Fix Keylime API compatibility and encryption algorithm support - #10
Open
StrongStool0954 wants to merge 6 commits into
Open
Fix Keylime API compatibility and encryption algorithm support#10StrongStool0954 wants to merge 6 commits into
StrongStool0954 wants to merge 6 commits into
Conversation
Add full HTTPS and mTLS support to the SPIRE Keylime agent plugin, enabling secure communication with Keylime agents that require TLS client certificates. Changes: - Add TLS configuration parameters to Config struct: - keylime_agent_use_tls: Enable/disable TLS - keylime_agent_ca_cert: CA certificate path for server verification - keylime_agent_client_cert: Client certificate path for mTLS - keylime_agent_client_key: Client private key path for mTLS - Add httpClient field to Plugin struct for configured HTTP client - Implement createHTTPClient() function: - Loads CA certificates for server verification - Loads client certificates for mTLS authentication - Configures TLS transport with proper certificate validation - Falls back to default client when TLS disabled - Update AidAttestation() to use dynamic protocol (http/https) - Add TLS validation to validatePluginConfig(): - Ensures client cert and key provided together - Validates configuration consistency - Update Configure() and getConfig() to handle HTTP client lifecycle This enables the plugin to connect to Keylime agents with mTLS enabled, eliminating all HTTP communication from the attestation infrastructure. Tested with: Go 1.24.4, SPIRE 1.11.1, Rust Keylime 0.2.5 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit removes the InsecureSkipVerify: true setting from the HTTP client configuration, enabling proper certificate validation when the SPIRE server plugin connects to the Keylime verifier over HTTPS. Security improvement: - Enforces certificate validation for Keylime verifier connections - Eliminates security warning from production deployment - Uses proper TLS verification with configured CA certificates Testing: Built and ready for deployment to production infrastructure. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updates the plugin to properly support Keylime v2.5 API and RSA 2048-bit encryption: - Update API version from v2.2 to v2.5 for consistent endpoint usage - Add rsa2048 to accepted encryption algorithms (Rust agent uses RSA 2048-bit keys) - Add automatic agent registration when agent not found in verifier - Fetch AK from registrar before adding agent to verifier - Add retry logic for agent state validation with support for state 1 (Registered) - Include all required fields in agent add request (metadata, runtime policy, etc.) This fixes attestation failures with Rust Keylime agents that use RSA 2048-bit attestation keys and ensures proper API version negotiation between plugin, registrar, and verifier. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Harden TPM policy from permissive (0x0) to verify PCR 7 (Secure Boot state). Changes: - Update TPM policy mask from 0x0 to 0x80 (PCR 7) - PCR 7 verifies UEFI Secure Boot configuration - Detects if Secure Boot is disabled or boot chain is tampered Security Impact: - Before: No boot integrity verification (except PCR 16) - After: Secure Boot state verified on every attestation - Measured boot reference state provides baseline validation Testing: - Agent ee755942-0e99-4010-a39d-d1b00f12920a re-attested successfully - 14+ continuous attestations passing with new policy - SPIRE agent obtained valid SVID after policy change This is Phase 1 of Keylime attestation hardening. Future phases will add kernel integrity (PCRs 8-9) and runtime IMA verification. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Replace empty IMA policy with functional exclude-based runtime policy that enables continuous attestation with IMA measurements. Changes: - Add comprehensive IMA runtime policy excluding volatile directories (/var, /tmp, /home, /proc, /sys, /dev/shm, /run, /dev, /sys/firmware) - Change IMA hash algorithm from sha1 to sha256 for better security - Rename variable from emptyRuntimePolicy to runtimePolicy - Use exclude-based approach instead of allowlist to avoid digest management complexity This enables Keylime verifier to validate IMA measurements during continuous attestation, verifying that only expected file accesses occur on the attested system. Testing: Verified continuous attestation passes with 'Get Quote' state and attestation_status: PASS. Agent successfully completes attestation every 2 seconds. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Expand TPM policy to verify both boot loader and Secure Boot state by adding PCR 4 to the verification mask. Changes: - Update TPM policy mask from 0x80 to 0x90 - Now verifies PCR 4 (boot loader/GRUB) and PCR 7 (Secure Boot) - Provides comprehensive boot chain verification PCR Coverage: - PCR 4: Boot loader components and configuration - PCR 7: Secure Boot state (UEFI variables) This ensures that both the boot loader integrity and Secure Boot enforcement are verified during attestation, preventing boot-time tampering. Testing: Verified continuous attestation passes with 'Get Quote' state, attestation_status: PASS, and tpm_policy correctly showing mask 0x90. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
mpeters
requested changes
Feb 23, 2026
|
|
||
| // getConfig gets the configuration under a read lock. | ||
| func (p *Plugin) getConfig() (*Config, error) { | ||
| func (p *Plugin) getConfig() (*Config, *http.Client, error) { |
Member
There was a problem hiding this comment.
Instead of putting the http.Client into the get/setConfig() functions, I would prefer to see new get/setHttpClient() functions.
| return status.Errorf(codes.Internal, "unable to contact Keylime verifier at %s: %s", keylimeStatusUrl, err) | ||
| } | ||
| p.log.Debug("Request results", "url", keylimeStatusUrl, "response", statusRes.StatusCode) | ||
|
|
Member
There was a problem hiding this comment.
What use-case does this solve? It seems odd to me for the spire plugin to register a keylime agent with the registrar. The agent needs to be registered with something like the keylime_tenant along with the attestation policy. Why is the spire plugin adding a default keylime policy?
| // TODO - make this more robust and less hard-coded | ||
| if keylimeOpState != 3 && keylimeOpState != 4 { | ||
| return status.Errorf(codes.Internal, "Keylime agent is not in a verified state. Current state: %d", keylimeOpState) | ||
| // Wait for agent to reach valid state with retry logic |
Member
There was a problem hiding this comment.
This section is definitely needed, so thanks for adding.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR fixes critical compatibility issues between the SPIRE plugin and the Rust Keylime agent, enabling successful attestation with proper API version negotiation and RSA 2048-bit key support.
Changes
Problem
The plugin was using API v2.2 endpoints while configuring agents with
supported_version: "2.5", causing endpoint mismatches. Additionally, the plugin only accepted["rsa", "ecc"]encryption algorithms, but Rust Keylime agents usersa2048, causing quote validation failures with:Testing
Tested with:
Result: Agent successfully attests and receives SPIFFE ID. Attestation completes with agent reaching state 1 (Registered).
Compatibility
Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com