- routers propertly wait on certs that are about to expire
- routers no longer send multiple extension requests
- routers now request cert verification
- routers now verify new certs before saving
- controller now supports verification requests
The previous implementation would send API Sessions to Edge Routers
while partially authenticated. Due to state issues addressed separately
in the c-SDK, these partial API Sessions are maintained if a channel
connected to an edge router was established during reconnect. This would
further cause problems with channel connection using the wrong API
session vs what the rest of the SDK was using.
- routers can now opt to extend their enrollment at any time with a
previous or new key
- adds tests for router enrollment
- adds tests for router enrollment extension
Router state used to be stored and accessed in a thread unsafe way.
State is now locks on a mutex for setting values and values are copied
out for referencing.
hostnames may be a nil pointer at times now due to the fact that edge
routers may be waiting to sync and may be "online" but edge hellos
have not been exchanged.
- edge router sync is now modular and can have different strategies
- plans to make this configurabe in the future with multiple strat
- legacy strategy is called "instant" and is the only option
- instant strat now supports control signaling and resync requests
- edge routers now do not remove connections till after a full sync
- added the ability for the controller to report the er sync status
- added er syn status to GET /edge-routers list and detail
- improved log output in sync logic
- adds ability for any authenticated API Session to create ephemeral
certificates
- allows UPDB session connection
- adds create/delete/read of current api session certificates
- add session cert pem result on create and detail
- fixes ER not updating sessions with new certs from API session
- fixes naming of session vs apiSession on members, functions, etc
- organizes ER state manager functions into apiSession vs session
- adds api session ids to api sessions and sessions sent from the
controller to ERs
- ensure api and ns fingerprints are the same
- filter api session certs by valid periods
- clarify fingerprint func naming
- http requests should hard timeout w/ a reasonable response
- edge routers should close when an API session token is not provided or
does not match
- stream both types of sessions on edge router connect
- stream sessions for time out processing/deletion
- add id to session messages (edge control pb update, breaks backwards
compat)
Paul Lorenz