diff --git a/controller/env/broker.go b/controller/env/broker.go index 2eacfb5e6..d1fa3fab2 100644 --- a/controller/env/broker.go +++ b/controller/env/broker.go @@ -641,11 +641,6 @@ func (b *Broker) modelSessionToProto(ns *model.Session) (*edge_ctrl_pb.Session, return nil, fmt.Errorf("could not convert to session proto, could not find service: %s", err) } - apiSession, err := b.ae.Handlers.ApiSession.Read(ns.ApiSessionId) - if err != nil { - return nil, fmt.Errorf("could not convert to network session proto, could not find session: %s", err) - } - fps, err := b.getActiveFingerprints(ns.Id) if err != nil { @@ -664,9 +659,8 @@ func (b *Broker) modelSessionToProto(ns *model.Session) (*edge_ctrl_pb.Session, } return &edge_ctrl_pb.Session{ - Id: apiSession.Id, + Id: ns.Id, Token: ns.Token, - SessionToken: apiSession.Token, Service: svc, CertFingerprints: fps, Type: sessionType, diff --git a/controller/env/xtv.go b/controller/env/xtv.go new file mode 100644 index 000000000..79beb8ccb --- /dev/null +++ b/controller/env/xtv.go @@ -0,0 +1,102 @@ +package env + +import ( + "github.com/michaelquigley/pfxlog" + "github.com/openziti/edge/controller/persistence" + "github.com/openziti/fabric/controller/xtv" + nfpem "github.com/openziti/foundation/util/pem" + "github.com/openziti/sdk-golang/ziti/signing" + "github.com/pkg/errors" + "go.etcd.io/bbolt" + "strings" + "time" +) + +func NewEdgeTerminatorValidator(ae *AppEnv) xtv.Validator { + return &EdgeTerminatorValidator{ + ae: ae, + } +} + +type EdgeTerminatorValidator struct { + ae *AppEnv +} + +func (v *EdgeTerminatorValidator) Validate(tx *bbolt.Tx, terminator xtv.Terminator, create bool) error { + session, err := v.getTerminatorSession(tx, terminator, "") + if err != nil { + return err + } + + if terminator.GetIdentity() == "" { + return nil + } + + identityTerminators, err := v.ae.BoltStores.Terminator.GetTerminatorsInIdentityGroup(tx, terminator, create) + for _, otherTerminator := range identityTerminators { + otherSession, err := v.getTerminatorSession(tx, otherTerminator, "sibling ") + if err != nil { + return err + } + if otherSession != nil { + if otherSession.ApiSession.IdentityId != session.ApiSession.IdentityId { + return errors.Errorf("sibling terminator %v with shared identity %v belongs to different identity", terminator.GetId(), terminator.GetIdentity()) + } + } + } + + verifier, err := signing.GetVerifier(terminator.GetIdentitySecret()) + if err != nil { + return err + } + + now := time.Now() + certs, err := v.ae.BoltStores.Session.LoadCerts(tx, session.Id) + if err != nil { + return err + } + for _, cert := range certs { + if cert.ValidFrom.Before(now) && cert.ValidTo.After(now) { + for _, x509 := range nfpem.PemToX509(cert.Cert) { + if verifier.Verify(x509.PublicKey) { + pfxlog.Logger().Debugf("verified terminator %v with identity %v", terminator.GetId(), terminator.GetIdentity()) + return nil + } + } + } + } + + return errors.Errorf("unable to verify identity secret for identity %v", terminator.GetIdentity()) +} + +func (v *EdgeTerminatorValidator) getTerminatorSession(tx *bbolt.Tx, terminator xtv.Terminator, context string) (*persistence.Session, error) { + if terminator.GetBinding() != "edge" { + return nil, errors.Errorf("%vterminator %v with identity %v is not edge terminator. Can't share identity", context, terminator.GetId(), terminator.GetIdentity()) + } + + addressParts := strings.Split(terminator.GetAddress(), ":") + if len(addressParts) != 2 { + return nil, errors.Errorf("%vterminator %v with identity %v is not edge terminator. Can't share identity", context, terminator.GetId(), terminator.GetIdentity()) + } + + if addressParts[0] != "hosted" { + return nil, errors.Errorf("%vterminator %v with identity %v is not edge terminator. Can't share identity", context, terminator.GetId(), terminator.GetIdentity()) + } + + sessionToken := addressParts[1] + session, err := v.ae.BoltStores.Session.LoadOneByToken(tx, sessionToken) + if err != nil { + pfxlog.Logger().Warnf("sibling terminator %v with shared identity %v has invalid session token %v", terminator.GetId(), terminator.GetIdentity(), sessionToken) + return nil, nil + } + + if session.ApiSession == nil { + apiSession, err := v.ae.BoltStores.ApiSession.LoadOneById(tx, session.ApiSessionId) + if err != nil { + return nil, err + } + session.ApiSession = apiSession + } + + return session, nil +} diff --git a/controller/internal/routes/terminator_api_model.go b/controller/internal/routes/terminator_api_model.go index a01c2a230..4cacbefe8 100644 --- a/controller/internal/routes/terminator_api_model.go +++ b/controller/internal/routes/terminator_api_model.go @@ -37,11 +37,13 @@ func MapCreateTerminatorToModel(terminator *rest_model.TerminatorCreate) *networ BaseEntity: models.BaseEntity{ Tags: terminator.Tags, }, - Service: stringz.OrEmpty(terminator.Service), - Router: stringz.OrEmpty(terminator.Router), - Binding: terminator.Binding, - Address: stringz.OrEmpty(terminator.Address), - Precedence: xt.GetPrecedenceForName(string(terminator.Precedence)), + Service: stringz.OrEmpty(terminator.Service), + Router: stringz.OrEmpty(terminator.Router), + Binding: terminator.Binding, + Address: stringz.OrEmpty(terminator.Address), + Identity: terminator.Identity, + IdentitySecret: terminator.IdentitySecret, + Precedence: xt.GetPrecedenceForName(string(terminator.Precedence)), } if terminator.Cost != nil { ret.Cost = uint16(*terminator.Cost) @@ -126,6 +128,7 @@ func MapTerminatorToRestModel(ae *env.AppEnv, terminator *network.Terminator) (* Router: ToEntityRef(router.Name, router, TransitRouterLinkFactory), Binding: &terminator.Binding, Address: &terminator.Address, + Identity: &terminator.Identity, } cost := rest_model.TerminatorCost(int64(terminator.Cost)) diff --git a/controller/model/session_model.go b/controller/model/session_model.go index b88c5a941..c0b1da863 100644 --- a/controller/model/session_model.go +++ b/controller/model/session_model.go @@ -92,22 +92,22 @@ func (entity *Session) toBoltEntityForCreate(tx *bbolt.Tx, handler Handler) (bol return nil, err } - fingerprints := map[string]bool{} + fingerprints := map[string]string{} for _, authenticatorId := range identity.Authenticators { - authPrints, err := handler.GetEnv().GetHandlers().Authenticator.ReadFingerprints(authenticatorId) + authenticator, err := handler.GetEnv().GetStores().Authenticator.LoadOneById(tx, authenticatorId) if err != nil { pfxlog.Logger().Errorf("encountered error retrieving fingerprints for authenticator [%s]", authenticatorId) continue } - for _, fingerprint := range authPrints { - fingerprints[fingerprint] = true + if certAuth := authenticator.ToCert(); certAuth != nil { + fingerprints[certAuth.Fingerprint] = certAuth.Pem } } - for fingerprint := range fingerprints { + + for fingerprint, cert := range fingerprints { validFrom := time.Now() validTo := time.Now().AddDate(1, 0, 0) - cert := "unknown" boltEntity.Certs = append(boltEntity.Certs, &persistence.SessionCert{ Cert: cert, diff --git a/controller/persistence/config_store_test.go b/controller/persistence/config_store_test.go index bcc821f52..158d061bb 100644 --- a/controller/persistence/config_store_test.go +++ b/controller/persistence/config_store_test.go @@ -17,6 +17,7 @@ package persistence import ( + "encoding/json" "fmt" "github.com/openziti/edge/eid" "go.etcd.io/bbolt" @@ -108,6 +109,22 @@ func (ctx *TestContext) testConfigCrud(*testing.T) { ctx.RequireCreate(config) ctx.ValidateBaseline(config) + configValue := ` + { + "boolArr" : [true, false, false, true], + "numArr" : [1, 3, 4], + "strArr" : ["hello", "world", "how", "are", "you?"] + } + ` + + configMap := map[string]interface{}{} + err = json.Unmarshal([]byte(configValue), &configMap) + ctx.NoError(err) + + config = newConfig(eid.New(), configType.Id, configMap) + ctx.RequireCreate(config) + ctx.ValidateBaseline(config) + config.Data = map[string]interface{}{ "dnsHostname": "ssh.mycompany.com", "support": int64(22), diff --git a/controller/persistence/migrations.go b/controller/persistence/migrations.go index 89446546c..8fb8d8ce7 100644 --- a/controller/persistence/migrations.go +++ b/controller/persistence/migrations.go @@ -19,10 +19,11 @@ package persistence import ( "github.com/openziti/foundation/storage/boltz" "github.com/pkg/errors" + log "github.com/sirupsen/logrus" ) const ( - CurrentDbVersion = 10 + CurrentDbVersion = 11 FieldVersion = "version" ) @@ -95,6 +96,12 @@ func (m *Migrations) migrate(step *boltz.MigrationStep) int { } } + if step.CurrentVersion < 11 { + step.SetError(m.stores.EdgeRouterPolicy.CheckIntegrity(step.Ctx.Tx(), true, func(err error, fixed bool) { + log.WithError(err).Debugf("attempting to update session token index. Fixed? %v", fixed) + })) + } + // current version if step.CurrentVersion <= CurrentDbVersion { return CurrentDbVersion diff --git a/controller/persistence/session_store.go b/controller/persistence/session_store.go index 90aeecc4c..9bc95ac40 100644 --- a/controller/persistence/session_store.go +++ b/controller/persistence/session_store.go @@ -130,7 +130,9 @@ func (entity *SessionCert) GetEntityType() string { type SessionStore interface { Store LoadOneById(tx *bbolt.Tx, id string) (*Session, error) + LoadOneByToken(tx *bbolt.Tx, token string) (*Session, error) LoadCerts(tx *bbolt.Tx, id string) ([]*SessionCert, error) + GetTokenIndex() boltz.ReadIndex } func newSessionStore(stores *stores) *sessionStoreImpl { @@ -144,6 +146,7 @@ func newSessionStore(stores *stores) *sessionStoreImpl { type sessionStoreImpl