From 6fc8db148120f5375527fd49ae18601a3913368e Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Thu, 14 Jul 2022 10:37:13 -0400 Subject: [PATCH 1/3] updates change log --- CHANGELOG.md | 83 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index fbe9ee691..4bbd85ae5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,86 @@ +# Release 0.26.1 + +## What's New +- All + - Identity `alt_server_certs` +- Edge + - N/A +- Fabric + - N/A +- Ziti CLI + - N/A +- SDK Golang + - N/a + +## All +### Identity `alt_server_certs` + +The [identity library](https://github.com/openziti/identity) has been updated to support a new field: `alt_server_certs` +. This field is an array of objects with `server_cert` and `server_key` fields. `alt_server_certs` is not touched by +higher level Ziti automations to renew certificates and is intended for manual or externally automated use. It allows +additional server certificates to be used for the controller and routers with separate private keys. It is useful in +scenarios where routers or controllers are exposed using certificates signed by public CAs (i.e. Let's Encrypt). + +The `server_cert` and `server_key` work the same as the root identity properties of the same name. In any single +`server_cert` source that provides a chain, it assumed that all leaf-certificates are based on the private key in +`server_key`. If `server_key` is not defined, the default root `server_key` will be used. The identity library will use +the certificate chains and private key pairs specified in `alt_server_certs` when generating a TLS configuration via +`ServerTLSConfig()`. All identity sources are viable: `pem`, `file`, etc. + +Go Identity Config Struct Definition: +```go +type Config struct { + Key string `json:"key" yaml:"key" mapstructure:"key"` + Cert string `json:"cert" yaml:"cert" mapstructure:"cert"` + ServerCert string `json:"server_cert,omitempty" yaml:"server_cert,omitempty" mapstructure:"server_cert,omitempty"` + ServerKey string `json:"server_key,omitempty" yaml:"server_key,omitempty" mapstructure:"server_key,omitempty"` + AltServerCerts []ServerPair `json:"alt_server_certs,omitempty" yaml:"alt_server_certs,omitempty" mapstructure:"alt_server_certs,omitempty"` + CA string `json:"ca,omitempty" yaml:"ca,omitempty" mapstructure:"ca"` +} + +type ServerPair struct { + ServerCert string `json:"server_cert,omitempty" yaml:"server_cert,omitempty" mapstructure:"server_cert,omitempty"` + ServerKey string `json:"server_key,omitempty" yaml:"server_key,omitempty" mapstructure:"server_key,omitempty"` +} +``` + +JSON Example: + +```json +{ + "cert": "./ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem", + "key": "./ziti/etc/ca/intermediate/private/ctrl.key.pem", + "server_cert": "./ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem", + "server_key": "./ziti/etc/ca/intermediate/certs/ctrl-server.key.pem", + "ca": "./ziti/etc/ca/intermediate/certs/ca-chain.cert.pem", + "alt_server_certs": [ + { + "server_cert": "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.cert.pem", + "server_key": "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.key.pem" + }, + { + "server_cert": "pem:-----BEGIN CERTIFICATE-----\nIIGBjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT...", + "server_key": "pem:-----BEGIN CERTIFICATE-----\nMIIEuDCCAqCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVT..." + } + ] +} +``` + +YAML Example: + +```yaml +cert: "./ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem" +key: "./ziti/etc/ca/intermediate/private/ctrl.key.pem" +server_cert: "./ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem" +server_key: "./ziti/etc/ca/intermediate/certs/ctrl-server.key.pem" +ca: "./ziti/etc/ca/intermediate/certs/ca-chain.cert.pem" +alt_server_certs: + - server_cert: "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.cert.pem" + server_key: "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.key.pem" + - server_cert: "pem:-----BEGIN CERTIFICATE-----\nIIGBjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT..." + server_key: "pem:-----BEGIN CERTIFICATE-----\nMIIEuDCCAqCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVT..." +``` + # Release 0.26.0 ## Breaking Changes From 636eca05d6dd5ddadaa761539ae7a662280f78ac Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Thu, 14 Jul 2022 15:22:24 -0400 Subject: [PATCH 2/3] update xweb/fabric/edge adds note about SNI dep missing --- CHANGELOG.md | 4 ++++ go.mod | 14 +++++++------- go.sum | 28 ++++++++++++++-------------- 3 files changed, 25 insertions(+), 21 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4bbd85ae5..0a69ee5bc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,8 +1,12 @@ # Release 0.26.1 +There was a missed dependency update for xweb in 0.26.0 that kept SNI from working in HTTP API components. This would +affect SNI support for all REST APIs. + ## What's New - All - Identity `alt_server_certs` + - Fixes missing identity update in xweb - Edge - N/A - Fabric diff --git a/go.mod b/go.mod index b527e050f..d08016035 100644 --- a/go.mod +++ b/go.mod @@ -23,16 +23,16 @@ require ( github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19 github.com/michaelquigley/pfxlog v0.6.9 github.com/openziti/agent v1.0.1 - github.com/openziti/channel v0.18.52 - github.com/openziti/edge v0.22.13 - github.com/openziti/fabric v0.19.16 + github.com/openziti/channel v0.18.53 + github.com/openziti/edge v0.22.17 + github.com/openziti/fabric v0.19.18 github.com/openziti/foundation/v2 v2.0.1 - github.com/openziti/identity v1.0.4 + github.com/openziti/identity v1.0.5 github.com/openziti/metrics v1.0.2 - github.com/openziti/sdk-golang v0.16.97 + github.com/openziti/sdk-golang v0.16.98 github.com/openziti/storage v0.1.14 - github.com/openziti/transport/v2 v2.0.15 - github.com/openziti/xweb/v2 v2.0.1 + github.com/openziti/transport/v2 v2.0.16 + github.com/openziti/xweb/v2 v2.0.2 github.com/openziti/ziti-db-explorer v1.1.1 github.com/pborman/uuid v1.2.0 github.com/pkg/errors v0.9.1 diff --git a/go.sum b/go.sum index 6403f94e7..c155981bc 100644 --- a/go.sum +++ b/go.sum @@ -667,32 +667,32 @@ github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTm github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw= github.com/openziti/agent v1.0.1 h1:mk3M6MOyK75Qc+lOdtKHywfaxnbSES9qi4NiLZQxOMU= github.com/openziti/agent v1.0.1/go.mod h1:ALOg74f4b4GpUOjDPusp6lezbQa/7rgo09HOrodDWAw= -github.com/openziti/channel v0.18.52 h1:i7pst/JGQRtuTnve59Ra2i2MiJZL7M0k3wanqD5W9j8= -github.com/openziti/channel v0.18.52/go.mod h1:bjclQL6meYD5Uiw8xuKw0CI24gyzPTd7WW0IsfRk2/k= +github.com/openziti/channel v0.18.53 h1:YEGsizInlHoEPITJye/HZqTMykRvuzIoa4wrFMcSMkc= +github.com/openziti/channel v0.18.53/go.mod h1:6vF4dSujAqDsmJU5+g82pXvZRiagqq972E0uNA4LG9o= github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k= github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo= -github.com/openziti/edge v0.22.13 h1:5w6cMPd19rMFoDPhsF8PbLE4qLfMVM5WcfSE15FtMSA= -github.com/openziti/edge v0.22.13/go.mod h1:d0LCgwrz/YGvqwy+vf5Uv589bYo1ZZHEfmnkuOZ2JL0= -github.com/openziti/fabric v0.19.16 h1:KqxhVjVklyURJir+rC95GPeu0t2ZthSp6lX2ppV9Mfk= -github.com/openziti/fabric v0.19.16/go.mod h1:8AlLbXYyOR0PpEB+yW9cUDx4duys9YwvF4pcskj4LLA= +github.com/openziti/edge v0.22.17 h1:2m/vDyAWBvc4UrdezsHi+U/cj5UiyXUk9HO2xTCSl8M= +github.com/openziti/edge v0.22.17/go.mod