Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

support domain substitutions #540

Open
scareything opened this issue Oct 27, 2022 · 2 comments
Open

support domain substitutions #540

scareything opened this issue Oct 27, 2022 · 2 comments

Comments

@scareything
Copy link
Member

scareything commented Oct 27, 2022

Adding some variables that are resolved when evaluating intercept.v1 dialOptions.identity would make it easier to support multiple remote networks. This follows from discussion on discourse.

Proposed variables

variable description example value
$dst_fqdn the fqdn that was intercepted. this is a synonym for $dst_hostname, but $dst_fqdn seems more clear "host1.region1.dc1.openziti.io"
$dst_host the host portion of the intercepted fqdn "host1"
$dst_domain the domain portion of the intercepted fqdn "openziti.io"
$dst_subdomain the complete subdomain portion of $dst_fqdn "region1.dc1"
$dst_subdomain[n] the n'th subdomain (starting from the right) in $dst_subdomain $dst_subdomain[0] == "dc1", $dst_subdomain[1] == "region1"
$dst_matched_wildcard the wildcard domain if $dst_fqdn matches an intercepted wildcard domain e.g. if wildcard is "*.dc1.openziti.io" then $dst_matched_wildcard == "dc1.openziti.io"
@jesse2point0
Copy link

jesse2point0 commented Aug 13, 2023

To clarify, $dst_host would match output of the `hostname' command of a Device, correct? If so, PERFECT!

How would devices with no domain (p2p hosts) be identified beyond their hostname? A scenario might be that there are two hosts named frontdeskpc in two different networks. Is there any conflict? They can be further distinguished by subnet or tag or attributes?

@scareything
Copy link
Member Author

It can be easy to forget that ziti "hostnames" are completely fictional as far as the hosts are concerned - that is unless you intentionally align the system hostnames with your ziti hostnames. When using $dst_hostname and the like, the ziti hostnames are just the addresses that you use to access other devices through the openziti overlay.

So you're free to line up system hostnames with ziti identities, but that alignment is really just a coincidence that you created (and probably need to maintain and keep straight). If you do this, and the hostnames are not sufficient to uniquely identify each device, then you'd probably quickly find that the openziti controller does not allow identities to have the same name.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants