Skip to content

v0.32.0

Pre-release
Pre-release
Compare
Choose a tag to compare
@github-actions github-actions released this 19 Jan 23:45
· 563 commits to release-next since this release
v0.32.0
This tag was signed with the committer’s verified signature. The key has expired.
ziti-ci
GPG key ID: 18E57B781A7A94BB
Expired
Learn about vigilant mode.
97e9244
This commit was created on github.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.

NOTE: This release has bugs related to link management and is not recommended for production use!

Release 0.32.0

What's New

  • Auth Rate Limiter
  • Link Management Fixes
  • ziti edge quickstart command deprecates redundant --already-initialized flag. The identical behavior is implied by --home.

Backwards compatibility

This release includes new response types from the REST authentication APIS. They are now able to return
429 (server too busy) responses to auth requests. As this is an API change, the version number is
being bumped to 0.32.

If controller and router are both v0.32 or later, only the router which dialed a link will report it to the controller.
If the controller is older, newer routers will report links from both the dialing and listening side of the link.

Auth Rate Limiter

In order to prevent clients from overwhelming the server with auth requests, an auth rate limiter has been introduced.
The rate limiter is adaptive, in that it will react to auth attempts timing out by shrinking the number of allowed
queued auth attempts. The number will slowly recover over time.

Example configuration:

edge:
  # This section allows configurating the rate limiter for auth attempts
  authRateLimiter:
    # if disabled, no auth rate limiting with be enforced
    enabled: true
    # the smallest window size for auth attempts
    minSize: 5
    # the largest allowed window size for auth attempts
    maxSize: 250

New metrics:

  • auth.limiter.queued_count - current number of queued auth attempts
  • auth.limiter.window_size - current size at which new auth attempts will be rejected
  • auth.limiter.work_timer - tracks the rate at which api sessions are being created and how long it's taking to create them

Link Management Fixes

With long lived link ids, there was potential for link control message to be ambiguous, as the link id wasn't enough to identify
a specific iteration of that link. An iteration field has been added to links so that messaging is unambiguous.
Links will also only be reported from the dialing router now to reduce ambiguouity and race condition in link control channel
messaging.

Router SSL Handshake Timeout Config

There is a new router config setting which allows setting the SSL handshake timeout for TLS connections, when using ALPN for listeners.

tls:
  handshakeTimeout: 15s

Component Updates and Bug Fixes

Assets 7
Loading