0383bc63f1
Raft should not initialize if db is misconfigured. Fixes #1973
2024-04-24 08:04:17 -04:00
a998a4afaf
Merge pull request #1967 from openziti/rdm-change-sets
...
Implement router data model changesets. Fixes #1966
2024-04-23 17:44:53 -04:00
8539bd642f
make golangci-lint happy, take 1
2024-04-23 15:04:10 -04:00
255dbdacfa
fixes #1971 OIDC auth now converts config type names to ids
2024-04-23 14:53:32 -04:00
898e41ae2a
Implement router data model changesets. Fixes #1966
2024-04-23 11:56:10 -04:00
a60ed6ffb6
Merge pull request #1965 from openziti/add.router.token.update.handling
...
fixes #1964 , fixes #1960 adds the ability to handle and process beare…
2024-04-23 09:34:20 -04:00
68f0167126
Merge pull request #1927 from openziti/fix.1926.enroll.certs.with.chains
...
fixes #1926 adds chains to enrollment responses
2024-04-23 09:33:22 -04:00
3fb9ff1ea3
fixes #1964 , fixes #1960 adds the ability to handle and process bearer token updates
...
- established connections can now send an update token message with the
body of a new bearer token
- the new token's signer is verified from the router data model along
with the claims (matching subject, api session id, etc.)
- cleans up token exchange claim handling in the controller
2024-04-22 14:48:33 -04:00
739bcf6d8e
tweaks behavior of token exchange
...
- allow access > access token exchanges
- explicitly check for token exchange types
- remove store error
- remove unused custom scopes
- helps with openziti/ziti#1960
allow offline_request
2024-04-18 16:35:04 -04:00
32d743ff11
Update router data model with: add service policy type, flesh out identity. Fixes #1950 Fixes #1951
2024-04-17 14:57:20 -04:00
3e9567b412
Use config types from edge-apis instead of manually parsing
2024-04-17 14:25:32 -04:00
a0245e5cd3
Allow ER/T to intercept services w/out sessions when in HA mode. Fixes #1942
2024-04-16 15:11:00 -04:00
ac7c4848c5
Don't use EdgeSessionRemoved tracking for HA sessions. Fixes #1936
2024-04-12 13:48:34 -04:00
9b6abbfa38
Merge pull request #1932 from openziti/fix.1931.invalid.kid
...
fixes #1931 random invalid kids
2024-04-11 16:48:40 -04:00
59894d61bc
fixes #1931 random invalid kids
...
- caused by usage of mesh peers instead of controller list
- peers from the mesh can be unreliable depending on startup time and
connection time
2024-04-11 11:32:24 -04:00
0ec0dec58d
Update changelog, deps and make the tls handshake rate limiter off by default
2024-04-10 14:09:48 -04:00
0e21934b75
fixes #1926 adds chains to enrollment responses
...
- all server and client certs issued attempt to build a chain less root
from the CA bundle during enrollment
- this change still requires all intermediates to be in the ca bundle,
untill they are moved somewhere else or provided in some other fashion
- updated tests to expect chains in enrollment responses
2024-04-10 10:57:57 -04:00
ff8d70e418
Move rate limiter logging to debug
2024-04-09 19:48:25 -04:00
8f4f9944f5
Add TLS handshake rate limiter. Fixes #1904
2024-04-09 17:25:35 -04:00
3d81cc39a4
Load test for controller with links, terminators, clients and traffic
2024-04-09 16:58:18 -04:00
4dfdabff8c
respect service policies for admin identities ( #1919 )
...
respect service policies for admin identities
2024-04-09 14:34:15 -04:00
6be77e96a5
Merge pull request #1903 from openziti/use-cmap-itercb
...
Use cmap IterCB instead of IterBuffered where possible. Fixes #1902
2024-04-09 13:25:44 -04:00
3a12eee5ad
Merge pull request #1901 from openziti/better-link-mgmt-backwards-compat
...
Improve link mgmt backwards compatibility. Fixes #1900
2024-04-09 13:24:55 -04:00
a6ec19f0c7
Merge pull request #1915 from openziti/fix-ha-ctrl-panic
...
