Forward ports the GHSA-mrpr-756c-xm47 fix, released in 2.0.2, to main.
- adds a shared cert.VerifyLeafCertChain helper that verifies the presented leaf
(certs[0], whose private key the TLS handshake proved) against the node's full
trusted-CA pool, treating certs[1:] only as candidate intermediates
- uses it for controller cluster mesh peer connections and router link
connections, which previously accepted a connection when any presented
certificate chained to the trusted CA while taking peer identity from the leaf
- matches the pinned metrics scrape certificate against the presented leaf only,
comparing full DER rather than just the signature, and rejects a leaf outside
its validity window
- adds negative-path tests covering rogue leaves paired with CA-chained filler
certificates
- caps buffered HTTP request bodies at 1 MiB across the client, management, fabric management, and OIDC web APIs
- rejects oversized bodies with 413 REQUEST_ENTITY_TOO_LARGE before authentication
- surfaces request body read errors instead of ignoring them
- returns after writing the request context error response in the client API handler
- adds integration coverage for oversized bodies with and without Content-Length
- adds a common/servermetrics package that owns the metrics MetricsMessage wire
format and the reporting/usage subsystem (message builder, usage registry,
interval and usage counters), wrapping the openziti/metrics Registry for
metric collection
- moves the controllers metrics reporter into the router package and removes it
from the shared metrics package, breaking a common -> router/env import cycle
- repoints controller and router consumers to common/servermetrics; base metric
collection stays on openziti/metrics
- keeps the proto field numbers and the metrics content-type identical so the
encoding is byte-compatible across the move, and uses a distinct proto package
name so ziti's and the library's messages coexist without a global proto
registry clash
- adds a round-trip test asserting wire compatibility with the library's
MetricsMessage
- leaves openziti/metrics unchanged, so sdk-golang and the shared xgress data
plane are unaffected
- channel.NewChannel(name, factory, bindHandler, opts) -> channel.NewSingleChannel(...)
- channel.NewChannelWithUnderlay(...) -> channel.NewSingleChannelWithUnderlay(...)
channel/v5 repurposes NewChannel for the unified multi-underlay constructor, so the
single-underlay call sites move to the renamed helpers. Mechanical rename only; like the
preceding import commit it does not build on its own.
- moves the channel dependency to channel/v5 v5.0.10 and sdk-golang to v1.9.0 in the root and zititest modules
- mechanically rewrites every channel/v4 import path to channel/v5
This is the import-path-only step; the API-level changes the switch requires land in the following commit. This commit does not build on its own.
- skips certificate DNS names starting with "*." in getPossibleIssuers,
since they produce unusable OIDC URLs (e.g. https://*.example.com/oidc/authorize)
- updates test to verify wildcard DNS SANs are excluded while IP SANs
from the same cert remain valid issuers
- adds DeleteRevocationsBatchCommand so expired-revocation cleanup goes
through raft as a single log entry per batch
- adds CreateRevocationsBatchCommand for batched revocation creation
through raft
- moves refresh-token revocations from synchronous inline creation to a
background batcher that flushes on a configurable interval, removing
the database and raft as a bottleneck on token refreshes
- skips revocation creation for tokens expiring within a configurable
threshold (revocationMinTokenLifetime), since they become invalid on
their own
- validates that revocationMinTokenLifetime is less than 50% of the
configured refresh token lifetime
- makes the revocation enforcer frequency configurable and restricts it
to run only on the raft leader
- adds tests for multi-batch delete, batched create with router RDM
propagation, and skip-threshold behavior
- adds new configuration tunables under edge.oidc: revocationBucketInterval,
revocationMinTokenLifetime, revocationBucketMaxSize, revocationMaxQueued,
revocationEnforcerFrequency
* fixes#3597, enable OIDC by default
- adds ability to have different sets of environment configs for tests
- adds ConfigSet struct as a configuration device for integration tests
- allows entire environments to be defined as needed
- original ats config set at "default-ats"
- tests that do not specify a config set, use "default-ats" as before
- standardizes configuration location, naming, etc.
