Release notes 1.2.1

Issues Fixed and Dependency Updates

• github.com/openziti/sdk-golang: v1.2.0 -> v1.2.1

  • Issue #777 - OIDC auth token refresh doesn't fall back to re-auth if token has expired
  • Issue #772 - xgress close tweaks
  • Issue #769 - Require sdk flow control when using more than one default connection

• github.com/openziti/channel/v4: v4.2.16 -> v4.2.18

  • Issue #201 - SendAndWait methods should return an error if the channel closes instead of blocking
  • Issue #199 - Reject multi-underlay connections that are the first connection for a channel, but aren't marked as such.

Release notes 1.2.0

What's New

This release contains substantial revisions to the SDK flow control feature first released in v1.1.0.
See the v1.1.0 release notes for more details.

It has now received a substantial amount of testing including long running tests and backwards compatibility testing.

These features should be used with version 1.6.6 or newer of OpenZiti.

It is still considered experimental, and the feature and APIs may still change, however Go SDK
users who are multi-plexing connections, are encouraged to try it out.

Once it has undergone sufficient soak time in a production environment, it will marked as stable.

Configuration

SDK Flow Control

If the router being connected to supports it, the sdk can now manage flow control
instead of delegating that to the router. This is mostly important when running
multiple simultaneous circuits through the SDK. When running multiple circuits,
a slow circuit can get stalled at the router because of flow control back-pressure.
This then back-pressures all circuits from the SDK to that router.

By moving the flow-control to the SDK, a slow circuit will not negatively impact
other circuits to the same router.

NOTE: If multiple default SDK connections are configured, then sdk flow control will
be required and turned on. This is because if you use multiple connections to send
payloads, they can get out of order, and the sdk flow control will reorder them
correctly, whereas the non-flow-control implementation assumes ordering is
handled by using a single TCP connection.

SDK flow control is enabled in the DialOptions and ListenOptions for the dial and hosting sides respectively.

t := true
dialOptions := &ziti.DialOptions{
    ConnectTimeout: wf.ConnectTimeout,
    SdkFlowControl: &t,
}

listenOptions := ziti.DefaultListenOptions()
listenOptions.SdkFlowControl = &t

This feature is still marked experimental to allow us to make breaking changes in case any issues are found.

Multi-underlay Configuration

// If set to a number greater than one, the sdk will attempt to create multiple connections to edge routers.
// This configuration value should not be considered part of the stable API yet. It currently defaults to one,
// but it may default to a larger number at some point in the future or be removed. If set to zero, it will
// be reset to one.
MaxDefaultConnections uint32 `json:"-"`

// If set to a number greater than zero, the sdk will attempt to create one or more separate connection to
// each edge routers for control plane data, such as dials. This configuration value should not be considered
// part of the stable API yet. It currently defaults to zero, but it may default to 1 at some point in the future
// or be removed.
MaxControlConnections uint32 `json:"-"`

Note that if MaxDefaultConnections is set to a value greater than 1, sdk flow control will be required and
will be enabled.

Issues Fixed and Dependency Updates

• github.com/openziti/sdk-golang: v1.1.2 -> v1.2.0

  • Issue #769 - Require sdk flow control when using more than one default connection
  • Issue #765 - Allow independent close of xgress send and receive
  • Issue #763 - Use a go-routine pool for payload ingest
  • Issue #761 - Use cmap.ConcurrentMap for message multiplexer
  • Issue #754 - panic: unaligned 64-bit atomic operation when running on 32-bit raspberry pi
  • Issue #757 - Not authenticated check fails on session create when using OIDC

• github.com/golang-jwt/jwt/v5: v5.2.2 -> v5.2.3

• github.com/openziti/channel/v4: v4.2.0 -> v4.2.15

  • Issue #194 - Add GetUnderlays and GetUnderlayCountsByType to Channel

• github.com/openziti/edge-api: v0.26.45 -> v0.26.46

  • Issue #155 - Add network interface list to routers and identities

• github.com/openziti/foundation/v2: v2.0.63 -> v2.0.70

  • Issue #443 - Allow injecting custom method into go-routine pools, to allow identifying them in stack dumps

• github.com/openziti/identity: v1.0.101 -> v1.0.109

• github.com/openziti/metrics: v1.4.1 -> v1.4.2

• github.com/openziti/secretstream: v0.1.34 -> v0.1.37

• github.com/openziti/transport/v2: v2.0.171 -> v2.0.182

• github.com/zitadel/oidc/v3: v3.39.0 -> v3.41.0

• golang.org/x/sys: v0.33.0 -> v0.34.0

• golang.org/x/crypto: v0.38.0 -> v0.40.0

• golang.org/x/net: v0.40.0 -> v0.42.0

• golang.org/x/sync: v0.14.0 -> v0.16.0

• golang.org/x/term: v0.32.0 -> v0.33.0

• golang.org/x/text: v0.25.0 -> v0.27.0

Release notes 1.1.2

Issues Fixed and Dependency Updates

• github.com/openziti/sdk-golang: v1.1.1 -> v1.1.2

  • Issue #742 - Additional CtrlId and GetDestinationType for inspect support
  • Issue #739 - go-jose v2.6.3 CVE-2025-27144 resolution

• github.com/zitadel/oidc/v3: v2.12.2 -> v3.39.0

• github.com/go-jose/go-jose/v4: v4.0.5 (new)

• github.com/zitadel/logging: v0.6.2 (new)

• github.com/zitadel/schema: v1.3.1 (new)

Release notes 1.1.1

Multi-underlay channel group secret

For additional security the experimental multi-underlay channel code now requires that
clients provide a shared secret. This ensures that channels are get the expected
underlays without requiring much larger group ids. This will require support on the
server side, so if the feature is enabled, router version 1.6.2+ will be required.

