From c7af8f168f431b73599676a95b134074f26dd152 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Thu, 18 Mar 2021 10:21:32 -0400 Subject: [PATCH 1/8] start using ziti-tunnel:latest --- ziti-tunnel/docker/BUILD.md | 3 +-- ziti-tunnel/docker/Dockerfile | 2 +- ziti-tunnel/docker/docker-compose.yml | 12 ++++++------ 3 files changed, 8 insertions(+), 9 deletions(-) diff --git a/ziti-tunnel/docker/BUILD.md b/ziti-tunnel/docker/BUILD.md index 61be95ce5..2e4ff82fd 100644 --- a/ziti-tunnel/docker/BUILD.md +++ b/ziti-tunnel/docker/BUILD.md @@ -81,7 +81,6 @@ Notes: - - - # Building for Development This build method produces an image for the CPU that is running the build host @@ -91,4 +90,4 @@ cache. $ ziti_version="0.15.3" \ $ docker build \ --build-arg ZITI_VERSION="${ziti_version}" \ - -t "netfoundry/ziti-tunnel:${ziti_version}" . \ No newline at end of file + -t "netfoundry/ziti-tunnel:${ziti_version}" . diff --git a/ziti-tunnel/docker/Dockerfile b/ziti-tunnel/docker/Dockerfile index 9249b15ef..bb44f925c 100644 --- a/ziti-tunnel/docker/Dockerfile +++ b/ziti-tunnel/docker/Dockerfile @@ -2,7 +2,7 @@ FROM debian:stable-slim as fetch-ziti-artifacts # This build stage grabs artifacts that are copied into the final image. # It uses the same base as the final image to maximize docker cache hits. -ARG ZITI_VERSION="0.18.2" +ARG ZITI_VERSION ARG ARTIFACTORY_TOKEN ARG ARTIFACTORY_BASE_URL="https://netfoundry.jfrog.io/netfoundry" diff --git a/ziti-tunnel/docker/docker-compose.yml b/ziti-tunnel/docker/docker-compose.yml index 396f012fc..333918b4b 100644 --- a/ziti-tunnel/docker/docker-compose.yml +++ b/ziti-tunnel/docker/docker-compose.yml @@ -1,13 +1,13 @@ version: "3.3" services: ziti-test: - image: netfoundry/ziti-tunnel:0.18.2 + image: netfoundry/ziti-tunnel:latest network_mode: host cap_add: - NET_ADMIN entrypoint: ["sh", "-c", "while true; do sleep 11; done"] ziti-tproxy: - image: netfoundry/ziti-tunnel:0.18.2 + image: netfoundry/ziti-tunnel:latest network_mode: host cap_add: - NET_ADMIN @@ -18,7 +18,7 @@ services: command: tproxy # command: tproxy --resolver udp://127.0.0.123:53 ziti-iproxy: - image: netfoundry/ziti-tunnel:0.18.2 + image: netfoundry/ziti-tunnel:latest volumes: - .:/netfoundry network_mode: host @@ -28,7 +28,7 @@ services: - NF_REG_NAME command: tproxy --resolver none ziti-tun: - image: netfoundry/ziti-tunnel:0.18.2 + image: netfoundry/ziti-tunnel:latest volumes: - .:/netfoundry network_mode: host @@ -40,7 +40,7 @@ services: devices: - "/dev/net/tun:/dev/net/tun" ziti-proxy: - image: netfoundry/ziti-tunnel:0.18.2 + image: netfoundry/ziti-tunnel:latest volumes: - .:/netfoundry environment: @@ -50,7 +50,7 @@ services: - "9999:9999" command: proxy "my example service":8888 "my other example service":9999 ziti-host: - image: netfoundry/ziti-tunnel:0.18.2 + image: netfoundry/ziti-tunnel:latest volumes: - .:/netfoundry environment: From bbbf24fd1c930b90963e837b07f12cd08459954d Mon Sep 17 00:00:00 2001 From: Shawn Carey Date: Tue, 13 Apr 2021 08:25:44 -0400 Subject: [PATCH 2/8] start release 0.19.11 with host.v1 config type updates --- CHANGELOG.md | 13 +++++++++++++ go.mod | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7b5475752..fe72807d1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,16 @@ +# Release 0.19.11 + +## What's New + +* The host.v1 service