From eeb9221fe406665e1eb2d06bb62ad60cd86acec8 Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Wed, 14 Jun 2023 09:29:28 -0400 Subject: [PATCH 1/2] adds .well-known/est/cacerts support to the management API --- controller/internal/routes/enroll_router.go | 9 +++++++-- controller/server/client-api.go | 14 +++++++------- controller/server/management-api.go | 10 +++++++++- 3 files changed, 23 insertions(+), 10 deletions(-) diff --git a/controller/internal/routes/enroll_router.go b/controller/internal/routes/enroll_router.go index 01d9fe6ee..4a7f4cebe 100644 --- a/controller/internal/routes/enroll_router.go +++ b/controller/internal/routes/enroll_router.go @@ -25,7 +25,8 @@ import ( "github.com/go-openapi/runtime/middleware" "github.com/michaelquigley/pfxlog" "github.com/openziti/edge-api/rest_client_api_server/operations/enroll" - "github.com/openziti/edge-api/rest_client_api_server/operations/well_known" + client_well_known "github.com/openziti/edge-api/rest_client_api_server/operations/well_known" + management_well_known "github.com/openziti/edge-api/rest_management_api_server/operations/well_known" "github.com/openziti/edge-api/rest_model" "github.com/openziti/edge/controller/env" "github.com/openziti/edge/controller/internal/permissions" @@ -81,7 +82,11 @@ func (ro *EnrollRouter) Register(ae *env.AppEnv) { }) // Utility, well-known - ae.ClientApi.WellKnownListWellKnownCasHandler = well_known.ListWellKnownCasHandlerFunc(func(params well_known.ListWellKnownCasParams) middleware.Responder { + ae.ClientApi.WellKnownListWellKnownCasHandler = client_well_known.ListWellKnownCasHandlerFunc(func(params client_well_known.ListWellKnownCasParams) middleware.Responder { + return ae.IsAllowed(ro.getCaCerts, params.HTTPRequest, "", "", permissions.Always()) + }) + + ae.ManagementApi.WellKnownListWellKnownCasHandler = management_well_known.ListWellKnownCasHandlerFunc(func(params management_well_known.ListWellKnownCasParams) middleware.Responder { return ae.IsAllowed(ro.getCaCerts, params.HTTPRequest, "", "", permissions.Always()) }) } diff --git a/controller/server/client-api.go b/controller/server/client-api.go index 61cc67107..08857228d 100644 --- a/controller/server/client-api.go +++ b/controller/server/client-api.go @@ -122,7 +122,7 @@ func (clientApi ClientApiHandler) RootPath() string { } func (clientApi ClientApiHandler) IsHandler(r *http.Request) bool { - return strings.HasPrefix(r.URL.Path, clientApi.RootPath()) + return strings.HasPrefix(r.URL.Path, clientApi.RootPath()) || r.URL.Path == WellKnownEstCaCerts } func (clientApi ClientApiHandler) ServeHTTP(writer http.ResponseWriter, request *http.Request) { @@ -150,15 +150,15 @@ func (clientApi ClientApiHandler) newHandler(ae *env.AppEnv) http.Handler { handler := http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { rw.Header().Set(ZitiInstanceId, ae.InstanceId) - //if not /edge prefix and not /fabric, translate to "/edge/client/v", this is a hack - //that should be removed once non-prefixed URLs are no longer used - if !strings.HasPrefix(r.URL.Path, controller.RestApiRootPath) && !strings.HasPrefix(r.URL.Path, "/fabric") { - r.URL.Path = controller.ClientRestApiBaseUrlLatest + r.URL.Path - } - //translate /edge/v1 to /edge/client/v1 r.URL.Path = strings.Replace(r.URL.Path, controller.LegacyClientRestApiBaseUrlV1, controller.ClientRestApiBaseUrlLatest, 