Commit Graph

  • f428793fa3 Merge pull request #4211 from openziti/backport.v1.6.x.fix.openziti.ziti.4206.connection-tracker-deadlock v1.6.19 Paul Lorenz 2026-07-31 15:53:57 -04:00
  • 18518041b7 Fix lock order inversion in ConnectionTracker. Fixes #4208 Paul Lorenz 2026-07-31 14:08:53 -04:00
  • d3fa41a6fc Fix lock order inversion in ConnectionTracker. Fixes #4207 Paul Lorenz 2026-07-31 14:08:34 -04:00
  • 0451ca7ebc Fix lock order inversion in ConnectionTracker. Fixes #4206 Paul Lorenz 2026-07-31 14:08:08 -04:00
  • a322c5d4e4 Add walking-skeleton integration test for SDK reroute takeover sdk-rerouting Paul Lorenz 2026-07-30 19:32:22 -04:00
  • cbb38eece9 Add router takeover handler, stale-fault guards, and capability Paul Lorenz 2026-07-31 10:13:22 -04:00
  • 6326203b5d Add controller Limbo state, takeover splice, and reroute token issuance Paul Lorenz 2026-07-31 10:13:08 -04:00
  • 922f4d8071 Add SDK rerouting design doc Paul Lorenz 2026-07-31 10:12:31 -04:00
  • 737b289132 Adapt the router xgress data-plane adapter to the multipath interface Paul Lorenz 2026-07-29 16:38:03 -04:00
  • 6ed04e095b Make circuit endpoint cleanup endpoint-scoped. Fixes #4081 Paul Lorenz 2026-07-02 18:57:59 -04:00
  • f6e5a49872 Add FaultReason to the Fault message Paul Lorenz 2026-07-22 15:15:43 -04:00
  • 3f507ac2b9 Make circuit endpoint cleanup endpoint-scoped. Fixes #4081 issue-4081-endpoint-scoped-cleanup Paul Lorenz 2026-07-02 18:57:25 -04:00
  • 20b97ec073 Merge pull request #4168 from openziti/backport.v2.0.x.fix.openziti.ziti.4165.terminator-remove-ownership Paul Lorenz 2026-07-30 15:33:47 -04:00
  • c9af14fb87 Honor ZITI_LOG_NO_JSON and restore terminal-aware log default. Fixes #4204 Paul Lorenz 2026-07-30 14:21:13 -04:00
  • 538f0d31ec Merge pull request #4080 from openziti/issue-4079-disconnect-router-reroute-ordering Paul Lorenz 2026-07-30 11:46:53 -04:00
  • c402275559 Merge pull request #4077 from openziti/fix-totp-token-iat-flake Paul Lorenz 2026-07-30 11:46:31 -04:00
  • 8dcc60d319 Add tests for opaque service session token loading Paul Lorenz 2026-07-30 10:58:05 -04:00
  • 7281cb156c Add tests for opaque service session token loading Paul Lorenz 2026-07-30 10:56:12 -04:00
  • 465b34d38c Merge pull request #4186 from openziti/update-deps-and-changelog v2.1.0-pre1 Paul Lorenz 2026-07-28 16:31:41 -04:00
  • 43fd23fdb8 Update changelog and deps in preparation for v2.1.0-pre1 Paul Lorenz 2026-07-23 20:09:10 -04:00
  • 6430e6c632 Merge pull request #4187 from openziti/fix-package-publish Clint Dovholuk 2026-07-28 14:17:45 -04:00
  • 72ec06934d Merge pull request #4188 from openziti/backport.v2.0.x.promote-downstreams Clint Dovholuk 2026-07-28 14:17:42 -04:00
  • c04ef14698 backport to 2.0.x - notification success should not block a release dovholuknf 2026-07-28 13:25:26 -04:00
  • d56f7981a3 Add optional tag input to promote-downstreams workflow Paul Lorenz 2026-05-27 10:05:45 -04:00
  • 215eec7f09 Drop release-build wait gate from promote-downstreams workflow Paul Lorenz 2026-05-27 09:45:45 -04:00
  • 3744441b47 keep chat notifications from blocking releases and document promotion recovery dovholuknf 2026-07-28 13:05:09 -04:00
  • 2334be5b4c Merge pull request #4183 from openziti/fix/forward-port-cert-validation-advisories Paul Lorenz 2026-07-28 12:31:09 -04:00
  • 73de47dc98 Note the 2.0.2 security advisories in the 2.1.0 release notes Paul Lorenz 2026-07-27 17:41:04 -04:00
  • f3a27b32a8 Validate router certificates on typed control channel connections Paul Lorenz 2026-07-27 17:40:35 -04:00
  • 898c95b217 Verify peer certificate chains against the leaf on control-plane connections Paul Lorenz 2026-07-27 17:39:48 -04:00
  • f4459ab2bf Merge commit from fork v1.6.18 Paul Lorenz 2026-07-27 15:12:10 -04:00
  • 11897fba7b Merge commit from fork v2.0.2 Paul Lorenz 2026-07-27 15:12:10 -04:00