configuration type has been changed as follows: + * Rename `dialIntercepted*` properties to `forwardProtocol`, `forwardAddress`, `forwardPort` for better consistency with non-tunneler client applications. + * Add `allowedProtocols`, `allowedAddresses`, and `allowedPortRanges` properties to whitelist destinations that are dialed via `forward*`. The `allowed*` properties are required for any corresponding `forward*` property that is `true`. + * Add `allowedSourceAddresses`, which serves as a whitelist for source IPs/CIDRs and informs the hosting tunneler of the local routes to establish when hosting a service. + + Caveats: + * Any existing host.v1 configurations that use will become invalid. + * ziti-tunnel and the converged router/tunneler creates local routes that are establised for `allowedSourceAddresses`, but the routes are not consistently cleaned up when `ziti-tunnel` exits. This issue will be addressed in a future release. + # Release 0.19.10 ## What's New diff --git a/go.mod b/go.mod index 2cb97355b..f4b24365f 100644 --- a/go.mod +++ b/go.mod @@ -27,7 +27,7 @@ require ( github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19 github.com/michaelquigley/pfxlog v0.3.7 - github.com/openziti/edge v0.19.74 + github.com/openziti/edge v0.19.78 github.com/openziti/fabric v0.16.51 github.com/openziti/foundation v0.15.46 github.com/openziti/sdk-golang v0.15.38 From 8b52e448fd314a0d7427030ec5aabc408958a256 Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Tue, 13 Apr 2021 17:04:13 -0400 Subject: [PATCH 3/8] fixes ziti updb password prompt - actually send prompt value - require confirmation --- common/enrollment/enroll.go | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/common/enrollment/enroll.go b/common/enrollment/enroll.go index 53fe1a17c..b1abef3a7 100644 --- a/common/enrollment/enroll.go +++ b/common/enrollment/enroll.go @@ -148,10 +148,26 @@ func processEnrollment() error { if tkn.EnrollmentMethod == "updb" { if password == "" { - password, err = term.PromptPassword("updb enrollment requires a password", false) + password, err = term.PromptPassword("updb enrollment requires a password, please enter one: ", false) + password = strings.TrimSpace(password) + if err != nil { - return fmt.Errorf("failed to complete enrollment, updb requires a non-empty password") + return fmt.Errorf("failed to complete enrollment, updb requires a non-empty password: %v", err) } + + confirm, err := term.PromptPassword("please confirm what you entered: ", false) + + if err != nil { + return fmt.Errorf("failed to complete enrollment, updb password confirmation failed: %v", err) + } + + confirm = strings.TrimSpace(confirm) + + if password != confirm { + return fmt.Errorf("failed to complete enrollment, passwords did not match") + } + + flags.Password = password } return enroll.EnrollUpdb(flags) From 8be643018c53c0311a740db7d6de83f5f43264b2 Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Wed, 14 Apr 2021 10:22:39 -0400 Subject: [PATCH 4/8] go mod tidy --- go.mod | 6 +++--- go.sum | 18 +++++++++--------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index f4b24365f..94b526d18 100644 --- a/go.mod +++ b/go.mod @@ -28,9 +28,9 @@ require ( github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19 github.com/michaelquigley/pfxlog v0.3.7 github.com/openziti/edge v0.19.78 - github.com/openziti/fabric v0.16.51 - github.com/openziti/foundation v0.15.46 - github.com/openziti/sdk-golang v0.15.38 + github.com/openziti/fabric v0.16.53 + github.com/openziti/foundation v0.15.48 + github.com/openziti/sdk-golang v0.15.39 github.com/pborman/uuid v1.2.0 github.com/pkg/errors v0.9.1 github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 diff --git a/go.sum b/go.sum index d7c74308a..70efecd37 100644 --- a/go.sum +++ b/go.sum @@ -613,15 +613,15 @@ github.com/openziti/bbolt v1.3.6-0.20210317142109-547da822475e h1:ST9+54UtCr96S5 github.com/openziti/bbolt v1.3.6-0.20210317142109-547da822475e/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ= github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k= github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo= -github.com/openziti/edge v0.19.74 h1:43gsaSE/tBjOyDHNMloFEdgD9WRGAZpihCBj9KrZTnY= -github.com/openziti/edge v0.19.74/go.mod h1:TUZs2pDysJL+aJvM1+bF88JLzK6yYcDh8DWrV0mMmVE= -github.com/openziti/fabric v0.16.51 h1:kXlEW9/TkWaUbExZy2SYAoqWRiPuhPaQ0vchzwLjyzg= -github.com/openziti/fabric v0.16.51/go.mod h1:Q8ZMLwNBHCKYDEp+38CEIXphiinhPb2lO8+UCAxaqu4= -github.com/openziti/foundation v0.15.46 h1:+7Q3dnwUpFnLjb4wtXFk/jaZwqaYpF0dyR1yp4eT/kA= -github.com/openziti/foundation v0.15.46/go.mod h1:NnSBTp9ZkcYsv6nYxZR0/NzoHfkIo6tjpBHDvBsPFqw= -github.com/openziti/sdk-golang v0.15.37/go.mod h1:UYITngFVgE1YQ/zoDt83Sqr36mj6NNcVHyetzqc6gdg= -github.com/openziti/sdk-golang v0.15.38 h1:KqW6A2LvPWCl6VhYHXP4Q7LtP+WbXaaTpGI0Cz73nQc= -github.com/openziti/sdk-golang v0.15.38/go.mod h1:UYITngFVgE1YQ/zoDt83Sqr36mj6NNcVHyetzqc6gdg= +github.com/openziti/edge v0.19.78 h1:Fd970IKzVagHz4qjYEB9obfQTYtsqE1BEoaf3j9tHHM= +github.com/openziti/edge v0.19.78/go.mod h1:dsgO/Ccd2EzKxPcagS84CQeVBO2tFRs5M2BVQs1SDYk= +github.com/openziti/fabric v0.16.53 h1:euH/rzJ7yTpUIFF5gRECVoPrUWGyoQYf2frdotcQBjk= +github.com/openziti/fabric v0.16.53/go.mod h1:bmbQB2A2ZgGbSxUT5dXYhgvD/hfpQQfrEq9ibj6x4LI= +github.com/openziti/foundation v0.15.47/go.mod h1:NnSBTp9ZkcYsv6nYxZR0/NzoHfkIo6tjpBHDvBsPFqw= +github.com/openziti/foundation v0.15.48 h1:NnL/xY684XeFiLBi5z0+uKf2tpPhlClbMeVmUQPF8Jo= +github.com/openziti/foundation v0.15.48/go.mod h1:NnSBTp9ZkcYsv6nYxZR0/NzoHfkIo6tjpBHDvBsPFqw= +github.com/openziti/sdk-golang v0.15.39 h1:xHv9tgfkkj1IQOFlztAMNsgd7Opa5hFrz2Zu6aPzKtw= +github.com/openziti/sdk-golang v0.15.39/go.mod h1:gNQRosz6RU80GmGNbXjGO6HKUtSlSOTEL2oTL2HLNwU= github.com/oracle/oci-go-sdk v24.2.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888= github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI= github.com/orcaman/concurrent-map v0.0.0-20210106121528-16402b402231 h1:fa50YL1pzKW+1SsBnJDOHppJN9stOEwS+CRWyUtyYGU= From 6ad2722829343037b54d0dfbccb3626c3d9a7a15 Mon Sep 17 00:00:00 2001 From: Paul Lorenz Date: Tue, 13 Apr 2021 13:54:26 -0400 Subject: [PATCH 5/8] Update deps and changelog. Remove ziti-enroller --- CHANGELOG.md | 3 + go.mod | 6 +- go.sum | 14 +- ziti-enroller/main.go | 32 ---- ziti-enroller/subcmd/root.go | 164 ------------------ ziti-enroller/subcmd/version.go | 35 ---- .../cmd/edge_controller/update_edge_router.go | 8 +- 7 files changed, 20 insertions(+), 242 deletions(-) delete mode 100644 ziti-enroller/main.go delete mode 100644 ziti-enroller/subcmd/root.go delete mode 100644 ziti-enroller/subcmd/version.go