diff --git a/CHANGELOG.md b/CHANGELOG.md index 8372cc62f..0e5058bf8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,138 @@ +# Release 0.26.2 + +## What's New +- Transport + - WS/WSS Identity Support +- Identity + - Alternate Server Certificate Support +- Edge + - N/A +- Fabric + - N/A +- Ziti CLI + - Improvements to `ziti edge list posture-check` output +- SDK Golang + - N/A + +## Transport +### WS/WSS Identity Support + +The binding `ws` and `wss` in the transport library now use identity for server certificates. Prior to this release +`ws` and `wss` would load the `server_cert` and `key` field from files only. Both now support an optional field named +`identity`. If not specified, the root `identity` field will be used. If specified it will be used for the specified +`ws` or `wss` binding. Since this field is processed by the [identity library](https://github.com/openziti/identity) +it supports all the private key and certificate sources that the identity framework supports (file, pem, hsm, etc.). +Additionally it also enables SNI support for `ws` and `wss` listeners. + +```yaml +transport: + ws: + writeTimeout: 10 + readTimeout: 5 + idleTimeout: 5 + pongTimeout: 60 + pingInterval: 54 + handshakeTimeout: 10 + readBufferSize: 4096 + writeBufferSize: 4096 + enableCompression: false + identity: + server_cert: ./certs/er1.server.cert.pem + server_key: ./certs/key.pem +``` + +Example: Relying on in the root `server_cert` and `alt_server_cert` field +```yaml +v: 3 + +identity: + cert: ./certs/er1.client.cert.pem + server_cert: ./certs/er1.server.cert.pem + key: ./certs/er1.key.pem + ca: ./certs/er1.ca-chain.cert.pem + alt_server_certs: + - server_cert: ./certs/er1.alt.server.cert.pem + server_key: ./certs/er1.alt.server.cert.pem +... + +transport: + ws: + writeTimeout: 10 + readTimeout: 5 + idleTimeout: 5 + pongTimeout: 60 + pingInterval: 54 + handshakeTimeout: 10 + readBufferSize: 4096 + writeBufferSize: 4096 + enableCompression: false +``` + +## Identity +### Alternate Server Certificate Support + +The [identity library](https://github.com/openziti/identity) has been updated to support a new field: `alt_server_certs` +. This field is an array of objects with `server_cert` and `server_key` fields. `alt_server_certs` is not touched by +higher level Ziti automations to renew certificates and is intended for manual or externally automated use. It allows +additional server certificates to be used for the controller and routers with separate private keys. It is useful in +scenarios where routers or controllers are exposed using certificates signed by public CAs (i.e. Let's Encrypt). + +The `server_cert` and `server_key` work the same as the root identity properties of the same name. In any single +`server_cert` source that provides a chain, it assumed that all leaf-certificates are based on the private key in +`server_key`. If `server_key` is not defined, the default root `server_key` will be used. The identity library will use +the certificate chains and private key pairs specified in `alt_server_certs` when generating a TLS configuration via +`ServerTLSConfig()`. All identity sources are viable: `pem`, `file`, etc. + +Go Identity Config Struct Definition: +```go +type Config struct { + Key string `json:"key" yaml:"key" mapstructure:"key"` + Cert string `json:"cert" yaml:"cert" mapstructure:"cert"` + ServerCert string `json:"server_cert,omitempty" yaml:"server_cert,omitempty" mapstructure:"server_cert,omitempty"` + ServerKey string `json:"server_key,omitempty" yaml:"server_key,omitempty" mapstructure:"server_key,omitempty"` + AltServerCerts []ServerPair `json:"alt_server_certs,omitempty" yaml:"alt_server_certs,omitempty" mapstructure:"alt_server_certs,omitempty"` + CA string `json:"ca,omitempty" yaml:"ca,omitempty" mapstructure:"ca"` +} +``` + +JSON Example: + +```json +{ + "cert": "./ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem", + "key": "./ziti/etc/ca/intermediate/private/ctrl.key.pem", + "server_cert": "./ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem", + "server_key": "./ziti/etc/ca/intermediate/certs/ctrl-server.key.pem", + "ca": "./ziti/etc/ca/intermediate/certs/ca-chain.cert.pem", + "alt_server_certs": [ + { + "server_cert": "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.cert.pem", + "server_key": "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.key.pem" + }, + { + "server_cert": "pem:-----BEGIN CERTIFICATE-----\nIIGBjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT...", + "server_key": "pem:-----BEGIN CERTIFICATE-----\nMIIEuDCCAqCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVT..." + } + ] +} +``` + +YAML Example: + +```yaml +cert: "./ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem" +key: "./ziti/etc/ca/intermediate/private/ctrl.key.pem" +server_cert: "./ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem" +server_key: "./ziti/etc/ca/intermediate/certs/ctrl-server.key.pem" +ca: "./ziti/etc/ca/intermediate/certs/ca-chain.cert.pem" +alt_server_certs: + - server_cert: "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.cert.pem" + server_key: "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.key.pem" + - server_cert: "pem:-----BEGIN CERTIFICATE-----\nIIGBjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT..." + server_key: "pem:-----BEGIN CERTIFICATE-----\nMIIEuDCCAqCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVT..." +``` + + # Release 0.26.1 There was a missed dependency update for xweb in 0.26.0 that kept SNI from working in HTTP API components. This would diff --git a/go.mod b/go.mod index fad22278b..f0647b54d 100644 --- a/go.mod +++ b/go.mod @@ -23,22 +23,22 @@ require ( github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19 github.com/michaelquigley/pfxlog v0.6.9 github.com/openziti/agent v1.0.1 - github.com/openziti/channel v0.18.53 - github.com/openziti/edge v0.22.21 - github.com/openziti/fabric v0.19.20 + github.com/openziti/channel v0.18.54 + github.com/openziti/edge v0.22.23 + github.com/openziti/fabric v0.19.21 github.com/openziti/foundation/v2 v2.0.1 github.com/openziti/identity v1.0.5 github.com/openziti/metrics v1.0.2 - github.com/openziti/sdk-golang v0.16.98 + github.com/openziti/sdk-golang v0.16.99 github.com/openziti/storage v0.1.14 - github.com/openziti/transport/v2 v2.0.16 + github.com/openziti/transport/v2 v2.0.17 github.com/openziti/xweb/v2 v2.0.2 github.com/openziti/ziti-db-explorer v1.1.1 github.com/pborman/uuid v1.2.0 github.com/pkg/errors v0.9.1 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 github.com/russross/blackfriday v1.5.2 - github.com/shirou/gopsutil/v3 v3.22.5 + github.com/shirou/gopsutil/v3 v3.22.6 github.com/sirupsen/logrus v1.8.1 github.com/spf13/cobra v1.5.0 github.com/spf13/pflag v1.0.5 diff --git a/go.sum b/go.sum index 34ea1edc8..f6213a696 100644 --- a/go.sum +++ b/go.sum @@ -667,14 +667,14 @@ github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTm github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw= github.com/openziti/agent v1.0.1 h1:mk3M6MOyK75Qc+lOdtKHywfaxnbSES9qi4NiLZQxOMU= github.com/openziti/agent v1.0.1/go.mod h1:ALOg74f4b4GpUOjDPusp6lezbQa/7rgo09HOrodDWAw= -github.com/openziti/channel v0.18.53 h1:YEGsizInlHoEPITJye/HZqTMykRvuzIoa4wrFMcSMkc= -github.com/openziti/channel v0.18.53/go.mod h1:6vF4dSujAqDsmJU5+g82pXvZRiagqq972E0uNA4LG9o= +github.com/openziti/channel v0.18.54 h1:aREX3VYknMmIBI2uQtg5jqkqEKRZOVZ+gkFuSm28GNM= +github.com/openziti/channel v0.18.54/go.mod h1:VzfH+/biFfdDMqACj4xaeKsMhREqjyjHcA70JVS8E4k= github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k= github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo= -github.com/openziti/edge v0.22.21 h1:tPvj5CcdFGIEY6jSkM2dhbRht4n+X4J0ISa5qwgJ9Dg= -github.com/openziti/edge v0.22.21/go.mod