Files
ziti/controller/command/command.go
T
Andrew Martinez 8c919dfbe2 backport openziti/ziti#4094 to release-v2.0.x accept first-party certs issued by a separate edge signing CA (#4153)
- publishes FirstPartyX509CertValidation/ThirdPartyX509CertValidation usages and
  intermediates on router data model public keys, deprecating ClientX509CertValidation
- builds the router first-party cert pool from RDM first-party keys unioned with
  ctrl-channel roots; TLS and VerifyClientCert paths share buildClientCertRoots with
  fallback to the deprecated usage for old controllers
- trusts the edge enrollment signing CA when verifying the certificate a router
  presents on the control channel, so a signing CA outside the controller's own
  trust bundle no longer refuses every router; the anchors go into a clone of the
  identity's pool, never the pool its live tls.Configs share
- propagates full controller signing cert chains over the mesh via
  SigningCertChainHeader and persists them in Controller store CertPem
- sends stored public keys during router sync instead of rebuilding them; publishes
  controller certs leaf-only
- stops router controller reconnect loops after shutdown
- gives each in-process controller its own command decoder registry
- adds the ha-3 three-controller harness and first-party cert integration tests
- drains the cli test stdout pipe while commands run; anchors the totp token
  issued-at assertion to the test clock
- backports the SPIFFE-capable test PKI from openziti/ziti#3947: --not-before on
  ziti pki create, tests/testdata/create-pki.sh/.ps1, and the generated PKI under
  tests/testdata/pki including the separate edge signing root and per-controller
  signing intermediates; existing config sets stay on the testdata/ca PKI
- skips *.pem, *.cert and *.key files in codespell
2026-08-26 14:43:34 -04:00

168 lines
4.7 KiB
Go

/*
Copyright NetFoundry Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package command
import (
"reflect"
"sync"
"github.com/michaelquigley/pfxlog"
"github.com/openziti/channel/v4"
"github.com/openziti/foundation/v2/debugz"
"github.com/openziti/foundation/v2/rate"
"github.com/openziti/ziti/v2/common/pb/ctrl_pb"
"github.com/openziti/ziti/v2/controller/change"
"github.com/openziti/ziti/v2/controller/storage/boltz"
"github.com/sirupsen/logrus"
)
// Command instances represent actions to be taken by the fabric controller. They are serializable,
// so they can be shipped from one controller for RAFT coordination
type Command interface {
// Apply runs the commands
Apply(ctx boltz.MutateContext) error
// GetChangeContext returns the change context associated with the command
GetChangeContext() *change.Context
// Encode returns a serialized representation of the command
Encode() ([]byte, error)
}
// CriticalCommand marks commands that establish base state (e.g. a snapshot restore). A failed apply
// of one must halt the node rather than log-and-advance the raft index, which would leave the node
// caught up on index but missing data. Ordinary commands are logged and skipped on failure.
type CriticalCommand interface {
Command
IsCriticalCommand()
}
// Validatable instances can be validated. Command instances which implement Validable will be validated
// before Command.Apply is called
type Validatable interface {
Validate() error
}
// Dispatcher instances will take a command and either send it to the leader to be applied, or if the current
// system is the leader, apply it locally
type Dispatcher interface {
Dispatch(command Command) error
IsLeaderOrLeaderless() bool
IsLeaderless() bool
IsLeader() bool
GetPeers() map[string]channel.Channel
GetRateLimiter() rate.RateLimiter
Bootstrap() error
CtrlAddresses() (uint64, []string, []*ctrl_pb.CtrlDetail)
// GetDecoders returns the command decoder registry used to decode commands dispatched
// through this dispatcher. Each dispatcher owns its own registry so multiple controllers
// in one process don't decode each other's commands.
GetDecoders() Decoders
}
// LocalDispatcher should be used when running a non-clustered system
type LocalDispatcher struct {
EncodeDecodeCommands bool
Limiter rate.RateLimiter
decodersInit sync.Once
decoders Decoders
}
func (self *LocalDispatcher) GetDecoders() Decoders {
self.decodersInit.Do(func() {
self.decoders = NewDecoders()
})
return self.decoders
}
func (self *LocalDispatcher) Bootstrap() error {
return nil
}
func (self *LocalDispatcher) IsLeader() bool {
return true
}
func (self *LocalDispatcher) IsLeaderOrLeaderless() bool {
return true
}
func (self *LocalDispatcher) IsLeaderless() bool {
return false
}
func (self *LocalDispatcher) GetPeers() map[string]channel.Channel {
return nil
}
func (self *LocalDispatcher) GetRateLimiter() rate.RateLimiter {
return self.Limiter
}
func (self *LocalDispatcher) CtrlAddresses() (uint64, []string, []*ctrl_pb.CtrlDetail) {
return 0, nil, nil
}
func (self *LocalDispatcher) Dispatch(command Command) error {
defer func() {
if p := recover(); p != nil {
pfxlog.Logger().
WithField(logrus.ErrorKey, p).
WithField("cmdType", reflect.TypeOf(command)).
Error("error while dispatching command of type")
debugz.DumpLocalStack()
panic(p)
}
}()
changeCtx := command.GetChangeContext()
if changeCtx == nil {
changeCtx = change.New().SetSourceType("unattributed").SetChangeAuthorType(change.AuthorTypeUnattributed)
}
if self.EncodeDecodeCommands {
bytes, err := command.Encode()
if err != nil {
return err
}
cmd, err := self.GetDecoders().Decode(bytes)
if err != nil {
return err
}
command = cmd
}
return self.Limiter.RunRateLimited(func() error {
ctx := changeCtx.NewMutateContext()
return command.Apply(ctx)
})
}
// Decoder instances know how to decode encoded commands
type Decoder interface {
Decode(commandType int32, data []byte) (Command, error)
}
// DecoderF is a function version of the Decoder interface
type DecoderF func(commandType int32, data []byte) (Command, error)
func (self DecoderF) Decode(commandType int32, data []byte) (Command, error) {
return self(commandType, data)
}