diff --git a/CHANGELOG.md b/CHANGELOG.md index fe72807d1..5b2f61ccd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,9 @@ ## What's New +* Add workaround for bbolt bug which caused some data to get left behind when deleting identities, seen when turning off tunneler capability on edge routers +* Remove deprecated ziti-enroller command. Enrollement can be done using the ziti-tunnel, ziti-router and ziti commands +* Fix UDP intercept handling * The host.v1 service configuration type has been changed as follows: * Rename `dialIntercepted*` properties to `forwardProtocol`, `forwardAddress`, `forwardPort` for better consistency with non-tunneler client applications. * Add `allowedProtocols`, `allowedAddresses`, and `allowedPortRanges` properties to whitelist destinations that are dialed via `forward*`. The `allowed*` properties are required for any corresponding `forward*` property that is `true`. diff --git a/go.mod b/go.mod index 94b526d18..8a941efad 100644 --- a/go.mod +++ b/go.mod @@ -27,10 +27,10 @@ require ( github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19 github.com/michaelquigley/pfxlog v0.3.7 - github.com/openziti/edge v0.19.78 - github.com/openziti/fabric v0.16.53 + github.com/openziti/edge v0.19.83 + github.com/openziti/fabric v0.16.54 github.com/openziti/foundation v0.15.48 - github.com/openziti/sdk-golang v0.15.39 + github.com/openziti/sdk-golang v0.15.40 github.com/pborman/uuid v1.2.0 github.com/pkg/errors v0.9.1 github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 diff --git a/go.sum b/go.sum index 70efecd37..4af1f6ee3 100644 --- a/go.sum +++ b/go.sum @@ -376,6 +376,7 @@ github.com/gophercloud/utils v0.0.0-20200508015959-b0167b94122c/go.mod h1:ehWUbL github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8= github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY= github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg= +github.com/gorilla/handlers v1.5.0/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q= github.com/gorilla/handlers v1.5.1 h1:9lRY6j8DEeeBT10CvO9hGW0gmky0BprnvDI5vfhUHH4= github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q= github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs= @@ -613,15 +614,14 @@ github.com/openziti/bbolt v1.3.6-0.20210317142109-547da822475e h1:ST9+54UtCr96S5 github.com/openziti/bbolt v1.3.6-0.20210317142109-547da822475e/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ= github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k= github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo= -github.com/openziti/edge v0.19.78 h1:Fd970IKzVagHz4qjYEB9obfQTYtsqE1BEoaf3j9tHHM= -github.com/openziti/edge v0.19.78/go.mod h1:dsgO/Ccd2EzKxPcagS84CQeVBO2tFRs5M2BVQs1SDYk= -github.com/openziti/fabric v0.16.53 h1:euH/rzJ7yTpUIFF5gRECVoPrUWGyoQYf2frdotcQBjk= -github.com/openziti/fabric v0.16.53/go.mod h1:bmbQB2A2ZgGbSxUT5dXYhgvD/hfpQQfrEq9ibj6x4LI= -github.com/openziti/foundation v0.15.47/go.mod h1:NnSBTp9ZkcYsv6nYxZR0/NzoHfkIo6tjpBHDvBsPFqw= +github.com/openziti/edge v0.19.83 h1:+DgptVlQIN9j95uX2LmUBgJmCS7qnBEKVCTeirNT/Vw= +github.com/openziti/edge v0.19.83/go.mod h1:atmbRzo8tAXatznFhQaM3BZlFJZxTq12OIGZazKz7J8= +github.com/openziti/fabric v0.16.54 h1:jfuAv5p73Uu7E2L26TBFoO+ZF5mzeAHgA9CSU8d+rfE= +github.com/openziti/fabric v0.16.54/go.mod