Merge pull request #658 from openziti/release-next

v0.25.4 release

.github/workflows/codesee-arch-diagram.yml

@@ -1,81 +0,0 @@
-on:
-  push:
-    branches:
-      - release-next
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-
-name: CodeSee Map
-
-jobs:
-  test_map_action:
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    name: Run CodeSee Map Analysis
-    steps:
-      - name: checkout
-        id: checkout
-        uses: actions/checkout@v2
-        with:
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          ref: ${{ github.event.pull_request.head.ref }}
-          fetch-depth: 0
-
-      # codesee-detect-languages has an output with id languages.
-      - name: Detect Languages
-        id: detect-languages
-        uses: Codesee-io/codesee-detect-languages-action@latest
-
-      - name: Configure JDK 16
-        uses: actions/setup-java@v2
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).java }}
-        with:
-          java-version: '16'
-          distribution: 'zulu'
-
-      # CodeSee Maps Go support uses a static binary so there's no setup step required.
-
-      - name: Configure Node.js 14
-        uses: actions/setup-node@v2
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).javascript }}
-        with:
-          node-version: '14'
-
-      - name: Configure Python 3.x
-        uses: actions/setup-python@v2
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).python }}
-        with:
-          python-version: '3.x'
-          architecture: 'x64'
-
-      - name: Configure Ruby '3.x'
-        uses: ruby/setup-ruby@v1
-        if: ${{ fromJSON(steps.detect-languages.outputs.languages).ruby }}
-        with:
-          ruby-version: '3.0'
-
-      # CodeSee Maps Rust support uses a static binary so there's no setup step required.
-
-      - name: Generate Map
-        id: generate-map
-        uses: Codesee-io/codesee-map-action@latest
-        with:
-          step: map
-          github_ref: ${{ github.ref }}
-          languages: ${{ steps.detect-languages.outputs.languages }}
-
-      - name: Upload Map
-        id: upload-map
-        uses: Codesee-io/codesee-map-action@latest
-        with:
-          step: mapUpload
-          api_token: ${{ secrets.CODESEE_ARCH_DIAG_API_TOKEN }}
-          github_ref: ${{ github.ref }}
-      
-      - name: Insights
-        id: insights
-        uses: Codesee-io/codesee-map-action@latest
-        with:
-          step: insights
-          api_token: ${{ secrets.CODESEE_ARCH_DIAG_API_TOKEN }}
-          github_ref: ${{ github.ref }}

.github/workflows/main.yml

@@ -103,8 +103,6 @@ jobs:
       - name: Build and Test
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ziti_ci_gpg_key: ${{ secrets.ZITI_CI_GPG_KEY }}
-          ziti_ci_gpg_key_id: ${{ secrets.ZITI_CI_GPG_KEY_ID }}
         run: |
           sudo apt-get update
           sudo apt-get -yq install gcc-arm-linux-gnueabihf g++-arm-linux-gnueabihf gcc-aarch64-linux-gnu
@@ -132,6 +130,8 @@ jobs:
         if: github.repository_owner == 'openziti' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v'))
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ziti_ci_gpg_key: ${{ secrets.ZITI_CI_GPG_KEY }}
+          ziti_ci_gpg_key_id: ${{ secrets.ZITI_CI_GPG_KEY_ID }}
         run: |
           $(go env GOPATH)/bin/ziti-ci tag -v -f version
           $(go env GOPATH)/bin/ziti-ci publish-to-github