  • cccdb6c691 Merge commit from fork Paul Lorenz 2026-07-27 15:11:53 -04:00
  • 9903cdd4f4 Merge commit from fork Paul Lorenz 2026-07-27 15:11:53 -04:00
  • 73361f9e66 Add security advisories to 1.6.18 release notes Paul Lorenz 2026-07-27 14:07:53 -04:00
  • 6b342c9515 Verify router leaf against full CA bundle without EKU restriction Paul Lorenz 2026-07-21 16:58:20 -04:00
  • 340157e2a5 Validate router certificates on typed control channel connections Paul Lorenz 2026-07-21 10:31:00 -04:00
  • 119c05c229 Add shared client certificate chain verification helper Paul Lorenz 2026-07-21 10:31:00 -04:00
  • e8e31ce9ba Add security advisories to 1.6.18 release notes Paul Lorenz 2026-07-27 14:07:30 -04:00
  • 621e9dc531 Verify peer leaf against full CA bundle without EKU restriction Paul Lorenz 2026-07-21 16:57:05 -04:00
  • b4d1231265 Add stricter certificate chain validation for peer connections Paul Lorenz 2026-07-21 10:26:52 -04:00
  • c2326fd1e7 Add shared client certificate chain verification helper Paul Lorenz 2026-07-21 10:26:52 -04:00
  • d6104e00f4 Add security advisories to 2.0.2 release notes Paul Lorenz 2026-07-27 14:06:44 -04:00
  • 3e6f0f2a76 Verify router leaf against full CA bundle without EKU restriction Paul Lorenz 2026-07-21 16:55:11 -04:00
  • 7e0cfdf190 Add server-auth certificate chain verification helper Paul Lorenz 2026-07-20 22:46:21 -04:00
  • d9ddd98423 Add negative-path tests for control channel connection validation Paul Lorenz 2026-07-20 14:53:03 -04:00
  • abf9cf8b1b Validate router certificates on typed control channel connections Paul Lorenz 2026-07-16 16:02:56 -04:00
  • d0440227bb Add shared client certificate chain verification helper Paul Lorenz 2026-07-20 14:25:05 -04:00
  • 6fe7fabebf Add security advisories to 2.0.2 release notes Paul Lorenz 2026-07-27 14:05:17 -04:00
  • f347f1a246 Verify peer leaf against full CA bundle without EKU restriction Paul Lorenz 2026-07-21 16:53:52 -04:00
  • dd54f108b4 Make mesh peer certificate validation direction-aware Paul Lorenz 2026-07-20 22:46:06 -04:00
  • cada8b364a Add negative-path tests for peer connection certificate validation Paul Lorenz 2026-07-20 14:54:59 -04:00
  • 2c60866d3e Add stricter certificate chain validation for peer connections Paul Lorenz 2026-07-20 14:25:05 -04:00
  • dbe3b67143 Add shared client certificate chain verification helper Paul Lorenz 2026-07-20 14:25:05 -04:00
  • 7e2474c610 remove two unused lines that deviate from main's test, working on understanding why the third is needed dovholuknf 2026-07-27 12:16:22 -04:00
  • 953215370f backport: expand wildcard server-cert SANs to allow-listed OIDC issuers dovholuknf 2026-07-27 11:46:54 -04:00
  • c06d52798a allow OS-trusted controller certs with ziti login dovholuknf 2026-07-27 11:38:03 -04:00
  • a87e7326e7 Merge pull request #4154 from openziti/backport.2.0.x.issue.4149 Clint Dovholuk 2026-07-27 07:45:48 -04:00
  • 3e5abf1696 adds regression test for api session certificate scoping Andrew Martinez 2026-07-24 16:36:48 -04:00
  • 8ef4e50b02 Reject terminator removals from a router that does not own them. Fixes #4166 Paul Lorenz 2026-07-24 15:50:38 -04:00
  • 5293b195f6 fixes GHSA-j952-6x8x-jmj6 reuse buffered request body in legacy enrollment Andrew Martinez 2026-07-24 12:29:34 -04:00
  • c0bf5b7126 Signal retry on leaderless terminator operations. Fixes #4161 Paul Lorenz 2026-07-24 11:43:33 -04:00
  • d838e209ac Signal retry on leaderless terminator operations. Fixes #4160 Paul Lorenz 2026-07-24 11:43:33 -04:00
  • 04dd0b16c9 typo add.l2.config.types Shawn Carey 2026-07-24 08:09:34 -04:00
  • 516427e9d9 deflake test Shawn Carey 2026-07-22 15:12:27 -04:00
  • 0b2af3edd7 update changelog Shawn Carey 2026-07-22 14:17:28 -04:00
  • 09b2611585 update username Shawn Carey 2026-06-26 14:35:59 -04:00
  • 565444880d add l2 config types Shawn Carey 2026-06-26 14:30:45 -04:00
