diff --git a/controller/internal/routes/enroll_router.go b/controller/internal/routes/enroll_router.go index 01d9fe6ee..4a7f4cebe 100644 --- a/controller/internal/routes/enroll_router.go +++ b/controller/internal/routes/enroll_router.go @@ -25,7 +25,8 @@ import ( "github.com/go-openapi/runtime/middleware" "github.com/michaelquigley/pfxlog" "github.com/openziti/edge-api/rest_client_api_server/operations/enroll" - "github.com/openziti/edge-api/rest_client_api_server/operations/well_known" + client_well_known "github.com/openziti/edge-api/rest_client_api_server/operations/well_known" + management_well_known "github.com/openziti/edge-api/rest_management_api_server/operations/well_known" "github.com/openziti/edge-api/rest_model" "github.com/openziti/edge/controller/env" "github.com/openziti/edge/controller/internal/permissions" @@ -81,7 +82,11 @@ func (ro *EnrollRouter) Register(ae *env.AppEnv) { }) // Utility, well-known - ae.ClientApi.WellKnownListWellKnownCasHandler = well_known.ListWellKnownCasHandlerFunc(func(params well_known.ListWellKnownCasParams) middleware.Responder { + ae.ClientApi.WellKnownListWellKnownCasHandler = client_well_known.ListWellKnownCasHandlerFunc(func(params client_well_known.ListWellKnownCasParams) middleware.Responder { + return ae.IsAllowed(ro.getCaCerts, params.HTTPRequest, "", "", permissions.Always()) + }) + + ae.ManagementApi.WellKnownListWellKnownCasHandler = management_well_known.ListWellKnownCasHandlerFunc(func(params management_well_known.ListWellKnownCasParams) middleware.Responder { return ae.IsAllowed(ro.getCaCerts, params.HTTPRequest, "", "", permissions.Always()) }) } diff --git a/controller/server/client-api.go b/controller/server/client-api.go index 61cc67107..08857228d 100644 --- a/controller/server/client-api.go +++ b/controller/server/client-api.go @@ -122,7 +122,7 @@ func (clientApi ClientApiHandler) RootPath() string { } func (clientApi ClientApiHandler) IsHandler(r *http.Request) bool { - return strings.HasPrefix(r.URL.Path, clientApi.RootPath()) + return strings.HasPrefix(r.URL.Path, clientApi.RootPath()) || r.URL.Path == WellKnownEstCaCerts } func (clientApi ClientApiHandler) ServeHTTP(writer http.ResponseWriter, request *http.Request) { @@ -150,15 +150,15 @@ func (clientApi ClientApiHandler) newHandler(ae *env.AppEnv) http.Handler { handler := http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { rw.Header().Set(ZitiInstanceId, ae.InstanceId) - //if not /edge prefix and not /fabric, translate to "/edge/client/v", this is a hack - //that should be removed once non-prefixed URLs are no longer used - if !strings.HasPrefix(r.URL.Path, controller.RestApiRootPath) && !strings.HasPrefix(r.URL.Path, "/fabric") { - r.URL.Path = controller.ClientRestApiBaseUrlLatest + r.URL.Path - } - //translate /edge/v1 to /edge/client/v1 r.URL.Path = strings.Replace(r.URL.Path, controller.LegacyClientRestApiBaseUrlV1, controller.ClientRestApiBaseUrlLatest, 1) + // .well-known/est/cacerts can be handled by the client API but the generated server requires + // the prefixed path for route resolution. + if r.URL.Path == WellKnownEstCaCerts { + r.URL.Path = controller.ClientRestApiBaseUrlLatest + WellKnownEstCaCerts + } + if r.URL.Path == controller.ClientRestApiSpecUrl { //work around for: https://github.com/go-openapi/runtime/issues/226 diff --git a/controller/server/management-api.go b/controller/server/management-api.go index 96e6ffabb..ee68b637f 