- adds HardenedJwksResolver, a jwks.Resolver that fetches an external jwt signer's
jwksEndpoint with an http/https-only scheme check, a total timeout and a redirect cap
- adds JwksFetchPolicy, gating a fetch on both the URL hostname and the address being
connected to, applied to the first request and to every redirect hop
- hostname gate: deniedHostnames blocks, allowedHostnames is exclusive when set; entries
are an exact hostname or a '*.suffix' wildcard that matches subdomains at any depth but
never the suffix itself, normalized to lower case punycode without a trailing dot
- address gate: built-in blocked (metadata, link-local, link-local multicast,
unspecified), then deniedIPs, then allowedIPs, then blockPrivateAddresses,
first-match-wins with deny over allow
- keeps the gates independent, so neither can authorize what the other refuses; the
address check runs in the dialer against the resolved address, so a hostname that
resolves to a blocked address is refused
- adds the [edge.externalJwtSigners.jwksFetch] config section with compatible defaults:
empty hostname lists, blockPrivateAddresses false, timeout 5s, maxRedirects 5
- takes IP lists as a flat address or a CIDR block, hostname lists as names only, and
rejects an entry belonging to the other list at startup
- rejects a jwksEndpoint the policy refuses when an external jwt signer is created or
updated, and logs an existing signer whose endpoint the configuration now refuses
when the token issuer cache loads
- documents both gates, their deny-wins precedence, the accepted entry forms and the
wildcard matching rules in etc/ctrl.with.edge.yml and CHANGELOG.md
- adds CreateCircuitV3 message type and handler for routers that have
already authorized dials locally via RDM, bypassing service session
tokens in favor of identity ID, service ID, and pre-assigned circuit ID
- renames CreateCircuitRequest/Response to CreateCircuitV2Request/V2Response
for clarity now that V3 exists
- adds CircuitManager.Reserve to atomically claim circuit IDs before routing,
preventing collisions on pre-assigned IDs
- extends CreateCircuitParams with GetCircuitId so V3 can supply a
pre-assigned circuit ID (falls back to UUID generation when empty)
- fixes IsDialableByIdentity which was incorrectly calling IsBindableByIdentity
- extracts V2 handler into its own file create_circuit_v2.go
- adds CreateCircuitV3RequestType/ResponseType (20222/20223) to edge_ctrl protobuf
- registers V3 handler in controller server
- adds DeleteRevocationsBatchCommand so expired-revocation cleanup goes
through raft as a single log entry per batch
- adds CreateRevocationsBatchCommand for batched revocation creation
through raft
- moves refresh-token revocations from synchronous inline creation to a
background batcher that flushes on a configurable interval, removing
the database and raft as a bottleneck on token refreshes
- skips revocation creation for tokens expiring within a configurable
threshold (revocationMinTokenLifetime), since they become invalid on
their own
- validates that revocationMinTokenLifetime is less than 50% of the
configured refresh token lifetime
- makes the revocation enforcer frequency configurable and restricts it
to run only on the raft leader
- adds tests for multi-batch delete, batched create with router RDM
propagation, and skip-threshold behavior
- adds new configuration tunables under edge.oidc: revocationBucketInterval,
revocationMinTokenLifetime, revocationBucketMaxSize, revocationMaxQueued,
revocationEnforcerFrequency
- replaces queue-position-based window adjustment with an exponentially
decaying success rate histogram to drive grow/shrink decisions
- introduces AdaptiveRateLimitTrackerConfig with configurable
successThreshold, increaseFactor, decreaseFactor,
increaseCheckInterval, and decreaseCheckInterval
- grows window by increaseFactor when success rate exceeds threshold,
shrinks by decreaseFactor when it falls below
- renames LoadAdaptiveRateLimiterConfig to a Load method on the config
- adds currentSize and currentWindow to Success/Backoff/Failed debug logs
- updates controller TLS handshake, raft, and router ctrl rate limiters
to use the new AdaptiveRateLimitTrackerConfig
- deletes proxyXgressConnection and transportXgressConn duplicate types
- adds ConnType enum (Tunnel, Transport, EdgeTransport, Proxy) to xgress_common
- replaces boolean isTransport parameter in NewXgressConn with ConnType
- updates HandleControlMsg to derive traceroute hop type from ConnType
- adds halfClose field to xgress_transport listener based on transport type
- updates all NewXgressConn call sites with appropriate ConnType values
* fixes#3597, enable OIDC by default
- adds ability to have different sets of environment configs for tests
- adds ConfigSet struct as a configuration device for integration tests
- allows entire environments to be defined as needed
- original ats config set at "default-ats"
- tests that do not specify a config set, use "default-ats" as before
- standardizes configuration location, naming, etc.
- adds README.md for the above
- updates testContext to now be config set aware
- add config value to disable, update tests, changelog
- add defense against cached version data for tests
fixes#3084 adds events and improper chain flag
- splits cert resolution into root, legacy root + intermediate,
and third-party pool. Allowing the detection of client authentication
with incomplete chains if root + intermediate succeeds after root only fails
- adds `improperClientCertChain` to API Sessions and Current API Session.
Added for OIDC and legacy auth. Set to true when a client certificate is used
that was issued by the network and did not pass the root-only pool.
* fix#2984 identity/router enrollment do not return full chains
- router extend via REST/ctrl now return full chains
- identity extend via REST now return full chains
- updates tests to allow for chain lengths
- modifies verification to look at the first cert in the chain (leaf)
- modifies edge routers to not start extension if new certs can't be
saved
- adds network-jwt tests
* Allow configuring endpoints file full path instead of directory. Fixes#2724
* Write initial router endpoints file based on ctrls in JWT. Fixes#2728
* Add ctrls property to non-ha router enrollment. Fixes#2108
* Enrollment doesn't contain controller which created the enrollment. Fixes#2729
- TMP/TEMP/TMPDIR are standards from windows, macOs, bsd, and linux
- TMP/TEMP/TMPDIR are set for all oses to allow cross platform configs
- Priotity order for selection is TMP/TEMP/TMPDIR
- For windows if TMP/TEMP are not set C:\temp is the default
- ziti edge login now properly probes endpoints and their return content
type along with the existing status code check
- probed endpoint responses are no longer blindly parsed
- the management endpoint is the default initial probe point, falling
back to the client version endpoint then the legacy root version
endpoint
- the SPA/ZAC bindings for web apis has been moved to the webapis folder
- improved erroring and messaging for the SPA/ZAC handling
- adds support for trust domain lookup on x509 chain
- adds support for non-ha trustDomain configuration
- adds default generated trust domain for non-ha controllers
- non-HA controllers will generate a trust domain from the root CA if
possible
- additionalTrustDomains has been added for transitioning between trust
domains
update changelog.md
Andrew Martinez