struct { *baseStore + indexToken boltz.ReadIndex symbolApiSession boltz.EntitySymbol symbolService boltz.EntitySymbol } @@ -152,10 +155,15 @@ func (store *sessionStoreImpl) NewStoreEntity() boltz.Entity { return &Session{} } +func (store *sessionStoreImpl) GetTokenIndex() boltz.ReadIndex { + return store.indexToken +} + func (store *sessionStoreImpl) initializeLocal() { store.AddExtEntitySymbols() - store.AddSymbol(FieldSessionToken, ast.NodeTypeString) + symbolToken := store.AddSymbol(FieldSessionToken, ast.NodeTypeString) + store.indexToken = store.AddUniqueIndex(symbolToken) store.symbolApiSession = store.AddFkSymbol(FieldSessionApiSession, store.stores.apiSession) store.symbolService = store.AddFkSymbol(FieldSessionService, store.stores.edgeService) @@ -176,6 +184,14 @@ func (store *sessionStoreImpl) LoadOneById(tx *bbolt.Tx, id string) (*Session, e return entity, nil } +func (store *sessionStoreImpl) LoadOneByToken(tx *bbolt.Tx, token string) (*Session, error) { + id := store.indexToken.Read(tx, []byte(token)) + if id != nil { + return store.LoadOneById(tx, string(id)) + } + return nil, nil +} + func (store *sessionStoreImpl) LoadCerts(tx *bbolt.Tx, id string) ([]*SessionCert, error) { ids := store.ListChildIds(tx, id, EntityTypeSessionCerts) diff --git a/controller/server/controller.go b/controller/server/controller.go index 890fb3426..ed6eda25a 100644 --- a/controller/server/controller.go +++ b/controller/server/controller.go @@ -24,6 +24,7 @@ import ( "github.com/openziti/edge/controller/apierror" "github.com/openziti/edge/controller/timeout" "github.com/openziti/edge/rest_server" + "github.com/openziti/fabric/controller/xtv" "net/http" "os" "os/signal" @@ -197,6 +198,11 @@ func (c *Controller) Initialize() { Errorf("could not add session enforcer") } + + xtv.RegisterValidator("edge", env.NewEdgeTerminatorValidator(c.AppEnv)) + if err := xtv.InitializeMappings(); err != nil { + log.Fatalf("error initializing xtv: %+v", err) + } } func (c *Controller) Run() { diff --git a/gateway/internal/fabric/manager.go b/gateway/internal/fabric/manager.go index 482bd7f1c..16109b69d 100644 --- a/gateway/internal/fabric/manager.go +++ b/gateway/internal/fabric/manager.go @@ -53,7 +53,7 @@ type StateManager interface { GetNetworkSession(token string) *edge_ctrl_pb.Session GetNetworkSessionWithTimeout(token string, timeout time.Duration) *edge_ctrl_pb.Session GetSessionByFingerprint(fingerprint string) chan *edge_ctrl_pb.ApiSession - GetSession(token string) chan *edge_ctrl_pb.ApiSession + GetSession(token string) *edge_ctrl_pb.ApiSession AddNetworkSessionRemovedListener(token string, callBack func(token string)) RemoveListener AddSessionRemovedListener(token string, callBack func(token string)) RemoveListener StartHeartbeat(channel channel2.Channel, seconds int) @@ -194,18 +194,13 @@ func (sm *StateManagerImpl) RemoveSession(token string) { } } -func (sm *StateManagerImpl) GetSession(token string) chan *edge_ctrl_pb.ApiSession { - ch := make(chan *edge_ctrl_pb.ApiSession) - go func() { - if val, ok := sm.sessionsByToken.Load(token); ok { - if session, ok := val.(*edge_ctrl_pb.ApiSession); ok { - ch <- session - return - } +func (sm *StateManagerImpl) GetSession(token string) *edge_ctrl_pb.ApiSession { + if val, ok := sm.sessionsByToken.Load(token); ok { + if session, ok := val.(*edge_ctrl_pb.ApiSession); ok { + return session } - ch <- nil - }() - return ch + } + return nil } func (sm *StateManagerImpl) GetSessionByFingerprint(fingerprint string) chan *edge_ctrl_pb.ApiSession { @@ -300,10 +295,10 @@ func (sm *StateManagerImpl) getSessionRemovedEventName(token string) events.Even } func (sm *StateManagerImpl) StartHeartbeat(ctrl channel2.Channel, intervalSeconds int) { - sm.heartbeatOperation = newHeartbeatOperation(ctrl, time.Duration(intervalSeconds) * time.Second, sm) + sm.heartbeatOperation = newHeartbeatOperation(ctrl, time.Duration(intervalSeconds)*time.Second, sm) var err error - sm.heartbeatRunner, err = runner.NewRunner(1*time.Second, 24 * time.Hour, func(e error, operation runner.Operation) { + sm.heartbeatRunner, err = runner.NewRunner(1*time.Second, 24*time.Hour, func(e error, operation runner.Operation) { pfxlog.Logger().WithError(err).Error("error during heartbeat runner") }) diff --git a/gateway/xgress_edge/connections.go b/gateway/xgress_edge/connections.go index cd4a108c2..c0033d8e8 100644 --- a/gateway/xgress_edge/connections.go +++ b/gateway/xgress_edge/connections.go @@ -22,10 +22,8 @@ import ( "github.com/michaelquigley/pfxlog" "github.com/openziti/edge/gateway/internal/fabric" "github.com/openziti/edge/internal/cert" - "github.com/openziti/edge/pb/edge_ctrl_pb" "github.com/openziti/foundation/channel2" "github.com/openziti/sdk-golang/ziti/edge" - "time" ) type sessionConnectionHandler struct { @@ -51,13 +49,7 @@ func (handler *sessionConnectionHandler) BindChannel(ch channel2.Channel) error fpg := cert.NewFingerprintGenerator() fingerprints := fpg.FromCerts(certificates) - sessionCh := handler.stateManager.GetSession(token) - var session *edge_ctrl_pb.ApiSession - select { - case session = <-sessionCh: - case <-time.After(250 * time.Millisecond): - return errors.New("session token lookup timeout") - } + session := handler.stateManager.GetSession(token) if session == nil { _ = ch.Close() diff --git a/gateway/xgress_edge/dialer.go b/gateway/xgress_edge/dialer.go index 022268553..462c32f1e 100644 --- a/gateway/xgress_edge/dialer.go +++ b/gateway/xgress_edge/dialer.go @@ -21,6 +21,7 @@ import ( "github.com/michaelquigley/pfxlog" "github.com/openziti/fabric/controller/xt" "github.com/openziti/fabric/router/xgress" + "github.com/openziti/foundation/channel2" "github.com/openziti/foundation/identity/identity" "github.com/openziti/sdk-golang/ziti/edge" log "github.com/sirupsen/logrus" @@ -77,11 +78,18 @@ func (dialer *dialer) Dial(destination string, sessionId *identity.TokenId, addr return nil, fmt.Errorf("host for token '%v' not found", token) } + callerId := "" + if sessionId.Data != nil { + if callerIdBytes, found := sessionId.Data[edge.CallerIdHeader]; found { + callerId = string(callerIdBytes) + } + } + log.Debug("dialing sdk client hosting service") - dialRequest := edge.NewDialMsg(listenConn.Id(), token) + dialRequest := edge.NewDialMsg(listenConn.Id(), token, callerId) dialRequest.Headers[edge.PublicKeyHeader] = sessionId.Data[edge.PublicKeyHeader] - reply, err := listenConn.SendAndWaitWithTimeout(dialRequest, 5*time.Second) + reply, err := listenConn.SendPrioritizedAndWaitWithTimeout(dialRequest, channel2.Highest, 5*time.Second) if err != nil { return nil, err } diff --git a/gateway/xgress_edge/listener.go b/gateway/xgress_edge/listener.go index 5fa3e6096..07829d691 100644 --- a/gateway/xgress_edge/listener.go +++ b/gateway/xgress_edge/listener.go @@ -152,6 +152,10 @@ func (proxy *ingressProxy) processConnect(req *channel2.Message, ch channel2.Cha peerData := make(map[uint32][]byte) peerData[edge.PublicKeyHeader] = req.Headers[edge.PublicKeyHeader] + if callerId, found := req.Headers[edge.CallerIdHeader]; found { + peerData[edge.CallerIdHeader] = callerId + } + if ns.Service.EncryptionRequired && req.Headers[edge.PublicKeyHeader] == nil { msg := "encryption required on service, initiator did not send public header" proxy.sendStateClosedReply(msg, req) @@ -159,7 +163,11 @@ func (proxy *ingressProxy) processConnect(req *channel2.Message, ch channel2.Cha return } - sessionInfo, err := xgress.GetSession(proxy.listener.factory, ns.Id, ns.Service.Id, peerData) + service := ns.Service.Id + if terminatorIdentity, found := req.GetStringHeader(edge.TerminatorIdentityHeader); found { + service = terminatorIdentity + "@" + service + } + sessionInfo, err := xgress.GetSession(proxy.listener.factory, ns.Id, service, peerData) if err != nil { log.Warn("failed to dial fabric ", err) proxy.sendStateClosedReply(err.Error(), req) @@ -270,7 +278,13 @@ func (proxy *ingressProxy) processBind(req *channel2.Message, ch channel2.Channe proxy.listener.factory.hostedServices.Put(token, messageSink) - terminatorId, err := xgress.AddTerminator(proxy.listener.factory, ns.Service.Id, "edge", "hosted:"+token, hostData, cost, precedence) + terminatorIdentity, _ := req.GetStringHeader(edge.TerminatorIdentityHeader) + var terminatorIdentitySecret []byte + if terminatorIdentity != "" { + terminatorIdentitySecret, _ = req.Headers[edge.TerminatorIdentitySecretHeader] + } + + terminatorId, err := xgress.AddTerminator(proxy.listener.factory, ns.Service.Id, "edge", "hosted:"+token, terminatorIdentity, terminatorIdentitySecret, hostData, cost, precedence) messageSink.terminatorIdRef.Set(terminatorId) log.Debugf("registered listener for terminator %v, token: %v", terminatorId, token) diff --git a/go.mod b/go.mod index 7712cf887..a5a44b2b6 100644 --- a/go.mod +++ b/go.mod @@ -32,12 +32,11 @@ require ( github.com/miekg/dns v1.1.31 github.com/mitchellh/mapstructure v1.3.3 github.com/netfoundry/secretstream v0.1.2 - github.com/openziti/fabric v0.13.6 + github.com/openziti/fabric v0.14.2 github.com/openziti/foundation v0.14.5 - github.com/openziti/sdk-golang v0.13.46 + github.com/openziti/sdk-golang v0.13.47 github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6 github.com/pkg/errors v0.9.1 - github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 github.com/sirupsen/logrus v1.6.0 github.com/spf13/cobra v1.0.0 github.com/stretchr/testify v1.6.1 diff --git a/go.sum b/go.sum index bd8d53097..13e1ad0a9 100644 --- a/go.sum +++ b/go.sum @@ -373,14 +373,12 @@ github.com/onsi/gomega