From c4daf2c8987934c91660cc9d3ebb80f17cdf7fca Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Thu, 12 Nov 2020 00:04:07 -0500 Subject: [PATCH] update changelog and deps --- CHANGELOG.md | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ go.mod | 4 ++-- go.sum | 6 ++++-- 3 files changed, 57 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b84b09600..2a7c68b36 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,10 +1,61 @@ # Release 0.17.4 +## Breaking Changes + * Process posture checks now accept process posture responses with `signerFingerprints` instead of a single + `singerFingerprint`. This renders older versions of the C-SDK (<=0.17.15) and Go-SDK (<=0.14.8) unable to properly respond to process posture checks. + Prior to this binaries with digital signatures not in leaf-leading order would fail process posture checks. + * OS posture checks implementations in Ziti SDKs and Ziti Apps must now pass x.y.z semver compliant versions in the `version` field of posture responses. + Failure to do so results failing posture checks. For operating systems that do not have all three x.y.z values, zeros should be used to supply the missing values. + ## What's New * [edge/#392](https://github.com/openziti/edge/issues/392) Pass AppData message headers * [edge/#394](https://github.com/openziti/edge/issues/394) Posture Checks evaluate to false for existing sessions that lose all checks * [edge/#396](https://github.com/openziti/edge/issues/396) Process checks can incorrectly pass + * [edge/#403](https://github.com/openziti/edge/issues/403) Support multiple executable signers signatures per process + * [edge/#401](https://github.com/openziti/edge/issues/401) Improve OS checks to support X.Y.Z semver comparisons + + +### Improve OS checks to support X.Y.Z semver comparisons + +OS Posture checks now support matching on x.y.z semver compliant formatting as well a flexible syntax to specify `Ranges` of +versions. A `Range` is a set of conditions which specify which versions satisfy the range. A singular version can be matched +on by simply supplying the version without any operators (e.g. `1.0.0` ). + +A condition is composed of an operator and a version. The supported operators are: + +- `<1.0.0` Less than `1.0.0` +- `<=1.0.0` Less than or equal to `1.0.0` +- `>1.0.0` Greater than `1.0.0` +- `>=1.0.0` Greater than or equal to `1.0.0` +- `1.0.0`, `=1.0.0`, `==1.0.0` Equal to `1.0.0` +- `!1.0.0`, `!=1.0.0` Not equal to `1.0.0`. Excludes version `1.0.0`. + +Note that spaces between the operator and the version will be gracefully tolerated. + +A `Range` can link multiple `Ranges` separated by space: + +Ranges can be linked by logical AND: + + - `>1.0.0 <2.0.0` would match between both ranges, so `1.1.1` and `1.8.7` but not `1.0.0` or `2.0.0` + - `>1.0.0 <3.0.0 !2.0.3` would match every version between `1.0.0` and `3.0.0` except `2.0.3` + +Ranges can also be linked by logical OR: + + - `<2.0.0 || >=3.0.0` would match `1.x.x` and `3.x.x` but not `2.x.x` + +AND has a higher precedence than OR. It's not possible to use brackets. + +Ranges can be combined by both AND and OR + + - `>1.0.0 <2.0.0 || >3.0.0 !4.2.1` would match `1.2.3`, `1.9.9`, `3.1.1`, but not `4.2.1`, `2.1.1` + +The Ziti Edge API still accepts arrays of versions, as such the arrays are OR'ed between. In addition, +the Ziti CLI supports providing version declarations: + +``` +ziti edge create posture-check os $postureCheckOsName -o "windows:>=10.0.19041" -a "pc1" +``` # Release 0.17.3 diff --git a/go.mod b/go.mod index 163ba2f6f..e010beb4a 100644 --- a/go.mod +++ b/go.mod @@ -25,10 +25,10 @@ require ( github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19 github.com/michaelquigley/pfxlog v0.0.0-20190813191113-2be43bd0dccc - github.com/openziti/edge v0.17.14 + github.com/openziti/edge v0.17.16 github.com/openziti/fabric v0.14.16 github.com/openziti/foundation v0.14.16 - github.com/openziti/sdk-golang v0.14.8 + github.com/openziti/sdk-golang v0.14.9 github.com/pborman/uuid v1.2.0 github.com/pkg/errors v0.9.1 github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 diff --git a/go.sum b/go.sum index 38099cbaa..21eaeafc6 100644 --- a/go.sum +++ b/go.sum @@ -496,8 +496,8 @@ github.com/onsi/gomega v1.8.1/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoT github.com/onsi/gomega v1.10.1 h1:o0+MgICZLuZ7xjH7Vx6zS/zcu93/BEp1VwkIW1mEXCE= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8= -github.com/openziti/edge v0.17.14 h1:BGSVW17/ktRpqonurM7vaqDiKjmjphy4RWwmylipcWQ= -github.com/openziti/edge v0.17.14/go.mod h1:35xxZ4Kgj4y5JKQzQH0UIOTKeXlo0Wh3IDdzl5AfFko= +github.com/openziti/edge v0.17.16 h1:uQ5DCYNmynPNaknG4z5DzAEvXwMW9FUMO2QaKCwLqv4= +github.com/openziti/edge v0.17.16/go.mod h1:fawL4+h2LewOKoUHoT23XHecYAqNo8dsr9DEZGsWqf4= github.com/openziti/fabric v0.14.16 h1:l+5ZX4FoXHusYDq7bFRaqOFtLpIVuZ/lqYibTKEJwg0= github.com/openziti/fabric v0.14.16/go.mod h1:aNECd87kH0bKntsHwPHtjbYf/9bk3MnlzQj21maO6FQ= github.com/openziti/foundation v0.14.15 h1:9QqOqo82wzws8zf5bfqezrmRj9E7AU1hnZHz8wiI9JY= @@ -506,6 +506,8 @@ github.com/openziti/foundation v0.14.16 h1:37jQVIVc3ZB/5Eb6FNS5uH6jQauTEbMWeIgbl github.com/openziti/foundation v0.14.16/go.mod h1:z98OIbCyr2B57EtamNgvDVIoQXct+zVVxOif9KsOOaM= github.com/openziti/sdk-golang v0.14.8 h1:b1BELh/n0heuwaCmjOKJvyLRhtc3ePOPRWnpuXcRuPY= github.com/openziti/sdk-golang v0.14.8/go.mod h1:oD18qkd+NQrT0oRuq6eckKcmvgCum8lmP3wV7R8yWBg= +github.com/openziti/sdk-golang v0.14.9 h1:R6tv7ZH313uGUtyeq+D0tsbcDntHR57rEXI+0wphkwE= +github.com/openziti/sdk-golang v0.14.9/go.mod h1:oD18qkd+NQrT0oRuq6eckKcmvgCum8lmP3wV7R8yWBg= github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6 h1:lNCW6THrCKBiJBpz8kbVGjC7MgdCGKwuvBgc7LoD6sw= github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI= github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=