mirror of https://github.com/openziti/ziti.git synced 2026-10-26 21:47:05 +00:00

Files

T

History

Andrew Martinez 948735d86c fixes openziti/ziti#4094 accept first-party certs issued by a separat… (#4140 )

* fixes openziti/ziti#4094 accept first-party certs issued by a separate edge signing CA

- adds FirstPartyX509CertValidation and ThirdPartyX509CertValidation usages and an
  intermediates field to the router data model public keys, deprecating
  ClientX509CertValidation
- publishes config CA bundle roots as first-party anchors with their intermediates and
  Ca store entries as third-party anchors; controller certs carry JWT validation only,
  since a controller identity is never a CA and anchors no client cert chains
- builds router first-party and client cert trust pools from the published usages,
  falling back to the deprecated usage against older controllers
- propagates the full signing cert chain between controllers via a new mesh
  SigningCertChainHeader and persists whole chains in controller records
- removes the orphaned InstantStrategy.AddPublicKey, dead since public key sync moved
  to controller list data
- gives each command dispatcher its own decoder registry so multiple in-process
  controllers no longer decode into the last-started controller's managers
- adds a three-controller in-process HA test harness with a split signing PKI,
  cluster formation and first-party cert integration tests
- trusts the edge signing CA when verifying router control channel certs
- adds a variadic additionalRoots parameter to VerifyLeafCertChain, applied to a
  clone of the caller's pool so an identity's live tls.Configs are unaffected
- passes the edge enrollment signing CA bundle as additional roots when admitting
  a router control channel connection, so a deployment whose signing CA sits
  outside the controller's own trust bundle no longer has every router refused
- leaves the fingerprint check bound to the verified leaf, so the wider anchor set
  changes which chains verify, not which routers are admitted
- covers the split-root case and the caller-pool guarantee in common/cert tests

2026-08-26 14:07:31 -04:00

decoder.go

Rewrite channel/v4 imports to channel/v5. For #3983

2026-06-18 12:51:02 -04:00

edge_ctrl.pb.go

fixes openziti/ziti#4094 accept first-party certs issued by a separat… (#4140 )

2026-08-26 14:07:31 -04:00

edge_ctrl.proto

fixes openziti/ziti#4094 accept first-party certs issued by a separat… (#4140 )

2026-08-26 14:07:31 -04:00

generate.go

Move protobufs to common

2023-08-04 17:01:15 -04:00

impl.go

Move routers to a subscription model where they subcribe to model data from one controller for a limited time. Fixes #2599

2025-01-07 19:21:53 -05:00

messages.go

Migrate to the sdk-golang v2 module path. For #3884

2026-06-23 15:43:39 -04:00

README.md

consolidated ha changes

2024-02-29 09:27:56 -05:00

README.md

Prerequisites

Install the protoc binary from: https://github.com/protocolbuffers/protobuf/releases
1. The release should include an include folder that needs to be next to the protoc binary
Install the protoc plugin for Go go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
Ensure protoc is on your path.
Ensure your Go bin directory is on your path

Generate Go Code

Two options, run the command manually or use go generate

Go Generate

Navigate to the root project directory edge
run go generate ./common/pb/edge_ctrl_pb/... or go generate \common\pb\edge_ctrl_pb\...

Note: Running a naked go generate will trigger all go:generate tags in the project, which you most likely do not want

Manually

Navigate to the project root
Run: protoc -I ./common/pb/edge_ctrl_pb/ ./common/pb/edge_ctrl_pb/edge_ctrl.proto --go_out=./pb/edge_ctrl_pb