- adds README.md for the above
- updates testContext to now be config set aware
- add config value to disable, update tests, changelog
- add defense against cached version data for tests
* fixesopenziti/ziti#3356 adds www-authenticate headers
- www-authenticate headers are returned on 401s from API requests
- www-authenticate headers are returned during authentication to signal
addtional JWT bearer tokens needed (secondary ext jwt)
- adds support for additional headers on API errors
- adds SecurityTokenCtx for centralized security header processing
(legacy, jwt, etc.)
- adds SecurityCtx for centralized identity, auth policy, MFA handling
- refactors existing JWT authentication methods (oidc, legacy) to use
centralized processing where possible
Harden OIDC token endpoint against panics and silent failures
- Wrap OIDC handler with TimeoutHandler to match all other API handlers
- Fix GetRootTlsJwtSigner using rootCerts[0] instead of resolved rootCert
- Propagate Generate() errors in createRefreshClaims and renewRefreshToken
- Use safe type assertion for kid header in JwtSignerKeyFunc
* restore legacy router healthcheck support for address 0.0.0.0
* restore extraneous comment
* move bindpoint to common since routers and controllers use it. put old validation back and soften message
* missed an import
* add support for and identity-driven bindPoints in controller
* cannot use ListenOptions as it pulls the go sdk into xweb :(
* more generic log message
* add ziti cli login tests in prep for continuing adding identity support in controller
* updates to tests
* updates to tests
* rebase with main
* allow login testing to external overlay
* more changes to allow a zitified ziti cli. add a test for testing login and ensure it works over a zitified connection
* refactor bindPoints to a module
* rebase with main
* no functional changes, just major refactoring based on PR requests. encapsulated all tests state into loginTestState, moved overlay to testutil
* rework a couple of util funcs to be cleaner per PR feedback
* make the new func more useful
* run tests via github action
* update changelog and remove unnecssary serveTls for now
* update from xweb v2 to v3
* change where factory is added and fix compilation issue of a test
* linting changes, move ascode test to cli_tests and activate via cli_tests
* use proper go build
* forgot to set the bin location
* fix timeout on test
* different errors on linux, windows and on gh runners
* cleanup after self-pr review
* use longer name to prevent codespell issues...
* additional changelog and add addressable terminator support
* fix out of control concatenation in cache file. fix ipv6 checking
* updates based on newer sdk and edge api client
* ensure oidc sessions auth for both older and newer commands
* add better error when url is empty and update changelog
* codespell fixes
* remove extraneous file
* update to 1.3.0 to kick off CI
* PR related changes. add interface enforcer and refactor networkIdentity
* go tidied
* fix golangci-lint and ha quickstart test
* keep fixing golanglint-ci... lol
* golanglint i was sure i'd fixed
* fix login test
* should fix ziti ops verify traffic as well
* fix verify traffic when all login information is supplied as well
* make all the timeouts longer? seems to run fine locally but fail in actions
* fix#3231 use root controller server certs for OIDC signing
- addresses HA vs non-HA signing
- fixes issue where APIs server w/ difference certs than the root
identity
- adds documentation for env/appenv
- adds a new composite type for TLSCert JWT signers
* address possible nil reference
* remove ineff assignment on jwt signing method
* fixes#2737 open-id config issuer mismatch
- scans all SANs for possible supported hostname/ips
- add copyright, add better accept handling
- re-arrange where issuers are determined
- removes support for root openid-config
- fixes issuer mapping
- fixes endpoint tests
- add support for wild card certificates influencing issuers
- ziti edge login now properly probes endpoints and their return content
type along with the existing status code check
- probed endpoint responses are no longer blindly parsed
- the management endpoint is the default initial probe point, falling
back to the client version endpoint then the legacy root version
endpoint
- the SPA/ZAC bindings for web apis has been moved to the webapis folder
- improved erroring and messaging for the SPA/ZAC handling
Paul Lorenz