Documentation
¶
Index ¶
- Constants
- func CalculateCaPems(caPems *bytes.Buffer) *bytes.Buffer
- func GetSpiffeIdFromCert(cert *x509.Certificate) (*url.URL, error)
- func GetSpiffeIdFromCertChain(certs []*x509.Certificate) (*url.URL, error)
- func GetSpiffeIdFromIdentity(id identity.Identity) (*url.URL, error)
- func GetSpiffeIdFromTlsCertChain(tlsCerts []*tls.Certificate) (*url.URL, error)
- func ValidateSpiffeId(id *identity.TokenId, spiffeId *url.URL) error
- type Api
- type CertValidatingIdentity
- type Config
- type ConnectEventsConfig
- type CtrlDialerConfig
- type CtrlOptions
- type EdgeConfig
- type Enrollment
- type EnrollmentOption
- type HttpTimeouts
- type IdentityStatusConfig
- type IdentityStatusSource
- type NetworkConfig
- type Oidc
- type RaftConfig
- type Totp
Constants ¶
const ( DefaultProfileMemoryInterval = 15 * time.Second DefaultHealthChecksBoltCheckInterval = 30 * time.Second DefaultHealthChecksBoltCheckTimeout = 20 * time.Second DefaultHealthChecksBoltCheckInitialDelay = 30 * time.Second DefaultRaftCommandHandlerMaxQueueSize = 250 // DefaultTlsHandshakeRateLimiterEnabled is whether the tls handshake rate limiter is enabled by default DefaultTlsHandshakeRateLimiterEnabled = false // TlsHandshakeRateLimiterMinSizeValue is the minimum size that can be configured for the tls handshake rate limiter // window range TlsHandshakeRateLimiterMinSizeValue = 5 // TlsHandshakeRateLimiterMaxSizeValue is the maximum size that can be configured for the tls handshake rate limiter // window range TlsHandshakeRateLimiterMaxSizeValue = 10000 // TlsHandshakeRateLimiterMetricOutstandingCount is the name of the metric tracking how many tasks are in process TlsHandshakeRateLimiterMetricOutstandingCount = "tls_handshake_limiter.in_process" // TlsHandshakeRateLimiterMetricCurrentWindowSize is the name of the metric tracking the current window size TlsHandshakeRateLimiterMetricCurrentWindowSize = "tls_handshake_limiter.window_size" // TlsHandshakeRateLimiterMetricWorkTimer is the name of the metric tracking how long successful tasks are taking to complete TlsHandshakeRateLimiterMetricWorkTimer = "tls_handshake_limiter.work_timer" // DefaultTlsHandshakeRateLimiterMaxWindow is the default max size for the tls handshake rate limiter DefaultTlsHandshakeRateLimiterMaxWindow = 2500 MinRouterDataModelLogSize = 10 DefaultRouterDataModelLogSize = 10000 DefaultRouterDataModelListenerBufferSize = 1000 DefaultRaftSnapshotInterval = 2 * time.Minute DefaultRaftSnapshotThreshold = 500 DefaultRaftTrailingLogs = 500 RaftRateLimiterQueueSizeMetricName = "raft.rate_limiter.queue_size" RaftRateLimiterWorkTimerMetricName = "raft.rate_limiter.work_timer" RaftRateLimiterWindowSizeMetricName = "raft.rate_limiter.window_size" BackgroundQueueMinSize = 10 BackgroundQueueMaxSize = math.MaxUint32 >> 2 DefaultBackgroundQueueEnabled = true DefaultBackgroundQueueSize = 1000 DefaultBackgroundQueueDropWhenFull = false DefaultBackgroundQueueThreshold = 50 * time.Millisecond DefaultConnectEventsQueueSize uint32 = 5 DefaultConnectEventsIdleTime = 30 * time.Second // DefaultCtrlDialer* constants define the default values for the ctrl channel dialer configuration. DefaultCtrlDialerEnabled = false DefaultCtrlDialerDialDelay = 30 * time.Second DefaultCtrlDialerMinRetryInterval = time.Second DefaultCtrlDialerMaxRetryInterval = 5 * time.Minute DefaultCtrlDialerRetryBackoffFactor = 1.5 DefaultCtrlDialerFastFailureWindow = 5 * time.Second DefaultCtrlDialerQueueSize = uint32(32) DefaultCtrlDialerMaxWorkers = uint32(10) )