100644 --- a/controller/server/management-api.go +++ b/controller/server/management-api.go @@ -31,6 +31,8 @@ import ( "time" ) +const WellKnownEstCaCerts = "/.well-known/est/cacerts" + var _ xweb.ApiHandlerFactory = &ManagementApiFactory{} type ManagementApiFactory struct { @@ -87,7 +89,7 @@ func (managementApi ManagementApiHandler) RootPath() string { } func (managementApi ManagementApiHandler) IsHandler(r *http.Request) bool { - return strings.HasPrefix(r.URL.Path, managementApi.RootPath()) + return strings.HasPrefix(r.URL.Path, managementApi.RootPath()) || r.URL.Path == WellKnownEstCaCerts } func (managementApi ManagementApiHandler) ServeHTTP(writer http.ResponseWriter, request *http.Request) { @@ -117,6 +119,12 @@ func (managementApi ManagementApiHandler) newHandler(ae *env.AppEnv) http.Handle return } + // .well-known/est/cacerts can be handled by the management API but the generated server requires + // the prefixed path for route resolution + if r.URL.Path == WellKnownEstCaCerts { + r.URL.Path = controller.ManagementRestApiBaseUrlLatest + WellKnownEstCaCerts + } + rc := ae.CreateRequestContext(rw, r) api.AddRequestContextToHttpContext(r, rc) diff --git a/go.mod b/go.mod index b51134ae8..c5a085f30 100644 --- a/go.mod +++ b/go.mod @@ -98,7 +98,7 @@ require ( github.com/jessevdk/go-flags v1.5.0 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/josharian/native v1.1.0 // indirect - github.com/klauspost/compress v1.16.5 // indirect + github.com/klauspost/compress v1.16.6 // indirect github.com/lufia/plan9stats v0.0.0-20230326075908-cb1d2100619a // indirect github.com/mailru/easyjson v0.7.7 // indirect github.com/mattn/go-colorable v0.1.13 // indirect @@ -118,7 +118,7 @@ require ( github.com/shoenig/go-m1cpu v0.1.6 // indirect github.com/speps/go-hashids v2.0.0+incompatible // indirect github.com/tklauser/go-sysconf v0.3.11 // indirect - github.com/tklauser/numcpus v0.6.0 // indirect + github.com/tklauser/numcpus v0.6.1 // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/yusufpapurcu/wmi v1.2.3 // indirect diff --git a/go.sum b/go.sum index 07e2cb784..45daf99d0 100644 --- a/go.sum +++ b/go.sum @@ -385,8 +385,8 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs= github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk= -github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI= -github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= +github.com/klauspost/compress v1.16.6 h1:91SKEy4K37vkp255cJ8QesJhjyRO0hn9i9G0GoUwLsk= +github.com/klauspost/compress v1.16.6/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg= @@ -612,8 +612,9 @@ github.com/tidwall/pretty v1.0.0 h1:HsD+QiTn7sK6flMKIvNmpqz1qrpP3Ps6jOKIKMooyg4= github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk= github.com/tklauser/go-sysconf v0.3.11 h1:89WgdJhk5SNwJfu+GKyYveZ4IaJ7xAkecBo+KdJV0CM= github.com/tklauser/go-sysconf v0.3.11/go.mod h1:GqXfhXY3kiPa0nAXPDIQIWzJbMCB7AmcWpGR8lSZfqI= -github.com/tklauser/numcpus v0.6.0 h1:kebhY2Qt+3U6RNK7UqpYNA+tJ23IBEGKkB7JQBfDYms= github.com/tklauser/numcpus v0.6.0/go.mod h1:FEZLMke0lhOUG6w2JadTzp0a+Nl8PF/GFkQ5UVIcaL4= +github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk= +github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY= github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM= github.com/ugorji/go v1.1.7 h1:/68gy2h+1mWMrwZFeD1kQialdSzAb432dtpeJ42ovdo= github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=