mirror of
https://github.com/openziti/ziti.git
synced 2026-09-10 08:45:41 +00:00
Andrew Martinez
f64b6879cf
- adds HardenedJwksResolver, a jwks.Resolver that fetches an external jwt signer's jwksEndpoint with an http/https-only scheme check, a total timeout and a redirect cap - adds JwksFetchPolicy, gating a fetch on both the URL hostname and the address being connected to, applied to the first request and to every redirect hop - hostname gate: deniedHostnames blocks, allowedHostnames is exclusive when set; entries are an exact hostname or a '*.suffix' wildcard that matches subdomains at any depth but never the suffix itself, normalized to lower case punycode without a trailing dot - address gate: built-in blocked (metadata, link-local, link-local multicast, unspecified), then deniedIPs, then allowedIPs, then blockPrivateAddresses, first-match-wins with deny over allow - keeps the gates independent, so neither can authorize what the other refuses; the address check runs in the dialer against the resolved address, so a hostname that resolves to a blocked address is refused - adds the [edge.externalJwtSigners.jwksFetch] config section with compatible defaults: empty hostname lists, blockPrivateAddresses false, timeout 5s, maxRedirects 5 - takes IP lists as a flat address or a CIDR block, hostname lists as names only, and rejects an entry belonging to the other list at startup - rejects a jwksEndpoint the policy refuses when an external jwt signer is created or updated, and logs an existing signer whose endpoint the configuration now refuses when the token issuer cache loads - documents both gates, their deny-wins precedence, the accepted entry forms and the wildcard matching rules in etc/ctrl.with.edge.yml and CHANGELOG.md