* The controller and the router wrote the complete service session token, an OIDC
service session JWT or a legacy session token, into structured log fields during
edge control operations. Several of the sites logged at Error or Info, so the
values reached logs at default verbosity during ordinary operation.
* Adds LoggingFields to the session and api session types in common, controller/model
and router/state, so a logging site asks for the session fields or the api session
fields instead of picking values by hand. Ids, type, identity, service and the
token's validity window go in; the token does not. Empty values are dropped, so the
sets merge over each other.
* AddLoggingFields in router/state now delegates to LoggingFields. Its output moves
from a nested field to flat prefixed keys.
* The edge control handlers log the session field set on the shared returnError and
logResult paths, on circuit setup and on terminator update. The terminator removal
paths log the terminator id, since they never load a session.
* Adds unit tests over returnError and logResult that fail if a session token reaches
a log entry, covering the loaded-session, failed-to-load and JWT-claims cases.
- reports edge router policy denials with an access-denied error naming the missing policy,
replacing the session error reused on the sessionless ER/T and create-circuit-v3 paths
- adds EdgeRouterManager.GetEdgeRouterAccess, which reports which of the two required policy
links (identity-to-edge-router, service-to-edge-router) is absent, and removes the boolean
IsAccessToEdgeRouterAllowed it replaces
- logs the controller's rejection on the router at warn level, since it is recoverable and
retried by the periodic scan; the router previously discarded the error code and message
- delays a new terminator's first create attempt by a fixed 2s so config applied in quick
succession settles before the router asks, avoiding a 2-3 minute wait for the retry scan; the
delay is a deliberate stopgap until edge router policy visibility lands in the router data model
- propagates the controller's error code and retry hint to SDK clients on the dial paths, which
dropped the code and left every refusal classified as unknown
- adds the retry hint header to controller error replies, grouped with the other error-reply
headers rather than the create-circuit-v3 request headers
- notes that the sync strategy headers alias the edge namespace's 1013-1015 ids and stay
disjoint only by message content type
- tests the per-policy denial reporting, the error code carried with and without a retry hint,
the controller-to-SDK error code mapping at both dial relay sites, and the terminator settle
gate
- waits for terminator establishment in the tunneler dataflow tests instead of a fixed sleep, so
they no longer race the settle delay
- restores the tproxy multiple-lanIf and multiple-resolver changelog entries with keep markers,
which regeneration drops because their commits reference pull requests rather than issues
- loadFromBolt now accepts a non-JWT (legacy/durable) service session token by
looking the session up via Session.ReadByToken and verifying it belongs to the
api session, so a legacy client's existing session keeps working across a
controller upgrade instead of failing as a malformed JWT
- classifies service-access token validation failures (malformed, expired, bad
claims, mismatched api session, revoked) as InvalidSession so the client
re-creates, while revocation-store/datastore read failures remain internalError
so a transient controller fault does not make clients discard valid sessions
- adds a typed common.InvalidTokenError so ValidateServiceAccessToken can
distinguish token-level failures from infrastructure failures
Bumps the sdk-golang dependency from v1 to the v2 module
(`github.com/openziti/sdk-golang/v2` at v2.0.0-pre1) and updates all
import paths. This is a no-behavior-change precursor that isolates the
dependency migration from the Connect-V2 feature work in #3884.
- Rewrites `github.com/openziti/sdk-golang/...` imports to
`github.com/openziti/sdk-golang/v2/...` across the main and zititest
modules.
- Pins both modules to `github.com/openziti/sdk-golang/v2 v2.0.0-pre1`.
- Adapts `edgeXgressConn.AcceptMessage` to the v2 `MsgSink` signature,
which now takes an `edge.SdkChannel` argument.
- Replaces the removed `edge.Conn.GetRouterId()` with
`RemoteAddr().String()` in the loop4 traffic-test logging.
For openziti/sdk-golang#936.
- moves the channel dependency to channel/v5 v5.0.10 and sdk-golang to v1.9.0 in the root and zititest modules
- mechanically rewrites every channel/v4 import path to channel/v5
This is the import-path-only step; the API-level changes the switch requires land in the following commit. This commit does not build on its own.
- adds CreateCircuitV3 message type and handler for routers that have
already authorized dials locally via RDM, bypassing service session
tokens in favor of identity ID, service ID, and pre-assigned circuit ID
- renames CreateCircuitRequest/Response to CreateCircuitV2Request/V2Response
for clarity now that V3 exists
- adds CircuitManager.Reserve to atomically claim circuit IDs before routing,
preventing collisions on pre-assigned IDs
- extends CreateCircuitParams with GetCircuitId so V3 can supply a
pre-assigned circuit ID (falls back to UUID generation when empty)
- fixes IsDialableByIdentity which was incorrectly calling IsBindableByIdentity
- extracts V2 handler into its own file create_circuit_v2.go
- adds CreateCircuitV3RequestType/ResponseType (20222/20223) to edge_ctrl protobuf
- registers V3 handler in controller server
* fixesopenziti/ziti#3356 adds www-authenticate headers
- www-authenticate headers are returned on 401s from API requests
- www-authenticate headers are returned during authentication to signal
addtional JWT bearer tokens needed (secondary ext jwt)
- adds support for additional headers on API errors
- adds SecurityTokenCtx for centralized security header processing
(legacy, jwt, etc.)
- adds SecurityCtx for centralized identity, auth policy, MFA handling
- refactors existing JWT authentication methods (oidc, legacy) to use
centralized processing where possible
* fix#2865 remove fingerprint checks from controller
- on their own fingerpint checking does not provide any additional
security as the underlying certificate is not verified
- fingerprint based checking will not work with spiffeid generated
certificates or x509 claims
- routers still support sending fingerprints for old controller support
* Make terminator creation asynchronous
* Make terminator creation idempotent
* Improve logging
* Add some timer logging and metrics.
* controller and router will both log their respective views of how long the terminator create took
* the router has a new xgress_edge_tunnel.terminator.create_time timer metric
* threaded timeout from fabric
* pr comments
* fix timing
* removed utc on deadline check
* small updates
* updated fabric version and add zero check to timeoutdeadline
* fix wrong fabric version
* Update deps
Co-authored-by: Cam Otts <cam@Cams-MacBook-Pro.local>
Co-authored-by: Paul Lorenz <paul.lorenz@netfoundry.io>
Andrew Martinez