From 7094f5d219a080e4f247b1c3814e57ce167ca992 Mon Sep 17 00:00:00 2001 From: dovholuknf <46322585+dovholuknf@users.noreply.github.com> Date: Tue, 11 Jul 2023 15:22:25 -0400 Subject: [PATCH] allow the CSR section of the router to be configured separately from the _advertised_ address --- ziti/cmd/config_templates/router.yml | 2 +- ziti/cmd/create_config.go | 2 ++ ziti/cmd/create_config_environment.go | 2 ++ ziti/cmd/create_config_router_edge_test.go | 16 ++++++++++------ ziti/cmd/create_config_test.go | 1 + ziti/cmd/helpers/env_helpers.go | 7 +++++++ ziti/constants/constants.go | 2 ++ 7 files changed, 25 insertions(+), 7 deletions(-) diff --git a/ziti/cmd/config_templates/router.yml b/ziti/cmd/config_templates/router.yml index f564f465e..810518151 100644 --- a/ziti/cmd/config_templates/router.yml +++ b/ziti/cmd/config_templates/router.yml @@ -65,7 +65,7 @@ edge: organizationalUnit: {{ .Router.Edge.CsrOU }} sans: dns: - - {{ .Router.Edge.AdvertisedHost }} + - {{ .Router.Edge.CsrSans }} - localhost ip: - "127.0.0.1" diff --git a/ziti/cmd/create_config.go b/ziti/cmd/create_config.go index 6bc17d589..b311fc67c 100644 --- a/ziti/cmd/create_config.go +++ b/ziti/cmd/create_config.go @@ -167,6 +167,7 @@ type EdgeRouterTemplateValues struct { CsrL string CsrO string CsrOU string + CsrSans string } type WSSRouterTemplateValues struct { @@ -288,6 +289,7 @@ func (data *ConfigTemplateValues) populateConfigValues() { data.Router.Edge.CsrL = cmdHelper.GetZitiEdgeRouterL() data.Router.Edge.CsrO = cmdHelper.GetZitiEdgeRouterO() data.Router.Edge.CsrOU = cmdHelper.GetZitiEdgeRouterOU() + data.Router.Edge.CsrSans = cmdHelper.GetRouterSans() data.Router.Listener.GetSessionTimeout = constants.DefaultGetSessionTimeout data.Router.Wss.WriteTimeout = foundation.DefaultWsWriteTimeout diff --git a/ziti/cmd/create_config_environment.go b/ziti/cmd/create_config_environment.go index b7b0ce87b..d9a0c4fdb 100644 --- a/ziti/cmd/create_config_environment.go +++ b/ziti/cmd/create_config_environment.go @@ -131,6 +131,7 @@ func NewCmdCreateConfigEnvironment() *cobra.Command { {constants.ZitiEdgeRouterCsrLVarName, constants.ZitiEdgeRouterCsrLVarDescription, data.Router.Edge.CsrL}, {constants.ZitiEdgeRouterCsrOVarName, constants.ZitiEdgeRouterCsrOVarDescription, data.Router.Edge.CsrO}, {constants.ZitiEdgeRouterCsrOUVarName, constants.ZitiEdgeRouterCsrOUVarDescription, data.Router.Edge.CsrOU}, + {constants.ZitiRouterCsrSansDnsVarName, constants.ZitiRouterCsrSansDnsVarDescription, data.Router.Edge.CsrSans}, } // Setup logging @@ -208,6 +209,7 @@ func NewCmdCreateConfigEnvironment() *cobra.Command { sb.WriteString(fmt.Sprintf("%-40s %-50s %s\n", constants.ZitiEdgeRouterCsrLVarName, constants.ZitiEdgeRouterCsrLVarDescription, data.Router.Edge.CsrL)) sb.WriteString(fmt.Sprintf("%-40s %-50s %s\n", constants.ZitiEdgeRouterCsrOVarName, constants.ZitiEdgeRouterCsrOVarDescription, data.Router.Edge.CsrO)) sb.WriteString(fmt.Sprintf("%-40s %-50s %s\n", constants.ZitiEdgeRouterCsrOUVarName, constants.ZitiEdgeRouterCsrOUVarDescription, data.Router.Edge.CsrOU)) + sb.WriteString(fmt.Sprintf("%-40s %-50s %s\n", constants.ZitiRouterCsrSansDnsVarName, constants.ZitiRouterCsrSansDnsVarDescription, data.Router.Edge.CsrSans)) cmd.Long = sb.String() diff --git a/ziti/cmd/create_config_router_edge_test.go b/ziti/cmd/create_config_router_edge_test.go index 2a0119469..11f6777ff 100644 --- a/ziti/cmd/create_config_router_edge_test.go +++ b/ziti/cmd/create_config_router_edge_test.go @@ -291,29 +291,32 @@ func TestEdgeRouterIPOverrideIsConsumed(t *testing.T) { func TestEdgeRouterCsrFields(t *testing.T) { routerOptions := clearEnvAndInitializeTestData() routerName := "CstTest" - config, data := createRouterConfig([]string{"edge", "--routerName", routerName}, routerOptions, nil) + config1, data := createRouterConfig([]string{"edge", "--routerName", routerName}, routerOptions, nil) // Check that the template values now contains the custom external IP override value assert.Equal(t, "US", data.Router.Edge.CsrC) - assert.Equal(t, "US", config.Edge.Csr.Country) + assert.Equal(t, "US", config1.Edge.Csr.Country) assert.Equal(t, "NC", data.Router.Edge.CsrST) - assert.Equal(t, "NC", config.Edge.Csr.Province) + assert.Equal(t, "NC", config1.Edge.Csr.Province) assert.Equal(t, "Charlotte", data.Router.Edge.CsrL) - assert.Equal(t, "Charlotte", config.Edge.Csr.Locality) + assert.Equal(t, "Charlotte", config1.Edge.Csr.Locality) assert.Equal(t, "NetFoundry", data.Router.Edge.CsrO) - assert.Equal(t, "NetFoundry", config.Edge.Csr.Organization) + assert.Equal(t, "NetFoundry", config1.Edge.Csr.Organization) assert.Equal(t, "Ziti", data.Router.Edge.CsrOU) - assert.Equal(t, "Ziti", config.Edge.Csr.OrganizationalUnit) + assert.Equal(t, "Ziti", config1.Edge.Csr.OrganizationalUnit) + assert.Contains(t, config1.Edge.Csr.Sans.Dns, hostname) C := "C" ST := "ST" L := "L" O := "O" OU := "OU" + extAddy := "some.external.address" _ = os.Setenv(constants.ZitiEdgeRouterCsrCVarName, C) _ = os.Setenv(constants.ZitiEdgeRouterCsrSTVarName, ST) _ = os.Setenv(constants.ZitiEdgeRouterCsrLVarName, L) _ = os.Setenv(constants.ZitiEdgeRouterCsrOVarName, O) _ = os.Setenv(constants.ZitiEdgeRouterCsrOUVarName, OU) + _ = os.Setenv(constants.ZitiRouterCsrSansDnsVarName, extAddy) config2, data2 := createRouterConfig([]string{"edge", "--routerName", routerName}, routerOptions, nil) // Check that the template values now contains the custom external IP override value @@ -327,4 +330,5 @@ func TestEdgeRouterCsrFields(t *testing.T) { assert.Equal(t, O, config2.Edge.Csr.Organization) assert.Equal(t, OU, data2.Router.Edge.CsrOU) assert.Equal(t, OU, config2.Edge.Csr.OrganizationalUnit) + assert.Contains(t, config2.Edge.Csr.Sans.Dns, extAddy) } diff --git a/ziti/cmd/create_config_test.go b/ziti/cmd/create_config_test.go index fb8f1053f..9fb90edf7 100644 --- a/ziti/cmd/create_config_test.go +++ b/ziti/cmd/create_config_test.go @@ -70,6 +70,7 @@ func getZitiEnvironmentVariables() []string { "ZITI_ROUTER_CSR_L", "ZITI_ROUTER_CSR_O", "ZITI_ROUTER_CSR_OU", + "ZITI_ROUTER_CSR_SANS_DNS", } } diff --git a/ziti/cmd/helpers/env_helpers.go b/ziti/cmd/helpers/env_helpers.go index d0a584bfd..1effa36f1 100644 --- a/ziti/cmd/helpers/env_helpers.go +++ b/ziti/cmd/helpers/env_helpers.go @@ -193,3 +193,10 @@ func getFromEnv(envVarName string, onNotFound envVarNotFound) string { func NormalizePath(input string) string { return strings.ReplaceAll(input, "\\", "/") } + +func GetRouterAdvertisedAddress() string { + return getFromEnv(constants.ZitiEdgeRouterAdvertisedHostVarName, HostnameOrNetworkName) +} +func GetRouterSans() string { + return getFromEnv(constants.ZitiRouterCsrSansDnsVarName, GetRouterAdvertisedAddress) +} diff --git a/ziti/constants/constants.go b/ziti/constants/constants.go index 58ed23907..aae90f321 100644 --- a/ziti/constants/constants.go +++ b/ziti/constants/constants.go @@ -129,4 +129,6 @@ const ( ZitiEdgeRouterCsrOVarDescription = "The organization (O) to use for router CSRs" ZitiEdgeRouterCsrOUVarName = "ZITI_ROUTER_CSR_OU" ZitiEdgeRouterCsrOUVarDescription = "The organization unit to use for router CSRs" + ZitiRouterCsrSansDnsVarName = "ZITI_ROUTER_CSR_SANS_DNS" + ZitiRouterCsrSansDnsVarDescription = "The SANS value to use for the CSR in the internal PKI. If not supplied, defaults to ZITI_ROUTER_ADVERTISED_HOST" )