h1:viW34MBUDZnLGW2mpHTnR89LHXYbmi74Umt2C6v6sNg= -github.com/openziti/fabric v0.19.20 h1:3hd6q2pCwGdGRySvoFAdBeyMQwMNHr5ZdIwsJLUzoDA= -github.com/openziti/fabric v0.19.20/go.mod h1:SLFSzdEqkCwJoW7nmUdeo2bvfDObK6M1h+fBQ8oUiGk= +github.com/openziti/edge v0.22.23 h1:3Mbw5iv/9zG51ziqUg4iADdqjE9hDXzqqc2mrLCoMuc= +github.com/openziti/edge v0.22.23/go.mod h1:7c9IErnlq/+cMaks6eltrE4YwF/12u/20f3GS86xDcU= +github.com/openziti/fabric v0.19.21 h1:Zvs9Il/pJJoIr9Au3uQFmQLNG/GORDDMExfsY6HJD+4= +github.com/openziti/fabric v0.19.21/go.mod h1:peqUiaaqc7I05oM5KXDSr8sX/iw8mwObkxB3fyqe+As= github.com/openziti/foundation/v2 v2.0.1 h1:HKYwAyxlZ4zmlt0t9Y/v6SWso0qUaeWapkWOlQDKPEk= github.com/openziti/foundation/v2 v2.0.1/go.mod h1:L75kwCC5WTUPqxuAd3G+WMBompaElMb/nYlJjR1sJ9Q= github.com/openziti/identity v1.0.5 h1:PKW1tj0ctOWgscL3P4gKiVFfKrP6dYeP0U6R8Aw6DKM= @@ -683,12 +683,12 @@ github.com/openziti/jwks v1.0.1 h1:+BtBzDWFVUlJfCbBhQR0BZI3YNtoBvfhfdCUSSB0G+0= github.com/openziti/jwks v1.0.1/go.mod h1:KwO0x9FBG0aoJS5f6nH5xeHoplyR1H143SMI9kF0mC8= github.com/openziti/metrics v1.0.2 h1:X3ip93aDDgVeyhqxBLVwCtdG7/kILktFxcpl5N2+4+E= github.com/openziti/metrics v1.0.2/go.mod h1:30EzUXm/VJfTVNoqPLx4x3mC/eslpCeh6wc4ejbZR/g= -github.com/openziti/sdk-golang v0.16.98 h1:djkdN8DHGuJehnGYTx5fD1gPqEhBy9v0rXj/eVXFtcc= -github.com/openziti/sdk-golang v0.16.98/go.mod h1:u/ft5kUJ2t4nxo0My33n0FNOc6MhBljmFJ4TpyfokEA= +github.com/openziti/sdk-golang v0.16.99 h1:+2+/iIhAMhGcUmPng8htNvjvN5Cz5Saz8ifUTHCnkMU= +github.com/openziti/sdk-golang v0.16.99/go.mod h1:Fjos3xNCHu/SHpEBb377x3pqxb1B6poyA8ytRcXknKk= github.com/openziti/storage v0.1.14 h1:JZv9OP0O4d3Z5c+ebaVpNUDJWrRsqgpTPHIwdCgYud0= github.com/openziti/storage v0.1.14/go.mod h1:PXc1iYT8m+EmZf9EGyRTFwAToY1/jd5cAV2FFxL2D/g= -github.com/openziti/transport/v2 v2.0.16 h1:dTo8TyJeYzLly04eadbN8o6m2tehzNNGadyL7abSMHk= -github.com/openziti/transport/v2 v2.0.16/go.mod h1:tkKEcr/NEjJ2NaYyn9ppAlXEidSOyusJGulfKLcqMws= +github.com/openziti/transport/v2 v2.0.17 h1:vMzNaqZbtYs9z3GoUZJPfwUlt55ascTDmwzzvFH45p0= +github.com/openziti/transport/v2 v2.0.17/go.mod h1:GgO7xeiT8pBxncGx/8wtz8XSelfpCGBC5pcG0FTGqcw= github.com/openziti/x509-claims v1.0.2 h1:PSv/xRfejIAcPc16A902k08rSBs3R8bjtL4qq6WEwCI= github.com/openziti/x509-claims v1.0.2/go.mod h1:Z0WIpBm6c4ecrpRKrou6Gk2wrLWxJO/+tuUwKh8VewE= github.com/openziti/xweb/v2 v2.0.2 h1:XYlVFriTq/U1wcUrc+XPnWJGhXh9NJPhtQ7+r3aC0cU= @@ -781,8 +781,8 @@ github.com/sacloud/libsacloud v1.36.2/go.mod h1:P7YAOVmnIn3DKHqCZcUKYUXmSwGBm3yS github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc= github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ= github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo= -github.com/shirou/gopsutil/v3 v3.22.5 h1:atX36I/IXgFiB81687vSiBI5zrMsxcIBkP9cQMJQoJA= -github.com/shirou/gopsutil/v3 v3.22.5/go.mod h1:so9G9VzeHt/hsd0YwqprnjHnfARAUktauykSbr+y2gA= +github.com/shirou/gopsutil/v3 v3.22.6 h1:FnHOFOh+cYAM0C30P+zysPISzlknLC5Z1G4EAElznfQ= +github.com/shirou/gopsutil/v3 v3.22.6/go.mod h1:EdIubSnZhbAvBS1yJ7Xi+AShB/hxwLHOMz4MCYz7yMs= github.com/shurcooL/component v0.0.0-20170202220835-f88ec8f54cc4/go.mod h1:XhFIlyj5a1fBNx5aJTbKoIq0mNaPvOagO+HjB3EtxrY= github.com/shurcooL/events v0.0.0-20181021180414-410e4ca65f48/go.mod h1:5u70Mqkb5O5cxEA8nxTsgrgLehJeAw6Oc4Ab1c/P1HM= github.com/shurcooL/github_flavored_markdown v0.0.0-20181002035957-2122de532470/go.mod h1:2dOwnU2uBioM+SGy2aZoq1f/Sd1l9OkAeAUvjSyvgU0= @@ -862,6 +862,7 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.7.4/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= +github.com/stretchr/testify v1.7.5/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s= @@ -1176,6 +1177,7 @@ golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220712014510-0a85c31ab51e h1:NHvCuwuS43lGnYhten69ZWqi2QOj/CiDNcKbVqwVoew= golang.org/x/sys v0.0.0-20220712014510-0a85c31ab51e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=