keylime / keylime/rust-keylime

Agent registers via insecure http

Open
#835 4 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
162
Forks
76
Avg merge
4d 17h
Merged PRs (30d)
3

Description

Agent registers itself via insecure http, not via https. This seems to be hardcoded on [L108](https://github.com/keylime/rust-keylime/blob/84d2a78df682f9be4230dc7dd1292f2944d7a8e1/keylime-agent/src/registrar_agent.rs#L108), despite Agent MTLS is configued to be `true`.

Since [Securing Keylime](https://keylime.readthedocs.io/en/latest/security.html) is completely TBD, and most of the docs do not recognize `rust-keylime` at all, I'm at a loss if this is by some limitation, or by design, or is this just an oversight in rust-keylime as its catching up to old keylime agent? Or maybe I missed something? :wink:

```console
INFO keylime_agent::registrar_agent > Requesting agent registration from http://:8890/v2.2/agents/7b32f0fc13de4a841ddcf808e02c8c1481f6741f51240c4e21038980d5be5819 for 7b32f0fc13de4a841ddcf808e02c8c1481f6741f51240c4e21038980d5be5819
INFO keylime_agent > SUCCESS: Agent 7b32f0fc13de4a841ddcf808e02c8c1481f6741f51240c4e21038980d5be5819 registered
INFO keylime_agent::registrar_agent > Requesting agent activation from http://:8890/v2.2/agents/7b32f0fc13de4a841ddcf808e02c8c1481f6741f51240c4e21038980d5be5819 for 7b32f0fc13de4a841ddcf808e02c8c1481f6741f51240c4e21038980d5be5819
INFO keylime_agent > SUCCESS: Agent 7b32f0fc13de4a841ddcf808e02c8c1481f6741f51240c4e21038980d5be5819 activated
INFO keylime_agent > Listening on https://127.0.0.1:9002/
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at keylime-agent/src/registrar_agent.rs line 108 and compare the registration and activation URLs with the Agent mTLS configuration described in the issue. Read the linked Securing Keylime documentation and inspect related configuration or tests to determine whether HTTPS is expected. Done means the intended transport behavior is established and covered by an appropriate test or documented limitation.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend-api-design, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.