const ( DefaultEdgeApiActivityUpdateBatchSize = 250 DefaultEdgeAPIActivityUpdateInterval = 90 * time.Second MaxEdgeAPIActivityUpdateBatchSize = 10000 MinEdgeAPIActivityUpdateBatchSize = 1 MaxEdgeAPIActivityUpdateInterval = 10 * time.Minute MinEdgeAPIActivityUpdateInterval = time.Millisecond DefaultEdgeSessionTimeout = 30 * time.Minute MinEdgeSessionTimeout = 1 * time.Minute MinEdgeEnrollmentDuration = 5 * time.Minute DefaultEdgeEnrollmentDuration = 180 * time.Minute DefaultHttpIdleTimeout = 5000 * time.Millisecond DefaultHttpReadTimeout = 5000 * time.Millisecond DefaultHttpReadHeaderTimeout = 5000 * time.Millisecond DefaultHttpWriteTimeout = 100000 * time.Millisecond DefaultTotpDomain = "openziti.io" DefaultAuthRateLimiterEnabled = true DefaultAuthRateLimiterMaxSize = 250 DefaultAuthRateLimiterMinSize = 5 AuthRateLimiterMinSizeValue = 5 AuthRateLimiterMaxSizeValue = 1000 DefaultIdentityOnlineStatusScanInterval = time.Minute MinIdentityOnlineStatusScanInterval = time.Second DefaultIdentityOnlineStatusUnknownTimeout = 5 * time.Minute DefaultIdentityOnlineStatusSource = IdentityStatusSourceHybrid )
const ( DefaultOptionsCreateCircuitRetries = 2 DefaultOptionsCycleSeconds = 60 DefaultOptionsInitialLinkLatency = 65 * time.Second DefaultOptionsPendingLinkTimeout = 10 * time.Second DefaultOptionsMetricsReportInterval = time.Minute DefaultOptionsMinRouterCost = 10 DefaultOptionsRouterConnectChurnLimit = time.Minute DefaultOptionsRouterMessagingMaxWorkers = 100 DefaultOptionsRouterMessagingQueueSize = 100 DefaultOptionsRouteTimeout = 10 * time.Second DefaultOptionsSmartRerouteCap = 4 DefaultOptionsSmartRerouteFraction = 0.02 DefaultOptionsSmartRerouteMinCostDelta = 15 OptionsRouterCommMaxQueueSize = 1_000_000 OptionsRouterCommMaxWorkers = 10_000 )
Variables ¶
This section is empty.
Functions ¶
func CalculateCaPems ¶
CalculateCaPems takes the supplied caPems buffer as a set of PEM Certificates separated by new lines. Duplicate certificates are removed, and the result is returned as a bytes.Buffer of PEM Certificates separated by new lines.
func GetSpiffeIdFromCert ¶
func GetSpiffeIdFromCert(cert *x509.Certificate) (*url.URL, error)
GetSpiffeIdFromCert will search a x509 certificate for a trust domain encoded as a spiffe:// URI SAN. Each certificate must contain 0 or 1 spiffe:// URI SAN. The first SPIFFE id looking up the chain is returned. If no SPIFFE id is encountered, nil is returned. Errors are returned for parsing and processing errors only.
func GetSpiffeIdFromCertChain ¶
func GetSpiffeIdFromCertChain(certs []*x509.Certificate) (*url.URL, error)
GetSpiffeIdFromCertChain cycles through a slice of certificates that goes from leaf up CAs. Each certificate must contain 0 or 1 spiffe:// URI SAN. The first encountered SPIFFE id looking up the chain back to the root CA is returned. If no SPIFFE id is encountered, nil is returned. Errors are returned for parsing and processing errors only.
func GetSpiffeIdFromIdentity ¶
GetSpiffeIdFromIdentity will search an Identity for a trust domain encoded as a spiffe:// URI SAN starting from the server cert and up its signing chain. Each certificate must contain 0 or 1 spiffe:// URI SAN. The first SPIFFE id looking up the chain back to the root CA is returned. If no SPIFFE id is encountered, nil is returned. Errors are returned for parsing and processing errors only.
func GetSpiffeIdFromTlsCertChain ¶
func GetSpiffeIdFromTlsCertChain(tlsCerts []*tls.Certificate) (*url.URL, error)
GetSpiffeIdFromTlsCertChain will search a tls certificate chain for a trust domain encoded as a spiffe:// URI SAN. Each certificate must contain 0 or 1 spiffe:// URI SAN. The first SPIFFE id looking up the chain is returned. If no SPIFFE id is encountered, nil is returned. Errors are returned for parsing and processing errors only.