.gitignore

@@ -26,3 +26,4 @@ ziti.ignore
 linux-build
 *.log
 /build/
+go.work

CHANGELOG.md

@@ -1,3 +1,371 @@
+# Release 0.25.4
+
+**NOTE**: Link management is undergoing some restructuring to support better link costing and multiple interfaces. The link types introduced in 0.25 should not be used. A more complete replacement is coming soon.
+
+* Enhancement: Add additional logging information to tunnel edge routers. Now adds the local address to the router/link chain.
+* Enhancement: Add additional metrics for terminator errors. 
+    - `service.dial.terminator.timeout`: Raised when the terminator times out when connecting with it's configured endpoint
+    - `service.dial.terminator.connection_refused`: Raised when the terminator cannot connect to it's configured endpoint
+    - `service.dial.terminator.invalid`: Raised when the edge router is unable to get or access the terminator
+    - `service.dial.terminator.misconfigured`: Raised when the fabric is unable to find or create the terminator
+* Enhancement: Authentication Policies
+* Enhancement: JWT Primary/Secondary Authentication
+* Enhancement: Required TOTP (fka MFA) Enrollment
+* Bug fix: Fix router panic which can happen on link bind
+* Bug fix: Fix router panic which can happen if the router shuts down before it's fully up an running
+* Enhancement: Avoid router warning like `destination exists for [p57a]` by not sending egress in route, since egress will always already be established
+* Enhancement: Change default dial retries to 2 from 3
+* Enhancement: Add circuit inspect. `ziti fabric inspect .* circuit:<circuit-id>` will now return information about the circuit from the routers. This will include routing information as well as flow control data from the initiator and terminator.
+* Change: Support for link types removed
+
+## Authentication Policies
+
+Authentication policies are configuration that allows administrators to enforce authentication requirements. A single
+authentication policy is assigned to each identity in the system. This assignment is controlled on the `Identity`
+entities within the Ziti Edge Management API. If an authentication policy is not specified, a system default policy is
+applied that. The default policy represents the behavior of Ziti v0.25.3 and earlier and may be updated to the network's
+requirements.
+
+### Assignment
+
+The `Identity` entity now supports a new field `authPolicyId`. In the REST Edge API this field is optional during create
+and existing calls to `POST /identities` will succeed. Every identity must have exactly one authentication policy
+assigned to it. If one is not assigned, the default authentication policy will be used (`authPolicyId` == `default`)
+
+Example w/o `authPolicyId`:
+
+`POST /edge/v1/management/identities`
+```json
+
+{
+    "name": "zde",
+    "type": "User",
+    "isAdmin": false,
+    "enrollment": {
+        "ott": "true"
+    },
+    "roleAttributes": [
+        "dial"
+    ]
+}
+```
+
+Example w/ `authPolicyId`:
+
+`POST /edge/v1/management/identities`
+```json
+{
+    "name": "zde",
+    "type": "User",
+    "isAdmin": false,
+    "enrollment": {
+        "ott": "true"
+    },
+    "roleAttributes": [
+        "dial"
+    ],
+    "authPolicyId": "xyak1."
+}
+```
+
+### Default Authentication Policy
+
+Ziti contains a single default authentication policy that is marked as a "system" definition. It cannot be deleted,
+but it can be updated. This authentication policy has a well known id of `default`. It can be viewed according to the
+following example:
+
+`GET /edge/v1/management/auth-policies/default`
+```json
+{
+  "data": {
+    "_links": {
+      "self": {
+        "href": "./auth-policies/default"
+      }
+    },
+    "createdAt": "2022-03-30T17:54:55.785Z",
+    "id": "default",
+    "tags": {},
+    "updatedAt": "2022-03-30T17:54:55.785Z",
+    "name": "Default",
+    "primary": {
+      "cert": {
+        "allowExpiredCerts": true,
+        "allowed": true
+      },
+      "extJwt": {
+        "allowed": true,
+        "allowedSigners": null
+      },
+      "updb": {
+        "allowed": true,
+        "lockoutDurationMinutes": 0,
+        "maxAttempts": 0,
+        "minPasswordLength": 5,
+        "requireMixedCase": false,
+        "requireNumberChar": false,
+        "requireSpecialChar": false
+      }
+    },
+    "secondary": {
+      "requireExtJwtSigner": null,
+      "requireTotp": false
+    }
+  },
+  "meta": {}
+}
+```
+
+### AuthPolicy Endpoints
+
+The following endpoints were added to support CRUD operations:
+
+- List `GET /edge/v1/management/auth-policies`
+- Create `POST /edge/v1/management/auth-policies`
+- Detail `GET /edge/v1/management/auth-policies/{id}`
+- Replace `PUT /edge/v1/management/auth-policies/{id}`
+- Patch `PATCH /edge/v1/management/auth-policies/{id}`
+- Delete `Delete /edge/v1/management/auth-policies/{id}`
+
+And have the following properties:
+
+- `name`: a unique name for the policy
+- `primary.cert.allowed` - allow certificate based authentication
+- `primary.cert.allowExpiredCerts` - allows clients with expired certificates to authenticate
+- `primary.extJwt.allowed` - allow external JWT authentication
+- `primary.extJwt.allowedSigners` - a specific set of external jwt signers that are allowed, if not set all enabled signers are allowed
+- `primary.updb.allowed` - allow username/password authentication
+- `primary.updb.lockoutDurationMinutes` - the number of minutes to lock an identity after exceeding `maxAttempts`, 0 = indefinite
+- `primary.updb.minPasswordLength` - the minimum lengths passwords must be, currently a placeholder
+- `primary.updb.requireMixedCase` - requires passwords to include mixed cases, currently a placeholder
+- `primary.updb.requireNumberChar` - requires passwords to include at least 1 number, currently a placeholder
+- `primary.updb.requireSpecialChar` - requires passwords to include at least 1 special character, currently a placeholder
+- `secondary.requireExtJwtSigner` - requires an additional JWT bearer token be provided on all API requests, null is disabled
+- `secondary.requireTotp` - requires TOTP (fka MFA enrollment) enrollment to be completed and in use
+Example Create:
+
+```json
+{
+    "name": "Original Name 1",
+    "primary": {
+        "cert": {
+            "allowExpiredCerts": true,
+            "allowed": true
+        },
+        "extJwt": {
+            "allowed": true,
+            "allowedSigners": [
+                "2BurseGARW"
+            ]
+        },
+        "updb": {
+            "allowed": true,
+            "lockoutDurationMinutes": 0,
+            "maxAttempts": 5,
+            "minPasswordLength": 5,
+            "requireMixedCase": true,
+            "requireNumberChar": true,
+            "requireSpecialChar": true
+        }
+    },
+    "secondary": {
+        "requireExtJwtSigner": null,
+        "requireTotp": false
+    },
+    "tags": {
+        "originalTag1Name": "originalTag1Value"
+    }
+}
+```
+
+## JWT Primary/Secondary Authentication
+
+A new primary authentication mechanism is available in addition to `cert` and `passsword` (UPDB). The internal
+method name is `ext-jwt` and it allows authentication by providing a bearer token by a known external JWT signer.
+A new entity `External JWT Singer` has been introduced and is defined in subsequent sections.
+
+Successful primary authentication requires:
+
+1) The target identity must have an authentication policy that allows primary external JWT signer authentication
+2) The JWT provided must include a `kid` that matches the `kid` defined on an external JWT signer
+3) The JWT provided must include a `sub` (or configured claim) that matches the identity's `id` or `externalId` (see below)
+4) The JWT provided must be properly signed by the signer defined by `kid`
+5) The JWT provided must be unexpired
+6) The encoded JWT must be provided during the initial authentication in the `Authorization` header with the prefix `Bearer ` and subsequent API calls
+
+A new secondary factor authentication mechanism is available in addition to TOTP (fka MFA). Both TOTP and `ext-jwt`
+secondary authentication factors can be enabled at the same time for a "nFA" setup.
+
+Successful secondary authentication requires all the same JWT token validation items, but as a secondary
+factor, not providing a valid JWT bearer token on API requests will drop the request's access to 
+"partially authenticated" - which has reduced access. Access can be restored by providing a valid JWT bearer token.
+Additionally, to turn on the functionality, an authentication policy that has the `requireExtJwtSigner` field must be
+set to a valid external JWT signer and assigned to the target identity(ies).
+
+### External JWT Signers 
+
+External JWT Signers can be managed on the following new REST Edge Management API endpoints:
+
+- List `GET /edge/v1/management/ext-jwt-signers`
+- Create `POST /edge/v1/management/ext-jwt-signers`
+- Detail `GET /edge/v1/management/ext-jwt-signers/{id}`
+- Replace `PUT /edge/v1/management/ext-jwt-signers/{id}`
+- Patch `PATCH /edge/v1/management/ext-jwt-signers/{id}`
+- Delete `Delete /edge/v1/management/ext-jwt-signers/{id}`
+
+And support the following properties:
+
+- `name` - a unique name for the signer
+- `certPem` - a unique PEM x509 certificate for the signer
+- `enabled` - whether the signer is currently enabled or disabled
+- `externalAuthUrl` - the URL clients should use to obtain a JWT
+- `claimsProperty` - the property to alternatively use for the target identity's `id` or `externalId`
+- `useExternalId` - whether to match the `claimsProperty` to `id` (false) or `externalId` (true)
+- `kid` - a unique `kid` value that will be present in a valid JWT's `kid` header
+
+Example Create:
+
+`POST /edge/v1/management/ext-jwt-signers`
+```json
+{
+    "certPem": "-----BEGIN CERTIFICATE-----\nMIIBizC ...",
+    "enabled": true,
+    "kid": "c7e2081d-b8f0-44b1-80fa-d73872692fd6",
+    "name": "Test JWT Signer Pre-Patch Kid",
+    "externalAuthUrl" : "https://my-jwt-provide/auth",
+    "claimsProperty": "email",
+    "useExternalId": "true"
+}
+```
+
+The above example creates a new signer that is enabled and that will instruct clients that they can attempt to obtain
+a JWT from `https://my-jwt-provide/auth`. The JWT that is returned from `https://my-jwt-provide/auth` should have a
+`kid` header of `c7e2081d-b8f0-44b1-80fa-d73872692fd6` and the `email` claim will be matched against Ziti identity's
+`externalId` field.
+
+### Identity ExternalId
+
+Ziti identity's have a new optional field named `externalId`. All existing identities will have this value defaulted
+to `null`. This value is unique if set and is currently only used for external JWT signer authentication. Ziti treats 
+the value as a case-sensitive opaque string.
+
+It has standard CRUD access on the `edge/v1/management/identities` endpoints for `POST`, `PUT`, `PATCH`, and `GET`.
+
+## Required TOTP (fka MFA) Enrollment
+
+With authentication policies, it is now possible to enforce MFA enrollment at authentication. Prior to this release,
+it was only possible to restrict access to service(s) via posture checks. The authentication policy value
+`secondary.requireTotp` being set to true will now force identities into a "partially authenticated" state unless
+TOTP MFA is completed.
+
+Due to this, it is now possible to enroll in TOTP MFA while "partially authenticated". It is not possible to manipulate
+an existing completed enrollment.
+
+## Circuit Inspection
+Here is an example of the kind of information you can get with the new circuit inspection factility
+
+```
+$ ziti fabric inspect .* circuit:GrtfcCjzD -j | jq
+{
+  "errors": null,
+  "success": true,
+  "values": [
+    {
+      "appId": "aKYdwbTf7l",
+      "name": "circuit:GrtfcCjzD",
+      "value": {
+        "Destinations": {
+          "1LKMInhzapHdurbaABaa50": {
+            "dest": "CX1kmb0fAl",
+            "id": "1LKMInhzapHdurbaABaa50",
+            "protocol": "tls",
+            "split": true,
+            "type": "link"
+          },
+          "wPBx": {
+            "addr": "wPBx",
+            "originator": "Initiator",
+            "recvBuffer": {
+              "lastSizeSent": 21,
+              "size": 0
+            },
+            "sendBuffer": {
+              "accumulator": 47,
+              "acquiredSafely": true,
+              "blockedByLocalWindow": false,
+              "blockedByRemoteWindow": false,
+              "closeWhenEmpty": false,
+              "closed": false,
+              "duplicateAcks": 0,
+              "linkRecvBufferSize": 23,
+              "linkSendBufferSize": 0,
+              "retransmits": 0,
+              "retxScale": 2,
+              "retxThreshold": 100,
+              "successfulAcks": 3,
+              "timeSinceLastRetx": "1m17.563s",
+              "windowsSize": 16384
+            },
+            "timeSinceLastLinkRx": "1m11.451s",
+            "type": "xgress"
+          }
+        },
+        "Forwards": {
+          "1LKMInhzapHdurbaABaa50": "wPBx",
+          "wPBx": "1LKMInhzapHdurbaABaa50"
+        }
+      }
+    },
+    {
+      "appId": "CX1kmb0fAl",
+      "name": "circuit:GrtfcCjzD",
+      "value": {
+        "Destinations": {
+          "1LKMInhzapHdurbaABaa50": {
+            "dest": "aKYdwbTf7l",
+            "id": "1LKMInhzapHdurbaABaa50",
+            "protocol": "tls",
+            "split": true,
+            "type": "link"
+          },
+          "MZ9x": {
+            "addr": "MZ9x",
+            "originator": "Terminator",
+            "recvBuffer": {
+              "lastSizeSent": 23,
+              "size": 0
+            },
+            "sendBuffer": {
+              "accumulator": 45,
+              "acquiredSafely": true,
+              "blockedByLocalWindow": false,
+              "blockedByRemoteWindow": false,
+              "closeWhenEmpty": false,
+              "closed": false,
+              "duplicateAcks": 0,
+              "linkRecvBufferSize": 21,
+              "linkSendBufferSize": 0,
+              "retransmits": 0,
+              "retxScale": 2,
+              "retxThreshold": 102,
+              "successfulAcks": 2,
+              "timeSinceLastRetx": "457983h26m1.336s",
+              "windowsSize": 16384
+            },
+            "timeSinceLastLinkRx": "1m16.555s",
+            "type": "xgress"
+          }
+        },
+        "Forwards": {
+          "1LKMInhzapHdurbaABaa50": "MZ9x",
+          "MZ9x": "1LKMInhzapHdurbaABaa50"
+        }
+      }
+    }
+  ]
+}
+```
+
 # Release 0.25.3
 
 * Enhancement: Add cost and precedence to host.v1 and host.v2 config types. This allows router-embedded tunnelers the ability to handle HA failover scenarios.
@@ -41,7 +409,7 @@ a single link between routers, unless you use the new link types feature.
     * Support for multiple link types
     * Existing link notifications
     * Link heartbeats/latency have changed
-    * Inspect and ps upport for links
+    * Inspect and ps support for links
     * Router version dissemination
     * Distributed control preparation
 * Enhancement: `ziti fabric list routers` now includes the link listener types and advertise addresses

go.mod

@@ -27,17 +27,22 @@ require (
 	github.com/fatih/color v1.13.0
 	github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa
 	github.com/go-acme/lego/v4 v4.2.0
-	github.com/go-openapi/runtime v0.23.2
+	github.com/go-openapi/runtime v0.23.3
 	github.com/go-openapi/strfmt v0.21.2
 	github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
 	github.com/golang/protobuf v1.5.2
 	github.com/google/go-cmp v0.5.7
 	github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d
+	github.com/jedib0t/go-pretty/v6 v6.2.4
 	github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19
-	github.com/michaelquigley/pfxlog v0.6.3
-	github.com/openziti/channel v0.18.17
-	github.com/openziti/foundation v0.17.12
-	github.com/openziti/sdk-golang v0.16.27
+	github.com/michaelquigley/pfxlog v0.6.9
+	github.com/openziti/channel v0.18.20
+	github.com/openziti/edge v0.21.169
+	github.com/openziti/fabric v0.17.88
+	github.com/openziti/foundation v0.17.22
+	github.com/openziti/sdk-golang v0.16.41
+	github.com/openziti/storage v0.1.2
+	github.com/openziti/transport v0.1.1
 	github.com/pborman/uuid v1.2.0
 	github.com/pkg/errors v0.9.1
 	github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0
@@ -68,7 +73,6 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
 	github.com/biogo/store v0.0.0-20200525035639-8c94ae1e7c9c // indirect
 	github.com/cenkalti/backoff/v4 v4.1.2 // indirect
-	github.com/cheekybits/genny v1.0.0 // indirect
 	github.com/coreos/go-iptables v0.6.0 // indirect
 	github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
@@ -92,7 +96,6 @@ require (
 	github.com/go-openapi/swag v0.21.1 // indirect
 	github.com/go-openapi/validate v0.21.0 // indirect
 	github.com/go-stack/stack v1.8.1 // indirect
-	github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
 	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
 	github.com/gomarkdown/markdown v0.0.0-20191123064959-2c17d62f5098 // indirect
 	github.com/google/uuid v1.3.0 // indirect
@@ -110,13 +113,10 @@ require (
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kr/pty v1.1.8 // indirect
 	github.com/kyokomi/emoji/v2 v2.2.8 // indirect
-	github.com/lucas-clemente/quic-go v0.23.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.0.3 // indirect
 	github.com/lucsky/cuid v1.2.1 // indirect
 	github.com/magiconair/properties v1.8.5 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/marten-seemann/qtls-go1-16 v0.1.4 // indirect
-	github.com/marten-seemann/qtls-go1-17 v0.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.12 // indirect
 	github.com/mattn/go-isatty v0.0.14 // indirect
 	github.com/mattn/go-runewidth v0.0.12 // indirect
@@ -129,15 +129,14 @@ require (
 	github.com/mitchellh/mapstructure v1.4.3 // indirect
 	github.com/natefinch/lumberjack v2.0.0+incompatible // indirect
 	github.com/netfoundry/secretstream v0.1.2 // indirect
-	github.com/nxadm/tail v1.4.8 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
-	github.com/onsi/ginkgo v1.16.4 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/openziti/dilithium v0.3.3 // indirect
 	github.com/orcaman/concurrent-map v0.0.0-20210106121528-16402b402231 // indirect
 	github.com/parallaxsecond/parsec-client-go v0.0.0-20220111122524-cb78842db373 // indirect
 	github.com/pelletier/go-toml v1.9.4 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/rivo/uniseg v0.2.0 // indirect
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e // indirect
 	github.com/speps/go-hashids v2.0.0+incompatible // indirect
 	github.com/spf13/afero v1.6.0 // indirect
@@ -154,26 +153,18 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.2 // indirect
 	go.mongodb.org/mongo-driver v1.8.3 // indirect
 	go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 // indirect
-	golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd // indirect
+	golang.org/x/crypto v0.0.0-20220331220935-ae2d96664a29 // indirect
 	golang.org/x/image v0.0.0-20191206065243-da761ea9ff43 // indirect
 	golang.org/x/mod v0.5.1 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/sys v0.0.0-20220315194320-039c03cc5b86 // indirect
+	golang.org/x/sys v0.0.0-20220330033206-e17cdc41300f // indirect
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
 	golang.org/x/text v0.3.7 // indirect
 	golang.org/x/tools v0.1.7 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
+	google.golang.org/protobuf v1.28.0 // indirect
 	gopkg.in/ini.v1 v1.66.2 // indirect
 	gopkg.in/square/go-jose.v2 v2.5.1 // indirect
-	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
 )
-
-require (
-	github.com/jedib0t/go-pretty/v6 v6.2.4
-	github.com/openziti/edge v0.21.139
-	github.com/openziti/fabric v0.17.68
-	github.com/rivo/uniseg v0.2.0 // indirect
-)

