keylime / keylime/rust-keylime
Agent registers via insecure http
- Dominant language
- Rust
- Stars
- 162
- Forks
- 76
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 3
Description
Agent registers itself via insecure http, not via https. This seems to be hardcoded on [L108](https://github.com/keylime/rust-keylime/blob/84d2a78df682f9be4230dc7dd1292f2944d7a8e1/keylime-agent/src/registrar_agent.rs#L108), despite Agent MTLS is configued to be `true`.
Since [Securing Keylime](https://keylime.readthedocs.io/en/latest/security.html) is completely TBD, and most of the docs do not recognize `rust-keylime` at all, I'm at a loss if this is by some limitation, or by design, or is this just an oversight in rust-keylime as its catching up to old keylime agent? Or maybe I missed something? :wink:
```console
INFO keylime_agent::registrar_agent > Requesting agent registration from http://:8890/v2.2/agents/7b32f0fc13de4a841ddcf808e02c8c1481f6741f51240c4e21038980d5be5819 for 7b32f0fc13de4a841ddcf808e02c8c1481f6741f51240c4e21038980d5be5819
INFO keylime_agent > SUCCESS: Agent 7b32f0fc13de4a841ddcf808e02c8c1481f6741f51240c4e21038980d5be5819 registered
INFO keylime_agent::registrar_agent > Requesting agent activation from http://:8890/v2.2/agents/7b32f0fc13de4a841ddcf808e02c8c1481f6741f51240c4e21038980d5be5819 for 7b32f0fc13de4a841ddcf808e02c8c1481f6741f51240c4e21038980d5be5819
INFO keylime_agent > SUCCESS: Agent 7b32f0fc13de4a841ddcf808e02c8c1481f6741f51240c4e21038980d5be5819 activated
INFO keylime_agent > Listening on https://127.0.0.1:9002/
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at keylime-agent/src/registrar_agent.rs line 108 and compare the registration and activation URLs with the Agent mTLS configuration described in the issue. Read the linked Securing Keylime documentation and inspect related configuration or tests to determine whether HTTPS is expected. Done means the intended transport behavior is established and covered by an appropriate test or documented limitation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend-api-design, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100