Types ¶
type CertValidatingIdentity ¶
func (*CertValidatingIdentity) ClientTLSConfig ¶
func (self *CertValidatingIdentity) ClientTLSConfig() *tls.Config
func (*CertValidatingIdentity) ServerTLSConfig ¶
func (self *CertValidatingIdentity) ServerTLSConfig() *tls.Config
func (*CertValidatingIdentity) VerifyConnection ¶
func (self *CertValidatingIdentity) VerifyConnection(state tls.ConnectionState) error
type Config ¶
type Config struct {
Id *identity.TokenId
SpiffeIdTrustDomain *url.URL
AdditionalTrustDomains []*url.URL
Raft *RaftConfig
Network *NetworkConfig
Edge *EdgeConfig
Db boltz.Db
Trace struct {
Handler *channel.TraceHandler
}
Profile struct {
Memory struct {
Path string
Interval time.Duration
}
CPU struct {
Path string
}
}
Ctrl struct {
Listener transport.Address
Options *CtrlOptions
Dialer CtrlDialerConfig
}
HealthChecks struct {
BoltCheck struct {
Interval time.Duration
Timeout time.Duration
InitialDelay time.Duration
}
}
RouterDataModel common.RouterDataModelConfig
Command struct {
RateLimiter command.RateLimiterConfig
Background struct {
Enabled bool
QueueSize uint32
DropWhenFull bool
DelayThreshold time.Duration
}
}
TlsHandshakeRateLimiter command.AdaptiveRateLimitTrackerConfig
ConnectEventsConfig ConnectEventsConfig
Src map[interface{}]interface{}
}
func LoadConfig ¶
func (*Config) IsRaftEnabled ¶
type ConnectEventsConfig ¶
type ConnectEventsConfig struct {
// QueueSize is the size of the work queue for each per-router pool.
QueueSize uint32
// IdleTime is how long a pool worker can be idle before exiting.
IdleTime time.Duration
}
ConnectEventsConfig configures the per-router goroutine pools used to process identity connect/disconnect events. Each router gets its own single-worker pool to ensure events from the same router are processed in order.
type CtrlDialerConfig ¶
type CtrlDialerConfig struct {
Enabled bool
Groups []string
DialDelay time.Duration
MinRetryInterval time.Duration
MaxRetryInterval time.Duration
RetryBackoffFactor float64
FastFailureWindow time.Duration
QueueSize uint32
MaxWorkers uint32
}
CtrlDialerConfig controls how the controller dials ctrl channel listeners advertised by routers.
type CtrlOptions ¶
type CtrlOptions struct {
*channel.Options
NewListener *transport.Address
AdvertiseAddress *transport.Address
RouterHeartbeatOptions *channel.HeartbeatOptions
PeerHeartbeatOptions *channel.HeartbeatOptions
}
CtrlOptions extends channel.Options to include support for additional, non-channel specific options (e.g. NewListener)
type EdgeConfig ¶
type EdgeConfig struct {
Enabled bool
Api Api
Oidc Oidc
Enrollment Enrollment
IdentityStatusConfig IdentityStatusConfig
Totp Totp
AuthRateLimiter command.AdaptiveRateLimiterConfig
DisablePostureChecks bool
// contains filtered or unexported fields
}
func LoadEdgeConfigFromMap ¶
func LoadEdgeConfigFromMap(configMap map[interface{}]interface{}) (*EdgeConfig, error)
func NewEdgeConfig ¶
func NewEdgeConfig() *EdgeConfig
func (*EdgeConfig) AddCaPems ¶
func (c *EdgeConfig) AddCaPems(caPems []byte)
AddCaPems adds a byte array of certificates to the current buffered list of CAs. The certificates should be in PEM format separated by new lines. RefreshCas should be called after all calls to AddCaPems are completed.