h1:fb5zFkB3YQxusAmsQLKKzEk7MmPodqDkqmOVTB+J3eE= github.com/openziti/foundation v0.15.48 h1:NnL/xY684XeFiLBi5z0+uKf2tpPhlClbMeVmUQPF8Jo= github.com/openziti/foundation v0.15.48/go.mod h1:NnSBTp9ZkcYsv6nYxZR0/NzoHfkIo6tjpBHDvBsPFqw= -github.com/openziti/sdk-golang v0.15.39 h1:xHv9tgfkkj1IQOFlztAMNsgd7Opa5hFrz2Zu6aPzKtw= -github.com/openziti/sdk-golang v0.15.39/go.mod h1:gNQRosz6RU80GmGNbXjGO6HKUtSlSOTEL2oTL2HLNwU= +github.com/openziti/sdk-golang v0.15.40 h1:AXAE4qeWf5TLO1ZCamaTTOdfCmWITWyeM4g+RVZDO5U= +github.com/openziti/sdk-golang v0.15.40/go.mod h1:yo85e6HhAL1+PrRjgrsL/ZgkyAcdqVxy4Ws1UMrogss= github.com/oracle/oci-go-sdk v24.2.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888= github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI= github.com/orcaman/concurrent-map v0.0.0-20210106121528-16402b402231 h1:fa50YL1pzKW+1SsBnJDOHppJN9stOEwS+CRWyUtyYGU= diff --git a/ziti-enroller/main.go b/ziti-enroller/main.go deleted file mode 100644 index 09188839a..000000000 --- a/ziti-enroller/main.go +++ /dev/null @@ -1,32 +0,0 @@ -/* - Copyright NetFoundry, Inc. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - https://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package main - -import ( - "github.com/openziti/ziti/ziti-enroller/subcmd" - "github.com/sirupsen/logrus" -) - -func main() { - logrus.SetFormatter(&logrus.TextFormatter{ - ForceColors: true, - DisableTimestamp: true, - TimestampFormat: "", - PadLevelText: true, - }) - subcmd.Execute() -} diff --git a/ziti-enroller/subcmd/root.go b/ziti-enroller/subcmd/root.go deleted file mode 100644 index 61ee594fc..000000000 --- a/ziti-enroller/subcmd/root.go +++ /dev/null @@ -1,164 +0,0 @@ -/* - Copyright NetFoundry, Inc. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - https://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package subcmd - -import ( - "encoding/json" - "fmt" - "github.com/michaelquigley/pfxlog" - "github.com/openziti/foundation/identity/certtools" - "github.com/openziti/sdk-golang/ziti/enroll" - "github.com/pkg/errors" - "github.com/sirupsen/logrus" - "github.com/spf13/cobra" - "io/ioutil" - "os" - "strings" -) - -// global state used by all subcommands are located here for easy discovery -var verbose bool -var jwtpath, outpath, keyPath, certPath, idname, caOverride string - -const verboseDesc = "Enable verbose logging." -const outpathDesc = "Output configuration file." -const jwtpathDesc = "Enrollment token (JWT file). Required" -const certDesc = "The certificate to present when establishing a connection." -const idnameDesc = "Names the identity. Ignored if not 3rd party auto enrollment" - -const outFlag = "out" - -func init() { - rootCmd.PersistentFlags().BoolVarP(&verbose, "verbose", "v", false, verboseDesc) - rootCmd.Flags().StringVarP(&jwtpath, "jwt", "j", "", jwtpathDesc) - rootCmd.Flags().StringVarP(&outpath, outFlag, "o", "", outpathDesc) - rootCmd.Flags().StringVarP(&idname, "idname", "n", "", idnameDesc) - rootCmd.Flags().StringVarP(&certPath, "cert", "c", "", certDesc) - rootCmd.Flags().StringVarP(&caOverride, "ca", "", "", "Additional trusted certificates") - - var keyDesc = "" - engines := certtools.ListEngines() - if len(engines) > 0 { - keyDesc = fmt.Sprintf("The key to use with the certificate. Optionally specify the engine to use. supported engines: %v", engines) - } else { - keyDesc = fmt.Sprintf("The key to use with the certificate.") - } - - rootCmd.Flags().StringVarP(&keyPath, "key", "k", "", keyDesc) - - _ = rootCmd.MarkFlagRequired("jwt") -} - -var rootCmd = &cobra.Command{ - Use: "ziti-enroller", - Short: "Ziti Enroller", - PersistentPreRun: func(cmd *cobra.Command, args []string) { - logrus.Warnf("ziti-enroller is DEPRECATED and will soon be removed. Please use 'ziti edge enroll' or 'ziti-tunnel enroll' instead.") - if verbose { - logrus.SetLevel(logrus.DebugLevel) - } - }, - RunE: func(cmd *cobra.Command, args []string) error { - return processEnrollment() - }, -} - -func Execute() { - rootCmd.SilenceUsage = true - rootCmd.SilenceErrors = true - if err := rootCmd.Execute(); err != nil { - pfxlog.Logger().Errorf("%s\n", err) - } -} - -func processEnrollment() error { - if strings.TrimSpace(outpath) == "" { - out, outErr := outPathFromJwt(jwtpath) - if outErr != nil { - return fmt.Errorf("could not set the output path: %s", outErr) - } - outpath = out - } - - if jwtpath != "" { - if _, err := os.Stat(jwtpath); os.IsNotExist(err) { - return fmt.Errorf("the provided jwt file does not exist: %s", jwtpath) - } - } - - if caOverride != "" { - if _, err := os.Stat(caOverride); os.IsNotExist(err) { - return fmt.Errorf("the provided ca file does not exist: %s", caOverride) - } - } - - if strings.TrimSpace(outpath) == strings.TrimSpace(jwtpath) { - return fmt.Errorf("the output path must not be the same as the jwt path") - } - - tokenStr, _ := ioutil.ReadFile(jwtpath) - - pfxlog.Logger().Debugf("jwt to parse: %s", tokenStr) - tkn, _, err := enroll.ParseToken(string(tokenStr)) - - if err != nil { - return fmt.Errorf("failed to parse JWT: %s", err.Error()) - } - - flags := enroll.EnrollmentFlags{ - CertFile: certPath, - KeyFile: keyPath, - Token: tkn, - IDName: idname, - AdditionalCAs: caOverride, - KeyAlg: "RSA", - } - conf, err := enroll.Enroll(flags) - if err != nil { - return fmt.Errorf("failed to enroll: %v", err) - } - - output, err := os.Create(outpath) - defer output.Close() - if err != nil { - return fmt.Errorf("failed to open file '%s': %s", outpath, err.Error()) - } - - enc := json.NewEncoder(output) - enc.SetEscapeHTML(false) - encErr := enc.Encode(&conf) - - if encErr == nil { - pfxlog.Logger().Infof("enrolled successfully. identity file written to: %s", outpath) - return nil - } else { - return fmt.Errorf("enrollment successful but the identity file was not able to be written to: %s [%s]", outpath, encErr) - } -} - -func outPathFromJwt(jwt string) (string, error) { - if strings.HasSuffix(jwt, ".jwt") { - return jwt[:len(jwt)-len(".jwt")] + ".json", nil - } else if strings.HasSuffix(jwt, ".json") { - //ugh - so that makes things a bit uglier but ok fine. we'll return an error in this situation - return "", errors.Errorf("unexpected configuration. cannot infer '%s' flag if the jwt file "+ - "ends in .json. rename jwt file or provide the '%s' flag", outFlag, outFlag) - } else { - //doesn't end with .jwt - so just slap a .json on the end and call it a day - return jwt + ".json", nil - } -} diff --git a/ziti-enroller/subcmd/version.go b/ziti-enroller/subcmd/version.go deleted file mode 100644 index 2ce83aa56..000000000 --- a/ziti-enroller/subcmd/version.go +++ /dev/null @@ -1,35 +0,0 @@ -/* - Copyright NetFoundry, Inc. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - https://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package subcmd - -import ( - "fmt" - "github.com/openziti/ziti/common/version" - "github.com/spf13/cobra" -) - -func init() { - rootCmd.AddCommand(versionCmd) -} - -var versionCmd = &cobra.Command{ - Use: "version", - Short: "Show component version", - Run: func(cmd *cobra.Command, args []string) { - fmt.Println(version.GetBuildMetadata(verbose)) - }, -} diff --git a/ziti/cmd/ziti/cmd/edge_controller/update_edge_router.go b/ziti/cmd/ziti/cmd/edge_controller/update_edge_router.go index a6c412d4f..8d49c863e 100644 --- a/ziti/cmd/ziti/cmd/edge_controller/update_edge_router.go +++ b/ziti/cmd/ziti/cmd/edge_controller/update_edge_router.go @@ -36,6 +36,7 @@ type updateEdgeRouterOptions struct { roleAttributes []string tags map[string]string appData map[string]string + usePut bool } func newUpdateEdgeRouterCmd(f cmdutil.Factory, out io.Writer, errOut io.Writer) *cobra.Command { @@ -67,6 +68,7 @@ func newUpdateEdgeRouterCmd(f cmdutil.Factory, out io.Writer, errOut io.Writer) "Set role attributes of the edge router. Use --role-attributes '' to set an empty list") cmd.Flags().StringToStringVar(&options.tags, "tags", nil, "Custom management tags") cmd.Flags().StringToStringVar(&options.appData, "app-data", nil, "Custom application data") + cmd.Flags().BoolVar(&options.usePut, "use-put", false, "Use PUT to when making the request") options.AddCommonFlags(cmd) @@ -111,6 +113,10 @@ func runUpdateEdgeRouter(o *updateEdgeRouterOptions) error { return errors.New("no change specified. must specify at least one attribute to change") } - _, err = patchEntityOfType(fmt.Sprintf("edge-routers/%v", id), entityData.String(), &o.edgeOptions) + if o.usePut { + _, err = putEntityOfType(fmt.Sprintf("edge-routers/%v", id), entityData.String(), &o.edgeOptions) + } else { + _, err = patchEntityOfType(fmt.Sprintf("edge-routers/%v", id), entityData.String(), &o.edgeOptions) + } return err } From 81f6f0c5b807bb08593bd72977a55328548ea563 Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Wed, 14 Apr 2021 14:04:21 -0400 Subject: [PATCH 6/8] changelog and deps --- CHANGELOG.md | 5 +++++ ziti-router/subcmd/run.go | 3 +++ 2 files changed, 8 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5b2f61ccd..647d36105 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,11 @@ * Rename `dialIntercepted*` properties to `forwardProtocol`, `forwardAddress`, `forwardPort` for better consistency with non-tunneler client applications. * Add `allowedProtocols`, `allowedAddresses`, and `allowedPortRanges` properties to whitelist destinations that are dialed via `forward*`. The `allowed*` properties are required for any corresponding `forward*` property that is `true`. * Add `allowedSourceAddresses`, which serves as a whitelist for source IPs/CIDRs and informs the hosting tunneler of the local routes to establish when hosting a service. +* Ziti Controller will now report service posture query policy types (Dial/Bind) +* Ziti Controller now supports enrollment extension for routers +* Ziti Router now support forcing enrollment extension via `run -e` +* Ziti Routers will now automatically extend their enrollment before their certificates expire +* `ziti edge enroll` with a UPDB JWT now confirms and properly sets the password supplied Caveats: * Any existing host.v1 configurations that use will become invalid. diff --git a/ziti-router/subcmd/run.go b/ziti-router/subcmd/run.go index 11997dc9f..c9b6c9649 100644 --- a/ziti-router/subcmd/run.go +++ b/ziti-router/subcmd/run.go @@ -36,7 +36,10 @@ import ( "syscall" ) +var forceEnrollmentExtension *bool + func init() { + forceEnrollmentExtension = runCmd.Flags().BoolP("extend", "e", false, "force the router on startup to extend enrollment certificates") root.AddCommand(runCmd) } From e6abeda5042a39a3a61d07698453baedecfd7f8f Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Thu, 15 Apr 2021 13:39:33 -0400 Subject: [PATCH 7/8] remove extra var declaration --- ziti-router/subcmd/run.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ziti-router/subcmd/run.go b/ziti-router/subcmd/run.go index c9b6c9649..a9b58ae23 100644 --- a/ziti-router/subcmd/run.go +++ b/ziti-router/subcmd/run.go @@ -39,7 +39,8 @@ import ( var forceEnrollmentExtension *bool func init() { - forceEnrollmentExtension = runCmd.Flags().BoolP("extend", "e", false, "force the router on startup to extend enrollment certificates") + //flags are added to an internal map and read later on, see getFlags() + runCmd.Flags().BoolP("extend", "e", false, "force the router on startup to extend enrollment certificates") root.AddCommand(runCmd) } From 74f8e715d6716a8454f4df5d85401318c0201ed2 Mon Sep 17 00:00:00 2001 From: Paul Lorenz Date: Thu, 15 Apr 2021 13:45:19 -0400 Subject: [PATCH 8/8] Fix doc links --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 50ef813c9..f404f3401 100644 --- a/README.md +++ b/README.md @@ -26,8 +26,8 @@ Ziti represents the next generation of secure, open-source networking for your a **Developer Focus** * [Open source code, available with the Apache 2.0 license](https://github.com/openziti) * Fully programable REST management APIs -* [SDKs for a variety of programming languages](~/ziti/clients/sdks.md) -* [Application specific configuration store allowing centralized management of configuration allowing you to add structured configuration specific to your application](~/config-store/overview.md) +* [SDKs for a variety of programming languages](https://openziti.github.io/ziti/clients/sdks) +* [Application specific configuration store allowing centralized management of configuration allowing you to add structured configuration specific to your application](https://openziti.github.io/ziti/config-store/overview) * An extensible fabric, allowing you to add your own * load balancing algorithms * interconnect protocols @@ -36,9 +36,9 @@ Ziti represents the next generation of secure, open-source networking for your a * control and management plane messaging and semantics **Easy Management** -* [A flexible and expressive policy model for managing access to services and edge routers](~/ziti/policies/overview.md) +* [A flexible and expressive policy model for managing access to services and edge routers](https://openziti.github.io/ziti/policies/overview) * A web based admin console -* [Pre-built tunnelers and proxies for a variety of operating systems, including mobile](~/ziti/clients/tunneler.md) +* [Pre-built tunnelers and proxies for a variety of operating systems, including mobile](https://openziti.github.io/ziti/clients/tunneler) Let's break some of these buzzwords down.