go.sum

@@ -162,7 +162,6 @@ github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cheekybits/genny v1.0.0 h1:uGGa4nei+j20rOSeDeP5Of12XVm7TGUd4dJA9RDitfE=
 github.com/cheekybits/genny v1.0.0/go.mod h1:+tQajlRqAUrPI7DOSpB0XAqZYtQakVtB7wXkRAgjxjQ=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
@@ -343,8 +342,8 @@ github.com/go-openapi/runtime v0.19.15/go.mod h1:dhGWCTKRXlAfGnQG0ONViOZpjfg0m2g
 github.com/go-openapi/runtime v0.19.16/go.mod h1:5P9104EJgYcizotuXhEuUrzVc+j1RiSjahULvYmlv98=
 github.com/go-openapi/runtime v0.19.24/go.mod h1:Lm9YGCeecBnUUkFTxPC4s1+lwrkJ0pthx8YvyjCfkgk=
 github.com/go-openapi/runtime v0.21.0/go.mod h1:aQg+kaIQEn+A2CRSY1TxbM8+sT9g2V3aLc1FbIAnbbs=
-github.com/go-openapi/runtime v0.23.2 h1:SLoYVM3ovq+lynpgrHQZ5WQcx+CBE0HHHCZU3c2jQoo=
-github.com/go-openapi/runtime v0.23.2/go.mod h1:AKurw9fNre+h3ELZfk6ILsfvPN+bvvlaU/M9q/r9hpk=
+github.com/go-openapi/runtime v0.23.3 h1:/dxjx4KCOQI5ImBMz036F6v/DzZ2NUjSRvbLJs1rgoE=
+github.com/go-openapi/runtime v0.23.3/go.mod h1:AKurw9fNre+h3ELZfk6ILsfvPN+bvvlaU/M9q/r9hpk=
 github.com/go-openapi/spec v0.17.0/go.mod h1:XkF/MOi14NmjsfZ8VtAKf8pIlbZzyoTvZsdfssdxcBI=
 github.com/go-openapi/spec v0.18.0/go.mod h1:XkF/MOi14NmjsfZ8VtAKf8pIlbZzyoTvZsdfssdxcBI=
 github.com/go-openapi/spec v0.19.2/go.mod h1:sCxk3jxKgioEJikev4fgkNmwS+3kuYdJtcsZsD5zxMY=
@@ -399,7 +398,6 @@ github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LB
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-stack/stack v1.8.1 h1:ntEHSVwIt7PNXNpgPmVfMrNhLtgjlmnZha2kOpuRiDw=
 github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4=
-github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/gobuffalo/attrs v0.0.0-20190224210810-a9411de4debd/go.mod h1:4duuawTqi2wkkpB4ePgWMaai6/Kc6WEz83bhFwpHzj0=
 github.com/gobuffalo/depgen v0.0.0-20190329151759-d478694a28d3/go.mod h1:3STtPUQYuzV0gBVOY3vy6CfMm/ljR4pABfrTeHNLHUY=
@@ -451,7 +449,6 @@ github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
 github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
-github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -602,7 +599,7 @@ github.com/iij/doapi v0.0.0-20190504054126-0bbf12d6d7df/go.mod h1:QMZY7/J/KSQEhK
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/influxdata/influxdb-client-go/v2 v2.2.2/go.mod h1:fa/d1lAdUHxuc1jedx30ZfNG573oQTQmUni3N6pcW+0=
-github.com/influxdata/influxdb-client-go/v2 v2.8.0/go.mod h1:x7Jo5UHHl+w8wu8UnGiNobDDHygojXwJX4mx7rXGKMk=
+github.com/influxdata/influxdb-client-go/v2 v2.8.1/go.mod h1:x7Jo5UHHl+w8wu8UnGiNobDDHygojXwJX4mx7rXGKMk=
 github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d h1:/WZQPMZNsjZ7IlCpsLGdQBINg5bxKQ1K1sh6awxLtkA=
 github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo=
 github.com/influxdata/line-protocol v0.0.0-20200327222509-2487e7298839/go.mod h1:xaLFMmpvUxqXtVkUJfg9QmT88cDaCJ3ZKgdZ78oO8Qo=
@@ -677,8 +674,6 @@ github.com/labstack/gommon v0.3.0/go.mod h1:MULnywXg0yavhxWKc+lOruYdAhDwPK9wf0OL
 github.com/linode/linodego v0.21.0/go.mod h1:UTpq1JUZD0CZsJ8rt+0CRkqbzrp1MbGakVPt2DXY5Mk=
 github.com/liquidweb/liquidweb-go v1.6.1/go.mod h1:UDcVnAMDkZxpw4Y7NOHkqoeiGacVLEIG/i5J9cyixzQ=
 github.com/lucas-clemente/quic-go v0.18.0/go.mod h1:yXttHsSNxQi8AWijC/vLP+OJczXqzHSOcJrM5ITUlCg=
-github.com/lucas-clemente/quic-go v0.23.0 h1:5vFnKtZ6nHDFsc/F3uuiF4T3y/AXaQdxjUqiVw26GZE=
-github.com/lucas-clemente/quic-go v0.23.0/go.mod h1:paZuzjXCE5mj6sikVLMvqXk8lJV2AsqtJ6bDhjEfxx0=
 github.com/lucasb-eyer/go-colorful v1.0.3 h1:QIbQXiugsb+q10B+MI+7DI1oQLdmnep86tWFlaaUAac=
 github.com/lucasb-eyer/go-colorful v1.0.3/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lucsky/cuid v1.2.1 h1:MtJrL2OFhvYufUIn48d35QGXyeTC8tn0upumW9WwTHg=
@@ -700,14 +695,8 @@ github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJ
 github.com/markbates/oncer v0.0.0-20181203154359-bf2de49a0be2/go.mod h1:Ld9puTsIW75CHf65OeIOkyKbteujpZVXDpWK6YGZbxE=
 github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0=
 github.com/marten-seemann/qpack v0.2.0/go.mod h1:F7Gl5L1jIgN1D11ucXefiuJS9UMVP2opoCp2jDKb7wc=
-github.com/marten-seemann/qpack v0.2.1/go.mod h1:F7Gl5L1jIgN1D11ucXefiuJS9UMVP2opoCp2jDKb7wc=
 github.com/marten-seemann/qtls v0.10.0/go.mod h1:UvMd1oaYDACI99/oZUYLzMCkBXQVT0aGm99sJhbT8hs=
 github.com/marten-seemann/qtls-go1-15 v0.1.0/go.mod h1:GyFwywLKkRt+6mfU99csTEY1joMZz5vmB1WNZH3P81I=
-github.com/marten-seemann/qtls-go1-15 v0.1.4/go.mod h1:GyFwywLKkRt+6mfU99csTEY1joMZz5vmB1WNZH3P81I=
-github.com/marten-seemann/qtls-go1-16 v0.1.4 h1:xbHbOGGhrenVtII6Co8akhLEdrawwB2iHl5yhJRpnco=
-github.com/marten-seemann/qtls-go1-16 v0.1.4/go.mod h1:gNpI2Ol+lRS3WwSOtIUUtRwZEQMXjYK+dQSBFbethAk=
-github.com/marten-seemann/qtls-go1-17 v0.1.0 h1:P9ggrs5xtwiqXv/FHNwntmuLMNq3KaSIG93AtAZ48xk=
-github.com/marten-seemann/qtls-go1-17 v0.1.0/go.mod h1:fz4HIxByo+LlWcreM4CZOYNuz3taBQ8rN2X6FqvaWo8=
 github.com/matryer/moq v0.0.0-20190312154309-6cfb0558e1bd/go.mod h1:9ELz6aaclSIGnZBoaSLZ3NAl1VTufbOrXBPvtcy6WiQ=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
@@ -745,8 +734,8 @@ github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyex
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/michaelquigley/pfxlog v0.3.1/go.mod h1:pwJmJ9nN787xk9U+0z8/5nP2GMhU6GGCTfgBWGpiXaQ=
-github.com/michaelquigley/pfxlog v0.6.3 h1:/od363CtyX4z03vhzyJnfzOevXEYihGHVnLVI64a/e0=
-github.com/michaelquigley/pfxlog v0.6.3/go.mod h1:D2vg1tPyPdSXWWkSnGk6Fomwh5b3clwVJDUh71tq8Sk=
+github.com/michaelquigley/pfxlog v0.6.9 h1:K/weH6ARu58aEDQi0ccinItvV958CeO6Ri4jqeFwd/w=
+github.com/michaelquigley/pfxlog v0.6.9/go.mod h1:D2vg1tPyPdSXWWkSnGk6Fomwh5b3clwVJDUh71tq8Sk=