Fix ha ctrl panics
2024-04-08 14:16:12 -04:00
3bdf2634cc
Fix panic on first ha controller startup. Fixes #1911
2024-04-08 12:31:35 -04:00
84711f460a
Fix panic in PeerConnected. Fixes #1914
2024-04-08 12:31:18 -04:00
d62e3cb71f
Use cmap IterCB instead of IterBuffered where possible. Fixes #1902
2024-04-04 21:27:38 -04:00
ad779ed118
Improve link mgmt backwards compatibility. Fixes #1900
...
* We're sending peer change messages to older routers that don't understand them.
* We should probably use the older controller link management code for routers without the link management stability fixes
* Includes a few minor cleanups
2024-04-04 19:07:24 -04:00
8d11af3d97
Optimize network run loop. Fixes #1897
...
* When routers change (connect/disconnect), we re-check the mesh. We are passing in the routers to the channel and they can build up, which is unnecessary. We only need to signal once for all the routers that change since the last time we checked, that the mesh needs to be checked.
* We pass link changes through the run method, which is unnecessary since we pass it to a new goroutine. This inefficiency should be fixed.
* We're evaluating all faulted links for rerouting, even if they were still pending. Only reroute connected links.
* We're using time.After in each for loop, which can accumulate timers. Use a single Ticker instead.
2024-04-04 18:46:50 -04:00
aaceb84a0f
Don't save old link statues in memory, the info is in link events. Fixes #1896
2024-04-04 18:18:35 -04:00
e59f9b8d66
fix LoadOneById name change
2024-03-26 11:00:15 -04:00
8c7b3b2e84
reduces prerms from admin to authenticated on list controllers
...
- updated public key sync to use controller list data instead of mesh peer
- fixes perms on controller list to not be admin only
2024-03-26 10:55:50 -04:00
b5e96dbeea
Merge pull request #1851 from openziti/posture-check-optimization
...
Return dummy values in service list for posture checks if no posture checks are defined. Fixes #1576
2024-03-25 10:37:30 -04:00
58b80488bf
Merge pull request #1855 from openziti/fix-unroute-panic
...
Fix panic if router is disconnected in unroute. Fixes #1854
2024-03-21 13:51:19 -04:00
3cdb009aea
Merge pull request #1853 from openziti/fix-db-validation
...
Fix validation perf. Fixes #1428 . Remove duplicate LoadOneById method.
2024-03-21 13:51:02 -04:00
5c7f53918b
Merge pull request #1850 from openziti/fix-session-sync-block
...
Don't allow session sync to block channel. Fixes #1849
2024-03-21 13:50:45 -04:00
881ec14b63
Fix validation perf. Fixes #1428 . Remove duplicate LoadOneById method.
2024-03-21 10:10:07 -04:00
3c3bfb69f7
Fix panic if router is disconnected in unroute. Fixes #1854
2024-03-21 10:02:39 -04:00
a089ca7c36
Return dummy values in service list for posture checks if no posture checks are defined. Fixes #1576
2024-03-20 14:23:15 -04:00
1e17a70d3f
Don't allow session sync to block channel. Fixes #1849
2024-03-20 14:02:18 -04:00
aad1ad57cf
Add api session cert index to fix lookup perf. Fixes #1846
2024-03-20 09:05:53 -04:00
0085e92ad4
Update HA smoketest for HA changes
2024-03-18 16:38:29 -04:00
36ced919ae
Merge branch 'main' into ha-staging
2024-03-14 08:38:57 -04:00
fab81e4cd4
Add terminator chaos testing and fix issues found. Fixes #1794 Fixes #1369
2024-03-12 10:31:36 -04:00
9cfc8e07fc
update sdk/edge-api deps
2024-03-12 09:45:55 -04:00
96ed30a200
fix store entity type copy-pasta
2024-03-06 10:18:02 -05:00
e4207d9f9f
lint fixes
2024-03-05 10:25:24 -05:00
a3c3da870f
pr changes, fixes revocation events
2024-03-05 09:48:13 -05:00
bfee741b20
more codespell errors
2024-02-29 10:08:37 -05:00
401de61bbc
spelling errors
2024-02-29 10:06:22 -05:00
Paul Lorenz