Issues Fixed and Dependency Updates

• github.com/openziti/sdk-golang: v1.1.0 -> v1.1.1

  • Issue #735 - Ensure Authenticate can't be called in parallel

• github.com/openziti/channel/v4: v4.0.6 -> v4.1.3

  • Issue #187 - Allow fallback to regular channel when 'is grouped' isn't set when using multi-listener
  • Issue #185 - Add group secret for multi-underlay channels

• github.com/openziti/edge-api: v0.26.42 -> v0.26.45

• github.com/openziti/foundation/v2: v2.0.59 -> v2.0.63

• github.com/openziti/secretstream: v0.1.32 -> v0.1.34

• github.com/openziti/transport/v2: v2.0.168 -> v2.0.171

• golang.org/x/oauth2: v0.29.0 -> v0.30.0

• golang.org/x/sys: v0.32.0 -> v0.33.0

• golang.org/x/crypto: v0.36.0 -> v0.38.0

• golang.org/x/net: v0.38.0 -> v0.40.0

• golang.org/x/sync: v0.12.0 -> v0.14.0

• golang.org/x/term: v0.30.0 -> v0.32.0

• golang.org/x/text: v0.23.0 -> v0.25.0

Release notes 1.1.0

What's New

• Experimental support for sdk based flow-control
• Config change for multiple underlays

SDK Flow Control

If the router being connected to supports it, the sdk can now manage flow control
instead of delegating that to the router. This is mostly important when running
multiple simultaneous circuits throught the SDK. When running multiple circuits,
a slow circuit can get stalled at the router because of flow control back-pressure.
This then back-pressures all circuits from the SDK to that router.

By moving the flow-control to the SDK, a slow circuit will not negatively impact
other circuits to the same router. This is currently enabled in the DialOptions
and ListenOptions for the dial and hosting sides respectively.

t := true
dialOptions := &ziti.DialOptions{
    ConnectTimeout: wf.ConnectTimeout,
    SdkFlowControl: &t,
}

listenOptions := ziti.DefaultListenOptions()
listenOptions.SdkFlowControl = &t

As this is an experimental feature, the configuration may change or be removed
in the future.

Config Changes

The multi-underlay configuration has changed. There are now two settings.

// If set to a number greater than one, the sdk will attempt to create multiple connections to edge routers.
// This configuration value should not be considered part of the stable API yet. It currently defaults to one,
// but it may default to a larger number at some point in the future or be removed. If set to zero, it will
// be reset to one.
MaxDefaultConnections uint32 `json:"-"`

// If set to a number greater than zero, the sdk will attempt to create one or more separate connection to
// each edge routers for control plane data, such as dials. This configuration value should not be considered
// part of the stable API yet. It currently defaults to zero, but it may default to 1 at some point in the future
// or be removed.
MaxControlConnections uint32 `json:"-"`

The old EnableSeparateControlPlaneConnection setting is gone. Set MaxControlConnections to 1 to enable
separation of control plane data.

Note that while present, the MaxDefaultConnections should not be used yet.

Issues Fixed and Dependency Updates

• github.com/openziti/sdk-golang: v1.0.2 -> v1.1.0

  • Issue #702 - [Go SDK] Support xgress flow control from the SDK

• github.com/openziti/channel/v4: v4.0.4 -> v4.0.6

  • Issue #182 - MultiListener can deadlock
  • Issue #180 - Add GetUserData to Channel interface

• github.com/openziti/identity: v1.0.100 -> v1.0.101

  • Issue #64 - Support a way to check if a cert/serverCert can be saved

Release notes 0.24.0

Issues Fixed and Dependency Updates

• github.com/openziti/sdk-golang: v0.23.45 -> v0.24.0

  • Issue #663 - Add API to allow controlling proxying connections to controllers and routers.

• github.com/go-resty/resty/v2: v2.15.3 -> v2.16.4

• github.com/openziti/channel/v3: v3.0.26 -> v3.0.27

• github.com/openziti/edge-api: v0.26.36 -> v0.26.38

• github.com/openziti/transport/v2: v2.0.159 -> v2.0.160

• golang.org/x/oauth2: v0.23.0 -> v0.25.0

• google.golang.org/protobuf: v1.36.2 -> v1.36.3

What's Changed

• Update for channel/v3 by @plorenz in #620
• implement support for receiving multipart edge messages by @ekoby in #624

Full Changelog: v0.23.41...v0.23.42