Release 1.6.20

What's New

• Security fixes (see Security Advisories below)
• Fixes a router circuit/goroutine leak that can lead to a router OOM
• Fixes a router panic on routers which aren't hosting tunnel services
• Fixes a controller crash on legacy v1 create-circuit requests with JWT-prefixed tokens
• Scopes terminator operations to the requesting router
• Controller read throughput under load: this release picks up bbolt v1.5.0, which removes a linear
  scan over all open read transactions that ran while holding bbolt's single global transaction
  mutex. Every controller read transaction takes that mutex twice, on open and on close, so the scan
  cost grew with read concurrency and could put a controller serving a high rate of service-list and
  policy queries into a lock convoy: many goroutines waiting on one mutex, a machine that looks
  fully busy while little work completes, and timeouts unexplained by the actual workload.

Security Advisories

This release addresses six security advisories. See the linked GitHub Security Advisories for full
details, impact, and affected versions.

• GHSA-q8g9-jc4c-jp6q (CVE pending) (High) - The controller buffered the entire body of every
  inbound request before any authentication check and with no size cap, so an unauthenticated client could
  exhaust controller memory, and crash it, by sending parallel large-body requests to endpoints such as
  enrollment.
• GHSA-j952-6x8x-jmj6 (CVE pending) (High) - The unauthenticated legacy enrollment path buffered
  the request body a second time, allocating twice the memory per request and roughly halving the bandwidth
  needed to drive the controller out of memory. Amplifies GHSA-q8g9-jc4c-jp6q.
• GHSA-hhm9-wf63-g7qj (CVE pending) (Medium) - When accepting an incoming router-to-router link, a
  router verified the dialing router's identity against the whole presented certificate chain instead of the
  leaf certificate whose key the TLS handshake proved. An attacker holding enrolled router credentials could
  present another router's certificate as filler and be admitted on a link under that router's identity,
  letting it intercept, inject, drop, or strand the circuits routed over that link.
• GHSA-6v5r-p2wr-q492 (CVE pending) (Medium) - The current-api-session certificates endpoint
  performed an unscoped list, so any authenticated user could read the API session certificates (subject
  DNs, fingerprints, and full PEM chains) of all identities, not just their own.
• GHSA-whjr-3j94-gw3c (CVE pending) (Medium) - A JWKS endpoint URL configured on an external JWT
  signer was fetched server-side with no timeout, private-range blocking, or allowlist, letting a caller with
  external-jwt-signer management access make the controller issue requests to arbitrary internal URLs,
  including cloud metadata endpoints (SSRF).
• GHSA-354c-gpg9-j988 (CVE pending) (Low) - With promptOnWake or promptOnUnlock enabled on an MFA
  posture check, the edge router dereferenced a nil wake/unlock timestamp while locally evaluating an
  authorized client's dial or bind, panicking and crashing the router (data-plane denial of service).

Contributors

Thanks to the community members who contributed to this release.

• @msbusk diagnosed the circuit leak in
  #4184 and validated the fix against a
  production workload.

Component Updates and Bug Fixes

• github.com/openziti/ziti: v1.6.19 -> v1.6.20
  • Issue #4270 - [Backport-1.6] Router leaks LinkSendBuffer goroutines in drainDeadlines() — circuits accumulate until the router OOMs
  • Issue #4114 - Router panics on ERT-terminator inspect when it hosts no tunnel services (1.6.x)
  • Issue #4237 - [Backport-1.6] Ensure terminator operations are scoped by source router
  • Issue #4243 - [Backport-1.6] Legacy v1 create-circuit handler crashes the controller on JWT-prefixed tokens