGzbisXo31MIeenXI= golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= +golang.org/x/net v0.0.0-20211029224645-99673261e6eb h1:pirldcYWx7rx7kE5r+9WsOXPXK0+WH5+uZ7uPmJ44uM= +golang.org/x/net v0.0.0-20211029224645-99673261e6eb/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= diff --git a/version b/version index e34629406..39010d220 100644 --- a/version +++ b/version @@ -1 +1 @@ -0.22 +0.23