1) + // .well-known/est/cacerts can be handled by the client API but the generated server requires + // the prefixed path for route resolution. + if r.URL.Path == WellKnownEstCaCerts { + r.URL.Path = controller.ClientRestApiBaseUrlLatest + WellKnownEstCaCerts + } + if r.URL.Path == controller.ClientRestApiSpecUrl { //work around for: https://github.com/go-openapi/runtime/issues/226 diff --git a/controller/server/management-api.go b/controller/server/management-api.go index 96e6ffabb..ee68b637f 100644 --- a/controller/server/management-api.go +++ b/controller/server/management-api.go @@ -31,6 +31,8 @@ import ( "time" ) +const WellKnownEstCaCerts = "/.well-known/est/cacerts" + var _ xweb.ApiHandlerFactory = &ManagementApiFactory{} type ManagementApiFactory struct { @@ -87,7 +89,7 @@ func (managementApi ManagementApiHandler) RootPath() string { } func (managementApi ManagementApiHandler) IsHandler(r *http.Request) bool { - return strings.HasPrefix(r.URL.Path, managementApi.RootPath()) + return strings.HasPrefix(r.URL.Path, managementApi.RootPath()) || r.URL.Path == WellKnownEstCaCerts } func (managementApi ManagementApiHandler) ServeHTTP(writer http.ResponseWriter, request *http.Request) { @@ -117,6 +119,12 @@ func (managementApi ManagementApiHandler) newHandler(ae *env.AppEnv) http.Handle return } + // .well-known/est/cacerts can be handled by the management API but the generated server requires + // the prefixed path for route resolution + if r.URL.Path == WellKnownEstCaCerts { + r.URL.Path = controller.ManagementRestApiBaseUrlLatest + WellKnownEstCaCerts + } + rc := ae.CreateRequestContext(rw, r) api.AddRequestContextToHttpContext(r, rc) From 1ef6548afc5541dfdee2c12efc18fb9dc8e1e25e Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Wed, 14 Jun 2023 13:48:32 -0400 Subject: [PATCH 2/2] dep update --- go.mod | 10 +++++----- go.sum | 21 +++++++++++---------- 2 files changed, 16 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index 3111ad07f..c5a085f30 100644 --- a/go.mod +++ b/go.mod @@ -34,8 +34,8 @@ require ( github.com/openziti/identity v1.0.57 github.com/openziti/jwks v1.0.3 github.com/openziti/metrics v1.2.27 - github.com/openziti/sdk-golang v0.20.64 - github.com/openziti/secretstream v0.1.8 + github.com/openziti/sdk-golang v0.20.66 + github.com/openziti/secretstream v0.1.9 github.com/openziti/storage v0.2.7 github.com/openziti/transport/v2 v2.0.91 github.com/openziti/x509-claims v1.0.3 @@ -51,7 +51,7 @@ require ( github.com/teris-io/shortid v0.0.0-20201117134242-e59966efd125 github.com/xeipuuv/gojsonschema v1.2.0 go.etcd.io/bbolt v1.3.7 - golang.org/x/crypto v0.9.0 + golang.org/x/crypto v0.10.0 golang.org/x/sync v0.2.0 golang.org/x/sys v0.9.0 google.golang.org/protobuf v1.30.0 @@ -98,7 +98,7 @@ require ( github.com/jessevdk/go-flags v1.5.0 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/josharian/native v1.1.0 // indirect - github.com/klauspost/compress v1.16.5 // indirect + github.com/klauspost/compress v1.16.6 // indirect github.com/lufia/plan9stats v0.0.0-20230326075908-cb1d2100619a // indirect github.com/mailru/easyjson v0.7.7 // indirect github.com/mattn/go-colorable v0.1.13 // indirect @@ -118,7 +118,7 @@ require ( github.com/shoenig/go-m1cpu v0.1.6 // indirect github.com/speps/go-hashids v2.0.0+incompatible // indirect github.com/tklauser/go-sysconf v0.3.11 // indirect - github.com/tklauser/numcpus v0.6.0 // indirect + github.com/tklauser/numcpus v0.6.1 // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/yusufpapurcu/wmi v1.2.3 // indirect diff --git a/go.sum b/go.sum index 394dca7e1..45daf99d0 100644 --- a/go.sum +++ b/go.sum @@ -385,8 +385,8 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs= github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk= -github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI= -github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= +github.com/klauspost/compress v1.16.6 h1:91SKEy4K37vkp255cJ8QesJhjyRO0hn9i9G0GoUwLsk= +github.com/klauspost/compress v1.16.6/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg= @@ -495,10 +495,10 @@ github.com/openziti/jwks v1.0.3 h1:hf8wkb+Cg4nH/HM0KROFd7u+C3DkRVcFZJ7tDV+4icc= github.com/openziti/jwks v1.0.3/go.mod h1:t4xxq8vlXGsPn29kiQVnZBBDDnEoOFqtJoHibkJunQQ= github.com/openziti/metrics v1.2.27 h1:Dw/FSC+QvyqkDmLeSsxzCRD0aFPwgivwQyQsxzlAgoQ= github.com/openziti/metrics v1.2.27/go.mod h1:mhP2c8MTGL0C5H8yAsNwBq88SW1C3Mx1ICVO6heMbJQ= -github.com/openziti/sdk-golang v0.20.64 h1:v11zS23QGLTFWYuzrKzJNNGiSA6SNsT+5mTAiVkLfcA= -github.com/openziti/sdk-golang v0.20.64/go.mod h1:Q21Nxifw9CAYSgnpKVK1H9tW3EZFaB/CpulWFuC6CuI= -github.com/openziti/secretstream v0.1.8 h1:AgPHLDuXTiM1apHQmBvwvSW1vbQqAm7wUJDHqkQ/6Nk= -github.com/openziti/secretstream v0.1.8/go.mod h1:qcF8EmSX5SAT8k2pzsDI4bWugopv9AA+ltgWDrcAAEw= +github.com/openziti/sdk-golang v0.20.66 h1:JN/Bdgol4NVdv8pBZ6SMir6RUcMJABarhhMcR8zpbUQ= +github.com/openziti/sdk-golang v0.20.66/go.mod h1:eOE5gmGojPaEG/ZPUQKLxj4SMQ4MCVz1uLkl/gHCT7Q= +github.com/openziti/secretstream v0.1.9 h1:mNCMr9oYQ4JAfdU4iU79i3si4vqVVsErzrhXuKC7R3M= +github.com/openziti/secretstream v0.1.9/go.mod h1:tq0XVUwFAT0TwfBpILp4KaeEnasduNTUixOIrmUZUGA= github.com/openziti/storage v0.2.7 h1:rQVVclnkCZyr4XXKMypIJf46HFGJX5KEYWEycUhWvtg= github.com/openziti/storage v0.2.7/go.mod h1:bGhUs/0XDsEJnTtNTpFAIh1X4lfdKvHu0m+8Z1TFVyM= github.com/openziti/transport/v2 v2.0.91 h1:eEWRSoy9+tDf6K+jJcl5TSHm6GX7IKiBQg8XxmDyELQ= @@ -612,8 +612,9 @@ github.com/tidwall/pretty v1.0.0 h1:HsD+QiTn7sK6flMKIvNmpqz1qrpP3Ps6jOKIKMooyg4= github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk= github.com/tklauser/go-sysconf v0.3.11 h1:89WgdJhk5SNwJfu+GKyYveZ4IaJ7xAkecBo+KdJV0CM= github.com/tklauser/go-sysconf v0.3.11/go.mod h1:GqXfhXY3kiPa0nAXPDIQIWzJbMCB7AmcWpGR8lSZfqI= -github.com/tklauser/numcpus v0.6.0 h1:kebhY2Qt+3U6RNK7UqpYNA+tJ23IBEGKkB7JQBfDYms= github.com/tklauser/numcpus v0.6.0/go.mod h1:FEZLMke0lhOUG6w2JadTzp0a+Nl8PF/GFkQ5UVIcaL4= +github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk= +github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY= github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM= github.com/ugorji/go v1.1.7 h1:/68gy2h+1mWMrwZFeD1kQialdSzAb432dtpeJ42ovdo= github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw= @@ -683,8 +684,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw= -golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g= -golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0= +golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM= +golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -889,7 +890,7 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE= +golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=