From 0cb47ff486d3336122bbf8bc7d8daba3fc560ca8 Mon Sep 17 00:00:00 2001 From: gberl002 Date: Tue, 3 May 2022 18:23:31 -0400 Subject: [PATCH 1/4] Adding EXTERNAL_DNS to PKI for controller --- quickstart/docker/image/ziti-cli-functions.sh | 41 ++++++++++--------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh index b5b1b8366..aca1ad73d 100755 --- a/quickstart/docker/image/ziti-cli-functions.sh +++ b/quickstart/docker/image/ziti-cli-functions.sh @@ -56,7 +56,7 @@ function cleanZitiController { } function initializeController { log_file="${ZITI_HOME-}/${ZITI_EDGE_CONTROLLER_RAWNAME}-init.log" -"${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${log_file}" + "${ZITI_BIN_DIR-}/ziti-controller" edge init "${ZITI_HOME_OS_SPECIFIC}/${ZITI_EDGE_CONTROLLER_RAWNAME}.yaml" -u "${ZITI_USER-}" -p "${ZITI_PWD}" &> "${log_file}" echo -e "ziti-controller initialized. see $(BLUE "${log_file}") for details" } function startZitiController { @@ -611,33 +611,34 @@ function expressInstall { } function pki_client_server { - name_local=${1-} - ZITI_CA_NAME_local=$2 - ip_local=$3 + file_name=${1-} + allow_list=$2 + ZITI_CA_NAME_local=$3 + ip_local=$4 if [[ "${ip_local}" == "" ]]; then ip_local="127.0.0.1" fi - if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-server.key"; then - echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}" + if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${file_name}-server.key"; then + echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}" "${ZITI_BIN_DIR-}/ziti" pki create server --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \ - --server-file "${name_local}-server" \ - --dns "${name_local},localhost" --ip "${ip_local}" \ - --server-name "${name_local} server certificate" + --server-file "${file_name}-server" \ + --dns "${allow_list}" --ip "${ip_local}" \ + --server-name "${file_name} server certificate" else - echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${name_local}" + echo "Creating server cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}" echo "key exists" fi - if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${name_local}-client.key"; then - echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}" + if ! test -f "${ZITI_PKI}/${ZITI_CA_NAME_local}/keys/${file_name}-client.key"; then + echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}" "${ZITI_BIN_DIR-}/ziti" pki create client --pki-root="${ZITI_PKI_OS_SPECIFIC}" --ca-name "${ZITI_CA_NAME_local}" \ - --client-file "${name_local}-client" \ - --key-file "${name_local}-server" \ - --client-name "${name_local}" + --client-file "${file_name}-client" \ + --key-file "${file_name}-server" \ + --client-name "${file_name}" else - echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${name_local}" + echo "Creating client cert from ca: ${ZITI_CA_NAME_local} for ${allow_list}" echo "key exists" fi echo " " @@ -717,7 +718,7 @@ function createRouterPki { export ZITI_ROUTER_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.cert" export ZITI_ROUTER_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.key" export ZITI_ROUTER_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/cas.cert" - pki_client_server "${router_name}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}" + pki_client_server "${router_name}" "${router_name},localhost,$(hostname)" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}" } function createPrivateRouterConfig { @@ -773,8 +774,10 @@ function createPki { pki_create_intermediate "${ZITI_SPURIOUS_INTERMEDIATE}" "${ZITI_SIGNING_INTERMEDIATE_NAME}" 1 echo " " - pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}" - pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}" + pki_allow_list="${ZITI_CONTROLLER_HOSTNAME},localhost" + if [[ "$EXTERNAL_DNS" != "" ]]; then pki_allow_list="$pki_allow_list,$EXTERNAL_DNS"; fi + pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${pki_allow_list}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}" + pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}" } From 312486621a61e4a7ffffd504f1570442a0238340 Mon Sep 17 00:00:00 2001 From: gberl002 Date: Tue, 3 May 2022 21:09:42 -0400 Subject: [PATCH 2/4] Refactoring parameter list order --- quickstart/docker/image/ziti-cli-functions.sh | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh index aca1ad73d..5b93eefea 100755 --- a/quickstart/docker/image/ziti-cli-functions.sh +++ b/quickstart/docker/image/ziti-cli-functions.sh @@ -611,10 +611,10 @@ function expressInstall { } function pki_client_server { - file_name=${1-} - allow_list=$2 - ZITI_CA_NAME_local=$3 - ip_local=$4 + allow_list=${1-} + ZITI_CA_NAME_local=$2 + ip_local=$3 + file_name=$4 if [[ "${ip_local}" == "" ]]; then ip_local="127.0.0.1" @@ -718,7 +718,7 @@ function createRouterPki { export ZITI_ROUTER_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.cert" export ZITI_ROUTER_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.key" export ZITI_ROUTER_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/cas.cert" - pki_client_server "${router_name}" "${router_name},localhost,$(hostname)" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}" + pki_client_server "${router_name},localhost,$(hostname)" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}" "${router_name}" } function createPrivateRouterConfig { @@ -776,8 +776,8 @@ function createPki { echo " " pki_allow_list="${ZITI_CONTROLLER_HOSTNAME},localhost" if [[ "$EXTERNAL_DNS" != "" ]]; then pki_allow_list="$pki_allow_list,$EXTERNAL_DNS"; fi - pki_client_server "${ZITI_CONTROLLER_HOSTNAME}" "${pki_allow_list}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}" - pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_HOSTNAME}" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}" + pki_client_server "${pki_allow_list}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}" "${ZITI_CONTROLLER_HOSTNAME}" + pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME},localhost" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}" "${ZITI_EDGE_CONTROLLER_HOSTNAME}" } From a1ad09df18df9633094e9d1a7e5370cb84beaff3 Mon Sep 17 00:00:00 2001 From: gberl002 Date: Wed, 4 May 2022 10:23:12 -0400 Subject: [PATCH 3/4] Updating changelog --- CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index febf00f45..5613e1e34 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ # Release 0.25.6 -There are no features or bug fixes in the release. The only change is moving from Go 1.17 to 1.18 +* Moving from Go 1.17 to 1.18 +* Bug fix: Fixes an issue in quickstart "Host it anywhere" where an EXTERNAL_DNS was not added to the PKI causing failures when attempting to use a router from outside the hosted environment. # Release 0.25.5 From 1ce7fbbe8e97756fdb9478505e161416de3cdd89 Mon Sep 17 00:00:00 2001 From: gberl002 Date: Wed, 4 May 2022 11:11:26 -0400 Subject: [PATCH 4/4] Adding 127.0.0.1 to approved IPs --- quickstart/docker/image/ziti-cli-functions.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/quickstart/docker/image/ziti-cli-functions.sh b/quickstart/docker/image/ziti-cli-functions.sh index 5b93eefea..98f76e710 100755 --- a/quickstart/docker/image/ziti-cli-functions.sh +++ b/quickstart/docker/image/ziti-cli-functions.sh @@ -718,7 +718,7 @@ function createRouterPki { export ZITI_ROUTER_IDENTITY_SERVER_CERT="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.cert" export ZITI_ROUTER_IDENTITY_KEY="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/server.key" export ZITI_ROUTER_IDENTITY_CA="${ZITI_PKI_OS_SPECIFIC}/routers/${router_name}/cas.cert" - pki_client_server "${router_name},localhost,$(hostname)" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}" "${router_name}" + pki_client_server "${router_name},localhost,127.0.0.1,$(hostname)" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_ROUTER_IP_OVERRIDE-}" "${router_name}" } function createPrivateRouterConfig { @@ -774,10 +774,10 @@ function createPki { pki_create_intermediate "${ZITI_SPURIOUS_INTERMEDIATE}" "${ZITI_SIGNING_INTERMEDIATE_NAME}" 1 echo " " - pki_allow_list="${ZITI_CONTROLLER_HOSTNAME},localhost" + pki_allow_list="${ZITI_CONTROLLER_HOSTNAME},localhost,127.0.0.1" if [[ "$EXTERNAL_DNS" != "" ]]; then pki_allow_list="$pki_allow_list,$EXTERNAL_DNS"; fi pki_client_server "${pki_allow_list}" "${ZITI_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_CONTROLLER_IP_OVERRIDE-}" "${ZITI_CONTROLLER_HOSTNAME}" - pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME},localhost" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}" "${ZITI_EDGE_CONTROLLER_HOSTNAME}" + pki_client_server "${ZITI_EDGE_CONTROLLER_HOSTNAME},localhost,127.0.0.1" "${ZITI_EDGE_CONTROLLER_INTERMEDIATE_NAME}" "${ZITI_EDGE_CONTROLLER_IP_OVERRIDE-}" "${ZITI_EDGE_CONTROLLER_HOSTNAME}" }