 github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4=
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
@@ -820,22 +809,27 @@ github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
 github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
-github.com/openziti/channel v0.18.17 h1:0nZz9WMmxGnySE5yg8IeBY20yjO/YPFurP1qNt2wryE=
-github.com/openziti/channel v0.18.17/go.mod h1:seDAqUKIl6J5vmHWlk042WkAzyY9qaPKr2DJc2DMpHE=
+github.com/openziti/channel v0.18.20 h1:tQC0VbJm54tp2E4+Grt7jjaomR9nK7egMi6AmfBp2oo=
+github.com/openziti/channel v0.18.20/go.mod h1:P6hCAQuuhTA5UGCZZWK/tro4L8WN5exPocC7gyc+7Ms=
 github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k=
 github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo=
-github.com/openziti/edge v0.21.139 h1:ilQIWWfej9f6AMnNcRpsjn99PV2eAGBWetMRbTCJ9V0=
-github.com/openziti/edge v0.21.139/go.mod h1:iQ3vlNek4vqsekcmE1i8qcGi90r/myYdoUsQzkZrZ64=
-github.com/openziti/fabric v0.17.67/go.mod h1:NpU40k5h8KoWMwBRT6w1t/pzl8J4f9fc1bMdG6ZQevQ=
-github.com/openziti/fabric v0.17.68 h1:2aC6b7krnkqaLxOF5mzr8CZ8wV202subup4espv9WeY=
-github.com/openziti/fabric v0.17.68/go.mod h1:3coRsWdb4jkFSYtMZh5NlTlgBw7y5oL3D8lky5eGmEQ=
-github.com/openziti/foundation v0.17.8/go.mod h1:dTaJgdO5OqnKpV+0OPHpnTnqfPpqNGbhJv8O6pMot6o=
-github.com/openziti/foundation v0.17.11/go.mod h1:2wUj+Kcvi8RsgP2wvPtmMLmk0OtIKD+3IVQj2pGZCrs=
-github.com/openziti/foundation v0.17.12 h1:buMTGTgrBlkr7Yv0pqTEJGvyZVg0Tp9gC02cqu3jhSI=
-github.com/openziti/foundation v0.17.12/go.mod h1:YT8EFUtJMS4qBN2j0KnVyKR0gUmGy4i8tLCETC3pM5A=
-github.com/openziti/sdk-golang v0.16.26/go.mod h1:Ay1QKaARofijMSjkkPzlu6jIadmWmc+w5ZGQgvIM7cQ=
-github.com/openziti/sdk-golang v0.16.27 h1:1ZdK5jmmqVWDjW8UzEDwIVA9mbbU3YP4iam+7xU9ZYI=
-github.com/openziti/sdk-golang v0.16.27/go.mod h1:bAjupBbh1GKyuNvJaWcn/8RLKIN/0WCNpRIfx9FMzn0=
+github.com/openziti/edge v0.21.169 h1:gCkgut6ntn10WYKAfybLbiLiKDDhH/SiTXrIITNif5o=
+github.com/openziti/edge v0.21.169/go.mod h1:5iymsfUc7vMuBih80e2GDfy3sUMUM0oojJKHDzGMVmM=
+github.com/openziti/fabric v0.17.88 h1:8cA0McXNgi4P7MN31TbwNUEC45DuQtII+VRe+ylGQyM=
+github.com/openziti/fabric v0.17.88/go.mod h1:+5lGx6Pv9XeBa2AxT3s3skjbbL6gwvbbTuQAqOCnOAY=
+github.com/openziti/foundation v0.17.20/go.mod h1:Nnr0vsqovHJimkdBHf2s4ZJAgvNhg6UdVqP+s0nY3P4=
+github.com/openziti/foundation v0.17.21/go.mod h1:Nnr0vsqovHJimkdBHf2s4ZJAgvNhg6UdVqP+s0nY3P4=
+github.com/openziti/foundation v0.17.22 h1:zFfgNHdLocEcoBqtognpJnYsVQaTm28EwqMNjBw8avk=
+github.com/openziti/foundation v0.17.22/go.mod h1:Nnr0vsqovHJimkdBHf2s4ZJAgvNhg6UdVqP+s0nY3P4=
+github.com/openziti/sdk-golang v0.16.40/go.mod h1:Xfz92DahfoAhfsx1FsAA0YnzwG/YHZaPaJTmZqWz8pk=
+github.com/openziti/sdk-golang v0.16.41 h1:ZFFiTaxflJW3BsOpPfb404dzLgQFZD7tMhdTodMH+1I=
+github.com/openziti/sdk-golang v0.16.41/go.mod h1:4M9NX/mUtRgfJoMTerdmZkVJvbAAEc4I/yN8Bf2ugYw=
+github.com/openziti/storage v0.1.1/go.mod h1:UIQP0wcEx/sryPILk4Z1/71NbfJft3Gk8PkEAvar858=
+github.com/openziti/storage v0.1.2 h1:CerlyWnfiZPrb8CVp4qOv4guQv+RVM78qFDKPVtEAL4=
+github.com/openziti/storage v0.1.2/go.mod h1:UIQP0wcEx/sryPILk4Z1/71NbfJft3Gk8PkEAvar858=
+github.com/openziti/transport v0.1.0/go.mod h1:2n6p2AZu3H9NzbJbQ7vOGFwtZKpvy8tIp+x+J7G5Sw0=
+github.com/openziti/transport v0.1.1 h1:HaSr8H+1edEpQ60WN05+KBfSlq8B7U1G1tUxDuezMTw=
+github.com/openziti/transport v0.1.1/go.mod h1:2n6p2AZu3H9NzbJbQ7vOGFwtZKpvy8tIp+x+J7G5Sw0=
 github.com/oracle/oci-go-sdk v24.2.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888=
 github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI=
 github.com/orcaman/concurrent-map v0.0.0-20210106121528-16402b402231 h1:fa50YL1pzKW+1SsBnJDOHppJN9stOEwS+CRWyUtyYGU=
@@ -980,7 +974,6 @@ github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
 github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo=
 github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk=
-github.com/spf13/cobra v1.3.0/go.mod h1:BrRVncBjOJa/eUcVVm9CE+oC6as8k+VYr4NY7WCi9V4=
 github.com/spf13/cobra v1.4.0 h1:y+wJpx64xcgO1V+RcnwW0LEHxTKRi2ZDPSBjWnrg88Q=
 github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
@@ -1137,10 +1130,9 @@ golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220307211146-efcb8507fb70/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd h1:XcWmESyNjXJMLahc3mqVQJcgSTDxFxhETVlfk9uGc38=
-golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220321153916-2c7772ba3064/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.0.0-20220331220935-ae2d96664a29 h1:tkVvjkPTB7pnW3jnid7kNyAMPVWllTNOf/qKDze4p9o=
+golang.org/x/crypto v0.0.0-20220331220935-ae2d96664a29/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1388,10 +1380,8 @@ golang.org/x/sys v0.0.0-20211205182925-97ca703d548d/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220315194320-039c03cc5b86 h1:A9i04dxx7Cribqbs8jf3FQLogkL/CV2YN7hj9KWJCkc=
-golang.org/x/sys v0.0.0-20220315194320-039c03cc5b86/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220330033206-e17cdc41300f h1:rlezHXNlxYWvBCzNses9Dlc7nGFaNMJeqLolcmQSSZY=
+golang.org/x/sys v0.0.0-20220330033206-e17cdc41300f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
@@ -1652,8 +1642,9 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
+google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/AlecAivazis/survey.v1 v1.8.7 h1:oBJqtgsyBLg9K5FK9twNUbcPnbCPoh+R9a+7nag3qJM=
 gopkg.in/AlecAivazis/survey.v1 v1.8.7/go.mod h1:iBNOmqKz/NUbZx3bA+4hAGLRC7fSK7tgtVDT4tB22XA=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=