h1:47Gh0EtHBL1D0LLixrWg/XvStkJAtrY0EkYzOReeROw= +github.com/openziti/fabric v0.19.18 h1:2FkP3Vutn2eZLtVSQBV8XHx3sQ/H8fJl0WU7RNim5DA= +github.com/openziti/fabric v0.19.18/go.mod h1:SLFSzdEqkCwJoW7nmUdeo2bvfDObK6M1h+fBQ8oUiGk= github.com/openziti/foundation/v2 v2.0.1 h1:HKYwAyxlZ4zmlt0t9Y/v6SWso0qUaeWapkWOlQDKPEk= github.com/openziti/foundation/v2 v2.0.1/go.mod h1:L75kwCC5WTUPqxuAd3G+WMBompaElMb/nYlJjR1sJ9Q= -github.com/openziti/identity v1.0.4 h1:48OuTuvJLTv32Vahonga+wHhS3GL8aFUgSHK2pqbcDs= -github.com/openziti/identity v1.0.4/go.mod h1:Nxf0CPFPkvdtFGvvsP4I/eZ//flU0q+sJVnLZDzlFOE= +github.com/openziti/identity v1.0.5 h1:PKW1tj0ctOWgscL3P4gKiVFfKrP6dYeP0U6R8Aw6DKM= +github.com/openziti/identity v1.0.5/go.mod h1:Nxf0CPFPkvdtFGvvsP4I/eZ//flU0q+sJVnLZDzlFOE= github.com/openziti/jwks v1.0.1 h1:+BtBzDWFVUlJfCbBhQR0BZI3YNtoBvfhfdCUSSB0G+0= github.com/openziti/jwks v1.0.1/go.mod h1:KwO0x9FBG0aoJS5f6nH5xeHoplyR1H143SMI9kF0mC8= github.com/openziti/metrics v1.0.2 h1:X3ip93aDDgVeyhqxBLVwCtdG7/kILktFxcpl5N2+4+E= github.com/openziti/metrics v1.0.2/go.mod h1:30EzUXm/VJfTVNoqPLx4x3mC/eslpCeh6wc4ejbZR/g= -github.com/openziti/sdk-golang v0.16.97 h1:FMdIQoSJl7iNrM0AhJMG8ChRZJ+2q1Y9jw6VzDuvPX4= -github.com/openziti/sdk-golang v0.16.97/go.mod h1:oHRuQCHv34DZG5XNHftBvjp5DR5tu6WtMnS52EHvWTQ= +github.com/openziti/sdk-golang v0.16.98 h1:djkdN8DHGuJehnGYTx5fD1gPqEhBy9v0rXj/eVXFtcc= +github.com/openziti/sdk-golang v0.16.98/go.mod h1:u/ft5kUJ2t4nxo0My33n0FNOc6MhBljmFJ4TpyfokEA= github.com/openziti/storage v0.1.14 h1:JZv9OP0O4d3Z5c+ebaVpNUDJWrRsqgpTPHIwdCgYud0= github.com/openziti/storage v0.1.14/go.mod h1:PXc1iYT8m+EmZf9EGyRTFwAToY1/jd5cAV2FFxL2D/g= -github.com/openziti/transport/v2 v2.0.15 h1:PsmNVsTeaav7/FHlczWlMhNW1wqdbVuC9ryAUzaywQw= -github.com/openziti/transport/v2 v2.0.15/go.mod h1:Dfd8ZORF/UHGrHL6FVaZka/58tFEKQK4tV0HSeqYBts= +github.com/openziti/transport/v2 v2.0.16 h1:dTo8TyJeYzLly04eadbN8o6m2tehzNNGadyL7abSMHk= +github.com/openziti/transport/v2 v2.0.16/go.mod h1:tkKEcr/NEjJ2NaYyn9ppAlXEidSOyusJGulfKLcqMws= github.com/openziti/x509-claims v1.0.2 h1:PSv/xRfejIAcPc16A902k08rSBs3R8bjtL4qq6WEwCI= github.com/openziti/x509-claims v1.0.2/go.mod h1:Z0WIpBm6c4ecrpRKrou6Gk2wrLWxJO/+tuUwKh8VewE= -github.com/openziti/xweb/v2 v2.0.1 h1:KF0bVCeiJ6TIJEsxdLZbnpdJKqZX095EiMTcoQynuz4= -github.com/openziti/xweb/v2 v2.0.1/go.mod h1:2+IpJFejJeJelA4QyAPluLS30hfyUP2eRTo9XD99W0Y= +github.com/openziti/xweb/v2 v2.0.2 h1:XYlVFriTq/U1wcUrc+XPnWJGhXh9NJPhtQ7+r3aC0cU= +github.com/openziti/xweb/v2 v2.0.2/go.mod h1:KQOOlnJk08EZT3TWkvDj/pbIUEVbgG0IrrNzl8gsi40= github.com/openziti/ziti-db-explorer v1.1.1 h1:G0eoTby+aIjjt5TxEfR+FMI2CWd4RvZFjzaIMX2lEBw= github.com/openziti/ziti-db-explorer v1.1.1/go.mod h1:h76h7Tsb+khb0v+CqYKL6ifUfJbUMjGBFU2IvupfBE4= github.com/oracle/oci-go-sdk v24.2.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888= From ee7ed76e8f79535ed32b655e2e1564b108cb993e Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Thu, 14 Jul 2022 15:27:47 -0400 Subject: [PATCH 3/3] remove 1.0.5 identity info --- CHANGELOG.md | 80 ++-------------------------------------------------- 1 file changed, 2 insertions(+), 78 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0a69ee5bc..a7ebe51e9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,86 +4,10 @@ There was a missed dependency update for xweb in 0.26.0 that kept SNI from worki affect SNI support for all REST APIs. ## What's New -- All - - Identity `alt_server_certs` - - Fixes missing identity update in xweb - Edge - - N/A + - Fixes missing identity update in xweb - Fabric - - N/A -- Ziti CLI - - N/A -- SDK Golang - - N/a - -## All -### Identity `alt_server_certs` - -The [identity library](https://github.com/openziti/identity) has