func (*EdgeConfig) CaCerts ¶
func (c *EdgeConfig) CaCerts() []*x509.Certificate
func (*EdgeConfig) CaCertsPool ¶
func (c *EdgeConfig) CaCertsPool() *x509.CertPool
func (*EdgeConfig) CaPems ¶
func (c *EdgeConfig) CaPems() []byte
func (*EdgeConfig) RefreshCas ¶
func (c *EdgeConfig) RefreshCas()
func (*EdgeConfig) SessionTimeoutDuration ¶
func (c *EdgeConfig) SessionTimeoutDuration() time.Duration
type Enrollment ¶
type Enrollment struct {
SigningCert identity.Identity
SigningCertConfig identity.Config
SigningCertCaPem []byte
EdgeIdentity EnrollmentOption
EdgeRouter EnrollmentOption
}
type EnrollmentOption ¶
type HttpTimeouts ¶
type HttpTimeouts struct {
ReadTimeoutDuration time.Duration
ReadHeaderTimeoutDuration time.Duration
WriteTimeoutDuration time.Duration
IdleTimeoutsDuration time.Duration
}
func DefaultHttpTimeouts ¶
func DefaultHttpTimeouts() *HttpTimeouts
type IdentityStatusConfig ¶
type IdentityStatusConfig struct {
Source IdentityStatusSource
ScanInterval time.Duration
UnknownTimeout time.Duration
}
type IdentityStatusSource ¶
type IdentityStatusSource uint32
const ( IdentityStatusSourceHeartbeats IdentityStatusSource = 1 IdentityStatusSourceConnectEvents IdentityStatusSource = 2 IdentityStatusSourceHybrid IdentityStatusSource = 3 )
type NetworkConfig ¶
type NetworkConfig struct {
CreateCircuitRetries uint32
CycleSeconds uint32
InitialLinkLatency time.Duration
IntervalAgeThreshold time.Duration
MetricsReportInterval time.Duration
MinRouterCost uint16
PendingLinkTimeout time.Duration
RouteTimeout time.Duration
RouterConnectChurnLimit time.Duration
RouterComm struct {
QueueSize uint32
MaxWorkers uint32
}
Smart struct {
RerouteFraction float32
RerouteCap uint32
MinCostDelta uint32
}
}
func DefaultNetworkConfig ¶
func DefaultNetworkConfig() *NetworkConfig
func LoadNetworkConfig ¶
func LoadNetworkConfig(src map[interface{}]interface{}) (*NetworkConfig, error)
type Oidc ¶
type Oidc struct {
AccessTokenDuration time.Duration
RefreshTokenDuration time.Duration
IdTokenDuration time.Duration
// RevocationMinTokenLifetime skips revocation for refresh tokens that expire
// within this duration. Unset (zero) means always revoke. Must be less than
// 50% of RefreshTokenDuration if set.
RevocationMinTokenLifetime time.Duration
// RevocationBucketInterval is the bucket window for batching refresh-token
// revocations before flushing them through raft.
RevocationBucketInterval time.Duration
// RevocationBucketMaxSize is the maximum number of revocations per raft
// log entry / DB transaction when flushing.
RevocationBucketMaxSize int
// RevocationMaxQueued is the maximum number of revocations that can
// accumulate in memory before new ones are dropped.
RevocationMaxQueued int
// RevocationEnforcerFrequency is how often the controller purges expired
// revocation records from the database.
RevocationEnforcerFrequency time.Duration
}
func (*Oidc) MaxTokenDuration ¶ added in v2.0.1
MaxTokenDuration returns the longest of the configured refresh, access, and id token durations. Revocations are set to expire after this so they outlive any token they target.
type RaftConfig ¶
type RaftConfig struct {
Recover bool
DataDir string
RestartSelf bool
AdvertiseAddress transport.Address
CommandHandlerOptions struct {
MaxQueueSize uint16
}
SnapshotInterval time.Duration
SnapshotThreshold uint32
TrailingLogs uint32
MaxAppendEntries *uint32
ElectionTimeout time.Duration
CommitTimeout *time.Duration
HeartbeatTimeout time.Duration
LeaderLeaseTimeout time.Duration
LogLevel *string
Logger hclog.Logger
WarnWhenLeaderlessFor time.Duration
ApplyTimeout time.Duration
PreferredLeader bool
RateLimiter command.AdaptiveRateLimitTrackerConfig
}