quickstart/docker/image/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:latest
+FROM ubuntu:rolling
 
 RUN apt update && \
     apt install jq curl netcat-openbsd vim inetutils-ping net-tools -y

quickstart/docker/image/run-router.sh

@@ -10,6 +10,7 @@ if [[ "${ZITI_EDGE_CONTROLLER_RAWNAME-}" == "" ]]; then export export ZITI_EDGE_
 if [[ "${ZITI_EDGE_ROUTER_RAWNAME-}" == "" ]]; then export export ZITI_EDGE_ROUTER_RAWNAME="${ZITI_NETWORK-}-edge-router"; fi
 if [[ "${ZITI_EDGE_ROUTER_PORT-}" == "" ]]; then export ZITI_EDGE_ROUTER_PORT="3022"; fi
 if [[ "${ZITI_EDGE_ROUTER_HOSTNAME}" == "" ]]; then export ZITI_EDGE_ROUTER_HOSTNAME="${ZITI_EDGE_ROUTER_RAWNAME}${ZITI_DOMAIN_SUFFIX}"; fi
+if [[ "${ZITI_EDGE_ROUTER_ROLES}" == "" ]]; then export ZITI_EDGE_ROUTER_ROLES="${ZITI_EDGE_ROUTER_RAWNAME}"; fi
 
 . ${ZITI_HOME}/ziti.env
 
@@ -42,7 +43,7 @@ fi
 
 echo "----------  Creating edge-router ${ZITI_EDGE_ROUTER_HOSTNAME}...."
 "${ZITI_BIN_DIR}/ziti" edge delete edge-router "${ZITI_EDGE_ROUTER_HOSTNAME}"
-"${ZITI_BIN_DIR}/ziti" edge create edge-router "${ZITI_EDGE_ROUTER_HOSTNAME}" -o "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.jwt" -t
+"${ZITI_BIN_DIR}/ziti" edge create edge-router "${ZITI_EDGE_ROUTER_HOSTNAME}" -o "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.jwt" -t -a "${ZITI_EDGE_ROUTER_ROLES}"
 sleep 1
 echo "---------- Enrolling edge-router ${ZITI_EDGE_ROUTER_HOSTNAME}...."
 "${ZITI_BIN_DIR}/ziti-router" enroll "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.yaml" --jwt "${ZITI_HOME}/${ZITI_EDGE_ROUTER_HOSTNAME}.jwt"

ziti-controller/main.go

@@ -19,13 +19,12 @@ package main
 import (
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/fabric/build"
-	"github.com/openziti/foundation/transport"
-	"github.com/openziti/foundation/transport/quic"
-	"github.com/openziti/foundation/transport/tcp"
-	"github.com/openziti/foundation/transport/tls"
-	"github.com/openziti/foundation/transport/transwarp"
-	"github.com/openziti/foundation/transport/transwarptls"
-	"github.com/openziti/foundation/transport/wss"
+	"github.com/openziti/transport"
+	"github.com/openziti/transport/tcp"
+	"github.com/openziti/transport/tls"
+	"github.com/openziti/transport/transwarp"
+	"github.com/openziti/transport/transwarptls"
+	"github.com/openziti/transport/wss"
 	"github.com/openziti/ziti/common/version"
 	"github.com/openziti/ziti/ziti-controller/subcmd"
 	"github.com/sirupsen/logrus"
@@ -35,7 +34,6 @@ func init() {
 	options := pfxlog.DefaultOptions().SetTrimPrefix("github.com/openziti/").NoColor()
 	pfxlog.GlobalInit(logrus.InfoLevel, options)
 