  • 6f5f68d939 Merge pull request #4151 from openziti/issue-4149-fix-upgrade-when-process-is-running Clint Dovholuk 2026-07-24 06:50:33 -04:00
  • 472b32c668 fixes GHSA-q8g9-jc4c-jp6q limit pre-auth request body buffering Andrew Martinez 2026-07-23 10:22:23 -04:00
  • 1fb93fddae require stop to succeed and verify it starts back up dovholuknf 2026-07-23 16:27:05 -04:00
  • 9a4564f36c require stop to succeed and verify it starts back up dovholuknf 2026-07-23 16:22:16 -04:00
  • 464d5d0c4f allow upgrading from 1.6 when service is already running dovholuknf 2026-07-23 11:54:05 -04:00
  • 69bac7aaeb allow upgrading from 1.6 when service is already running dovholuknf 2026-07-23 11:54:05 -04:00
  • 9054e77fff Accept legacy sessions and signal recovery for invalid service tokens. Fixes #4145 Paul Lorenz 2026-07-23 10:53:22 -04:00
  • f219e6d035 Accept legacy sessions and signal recovery for invalid service tokens. Fixes #4145 Paul Lorenz 2026-07-23 10:53:22 -04:00
  • aadd338fd7 set dns ip range before creating interceptor (#4131) Shawn Carey 2026-07-23 07:27:43 -04:00
  • 18dfaf4058 set dns ip range before creating interceptor [v2.0.x] (#4130) Shawn Carey 2026-07-23 07:27:24 -04:00
  • 8b513d1e9f set dns ip range before creating interceptor [v1.6.x] (#4129) Shawn Carey 2026-07-23 07:27:09 -04:00
  • 47f21654dd Filter service policies by string type in enforcer/list queries. Fixes #4141 Paul Lorenz 2026-07-22 15:44:46 -04:00
  • 091ca0ef07 Filter service policies by string type in enforcer/list queries. Fixes #4141 Paul Lorenz 2026-07-22 15:44:46 -04:00
  • e7d23ef0ae fixes openziti/ziti#3990 push service and posture changes to subscrib… (#4057) Andrew Martinez 2026-07-22 16:52:39 +01:00
  • c25d2d554b Sign legacy session JWT with the durable session id. Fixes #4125 Paul Lorenz 2026-07-21 21:19:38 -04:00
  • 42823383be Sign legacy session JWT with the durable session id. Fixes #4125 Paul Lorenz 2026-07-21 21:19:38 -04:00
  • e9309f530b Merge pull request #4113 from openziti/backport-v1.6.x-bbolt-mem Paul Lorenz 2026-07-21 11:49:43 -04:00
  • 8ccf025fd9 Merge pull request #4112 from openziti/backport-v2.0.x-bbolt-mem Paul Lorenz 2026-07-21 11:26:52 -04:00
  • 78e288fa6d Merge pull request #4109 from openziti/fix-terminator-peerdata-mmap Paul Lorenz 2026-07-21 11:21:39 -04:00
  • 05840b16c5 Fix flaky iat comparison in Test_API_Session_TOTP_Tokens Paul Lorenz 2026-07-02 15:25:41 -04:00
  • 0c3015190f Backfill cluster id on leadership; make InitClusterId idempotent. For #4104 Paul Lorenz 2026-07-17 11:55:53 -04:00
  • d8cedeb8ea Persist cluster id across migration snapshot restore. For #4104 Paul Lorenz 2026-07-17 11:34:39 -04:00
  • 11e049a452 Halt on critical-command apply failure instead of advancing. For #4104 Paul Lorenz 2026-07-14 23:02:08 -04:00
  • 63b9dd6e79 Drop divergent mesh peers on cluster-id change; refuse forked bootstrap. For #4104 Paul Lorenz 2026-07-14 22:50:18 -04:00
  • 3c12fe9dd4 Warn when db is set on an already-initialized cluster. For #4104 Paul Lorenz 2026-07-14 22:38:00 -04:00
  • 450b98b9a1 Validate migration source db has data before restore. For #4104 Paul Lorenz 2026-07-14 22:34:21 -04:00
  • 5437d7f728 Load cluster id before starting raft and mesh. For #4104 Paul Lorenz 2026-07-14 22:25:16 -04:00
  • 6f244eef3b Copy eventual event data out of bolt memory. For #4108 Paul Lorenz 2026-07-15 19:12:28 -04:00
  • dc863f432e Copy terminator peer data and instance secret out of bolt memory. Fixes #4108 Paul Lorenz 2026-07-15 17:00:39 -04:00
  • 098bf285aa Copy eventual event data out of bolt memory. For #4108 Paul Lorenz 2026-07-15 19:12:28 -04:00
  • 1dc6df28ae Copy terminator peer data and instance secret out of bolt memory. Fixes #4108 Paul Lorenz 2026-07-15 17:00:39 -04:00
  • 95d6210e22 Copy eventual event data out of bolt memory. For #4108 Paul Lorenz 2026-07-15 19:12:28 -04:00