v1.8.1/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoT github.com/onsi/gomega v1.10.1 h1:o0+MgICZLuZ7xjH7Vx6zS/zcu93/BEp1VwkIW1mEXCE= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8= -github.com/openziti/fabric v0.13.6 h1:z3ULb1BdhSAEEp6aSwcxAY0B0QOVZM0LOuDqHRo9Ugg= -github.com/openziti/fabric v0.13.6/go.mod h1:nCUaSeDlpvmgWzFlizIDMJBy/ynLg/oLKj7PVjPx1i0= -github.com/openziti/foundation v0.14.4 h1:03eMJT1XFU71+hj1tzdetZPQw1+SiMpXtz/Q97rBT/Y= -github.com/openziti/foundation v0.14.4/go.mod h1:BxcI+GProVBiFYRDkrjg+/r5ptd8/iYdsc+bxAxwQCk= +github.com/openziti/fabric v0.14.2 h1:G+/iquSwMJBEtDDJQhYhdRysvnl/u82X+/Kqk3hC0sE= +github.com/openziti/fabric v0.14.2/go.mod h1:xlES2jGDEuvDGMXvAugWVDhbZdx8dTw6jZBeX1s52Wc= github.com/openziti/foundation v0.14.5 h1:GifwpaJz1jqkHN65spQQATnLVr2B/JYrBSaGCxenMZM= github.com/openziti/foundation v0.14.5/go.mod h1:BxcI+GProVBiFYRDkrjg+/r5ptd8/iYdsc+bxAxwQCk= -github.com/openziti/sdk-golang v0.13.46 h1:z7kzh5v1UQtO1tZM/79RnNhvfJt0tT3NMA/MWFBR1lc= -github.com/openziti/sdk-golang v0.13.46/go.mod h1:Xxz3Gxnms/NvdTQR8ltoui4AHSXX8JqABOkO5OdL/74= +github.com/openziti/sdk-golang v0.13.47 h1:VsrOv9nTQWGdS89hKG8LSQvWzJFWZtNtBT+o4ULYP70= +github.com/openziti/sdk-golang v0.13.47/go.mod h1:Xxz3Gxnms/NvdTQR8ltoui4AHSXX8JqABOkO5OdL/74= github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6 h1:lNCW6THrCKBiJBpz8kbVGjC7MgdCGKwuvBgc7LoD6sw= github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI= github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k= diff --git a/pb/edge_ctrl_pb/edge_ctrl.pb.go b/pb/edge_ctrl_pb/edge_ctrl.pb.go index ebb721fa0..70e053bc2 100644 --- a/pb/edge_ctrl_pb/edge_ctrl.pb.go +++ b/pb/edge_ctrl_pb/edge_ctrl.pb.go @@ -329,7 +329,6 @@ type Session struct { CertFingerprints []string `protobuf:"bytes,3,rep,name=certFingerprints,proto3" json:"certFingerprints,omitempty"` Urls []string `protobuf:"bytes,4,rep,name=urls,proto3" json:"urls,omitempty"` Service *Service `protobuf:"bytes,5,opt,name=service,proto3" json:"service,omitempty"` - SessionToken string `protobuf:"bytes,6,opt,name=sessionToken,proto3" json:"sessionToken,omitempty"` Id string `protobuf:"bytes,7,opt,name=id,proto3" json:"id,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` @@ -396,13 +395,6 @@ func (m *Session) GetService() *Service { return nil } -func (m *Session) GetSessionToken() string { - if m != nil { - return m.SessionToken - } - return "" -} - func (m *Session) GetId() string { if m != nil { return m.Id @@ -787,50 +779,49 @@ func init() { } var fileDescriptor_23f46a161f139ee1 = []byte{ - // 719 bytes of a gzipped FileDescriptorProto - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x55, 0xcd, 0x6e, 0xd3, 0x4c, - 0x14, 0xed, 0x38, 0x49, 0x93, 0xdc, 0x54, 0x8d, 0xbf, 0xfb, 0x35, 0xc5, 0x2d, 0x20, 0x05, 0xb3, - 0x89, 0x8a, 0x1a, 0x44, 0x59, 0x14, 0x75, 0x57, 0xfa, 0xa3, 0x4a, 0x48, 0x20, 0xb9, 0xb0, 0x41, - 0x42, 0xc8, 0xb5, 0xaf, 0x8a, 0x55, 0xd7, 0x13, 0x66, 0x26, 0x91, 0xb2, 0x07, 0xde, 0x01, 0xa9, - 0xa9, 0x80, 0x17, 0xe1, 0x05, 0x60, 0xc5, 0x4b, 0xf0, 0xb3, 0xe4, 0x05, 0x90, 0xc7, 0x76, 0xe2, - 0xb4, 0x06, 0x5a, 0x89, 0xdd, 0xdc, 0x73, 0xef, 0x9c, 0xcc, 0x39, 0x73, 0x3c, 0x81, 0x26, 0xf9, - 0x87, 0xf4, 0xdc, 0x53, 0x22, 0xec, 0xf6, 0x04, 0x57, 0x1c, 0xe7, 0x72, 0xc0, 0x81, 0xfd, 0x96, - 0x41, 0x63, 0x9f, 0xc4, 0x80, 0xc4, 0x1e, 0x85, 0x21, 0x47, 0x0b, 0xaa, 0x03, 0x12, 0x32, 0xe0, - 0x91, 0xc5, 0xda, 0xac, 0x53, 0x77, 0xb2, 0x12, 0xd7, 0xa1, 0xec, 0xbb, 0xca, 0xb5, 0x8c, 0x76, - 0xa9, 0xd3, 0x58, 0xbb, 0xd9, 0xcd, 0xd3, 0x74, 0x73, 0x14, 0xdd, 0x6d, 0x57, 0xb9, 0x3b, 0x91, - 0x12, 0x43, 0x47, 0x6f, 0x58, 0x5e, 0x87, 0xfa, 0x18, 0x42, 0x13, 0x4a, 0x47, 0x34, 0x4c, 0xb9, - 0xe3, 0x25, 0x2e, 0x40, 0x65, 0xe0, 0x86, 0x7d, 0xb2, 0x0c, 0x8d, 0x25, 0xc5, 0x86, 0x71, 0x8f, - 0xd9, 0x5f, 0x18, 0x34, 0xb6, 0xc2, 0x80, 0x22, 0xf5, 0xb7, 0xb3, 0x2d, 0x43, 0xed, 0x05, 0x97, - 0x2a, 0x72, 0x8f, 0x33, 0x9a, 0x71, 0x8d, 0xd7, 0xa0, 0xae, 0x85, 0x7b, 0x3c, 0x94, 0x56, 0xa9, - 0x5d, 0xea, 0xd4, 0x9d, 0x09, 0x30, 0x56, 0x55, 0x2e, 0x52, 0x95, 0xfb, 0xf1, 0x7f, 0xa7, 0xea, - 0x01, 0x54, 0x76, 0x84, 0xe0, 0x02, 0x11, 0xca, 0x1e, 0xf7, 0x29, 0xdd, 0xa5, 0xd7, 0xb1, 0xc4, - 0x63, 0x92, 0xd2, 0x3d, 0xcc, 0x36, 0x66, 0x65, 0x4c, 0xe8, 0xb9, 0x7d, 0x49, 0x56, 0x29, 0x21, - 0xd4, 0x85, 0xfd, 0x0c, 0xaa, 0xb1, 0xf5, 0x81, 0x47, 0x38, 0x0f, 0x46, 0xe0, 0xa7, 0x64, 0x46, - 0xe0, 0xc7, 0xf4, 0x39, 0x3f, 0xf4, 0x1a, 0xbb, 0x80, 0x14, 0x79, 0x62, 0xd8, 0x53, 0x01, 0x8f, - 0x1c, 0x7a, 0xd9, 0x0f, 0x04, 0xf9, 0x9a, 0xb1, 0xe6, 0x14, 0x74, 0xec, 0x9f, 0x2c, 0xe6, 0x97, - 0xda, 0xe3, 0x05, 0xa8, 0x28, 0x7e, 0x44, 0x99, 0xf7, 0x49, 0x81, 0xab, 0x50, 0x56, 0xc3, 0x5e, - 0xf2, 0x2b, 0xf3, 0x6b, 0x4b, 0x67, 0x53, 0xa1, 0xb7, 0x3e, 0x1e, 0xf6, 0xc8, 0xd1, 0x63, 0xb8, - 0x02, 0xa6, 0x47, 0x42, 0xed, 0x06, 0xd1, 0x21, 0x89, 0x9e, 0x08, 0x22, 0x95, 0xdd, 0xc9, 0x39, - 0x3c, 0x16, 0xd0, 0x17, 0xa1, 0xd4, 0x57, 0x53, 0x77, 0xf4, 0x1a, 0x6f, 0x43, 0x55, 0x26, 0x7a, - 0xad, 0x4a, 0x9b, 0x75, 0x1a, 0x6b, 0xad, 0xf3, 0x39, 0x0c, 0x3c, 0x72, 0xb2, 0x29, 0xb4, 0x61, - 0x4e, 0xa6, 0xa7, 0xd0, 0x87, 0x9f, 0xd5, 0x87, 0x9f, 0xc2, 0x52, 0xe7, 0xaa, 0x99, 0x73, 0xf6, - 0x43, 0x80, 0xcd, 0x5e, 0xf0, 0x67, 0xdd, 0x45, 0x42, 0x8c, 0x62, 0x21, 0x36, 0x87, 0xe6, 0x84, - 0x6f, 0xd3, 0xf7, 0xc9, 0xc7, 0x36, 0x34, 0x02, 0xb9, 0xdb, 0x0f, 0xc3, 0x7d, 0xe5, 0xaa, 0x24, - 0x02, 0x35, 0x27, 0x0f, 0xe1, 0x06, 0x34, 0xdc, 0xf1, 0x26, 0x99, 0x7e, 0x75, 0xd6, 0xb4, 0xda, - 0x09, 0xab, 0x93, 0x1f, 0xb6, 0x1f, 0xc1, 0x7f, 0x93, 0xd6, 0x93, 0x9e, 0xef, 0x2a, 0xf2, 0xcf, - 0x12, 0xb2, 0xcb, 0x10, 0xde, 0xca, 0x13, 0x3a, 0x74, 0xcc, 0x07, 0xe4, 0xe3, 0x22, 0xcc, 0x6a, - 0x2f, 0x12, 0xae, 0xba, 0x93, 0x56, 0xf6, 0x2a, 0xfc, 0x3f, 0x19, 0xde, 0x23, 0x57, 0xa8, 0x03, - 0x72, 0xd5, 0x6f, 0xc7, 0x3d, 0x98, 0xbb, 0xa4, 0x35, 0x77, 0xa0, 0x26, 0xa7, 0x7d, 0x69, 0x15, - 0xe6, 0xce, 0x19, 0x8f, 0xd9, 0x1d, 0x98, 0xbf, 0xe0, 0xe9, 0x8f, 0xc6, 0x93, 0x99, 0x71, 0xc5, - 0x01, 0xc8, 0xd2, 0x69, 0x14, 0xa7, 0xb3, 0x74, 0x91, 0x74, 0xae, 0x7c, 0x34, 0xa0, 0xb1, 0xc5, - 0x23, 0x45, 0x91, 0x8a, 0x3f, 0x12, 0xac, 0x41, 0xf9, 0x29, 0x09, 0x6e, 0xce, 0x60, 0x0b, 0x9a, - 0xb9, 0x37, 0x35, 0x6e, 0x9a, 0xef, 0x4e, 0x58, 0x0c, 0xe7, 0x1e, 0x25, 0x0d, 0xbf, 0x3f, 0x61, - 0xd8, 0x84, 0xba, 0x7e, 0x53, 0x34, 0xf0, 0xe1, 0x84, 0xe1, 0x22, 0x98, 0x79, 0x53, 0x35, 0xfe, - 0x6a, 0xc4, 0xd0, 0x02, 0x9c, 0x56, 0xa7, 0x3b, 0xaf, 0xa7, 0x3a, 0xa9, 0x43, 0xba, 0xf3, 0x66, - 0xc4, 0x70, 0x29, 0x7f, 0x9f, 0x13, 0xba, 0xaf, 0x23, 0x86, 0x57, 0xa1, 0x75, 0x2e, 0x68, 0xba, - 0xf9, 0xed, 0x6c, 0x33, 0x4f, 0xfa, 0x7d, 0xc4, 0xf0, 0x3a, 0x5c, 0x29, 0x08, 0x89, 0x6e, 0xff, - 0x18, 0x31, 0x34, 0x01, 0x76, 0x22, 0xc1, 0xc3, 0x50, 0x23, 0x9f, 0x4e, 0xb5, 0xf2, 0x04, 0xd9, - 0x22, 0xa1, 0xa4, 0x86, 0x3f, 0x9f, 0xb2, 0x95, 0x1b, 0xf1, 0xdf, 0xd7, 0xf8, 0x95, 0x89, 0x0d, - 0xdc, 0x0e, 0xdc, 0xd0, 0x9c, 0x89, 0x57, 0xf7, 0x83, 0xc8, 0x37, 0xd9, 0xc1, 0xac, 0x7e, 0xed, - 0xef, 0xfe, 0x0a, 0x00, 0x00, 0xff, 0xff, 0xbb, 0x38, 0x54, 0xdd, 0x0a, 0x07, 0x00, 0x00, + // 700 bytes of a gzipped FileDescriptorProto + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xac, 0x55, 0xdd, 0x6e, 0xd3, 0x4c, + 0x10, 0xfd, 0x9c, 0xa4, 0x4d, 0x32, 0xa9, 0x1a, 0x7f, 0x0b, 0x29, 0x69, 0x01, 0xa9, 0x98, 0x9b, + 0xaa, 0xa8, 0x41, 0x94, 0x8b, 0xa2, 0xde, 0x95, 0xfe, 0xa8, 0x12, 0x12, 0x48, 0x2e, 0xdc, 0x20, + 0x21, 0xe4, 0xda, 0xab, 0x62, 0xd5, 0xf5, 0x86, 0xf5, 0xa6, 0x52, 0xee, 0x81, 0x77, 0x40, 0x82, + 0x0a, 0x78, 0x11, 0x5e, 0x00, 0xc4, 0x05, 0x2f, 0xc1, 0xcf, 0x4b, 0x30, 0x3b, 0xfe, 0xc9, 0xa6, + 0x31, 0xd0, 0x4a, 0xdc, 0xed, 0x9e, 0x33, 0x7b, 0x76, 0xe6, 0xec, 0x78, 0x0c, 0x6d, 0x1e, 0x1c, + 0xf0, 0xa7, 0xbe, 0x92, 0x51, 0xaf, 0x2f, 0x85, 0x12, 0x6c, 0xc6, 0x00, 0xf6, 0x9d, 0xd7, 0x16, + 0xb4, 0xf6, 0xb8, 0x3c, 0xe6, 0x72, 0x97, 0x47, 0x91, 0x60, 0x5d, 0xa8, 0xe3, 0x3a, 0x09, 0x45, + 0xdc, 0xb5, 0x16, 0xad, 0xa5, 0xa6, 0x9b, 0x6f, 0xd9, 0x1a, 0xd4, 0x02, 0x4f, 0x79, 0xdd, 0xca, + 0x62, 0x75, 0xa9, 0xb5, 0x7a, 0xbd, 0x67, 0xca, 0xf4, 0x0c, 0x89, 0xde, 0x16, 0x46, 0x6d, 0xc7, + 0x4a, 0x0e, 0x5d, 0x3a, 0xb0, 0xb0, 0x06, 0xcd, 0x02, 0x62, 0x36, 0x54, 0x0f, 0xf9, 0x30, 0xd3, + 0xd6, 0x4b, 0x76, 0x11, 0xa6, 0x8e, 0xbd, 0x68, 0xc0, 0x51, 0x58, 0x63, 0xe9, 0x66, 0xbd, 0x72, + 0xc7, 0x72, 0xbe, 0x62, 0x6e, 0x9b, 0x51, 0xc8, 0x63, 0xf5, 0xb7, 0xdc, 0x16, 0xa0, 0xf1, 0x4c, + 0x24, 0x2a, 0xf6, 0x8e, 0x72, 0x99, 0x62, 0xcf, 0xae, 0x40, 0x93, 0x0a, 0xf7, 0x45, 0x94, 0x74, + 0xab, 0x98, 0x7c, 0xd3, 0x1d, 0x01, 0x45, 0x55, 0xb5, 0xb2, 0xaa, 0x8c, 0xcb, 0xff, 0x5d, 0x55, + 0xf7, 0x60, 0x6a, 0x5b, 0x4a, 0x21, 0x19, 0x83, 0x9a, 0x2f, 0x02, 0x9e, 0x9d, 0xa2, 0xb5, 0x2e, + 0xf1, 0x88, 0x27, 0x89, 0x77, 0x90, 0x1f, 0xcc, 0xb7, 0x5a, 0xd0, 0xf7, 0x06, 0x09, 0xc7, 0x12, + 0x48, 0x90, 0x36, 0xce, 0x13, 0xa8, 0x6b, 0xeb, 0x43, 0x9f, 0xb3, 0x59, 0xa8, 0x84, 0x41, 0x26, + 0x86, 0x2b, 0x2d, 0x6f, 0xf8, 0x41, 0x6b, 0xd6, 0x03, 0xc6, 0x63, 0x5f, 0x0e, 0xfb, 0x0a, 0x5d, + 0x73, 0xf9, 0xf3, 0x41, 0x28, 0x79, 0x40, 0x8a, 0x0d, 0xb7, 0x84, 0x71, 0xbe, 0x58, 0x5a, 0x3f, + 0x21, 0x8f, 0x31, 0x01, 0x25, 0x0e, 0x79, 0xee, 0x7d, 0xba, 0x61, 0x2b, 0x50, 0x53, 0xc3, 0x7e, + 0x7a, 0xcb, 0xec, 0xea, 0xfc, 0xe9, 0xae, 0xa0, 0xa3, 0x0f, 0x31, 0xc0, 0xa5, 0x30, 0xb6, 0x0c, + 0xb6, 0xcf, 0xa5, 0xda, 0x09, 0xe3, 0x03, 0x2e, 0xfb, 0x32, 0x8c, 0x55, 0xfe, 0x26, 0x13, 0xb8, + 0x2e, 0x60, 0x20, 0xf1, 0xcd, 0x6a, 0xc4, 0xd3, 0x9a, 0xdd, 0x84, 0x7a, 0x92, 0xd6, 0xdb, 0x9d, + 0xc2, 0x1b, 0x5b, 0xab, 0x9d, 0xc9, 0x3e, 0x44, 0xd2, 0xcd, 0xa3, 0x32, 0x57, 0xea, 0xb9, 0x2b, + 0xce, 0x7d, 0x80, 0x8d, 0x7e, 0xf8, 