-	transport.AddAddressParser(quic.AddressParser{})
 	transport.AddAddressParser(tls.AddressParser{})
 	transport.AddAddressParser(tcp.AddressParser{})
 	transport.AddAddressParser(transwarp.AddressParser{})

ziti-controller/subcmd/run.go

@@ -18,6 +18,11 @@ package subcmd
 
 import (
 	"fmt"
+	"net"
+	"os"
+	"os/signal"
+	"syscall"
+
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge/controller/server"
 	"github.com/openziti/fabric/controller"
@@ -25,10 +30,6 @@ import (
 	"github.com/openziti/ziti/common/version"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
-	"io"
-	"os"
-	"os/signal"
-	"syscall"
 )
 
 func init() {
@@ -77,8 +78,10 @@ func run(cmd *cobra.Command, args []string) {
 	if cliAgentEnabled {
 		options := agent.Options{Addr: cliAgentAddr}
 		fabricController.RegisterDefaultAgentOps()
-		options.CustomOps = map[byte]func(conn io.ReadWriter) error{
-			agent.CustomOp: fabricController.HandleCustomAgentOp,
+		options.CustomOps = map[byte]func(conn net.Conn) error{
+			agent.CustomOp: func(conn net.Conn) error {
+				return fabricController.HandleCustomAgentOp(conn)
+			},
 		}
 		if err := agent.Listen(options); err != nil {
 			pfxlog.Logger().WithError(err).Error("unable to start CLI agent")

ziti-fabric-test/main.go

@@ -22,13 +22,12 @@ import (
 	"math/rand"
 
 	"github.com/michaelquigley/pfxlog"
-	"github.com/openziti/foundation/transport"
-	"github.com/openziti/foundation/transport/quic"
-	"github.com/openziti/foundation/transport/tcp"
-	"github.com/openziti/foundation/transport/tls"
-	"github.com/openziti/foundation/transport/transwarp"
-	"github.com/openziti/foundation/transport/transwarptls"
-	"github.com/openziti/foundation/transport/wss"
+	"github.com/openziti/transport"
+	"github.com/openziti/transport/tcp"
+	"github.com/openziti/transport/tls"
+	"github.com/openziti/transport/transwarp"
+	"github.com/openziti/transport/transwarptls"
+	"github.com/openziti/transport/wss"
 	"github.com/openziti/foundation/util/info"
 	"github.com/openziti/ziti/ziti-fabric-test/subcmd"
 	_ "github.com/openziti/ziti/ziti-fabric-test/subcmd/client"
@@ -39,7 +38,6 @@ import (
 
 func init() {
 	pfxlog.GlobalInit(logrus.InfoLevel, pfxlog.DefaultOptions().SetTrimPrefix("github.com/openziti/").NoColor())
-	transport.AddAddressParser(quic.AddressParser{})
 	transport.AddAddressParser(tls.AddressParser{})
 	transport.AddAddressParser(tcp.AddressParser{})
 	transport.AddAddressParser(transwarp.AddressParser{})

ziti-fabric-test/subcmd/client/http.go

@@ -25,7 +25,7 @@ import (
 	"github.com/openziti/fabric/router/xgress_transport"
 	"github.com/openziti/foundation/identity/dotziti"
 	"github.com/openziti/foundation/identity/identity"
-	"github.com/openziti/foundation/transport"
+	"github.com/openziti/transport"
 	"github.com/spf13/cobra"
 	"io/ioutil"
 	"net"

ziti-fabric-test/subcmd/client/nc.go

@@ -22,7 +22,7 @@ import (
 	"github.com/openziti/fabric/router/xgress_transport"
 	"github.com/openziti/foundation/identity/dotziti"
 	"github.com/openziti/foundation/identity/identity"
-	"github.com/openziti/foundation/transport"
+	"github.com/openziti/transport"
 	"github.com/openziti/foundation/util/info"
 	"github.com/openziti/ziti/ziti-fabric-test/subcmd"
 	"github.com/spf13/cobra"

ziti-fabric-test/subcmd/loop2/dialer.go

@@ -22,7 +22,7 @@ import (
 	"github.com/openziti/fabric/router/xgress_transport"
 	"github.com/openziti/foundation/identity/dotziti"
 	"github.com/openziti/foundation/identity/identity"
-	"github.com/openziti/foundation/transport"
+	"github.com/openziti/transport"
 	"github.com/openziti/sdk-golang/ziti"
 	"github.com/openziti/sdk-golang/ziti/config"
 	"github.com/openziti/ziti/ziti-fabric-test/subcmd/loop2/pb"

ziti-fabric-test/subcmd/loop2/listener.go

@@ -20,7 +20,7 @@ import (
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/foundation/identity/dotziti"
 	"github.com/openziti/foundation/identity/identity"
-	"github.com/openziti/foundation/transport"
+	"github.com/openziti/transport"
 	"github.com/openziti/sdk-golang/ziti"
 	"github.com/openziti/sdk-golang/ziti/config"
 	"github.com/openziti/ziti/ziti-fabric-test/subcmd/loop2/pb"

ziti-fabric-test/subcmd/loop3/dialer.go

@@ -23,7 +23,7 @@ import (
 	"github.com/openziti/foundation/agent"
 	"github.com/openziti/foundation/identity/dotziti"
 	"github.com/openziti/foundation/identity/identity"
-	"github.com/openziti/foundation/transport"
+	"github.com/openziti/transport"
 	"github.com/openziti/sdk-golang/ziti"
 	"github.com/openziti/sdk-golang/ziti/config"
 	"github.com/spf13/cobra"

ziti-fabric-test/subcmd/loop3/listener.go

@@ -22,7 +22,7 @@ import (
 	"github.com/openziti/foundation/agent"
 	"github.com/openziti/foundation/identity/dotziti"
 	"github.com/openziti/foundation/identity/identity"
-	"github.com/openziti/foundation/transport"
+	"github.com/openziti/transport"
 	"github.com/openziti/sdk-golang/ziti"
 	"github.com/openziti/sdk-golang/ziti/config"
 	loop3_pb "github.com/openziti/ziti/ziti-fabric-test/subcmd/loop3/pb"

ziti-fabric/main.go

@@ -20,13 +20,12 @@ import (
 	"fmt"
 
 	"github.com/michaelquigley/pfxlog"
-	"github.com/openziti/foundation/transport"
-	"github.com/openziti/foundation/transport/quic"
-	"github.com/openziti/foundation/transport/tcp"
-	"github.com/openziti/foundation/transport/tls"
-	"github.com/openziti/foundation/transport/transwarp"
-	"github.com/openziti/foundation/transport/transwarptls"
-	"github.com/openziti/foundation/transport/wss"
+	"github.com/openziti/transport"
+	"github.com/openziti/transport/tcp"
+	"github.com/openziti/transport/tls"
+	"github.com/openziti/transport/transwarp"
+	"github.com/openziti/transport/transwarptls"
+	"github.com/openziti/transport/wss"
 	"github.com/openziti/ziti/ziti-fabric/subcmd"
 	_ "github.com/openziti/ziti/ziti-fabric/subcmd/trace"
 	"github.com/sirupsen/logrus"
@@ -34,7 +33,6 @@ import (
 
