mirror of
https://github.com/openziti/ziti.git
synced 2026-09-11 13:29:03 +00:00
Paul Lorenz
898c95b217
Forward ports the GHSA-mrpr-756c-xm47 fix, released in 2.0.2, to main. - adds a shared cert.VerifyLeafCertChain helper that verifies the presented leaf (certs[0], whose private key the TLS handshake proved) against the node's full trusted-CA pool, treating certs[1:] only as candidate intermediates - uses it for controller cluster mesh peer connections and router link connections, which previously accepted a connection when any presented certificate chained to the trusted CA while taking peer identity from the leaf - matches the pinned metrics scrape certificate against the presented leaf only, comparing full DER rather than just the signature, and rejects a leaf outside its validity window - adds negative-path tests covering rogue leaves paired with CA-chained filler certificates