been updated to support a new field: `alt_server_certs` -. This field is an array of objects with `server_cert` and `server_key` fields. `alt_server_certs` is not touched by -higher level Ziti automations to renew certificates and is intended for manual or externally automated use. It allows -additional server certificates to be used for the controller and routers with separate private keys. It is useful in -scenarios where routers or controllers are exposed using certificates signed by public CAs (i.e. Let's Encrypt). - -The `server_cert` and `server_key` work the same as the root identity properties of the same name. In any single -`server_cert` source that provides a chain, it assumed that all leaf-certificates are based on the private key in -`server_key`. If `server_key` is not defined, the default root `server_key` will be used. The identity library will use -the certificate chains and private key pairs specified in `alt_server_certs` when generating a TLS configuration via -`ServerTLSConfig()`. All identity sources are viable: `pem`, `file`, etc. - -Go Identity Config Struct Definition: -```go -type Config struct { - Key string `json:"key" yaml:"key" mapstructure:"key"` - Cert string `json:"cert" yaml:"cert" mapstructure:"cert"` - ServerCert string `json:"server_cert,omitempty" yaml:"server_cert,omitempty" mapstructure:"server_cert,omitempty"` - ServerKey string `json:"server_key,omitempty" yaml:"server_key,omitempty" mapstructure:"server_key,omitempty"` - AltServerCerts []ServerPair `json:"alt_server_certs,omitempty" yaml:"alt_server_certs,omitempty" mapstructure:"alt_server_certs,omitempty"` - CA string `json:"ca,omitempty" yaml:"ca,omitempty" mapstructure:"ca"` -} - -type ServerPair struct { - ServerCert string `json:"server_cert,omitempty" yaml:"server_cert,omitempty" mapstructure:"server_cert,omitempty"` - ServerKey string `json:"server_key,omitempty" yaml:"server_key,omitempty" mapstructure:"server_key,omitempty"` -} -``` - -JSON Example: - -```json -{ - "cert": "./ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem", - "key": "./ziti/etc/ca/intermediate/private/ctrl.key.pem", - "server_cert": "./ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem", - "server_key": "./ziti/etc/ca/intermediate/certs/ctrl-server.key.pem", - "ca": "./ziti/etc/ca/intermediate/certs/ca-chain.cert.pem", - "alt_server_certs": [ - { - "server_cert": "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.cert.pem", - "server_key": "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.key.pem" - }, - { - "server_cert": "pem:-----BEGIN CERTIFICATE-----\nIIGBjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT...", - "server_key": "pem:-----BEGIN CERTIFICATE-----\nMIIEuDCCAqCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVT..." - } - ] -} -``` - -YAML Example: - -```yaml -cert: "./ziti/etc/ca/intermediate/certs/ctrl-client.cert.pem" -key: "./ziti/etc/ca/intermediate/private/ctrl.key.pem" -server_cert: "./ziti/etc/ca/intermediate/certs/ctrl-server.cert.pem" -server_key: "./ziti/etc/ca/intermediate/certs/ctrl-server.key.pem" -ca: "./ziti/etc/ca/intermediate/certs/ca-chain.cert.pem" -alt_server_certs: - - server_cert: "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.cert.pem" - server_key: "./ziti/etc/ca/intermediate/certs/alt01-ctrl-server.key.pem" - - server_cert: "pem:-----BEGIN CERTIFICATE-----\nIIGBjCCA+6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZcxCzAJBgNVBAYTAlVT..." - server_key: "pem:-----BEGIN CERTIFICATE-----\nMIIEuDCCAqCgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgYsxCzAJBgNVBAYTAlVT..." -``` + - Fixes missing identity update in xweb # Release 0.26.0