 func init() {
 	pfxlog.GlobalInit(logrus.InfoLevel, pfxlog.DefaultOptions().SetTrimPrefix("github.com/openziti/").NoColor())
-	transport.AddAddressParser(quic.AddressParser{})
 	transport.AddAddressParser(tls.AddressParser{})
 	transport.AddAddressParser(tcp.AddressParser{})
 	transport.AddAddressParser(transwarp.AddressParser{})

ziti-fabric/subcmd/client.go

@@ -20,7 +20,7 @@ import (
 	"github.com/openziti/channel"
 	"github.com/openziti/foundation/identity/dotziti"
 	"github.com/openziti/foundation/identity/identity"
-	"github.com/openziti/foundation/transport"
+	"github.com/openziti/transport"
 	"github.com/spf13/cobra"
 )
 

ziti-router/main.go

@@ -19,15 +19,14 @@ package main
 import (
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/fabric/build"
-	"github.com/openziti/foundation/transport"
-	"github.com/openziti/foundation/transport/quic"
-	"github.com/openziti/foundation/transport/tcp"
-	"github.com/openziti/foundation/transport/tls"
-	"github.com/openziti/foundation/transport/transwarp"
-	"github.com/openziti/foundation/transport/transwarptls"
-	"github.com/openziti/foundation/transport/udp"
-	"github.com/openziti/foundation/transport/ws"
-	"github.com/openziti/foundation/transport/wss"
+	"github.com/openziti/transport"
+	"github.com/openziti/transport/tcp"
+	"github.com/openziti/transport/tls"
+	"github.com/openziti/transport/transwarp"
+	"github.com/openziti/transport/transwarptls"
+	"github.com/openziti/transport/udp"
+	"github.com/openziti/transport/ws"
+	"github.com/openziti/transport/wss"
 	"github.com/openziti/ziti/common/version"
 	"github.com/openziti/ziti/ziti-router/subcmd"
 	"github.com/sirupsen/logrus"
@@ -37,7 +36,6 @@ func init() {
 	options := pfxlog.DefaultOptions().SetTrimPrefix("github.com/openziti/").NoColor()
 	pfxlog.GlobalInit(logrus.InfoLevel, options)
 
-	transport.AddAddressParser(quic.AddressParser{})
 	transport.AddAddressParser(tls.AddressParser{})
 	transport.AddAddressParser(tcp.AddressParser{})
 	transport.AddAddressParser(transwarp.AddressParser{})

ziti-router/subcmd/run.go

@@ -18,6 +18,11 @@ package subcmd
 
 import (
 	"fmt"
+	"net"
+	"os"
+	"os/signal"
+	"syscall"
+
 	"github.com/michaelquigley/pfxlog"
 	"github.com/openziti/edge/edge_common"
 	"github.com/openziti/edge/router/debugops"
@@ -33,10 +38,6 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
-	"io"
-	"os"
-	"os/signal"
-	"syscall"
 )
 
 var forceEnrollmentExtension *bool
@@ -99,8 +100,10 @@ func run(cmd *cobra.Command, args []string) {
 		if debugOpsEnabled {
 			r.RegisterDefaultDebugOps()
 			debugops.RegisterEdgeRouterDebugOps(r, stateManager)
-			options.CustomOps = map[byte]func(conn io.ReadWriter) error{
-				agent.CustomOp: r.HandleDebug,
+			options.CustomOps = map[byte]func(conn net.Conn) error{
+				agent.CustomOp: func(conn net.Conn) error {
+					return r.HandleDebug(conn)
+				},
 			}
 		}
 		if err := agent.Listen(options); err != nil {

ziti/cmd/ziti/cmd/api/delete.go

@@ -2,7 +2,7 @@ package api
 
 import (
 	"github.com/fatih/color"
-	"github.com/openziti/foundation/storage/boltz"
+	"github.com/openziti/storage/boltz"
 	"github.com/openziti/ziti/ziti/cmd/ziti/util"
 	"net/url"
 	"strings"

ziti/cmd/ziti/cmd/create_config.go

@@ -22,7 +22,7 @@ import (
 	fabCtrl "github.com/openziti/fabric/controller"
 	fabForwarder "github.com/openziti/fabric/router/forwarder"
 	fabXweb "github.com/openziti/fabric/xweb"
-	foundation "github.com/openziti/foundation/transport"
+	foundation "github.com/openziti/transport"
 	"github.com/openziti/ziti/ziti/cmd/ziti/cmd/common"
 	cmdhelper "github.com/openziti/ziti/ziti/cmd/ziti/cmd/helpers"
 	"github.com/openziti/ziti/ziti/cmd/ziti/constants"

ziti/cmd/ziti/cmd/edge/delete.go

@@ -18,7 +18,7 @@ package edge
 
 import (
 	"github.com/fatih/color"
-	"github.com/openziti/foundation/storage/boltz"
+	"github.com/openziti/storage/boltz"
 	"github.com/openziti/ziti/ziti/cmd/ziti/cmd/api"
 	"io"
 	"net/url"

ziti/cmd/ziti/cmd/edge/policy_advisor.go

@@ -208,13 +208,13 @@ func runPolicyAdvisorForIdentities(o *policyAdvisorOptions) error {
 		filter := fmt.Sprintf(`true skip %v limit 2`, skip)
 		children, _, err := filterEntitiesOfType("identities", filter, false, o.Out, o.Options.Timeout, o.Options.Verbose)
 		if err != nil {
-			panic(err)
+			return err
 		}
 
 		for _, child := range children {
 			identityId, _ := child.S("id").Data().(string)
 			if err := runPolicyAdvisorForIdentity(identityId, o); err != nil {
-				panic(err)
+				return err
 			}
 		}
 		skip += len(children)
@@ -238,13 +238,13 @@ func runPolicyAdvisorForServices(o *policyAdvisorOptions) error {
 		filter := fmt.Sprintf(`true skip %v limit 2`, skip)
 		children, _, err := filterEntitiesOfType("services", filter, false, o.Out, o.Options.Timeout, o.Options.Verbose)
 		if err != nil {
-			panic(err)
+			return err
 		}
 
 		for _, child := range children {
 			serviceId, _ := child.S("id").Data().(string)
 			if err := runPolicyAdvisorForService(serviceId, o); err != nil {
-				panic(err)
+				return err
 			}
 		}
 		skip += len(children)
@@ -269,13 +269,13 @@ func runPolicyAdvisorForIdentity(identityId string, o *policyAdvisorOptions) err
 		filter = fmt.Sprintf(`true skip %v limit 2`, skip)
 		children, _, err := filterSubEntitiesOfType("identities", "services", identityId, filter, &o.Options)
 		if err != nil {
-			panic(err)
+			return err
 		}
 
 		for _, child := range children {
 			serviceId, _ := child.S("id").Data().(string)
 			if err := runPolicyAdvisorForIdentityAndService(identityId, serviceId, o); err != nil {
-				panic(err)
+				return err
 			}
 		}
 		skip += len(children)

ziti/cmd/ziti/util/rest.go

@@ -555,7 +555,7 @@ func EdgeControllerLogin(url string, cert string, authentication string, out io.
 		Post(url + "/authenticate")
 
 	if err != nil {
-		return nil, fmt.Errorf("unable to authentiate to %v. Error: %v", url, err)
+		return nil, fmt.Errorf("unable to authenticate to %v. Error: %v", url, err)
 	}
 
 	if resp.StatusCode() != http.StatusOK {