0xe7, 0x9a, 0xca, 0x92, 0xac, 0x94, 0x27, 0xe9, 0x08, 0x68, + 0x8f, 0xf4, 0x36, 0x82, 0x80, 0x07, 0x6c, 0x11, 0x5a, 0x61, 0xb2, 0x33, 0x88, 0xa2, 0x3d, 0xe5, + 0xa9, 0xf4, 0x79, 0x1b, 0xae, 0x09, 0xb1, 0x75, 0x68, 0x79, 0xc5, 0xa1, 0x24, 0xfb, 0xa2, 0xba, + 0xe3, 0x95, 0x8c, 0x54, 0x5d, 0x33, 0xd8, 0x79, 0x00, 0xff, 0x8f, 0xa8, 0x47, 0x7d, 0xec, 0x45, + 0xbc, 0xf2, 0x94, 0xa0, 0x75, 0x1e, 0xc1, 0x1b, 0xa6, 0xa0, 0xcb, 0x8f, 0xc4, 0x31, 0x0a, 0xce, + 0xc1, 0x34, 0x79, 0x91, 0x6a, 0x35, 0xdd, 0x6c, 0xe7, 0xac, 0xc0, 0x85, 0x51, 0xf0, 0x2e, 0xf7, + 0xa4, 0xda, 0xe7, 0x9e, 0xfa, 0x6d, 0xb8, 0x0f, 0x33, 0xe7, 0xb4, 0xe6, 0x16, 0x34, 0x92, 0x71, + 0x5f, 0x3a, 0xa5, 0x3d, 0xe5, 0x16, 0x61, 0xce, 0x12, 0xcc, 0x9e, 0x31, 0xfb, 0xc3, 0x22, 0x32, + 0x37, 0xae, 0xbc, 0x01, 0xf2, 0xce, 0xab, 0x94, 0x77, 0x5e, 0xf5, 0x2c, 0x9d, 0xb7, 0xfc, 0xb1, + 0x82, 0xd3, 0x4b, 0xc4, 0x0a, 0x27, 0x88, 0xfe, 0x00, 0x58, 0x03, 0x6a, 0x8f, 0xb9, 0x14, 0xf6, + 0x7f, 0xac, 0x03, 0x6d, 0x63, 0x5e, 0x6a, 0xd2, 0x7e, 0xf7, 0xc6, 0xd2, 0xb0, 0x31, 0x70, 0x08, + 0x7e, 0x8f, 0x70, 0x1b, 0x9a, 0x34, 0x2f, 0x08, 0xf8, 0x80, 0xc0, 0x1c, 0xd8, 0xa6, 0xa9, 0x84, + 0xbf, 0x78, 0x6b, 0xe1, 0xec, 0x60, 0xe3, 0xd5, 0x11, 0xf3, 0x72, 0x8c, 0xc9, 0x1c, 0x22, 0xe6, + 0x15, 0x32, 0xf3, 0xe6, 0x7b, 0x8e, 0xe4, 0xbe, 0x21, 0x75, 0x19, 0x3a, 0x13, 0x8d, 0x46, 0xe4, + 0xf7, 0xd3, 0xa4, 0x29, 0xfa, 0x03, 0xc9, 0xab, 0x70, 0xa9, 0xa4, 0x49, 0x88, 0xfe, 0x89, 0xb4, + 0x0d, 0xb0, 0x1d, 0x4b, 0x11, 0x45, 0x84, 0x7c, 0x3a, 0xa1, 0xca, 0x53, 0x64, 0x13, 0x3f, 0xaf, + 0x84, 0xe0, 0xcf, 0x27, 0xd6, 0xf2, 0x35, 0xfd, 0x6b, 0x2a, 0x26, 0x88, 0x36, 0x70, 0x2b, 0xf4, + 0x22, 0x34, 0x10, 0x57, 0x77, 0xc3, 0x38, 0xb0, 0xad, 0xfd, 0x69, 0x9a, 0xe4, 0xb7, 0x7f, 0x05, + 0x00, 0x00, 0xff, 0xff, 0xe5, 0xef, 0x7d, 0x75, 0xe6, 0x06, 0x00, 0x00, } diff --git a/pb/edge_ctrl_pb/edge_ctrl.proto b/pb/edge_ctrl_pb/edge_ctrl.proto index 9c7767a7d..fd1f9368a 100644 --- a/pb/edge_ctrl_pb/edge_ctrl.proto +++ b/pb/edge_ctrl_pb/edge_ctrl.proto @@ -53,7 +53,6 @@ message Session { repeated string certFingerprints = 3; repeated string urls = 4; Service service = 5; - string sessionToken = 6; string id = 7; } diff --git a/rest_model/terminator_create.go b/rest_model/terminator_create.go index 599392da5..8da46d26d 100644 --- a/rest_model/terminator_create.go +++ b/rest_model/terminator_create.go @@ -51,6 +51,13 @@ type TerminatorCreate struct { // cost Cost *TerminatorCost `json:"cost,omitempty"` + // identity + Identity string `json:"identity,omitempty"` + + // identity secret + // Format: byte + IdentitySecret strfmt.Base64 `json:"identitySecret,omitempty"` + // precedence Precedence TerminatorPrecedence `json:"precedence,omitempty"` diff --git a/rest_model/terminator_detail.go b/rest_model/terminator_detail.go index 43ff4d80c..ada64401e 100644 --- a/rest_model/terminator_detail.go +++ b/rest_model/terminator_detail.go @@ -58,6 +58,10 @@ type TerminatorDetail struct { // Required: true DynamicCost *TerminatorCost `json:"dynamicCost"` + // identity + // Required: true + Identity *string `json:"identity"` + // precedence // Required: true Precedence TerminatorPrecedence `json:"precedence"` @@ -98,6 +102,8 @@ func (m *TerminatorDetail) UnmarshalJSON(raw []byte) error { DynamicCost *TerminatorCost `json:"dynamicCost"` + Identity *string `json:"identity"` + Precedence TerminatorPrecedence `json:"precedence"` Router *EntityRef `json:"router"` @@ -120,6 +126,8 @@ func (m *TerminatorDetail) UnmarshalJSON(raw []byte) error { m.DynamicCost = dataAO1.DynamicCost + m.Identity = dataAO1.Identity + m.Precedence = dataAO1.Precedence m.Router = dataAO1.Router @@ -151,6 +159,8 @@ func (m TerminatorDetail) MarshalJSON() ([]byte, error) { DynamicCost *TerminatorCost `json:"dynamicCost"` + Identity *string `json:"identity"` + Precedence TerminatorPrecedence `json:"precedence"` Router *EntityRef `json:"router"` @@ -170,6 +180,8 @@ func (m TerminatorDetail) MarshalJSON() ([]byte, error) { dataAO1.DynamicCost = m.DynamicCost + dataAO1.Identity = m.Identity + dataAO1.Precedence = m.Precedence dataAO1.Router = m.Router @@ -213,6 +225,10 @@ func (m *TerminatorDetail) Validate(formats strfmt.Registry) error { res = append(res, err) } + if err := m.validateIdentity(formats); err != nil { + res = append(res, err) + } + if err := m.validatePrecedence(formats); err != nil { res = append(res, err) } @@ -293,6 +309,15 @@ func (m *TerminatorDetail) validateDynamicCost(formats strfmt.Registry) error { return nil } +func (m *TerminatorDetail) validateIdentity(formats strfmt.Registry) error { + + if err := validate.Required("identity", "body", m.Identity); err != nil { + return err + } + + return nil +} + func (m *TerminatorDetail) validatePrecedence(formats strfmt.Registry) error { if err := m.Precedence.Validate(formats); err != nil { diff --git a/rest_server/embedded_spec.go b/rest_server/embedded_spec.go index 85dd7bdb1..a7acce7ef 100644 --- a/rest_server/embedded_spec.go +++ b/rest_server/embedded_spec.go @@ -7550,6 +7550,13 @@ func init() { "cost": { "$ref": "#/definitions/terminatorCost" }, + "identity": { + "type": "string" + }, + "identitySecret": { + "type": "string", + "format": "byte" + }, "precedence": { "$ref": "#/definitions/terminatorPrecedence" }, @@ -7579,6 +7586,7 @@ func init() { "router", "binding", "address", + "identity", "cost", "precedence", "dynamicCost" @@ -7596,6 +7604,9 @@ func init() { "dynamicCost": { "$ref": "#/definitions/terminatorCost" }, + "identity": { + "type": "string" + }, "precedence": { "$ref": "#/definitions/terminatorPrecedence" }, @@ -23353,6 +23364,13 @@ func init() { "cost": { "$ref": "#/definitions/terminatorCost" }, + "identity": { + "type": "string" + }, + "identitySecret": { + "type": "string", + "format": "byte" + }, "precedence": { "$ref": "#/definitions/terminatorPrecedence" }, @@ -23382,6 +23400,7 @@ func init() { "router", "binding", "address", + "identity", "cost", "precedence", "dynamicCost" @@ -23399,6 +23418,9 @@ func init() { "dynamicCost": { "$ref": "#/definitions/terminatorCost" }, + "identity": { + "type": "string" + }, "precedence": { "$ref": "#/definitions/terminatorPrecedence" }, diff --git a/specs/swagger.yml b/specs/swagger.yml index 0ad980a74..9faff611f 100644 --- a/specs/swagger.yml +++ b/specs/swagger.yml @@ -3,7 +3,7 @@ swagger: '2.0' info: version: 0.16.3 title: Ziti Edge - contact: {} + contact: { } host: demo.ziti.dev basePath: /edge/v1 schemes: @@ -34,7 +34,7 @@ paths: This endpoint is used during enrollments to bootstrap trust between enrolling clients and the Ziti Edge API. This endpoint returns a base64 encoded PKCS7 store. The content can be base64 decoded and parsed by any library that supports parsing PKCS7 stores. - security: [] + security: [ ] tags: - Well Known operationId: listWellKnownCas @@ -114,7 +114,7 @@ paths: '/': get: summary: Returns version information - security: [] + security: [ ] tags: - Informational operationId: listRoot @@ -124,7 +124,7 @@ paths: '/version': get: summary: Returns version information - security: [] + security: [ ] tags: - Informational operationId: listVersion @@ -139,7 +139,7 @@ paths: summary: Returns a list of accessible resource counts description: This endpoint is usefull for UIs that wish to display UI elements with counts. security: - - ztSession: [] + - ztSession: [ ] tags: - Informational operationId: listSummary @@ -152,7 +152,7 @@ paths: get: summary: Returns a list of API specs description: Returns a list of spec files embedded within the controller for consumption/documentation/code geneartion - security: [] + security: [ ] tags: - Informational operationId: listSpecs @@ -165,7 +165,7 @@ paths: get: summary: Return a single spec resource description: Returns single spec resource embedded within the controller for consumption/documentation/code geneartion - security: [] + security: [ ] tags: - Informational operationId: detailSpec @@ -178,7 +178,7 @@ paths: get: summary: Returns the spec's file description: Return the body of the specification (i.e. Swagger, OpenAPI 2.0, 3.0, etc). - security: [] + security: [ ] tags: - Informational operationId: detailSpecBody @@ -198,7 +198,7 @@ paths: Returns a list of active API sessions. The resources can be sorted, filtered, and paginated. This endpoint requries admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - API Session operationId: listAPISessions @@ -218,7 +218,7 @@ paths: summary: Retrieves a single API Session description: Retrieves a single API Session by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - API Session operationId: detailAPISessions @@ -233,7 +233,7 @@ paths: summary: Deletes an API Sessions description: Deletes and API sesion by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - API Session operationId: deleteAPISessions @@ -254,7 +254,7 @@ paths: summary: Authenticate via a method supplied via a query string parameter description: | Allows authentication Methods include "password" and "cert" - security: [] + security: [ ] tags: - Authentication operationId: authenticate @@ -281,7 +281,7 @@ paths: Returns a list of authenticators associated to identities. The resources can be sorted, filtered, and paginated. This endpoint requries admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Authenticator operationId: listAuthenticators @@ -294,7 +294,7 @@ paths: description: | Creates an authenticator for a specific identity. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Authenticator operationId: createAuthenticator @@ -321,7 +321,7 @@ paths: summary: Retrieves a single authenticator description: Retrieves a single authenticator by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Authenticator operationId: detailAuthenticator @@ -336,7 +336,7 @@ paths: summary: Update all fields on an authenticator description: Update all fields on an authenticator by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Authenticator operationId: updateAuthenticator @@ -360,7 +360,7 @@ paths: summary: Update the supplied fields on an authenticator description: Update the supplied fields on an authenticator by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Authenticator operationId: patchAuthenticator @@ -386,7 +386,7 @@ paths: Delete an authenticator by id. Deleting all authenticators for an identity will make it impossible to log in. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Authenticator operationId: deleteAuthenticator @@ -406,7 +406,7 @@ paths: summary: List CAs description: Retrieves a list of CA resources; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Certificate Authority operationId: listCas @@ -421,7 +421,7 @@ paths: summary: Creates a CA description: Creates a CA in an unverified state. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Certificate Authority operationId: createCa @@ -447,7 +447,7 @@ paths: summary: Retrieves a single CA description: Retrieves a single CA by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Certificate Authority operationId: detailCa @@ -462,7 +462,7 @@ paths: summary: Update all fields on a CA description: Update all fields on a CA by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Certificate Authority operationId: updateCa @@ -486,7 +486,7 @@ paths: summary: Update the supplied fields on a CA description: Update only the supplied fields on a CA by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Certificate Authority operationId: patchCa @@ -512,7 +512,7 @@ paths: Delete a CA by id. Deleting a CA will delete its associated certificate authenticators. This can make it impossible for identities to authenticate if they no longer have any valid authenticators. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Certificate Authority operationId: deleteCa @@ -532,7 +532,7 @@ paths: For CA auto enrollment, the enrollment JWT is static and provided on each CA resource. This endpoint provides the jwt as a text response. security: - - ztSession: [] + - ztSession: [ ] tags: - Certificate Authority operationId: getCaJwt @@ -563,7 +563,7 @@ paths: The common name on the certificate must match the verificationToken property of the CA. Unverfieid CAs can not be used for enrollment/authentication. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Certificate Authority operationId: verifyCa @@ -594,7 +594,7 @@ paths: description: | Retrieves a list of config-type resources; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: listConfigTypes @@ -608,7 +608,7 @@ paths: post: summary: Create a config-type. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: createConfigType @@ -633,7 +633,7 @@ paths: summary: Retrieves a single config-type description: Retrieves a single config-type by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: detailConfigType @@ -648,7 +648,7 @@ paths: summary: Update all fields on a config-type description: Update all fields on a config-type by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: updateConfigType @@ -672,7 +672,7 @@ paths: summary: Update the supplied fields on a config-type description: Update the supplied fields on a config-type. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: patchConfigType @@ -696,7 +696,7 @@ paths: summary: Delete a config-type description: Delete a config-type by id. Removing a configuration type that are in use will result in a 409 conflict HTTP status code and error. All configurations of a type must be removed first. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: deleteConfigType @@ -716,7 +716,7 @@ paths: summary: Lists the configs of a specific config-type description: Lists the configs associated to a config-type. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: listConfigsForConfigType @@ -732,7 +732,7 @@ paths: description: | Retrieves a list of config resources; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: listConfigs @@ -749,7 +749,7 @@ paths: summary: Create a config resource description: Create a config resource. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: createConfig @@ -774,7 +774,7 @@ paths: summary: Retrieves a single config description: Retrieves a single config by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: detailConfig @@ -789,7 +789,7 @@ paths: summary: Update all fields on a config description: Update all fields on a config by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: updateConfig @@ -813,7 +813,7 @@ paths: summary: Update the supplied fields on a config description: Update the supplied fields on a config. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: patchConfig @@ -837,7 +837,7 @@ paths: summary: Delete a config description: Delete a config by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Config operationId: deleteConfig @@ -859,7 +859,7 @@ paths: summary: Return the current API session description: Retrieves the API session that was used to issue the current request security: - - ztSession: [] + - ztSession: [ ] tags: - Current API Session operationId: getCurrentAPISession @@ -872,7 +872,7 @@ paths: summary: Logout description: Terminates the current API session security: - - ztSession: [] + - ztSession: [ ] tags: - CurrentAPI Session responses: @@ -885,7 +885,7 @@ paths: summary: Return the current identity description: Returns the identity associated with the API sessions used to issue the current request security: - - ztSession: [] + - ztSession: [ ] tags: - Current API Session operationId: getCurrentIdentity @@ -899,7 +899,7 @@ paths: summary: List authenticators for the current identity description: Retrieves a list of authenticators assigned to the current API session's identity; supports filtering, sorting, and pagination. security: - - ztSession: [] + - ztSession: [ ] tags: - Current API Session operationId: listCurrentIdentityAuthenticators @@ -919,7 +919,7 @@ paths: summary: Retrieve an authenticator for the current identity description: Retrieves a single authenticator by id. Will only show authenticators assigned to the API session's identity. security: - - ztSession: [] + - ztSession: [ ] tags: - Current API Session operationId: detailCurrentIdentityAuthenticator @@ -936,7 +936,7 @@ paths: Update all fields on an authenticator by id. Will only update authenticators assigned to the API session's identity. security: - - ztSession: [] + - ztSession: [ ] tags: - Current API Session operationId: updateCurrentIdentityAuthenticator @@ -962,7 +962,7 @@ paths: Update the supplied fields on an authenticator by id. Will only update authenticators assigned to the API session's identity. security: - - ztSession: [] + - ztSession: [ ] tags: - Current API Session operationId: patchCurrentIdentityAuthenticator @@ -992,7 +992,7 @@ paths: description: | Retrieves a list of edge router policy resources; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router Policy operationId: listEdgeRouterPolicies @@ -1009,7 +1009,7 @@ paths: summary: Create an edge router policy resource description: Create an edge router policy resource. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router Policy operationId: createEdgeRouterPolicy @@ -1034,7 +1034,7 @@ paths: summary: Retrieves a single edge router policy description: Retrieves a single edge router policy by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router Policy operationId: detailEdgeRouterPolicy @@ -1049,7 +1049,7 @@ paths: summary: Update all fields on an edge router policy description: Update all fields on an edge router policy by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router Policy operationId: updateEdgeRouterPolicy @@ -1073,7 +1073,7 @@ paths: summary: Update the supplied fields on an edge router policy description: Update the supplied fields on an edge router policy. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router Policy operationId: patchEdgeRouterPolicy @@ -1097,7 +1097,7 @@ paths: summary: Delete an edge router policy description: Delete an edge router policy by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router Policy operationId: deleteEdgeRouterPolicy @@ -1118,7 +1118,7 @@ paths: description: | Retrieves a list of edge routers an edge router policy resources affects; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router Policy operationId: listEdgeRouterPolicyEdgeRouters @@ -1137,7 +1137,7 @@ paths: description: | Retrieves a list of identities an edge router policy resources affects; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router Policy operationId: listEdgeRouterPolicyIdentities @@ -1157,7 +1157,7 @@ paths: description: | Retrieves a list of edge router resources; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router operationId: listEdgeRouters @@ -1176,7 +1176,7 @@ paths: summary: Create an edge router description: Create a edge router resource. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router operationId: createEdgeRouter @@ -1201,7 +1201,7 @@ paths: summary: Retrieves a single edge router description: Retrieves a single edge router by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router operationId: detailEdgeRouter @@ -1216,7 +1216,7 @@ paths: summary: Update all fields on an edge router description: Update all fields on an edge router by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router operationId: updateEdgeRouter @@ -1240,7 +1240,7 @@ paths: summary: Update the supplied fields on an edge router description: Update the supplied fields on an edge router. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router operationId: patchEdgeRouter @@ -1264,7 +1264,7 @@ paths: summary: Delete an edge router description: Delete an edge router by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router operationId: deleteEdgeRouter @@ -1284,7 +1284,7 @@ paths: summary: List the edge router policies that affect an edge router description: Retrieves a list of edge router policies that apply to the specified edge router. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router operationId: listEdgeRouterEdgeRouterPolicies @@ -1303,7 +1303,7 @@ paths: description: | Retrieves a list of identities that may access services via the given edge router. Supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router operationId: listEdgeRouterIdentities @@ -1321,7 +1321,7 @@ paths: summary: List the service policies that affect an edge router description: Retrieves a list of service policies policies that apply to the specified edge router. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router operationId: listEdgeRouterServiceEdgeRouterPolicies @@ -1341,7 +1341,7 @@ paths: description: | Retrieves a list of services that may be accessed via the given edge router. Supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Edge Router operationId: listEdgeRouterServices @@ -1476,7 +1476,7 @@ paths: description: | Retrieves a list of outstanding enrollments; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Enrollment operationId: listEnrollments @@ -1496,7 +1496,7 @@ paths: summary: Retrieves an outstanding enrollment description: Retrieves a single outstanding enrollment by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Enrollment operationId: detailEnrollment @@ -1511,7 +1511,7 @@ paths: summary: Delete an outstanding enrollment description: Delete an outstanding enrollment by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Enrollment operationId: deleteEnrollment @@ -1532,7 +1532,7 @@ paths: description: | Retrieves a list of geo-regions; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Geo Region operationId: listGeoRegions @@ -1552,7 +1552,7 @@ paths: summary: Retrieves a geo-region description: Retrieves a single geo-region by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Geo Region operationId: detailGeoRegion @@ -1572,7 +1572,7 @@ paths: description: | Retrieves a list of identity resources; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: listIdentities @@ -1591,7 +1591,7 @@ paths: summary: Create an identity resource description: Create an identity resource. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: createIdentity @@ -1616,7 +1616,7 @@ paths: summary: Retrieves a single identity description: Retrieves a single identity by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: detailIdentity @@ -1631,7 +1631,7 @@ paths: summary: Update all fields on an identity description: Update all fields on an identity by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: updateIdentity @@ -1655,7 +1655,7 @@ paths: summary: Update the supplied fields on an identity description: Update the supplied fields on an identity. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: patchIdentity @@ -1679,7 +1679,7 @@ paths: summary: Delete an identity description: Delete an identity by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: deleteIdentity @@ -1699,7 +1699,7 @@ paths: summary: List the edge router policies that affect an idenitty description: Retrieves a list of edge router policies that apply to the specified identity. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: listIdentitysEdgeRouterPolicies @@ -1717,7 +1717,7 @@ paths: summary: List the service configs associated a specific identity description: Retrieves a list of service configs associated to a specific identity security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: listIdentitysServiceConfigs @@ -1739,7 +1739,7 @@ paths: schema: $ref: '#/definitions/serviceConfigsAssignList' security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: associateIdentitysServiceConfigs @@ -1763,7 +1763,7 @@ paths: schema: $ref: '#/definitions/serviceConfigsAssignList' security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: disassociateIdentitysServiceConfigs @@ -1783,7 +1783,7 @@ paths: summary: List the service policies that affect an identity description: Retrieves a list of service policies that apply to the specified identity. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: listIdentityServicePolicies @@ -1803,7 +1803,7 @@ paths: description: | Retrieves a list of edge-routers that the given identity may use to access services. Supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: listIdentityEdgeRouters @@ -1823,7 +1823,7 @@ paths: description: | Retrieves a list of services that the given identity has access to. Supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: listIdentityServices @@ -1847,7 +1847,7 @@ paths: to check if the identity and service have access to common edge routers so that a connnection can be made. | Will also check if at least one edge router is on-line. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: getIdentityPolicyAdvice @@ -1867,7 +1867,7 @@ paths: description: | Retrieves a list of identity types; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: listIdentityTypes @@ -1887,7 +1887,7 @@ paths: summary: Retrieves a identity type description: Retrieves a single identity type by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Identity operationId: detailIdentityType @@ -1907,7 +1907,7 @@ paths: description: | Retrieves a list of service edge router policy resources; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Edge Router Policy operationId: listServiceEdgeRouterPolicies @@ -1924,7 +1924,7 @@ paths: summary: Create a service edge router policy resource description: Create a service edge router policy resource. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Edge Router Policy operationId: createServiceEdgeRouterPolicy @@ -1949,7 +1949,7 @@ paths: summary: Retrieves a single service edge policy description: Retrieves a single service edge policy by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Edge Router Policy operationId: detailServiceEdgeRouterPolicy @@ -1964,7 +1964,7 @@ paths: summary: Update all fields on a service edge policy description: Update all fields on a service edge policy by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Edge Router Policy operationId: updateServiceEdgeRouterPolicy @@ -1988,7 +1988,7 @@ paths: summary: Update the supplied fields on a service edge policy description: Update the supplied fields on a service edge policy. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Edge Router Policy operationId: patchServiceEdgeRouterPolicy @@ -2012,7 +2012,7 @@ paths: summary: Delete a service edge policy description: Delete a service edge policy by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Edge Router Policy operationId: deleteServiceEdgeRouterPolicy @@ -2032,7 +2032,7 @@ paths: summary: List the edge routers that a service edge router policy applies to description: List the edge routers that a service edge router policy applies to security: - - ztSession: [] + - ztSession: [ ] tags: - Service Edge Router Policy operationId: listServiceEdgeRouterPolicyEdgeRouters @@ -2050,7 +2050,7 @@ paths: summary: List the services that a service edge router policy applies to description: List the services that a service edge router policy applies to security: - - ztSession: [] + - ztSession: [ ] tags: - Service Edge Router Policy operationId: listServiceEdgeRouterPolicyServices @@ -2071,7 +2071,7 @@ paths: description: | Retrieves a list of service policy resources; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Policy operationId: listServicePolicies @@ -2088,7 +2088,7 @@ paths: summary: Create a service policy resource description: Create a service policy resource. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Policy operationId: createServicePolicy @@ -2113,7 +2113,7 @@ paths: summary: Retrieves a single service policy description: Retrieves a single service policy by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Policy operationId: detailServicePolicy @@ -2128,7 +2128,7 @@ paths: summary: Update all fields on a service policy description: Update all fields on a service policy by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Policy operationId: updateServicePolicy @@ -2152,7 +2152,7 @@ paths: summary: Update the supplied fields on a service policy description: Update the supplied fields on a service policy. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Policy operationId: patchServicePolicy @@ -2176,7 +2176,7 @@ paths: summary: Delete a service policy description: Delete a service policy by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Policy operationId: deleteServicePolicy @@ -2197,7 +2197,7 @@ paths: description: | Retrieves a list of identity resources that are affected by a service policy; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Policy operationId: listServicePolicyIdentities @@ -2220,7 +2220,7 @@ paths: description: | Retrieves a list of service resources that are affected by a service policy; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service Policy operationId: listServicePolicyServices @@ -2245,7 +2245,7 @@ paths: description: | Retrieves a list of config resources; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service operationId: listServices @@ -2264,7 +2264,7 @@ paths: summary: Create a services resource description: Create a services resource. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service operationId: createService @@ -2289,7 +2289,7 @@ paths: summary: Retrieves a single service description: Retrieves a single service by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service operationId: detailService @@ -2304,7 +2304,7 @@ paths: summary: Update all fields on a service description: Update all fields on a service by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service operationId: updateService @@ -2328,7 +2328,7 @@ paths: summary: Update the supplied fields on a service description: Update the supplied fields on a service. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service operationId: patchService @@ -2352,7 +2352,7 @@ paths: summary: Delete a service description: Delete a service by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service operationId: deleteService @@ -2373,7 +2373,7 @@ paths: description: | Retrieves a list of config resources associated to a specific service; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service operationId: listServiceConfig @@ -2394,7 +2394,7 @@ paths: description: | Retrieves a list of service edge router policy resources that affect a specific service; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service operationId: listServiceServiceEdgeRouterPolicies @@ -2415,7 +2415,7 @@ paths: description: | Retrieves a list of service policy resources that affect specific service; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service operationId: listServiceServicePolicies @@ -2437,7 +2437,7 @@ paths: description: | Retrieves a list of identities that have access to this service. Supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service operationId: listServiceIdentities @@ -2459,7 +2459,7 @@ paths: description: | Retrieves a list of edge-routers that may be used to access the given service. Supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service operationId: listServiceEdgeRouters @@ -2481,7 +2481,7 @@ paths: description: | Retrieves a list of terminator resources that are assigned specific service; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Service operationId: listServiceTerminators @@ -2506,7 +2506,7 @@ paths: Sessions are tied to an API session and are moved when an API session times out or logs out. Active sessions (i.e. Ziti SDK connected to an edge router) will keep the session and API session marked as active. security: - - ztSession: [] + - ztSession: [ ] tags: - Session operationId: listSessions @@ -2523,7 +2523,7 @@ paths: summary: Create a session resource description: Create a session resource. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Session operationId: createSession @@ -2548,7 +2548,7 @@ paths: summary: Retrieves a single session description: Retrieves a single session by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Session operationId: detailSession @@ -2563,7 +2563,7 @@ paths: summary: Delete a session description: Delete a session by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Session operationId: deleteSession @@ -2585,7 +2585,7 @@ paths: description: | Retrieves a list of terminator resources; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Terminator operationId: listTerminators @@ -2602,7 +2602,7 @@ paths: summary: Create a terminator resource description: Create a terminator resource. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Terminator operationId: createTerminator @@ -2627,7 +2627,7 @@ paths: summary: Retrieves a single terminator description: Retrieves a single terminator by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Terminator operationId: detailTerminator @@ -2642,7 +2642,7 @@ paths: summary: Update all fields on a terminator description: Update all fields on a terminator by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Terminator operationId: updateTerminator @@ -2666,7 +2666,7 @@ paths: summary: Update the supplied fields on a terminator description: Update the supplied fields on a terminator. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Terminator operationId: patchTerminator @@ -2690,7 +2690,7 @@ paths: summary: Delete a terminator description: Delete a terminator by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Terminator operationId: deleteTerminator @@ -2713,7 +2713,7 @@ paths: description: | Retrieves a list of role attributes in use by edge routers; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Role Attributes operationId: listEdgeRouterRoleAttributes @@ -2733,7 +2733,7 @@ paths: description: | Retrieves a list of role attributes in use by identities; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Role Attributes operationId: listIdentityRoleAttributes @@ -2753,7 +2753,7 @@ paths: description: | Retrieves a list of role attributes in use by services; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Role Attributes operationId: listServiceRoleAttributes @@ -2775,7 +2775,7 @@ paths: description: | Retrieves a list of transit router resources; supports filtering, sorting, and pagination. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Transit Router operationId: listTransitRouters @@ -2792,7 +2792,7 @@ paths: summary: Create a transit router resource description: Create a transit router resource. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Transit Router operationId: createTransitRouter @@ -2817,7 +2817,7 @@ paths: summary: Retrieves a single transit router description: Retrieves a single transit router by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Transit Router operationId: detailTransitRouter @@ -2832,7 +2832,7 @@ paths: summary: Update all fields on a transit router description: Update all fields on a transit router by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Transit Router operationId: updateTransitRouter @@ -2856,7 +2856,7 @@ paths: summary: Update the supplied fields on a transit router description: Update the supplied fields on a transit router. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Transit Router operationId: patchTransitRouter @@ -2880,7 +2880,7 @@ paths: summary: Delete a transit router description: Delete a transit router by id. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Transit Router operationId: deleteTransitRouter @@ -2902,7 +2902,7 @@ paths: summary: Create a new database snapshot description: Create a new database snapshot. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Database operationId: createDatabaseSnapshot @@ -2918,7 +2918,7 @@ paths: summary: Runs an data integrity scan on the datastore and returns any found issues description: Runs an data integrity scan on the datastore and returns any found issues. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Database operationId: checkDataIntegrity @@ -2932,7 +2932,7 @@ paths: summary: Runs an data integrity scan on the datastore, attempts to fix any issues it can and returns any found issues description: Runs an data integrity scan on the datastore, attempts to fix any issues it can, and returns any found issues. Requires admin access. security: - - ztSession: [] + - ztSession: [ ] tags: - Database operationId: fixDataIntegrity @@ -3020,7 +3020,7 @@ responses: 'application/json': error: args: - urlVars: {} + urlVars: { } cause: field: '(root)' type: required @@ -3047,7 +3047,7 @@ responses: 'application/json': error: args: - urlVars: {} + urlVars: { } cause: '' causeMessage: '' code: UNAUTHORIZED @@ -3065,7 +3065,7 @@ responses: 'application/json': error: args: - urlVars: {} + urlVars: { } cause: '' causeMessage: '' code: INVALID_AUTH @@ -3117,7 +3117,7 @@ responses: 'application/json': error: args: - urlVars: {} + urlVars: { } causeMessage: 'you have hit a rate limit in the requested operation' code: RATE_LIMITED message: The resource is rate limited and the rate limit has been exceeded. Please try again later @@ -3161,7 +3161,7 @@ responses: $ref: '#/definitions/currentAPISessionDetailEnvelope' examples: default: - meta: {} + meta: { } data: id: 27343114-b44f-406e-9981-f3c4f2f28d54 createdAt: '2020-03-09T19:03:49.1883693Z' @@ -3181,7 +3181,7 @@ responses: self: href: './identities/66352d7b-a6b2-4ce9-85bb-9f18e318704d' expiresAt: '2020-03-09T19:34:21.5600897Z' - configTypes: [] + configTypes: [ ] detailCurrentIdentity: description: The identity associated with the API Session used to issue the request @@ -3189,7 +3189,7 @@ responses: $ref: '#/definitions/currentIdentityDetailEnvelope' examples: default: - meta: {} + meta: { } data: id: 66352d7b-a6b2-4ce9-85bb-9f18e318704d createdAt: '2020-01-13T16:38:13.6854788Z' @@ -3201,7 +3201,7 @@ responses: href: './identities/66352d7b-a6b2-4ce9-85bb-9f18e318704d' service-policies: href: './identities/66352d7b-a6b2-4ce9-85bb-9f18e318704d/identities' - tags: {} + tags: { } name: Default Admin type: urlName: identity-types @@ -3215,7 +3215,7 @@ responses: authenticators: updb: username: admin - enrollment: {} + enrollment: { } roleAttributes: $ref: '#/definitions/attributes' @@ -4381,7 +4381,7 @@ definitions: href: "./edge-routers/b0766b8d-bd1a-4d28-8415-639b29d3c83d/edge-routers" self: href: "./edge-routers/b0766b8d-bd1a-4d28-8415-639b29d3c83d" - tags: {} + tags: { } name: TestGateway-e33c837f-3222-4b40-bcd6-b3458fd5156e fingerprint: roleAttributes: @@ -4400,7 +4400,7 @@ definitions: enrollmentCreatedAt: '2020-03-16T17:13:31.5777637Z' enrollmentExpiresAt: '2020-03-16T17:18:31.5777637Z' hostname: '' - supportedProtocols: {} + supportedProtocols: { } ################################################################### # Edge Router Policies ################################################################## @@ -4906,7 +4906,7 @@ definitions: type: object properties: urlVars: - properties: {} + properties: { } additionalProperties: type: string type: object @@ -4920,7 +4920,7 @@ definitions: $ref: '#/definitions/meta' data: type: object - example: {} + example: { } meta: type: object properties: @@ -5439,6 +5439,7 @@ definitions: - router - binding - address + - identity - cost - precedence - dynamicCost @@ -5455,6 +5456,8 @@ definitions: type: string address: type: string + identity: + type: string cost: $ref: '#/definitions/terminatorCost' precedence: @@ -5477,6 +5480,11 @@ definitions: type: string address: type: string + identity: + type: string + identitySecret: + type: string + format: byte cost: $ref: '#/definitions/terminatorCost' precedence: diff --git a/tests/addressable_terminators_test.go b/tests/addressable_terminators_test.go new file mode 100644 index 000000000..9806724d1 --- /dev/null +++ b/tests/addressable_terminators_test.go @@ -0,0 +1,202 @@ +// +build apitests + +/* + Copyright NetFoundry, Inc. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +*/ + +package tests + +import ( + "fmt" + "github.com/openziti/fabric/controller/xt_smartrouting" + "github.com/openziti/sdk-golang/ziti" + "github.com/openziti/sdk-golang/ziti/edge" + "github.com/pkg/errors" + "net" + "testing" + "time" +) + +func Test_AddressableTerminators(t *testing.T) { + ctx := NewTestContext(t) + defer ctx.Teardown() + ctx.StartServer() + ctx.RequireAdminLogin() + + service := ctx.AdminSession.RequireNewServiceAccessibleToAll(xt_smartrouting.Name) + fmt.Printf("service id: %v\n", service.Id) + + ctx.CreateEnrollAndStartEdgeRouter() + + type host struct { + id *identity + context ziti.Context + listener net.Listener + } + + var hosts []*host + var err error + + for i := 0; i < 2; i++ { + host := &host{} + hosts = append(hosts, host) + + host.id, host.context = ctx.AdminSession.RequireCreateSdkContext() + host.listener, err = host.context.ListenWithOptions(service.Name, &ziti.ListenOptions{ + BindUsingEdgeIdentity: true, + }) + ctx.Req.NoError(err) + } + + type client struct { + id *identity + context ziti.Context + } + + var clients []*client + + for i := 0; i < 3; i++ { + client := &client{} + clients = append(clients, client) + client.id, client.context = ctx.AdminSession.RequireCreateSdkContext() + } + + waitForConn := func(listener net.Listener, timeout time.Duration) (net.Conn, error) { + connC := make(chan net.Conn, 1) + errC := make(chan error, 1) + go func() { + conn, err := listener.Accept() + if err != nil { + errC <- err + } else { + connC <- conn + } + }() + + select { + case conn := <-connC: + return conn, nil + case err := <-errC: + return nil, err + case <-time.After(timeout): + return nil, errors.Errorf("timed out waiting for connection after %v", timeout) + } + } + + for _, client := range clients { + for _, host := range hosts { + conn, err := client.context.DialWithOptions(service.Name, &ziti.DialOptions{ + Identity: host.id.name, + }) + ctx.Req.NoError(err) + hostConn, err := waitForConn(host.listener, time.Second) + ctx.Req.NoError(err) + ctx.Req.Equal(client.id.name, hostConn.RemoteAddr().String()) + ctx.Req.NoError(conn.Close()) + ctx.Req.NoError(hostConn.Close()) + } + } +} + +func Test_AddressableTerminatorSameIdentity(t *testing.T) { + ctx := NewTestContext(t) + defer ctx.Teardown() + ctx.StartServer() + ctx.RequireAdminLogin() + + service := ctx.AdminSession.RequireNewServiceAccessibleToAll(xt_smartrouting.Name) + fmt.Printf("service id: %v\n", service.Id) + + ctx.CreateEnrollAndStartEdgeRouter() + + errorC := make(chan error, 1) + errorHandler := func(err error) { + select { + case errorC <- err: + default: + } + } + + identity, context := ctx.AdminSession.RequireCreateSdkContext() + listener, err := context.ListenWithOptions(service.Name, &ziti.ListenOptions{ + BindUsingEdgeIdentity: true, + ConnectTimeout: 5 * time.Second, + }) + ctx.Req.NoError(err) + listener.(edge.SessionListener).SetErrorEventHandler(errorHandler) + defer func() { _ = listener.Close() }() + + context2 := ziti.NewContextWithConfig(identity.config) + listener2, err := context2.ListenWithOptions(service.Name, &ziti.ListenOptions{ + BindUsingEdgeIdentity: true, + ConnectTimeout: 5 * time.Second, + }) + listener2.(edge.SessionListener).SetErrorEventHandler(errorHandler) + ctx.Req.NoError(err) + defer func() { _ = listener2.Close() }() + + select { + case err = <-errorC: + case <-time.After(5 * time.Second): + err = nil + } + ctx.Req.NoError(err) +} + +func Test_AddressableTerminatorDifferentIdentity(t *testing.T) { + ctx := NewTestContext(t) + defer ctx.Teardown() + ctx.StartServer() + ctx.RequireAdminLogin() + + service := ctx.AdminSession.RequireNewServiceAccessibleToAll(xt_smartrouting.Name) + fmt.Printf("service id: %v\n", service.Id) + + ctx.CreateEnrollAndStartEdgeRouter() + + errorC := make(chan error, 1) + errorHandler := func(err error) { + select { + case errorC <- err: + default: + } + } + + _, context := ctx.AdminSession.RequireCreateSdkContext() + listener, err := context.ListenWithOptions(service.Name, &ziti.ListenOptions{ + Identity: "foobar", + ConnectTimeout: 5 * time.Second, + }) + listener.(edge.SessionListener).SetErrorEventHandler(errorHandler) + ctx.Req.NoError(err) + defer func() { _ = listener.Close() }() + + _, context2 := ctx.AdminSession.RequireCreateSdkContext() + listener2, err := context2.ListenWithOptions(service.Name, &ziti.ListenOptions{ + Identity: "foobar", + ConnectTimeout: 5 * time.Second, + }) + ctx.Req.NoError(err) + listener2.(edge.SessionListener).SetErrorEventHandler(errorHandler) + defer func() { _ = listener2.Close() }() + + select { + case err = <-errorC: + case <-time.After(5 * time.Second): + err = nil + } + ctx.Req.Error(err) + ctx.Req.Contains(err.Error(), "shared identity foobar belongs to different identity") +} diff --git a/tests/ats-ctrl.yml b/tests/ats-ctrl.yml index 0e6e3e2b9..571f60a95 100644 --- a/tests/ats-ctrl.yml +++ b/tests/ats-ctrl.yml @@ -7,19 +7,23 @@ v: 3 # memory: # path: ctrl.memprof -db: testdata/${ZITI_TEST_DB}.db +db: testdata/${ZITI_TEST_DB}.db identity: - cert: testdata/ca/intermediate/certs/ctrl-client.cert.pem - server_cert: testdata/ca/intermediate/certs/ctrl-server.cert.pem - key: testdata/ca/intermediate/private/ctrl.key.pem - ca: testdata/ca/intermediate/certs/ca-chain.cert.pem + cert: testdata/ca/intermediate/certs/ctrl-client.cert.pem + server_cert: testdata/ca/intermediate/certs/ctrl-server.cert.pem + key: testdata/ca/intermediate/private/ctrl.key.pem + ca: testdata/ca/intermediate/certs/ca-chain.cert.pem ctrl: - listener: tls:127.0.0.1:6262 + listener: tls:127.0.0.1:6262 mgmt: - listener: tls:127.0.0.1:10000 + listener: tls:127.0.0.1:10000 + +terminator: + validators: + edge: edge #metrics: # influxdb: @@ -38,7 +42,7 @@ edge: # This section represents the configuration of the Edge API that is served over HTTPS api: # (required) The interface and port that the Edge API should be served on. - listener: 127.0.0.1:1281 + listener: 127.0.0.1:1281 # (required) The host/port combination that is reported as publicly accessible for the Edge API advertise: localhost:1281 # (optional, defaults to 10) The number of minutes before an Edge API session will timeout. Timeouts are reset by diff --git a/tests/auth_perf_test.go b/tests/auth_perf_test.go index 130a159d0..ac4267332 100644 --- a/tests/auth_perf_test.go +++ b/tests/auth_perf_test.go @@ -1,4 +1,4 @@ -// +build apitests,perftests +// +build apitests,perftests,ignore /* Copyright NetFoundry, Inc. diff --git a/tests/authenticate.go b/tests/authenticate.go index 5d27acb2b..e1291e492 100644 --- a/tests/authenticate.go +++ b/tests/authenticate.go @@ -231,8 +231,8 @@ func (request *authenticatedRequests) newAuthenticatedJsonRequest(body interface func (request *authenticatedRequests) RequireCreateSdkContext() (*identity, ziti.Context) { identity := request.RequireNewIdentityWithOtt(false) - config := request.testContext.EnrollIdentity(identity.Id) - context := ziti.NewContextWithConfig(config) + identity.config = request.testContext.EnrollIdentity(identity.Id) + context := ziti.NewContextWithConfig(identity.config) return identity, context } diff --git a/tests/entities.go b/tests/entities.go index 596ed9a6b..5e3f0ac0f 100644 --- a/tests/entities.go +++ b/tests/entities.go @@ -28,6 +28,7 @@ import ( "crypto/x509/pkix" "encoding/pem" "github.com/openziti/edge/eid" + "github.com/openziti/sdk-golang/ziti/config" "math/big" "sort" "time" @@ -157,6 +158,7 @@ type identity struct { enrollment map[string]interface{} roleAttributes []string tags map[string]interface{} + config *config.Config } func (entity *identity) getId() string { diff --git a/tests/model_sdk_performance_test.go b/tests/model_sdk_performance_test.go index 92520ceca..1478bbb38 100644 --- a/tests/model_sdk_performance_test.go +++ b/tests/model_sdk_performance_test.go @@ -1,4 +1,4 @@ -// +build apitests,perftests +// +build apitests,perftests,ignore package tests