rpms/keylime-agent-rust
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Update to upstream version 0.2.10

Browse Source 
Resolves: RHEL-180616
Resolves: RHEL-153606

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
This commit is contained in:
Anderson Toshiyuki Sasaki 2026-07-08 17:45:59 +02:00
parent 4b274d7f8c
commit e8c0e4a9a5
No known key found for this signature in database
7 changed files with 9 additions and 1611 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -19,3 +19,5 @@
/rust-keylime-0.2.7-vendor.tar.zstd
/v0.2.9.tar.gz
/rust-keylime-0.2.9-vendor.tar.zstd
/v0.2.10.tar.gz
/rust-keylime-0.2.10-vendor.tar.zstd

514
0003-rust-keylime-registrar-tls-port.patch
View File

@ -1,514 +0,0 @@
From 3cbb5cddc5e149619ea11c797d2963e68b50b280 Mon Sep 17 00:00:00 2001
From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Date: Tue, 10 Mar 2026 10:47:01 +0100
Subject: [PATCH 1/2] push-attestation: Use registrar TLS port when TLS is
enabled
The push-attestation agent was using the plaintext registrar port (8890)
even when TLS was enabled, but the registrar listens on a separate port
for TLS connections (8891). Add a registrar_tls_port config option and
use it when TLS is active.
The decision on whether using TLS or not is consolidated in
create_registrar_tls_config(), which now sets the registrar_tls_port in
RegistrarTlsConfig. Downstream code (register_agent) simply uses the
port from the TLS config when present, or falls back to the plaintext
port.
Port constants (DEFAULT_REGISTRAR_PORT, DEFAULT_REGISTRAR_TLS_PORT) are
used instead of hardcoded values.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
---
keylime-agent.conf | 8 ++
keylime-push-model-agent/src/main.rs | 11 +++
keylime-push-model-agent/src/registration.rs | 85 +++++++++++++++-----
keylime/src/config/base.rs | 3 +
keylime/src/config/push_model.rs | 2 +
keylime/src/config/testing.rs | 6 +-
6 files changed, 95 insertions(+), 20 deletions(-)
diff --git a/keylime-agent.conf b/keylime-agent.conf
index 4ed60ccf5..a9d822070 100644
--- a/keylime-agent.conf
+++ b/keylime-agent.conf
@@ -61,6 +61,14 @@ contact_port = 9002
registrar_ip = "127.0.0.1"
registrar_port = 8890
+# The TLS port of the registrar server which agent communicates with when
+# registrar_tls_enabled is set to true.
+# This is the port the registrar listens on for TLS connections.
+#
+# To override registrar_tls_port, set KEYLIME_AGENT_REGISTRAR_TLS_PORT
+# environment variable.
+registrar_tls_port = 8891
+
# Enable TLS communication between agent and registrar.
# When enabled, the agent will use TLS (server verification only) when
# communicating with the registrar. The registrar_tls_ca_cert option must be
diff --git a/keylime-push-model-agent/src/main.rs b/keylime-push-model-agent/src/main.rs
index bd0656d97..a9753bf8a 100644
--- a/keylime-push-model-agent/src/main.rs
+++ b/keylime-push-model-agent/src/main.rs
@@ -117,6 +117,7 @@ fn create_registrar_tls_config<T: PushModelConfigTrait>(
ca_cert: Some(ca_cert.to_string()),
disable_tls: None,
timeout: Some(timeout),
+ registrar_tls_port: config.registrar_tls_port(),
});
}
@@ -346,10 +347,12 @@ async fn main() -> Result<()> {
#[cfg(test)]
mod tests {
use super::*;
+ use keylime::config::DEFAULT_REGISTRAR_TLS_PORT;
// Mock config for testing
struct MockConfig {
tls_enabled: bool,
+ tls_port: u32,
ca_cert: String,
backoff_max_delay: Option<u64>,
backoff_max_retries: Option<u32>,
@@ -421,6 +424,9 @@ mod tests {
fn registrar_port(&self) -> u32 {
0
}
+ fn registrar_tls_port(&self) -> u32 {
+ self.tls_port
+ }
fn tpm_encryption_alg(&self) -> &str {
""
}
@@ -446,6 +452,7 @@ mod tests {
// Test when TLS is disabled
let config = MockConfig {
tls_enabled: false,
+ tls_port: DEFAULT_REGISTRAR_TLS_PORT,
ca_cert: "".to_string(),
backoff_max_delay: None,
backoff_max_retries: None,
@@ -461,6 +468,7 @@ mod tests {
// Test when TLS is enabled with CA certificate (push model doesn't use client certs)
let config = MockConfig {
tls_enabled: true,
+ tls_port: DEFAULT_REGISTRAR_TLS_PORT,
ca_cert: "/path/to/ca.crt".to_string(),
backoff_max_delay: None,
backoff_max_retries: None,
@@ -474,6 +482,7 @@ mod tests {
assert_eq!(tls_config.ca_cert, Some("/path/to/ca.crt".to_string()));
assert_eq!(tls_config.timeout, Some(5000));
assert_eq!(tls_config.disable_tls, None);
+ assert_eq!(tls_config.registrar_tls_port, DEFAULT_REGISTRAR_TLS_PORT);
}
#[test]
@@ -481,6 +490,7 @@ mod tests {
// Test when TLS is enabled but no CA certificate path is provided
let config = MockConfig {
tls_enabled: true,
+ tls_port: DEFAULT_REGISTRAR_TLS_PORT,
ca_cert: "".to_string(),
backoff_max_delay: None,
backoff_max_retries: None,
@@ -496,6 +506,7 @@ mod tests {
// Test that custom timeout is properly set
let config = MockConfig {
tls_enabled: true,
+ tls_port: DEFAULT_REGISTRAR_TLS_PORT,
ca_cert: "/path/to/ca.crt".to_string(),
backoff_max_delay: None,
backoff_max_retries: None,
diff --git a/keylime-push-model-agent/src/registration.rs b/keylime-push-model-agent/src/registration.rs
index bc5e3b283..0189cb15b 100644
--- a/keylime-push-model-agent/src/registration.rs
+++ b/keylime-push-model-agent/src/registration.rs
@@ -9,10 +9,15 @@ use keylime::{
/// TLS configuration for registrar communication in push model.
/// Push model uses server-only TLS verification (no client certificates/mTLS).
+///
+/// When this struct is `Some`, TLS is considered active: the registrar client
+/// will use HTTPS, and `registrar_tls_port` will be used instead of the
+/// plaintext port.
pub struct RegistrarTlsConfig {
pub ca_cert: Option<String>,
pub disable_tls: Option<bool>,
pub timeout: Option<u64>,
+ pub registrar_tls_port: u32,
}
pub async fn check_registration(
@@ -55,18 +60,26 @@ pub async fn register_agent(
// Resolve agent UUID using the centralized helper
let agent_uuid = context_info.resolve_agent_id(config.uuid());
- // Extract TLS config values; push model doesn't use client certs (no mTLS)
- let (ca_cert, disable_tls, timeout) = if let Some(tls) = tls_config {
- (tls.ca_cert, tls.disable_tls, tls.timeout)
- } else {
- (None, None, None)
- };
+ // Extract TLS config values; push model doesn't use client certs (no mTLS).
+ // When tls_config is Some, TLS is active: use the TLS port and CA cert.
+ // When None, TLS is not active: use the plaintext port.
+ let (ca_cert, disable_tls, timeout, registrar_port) =
+ if let Some(tls) = tls_config {
+ (
+ tls.ca_cert,
+ tls.disable_tls,
+ tls.timeout,
+ tls.registrar_tls_port,
+ )
+ } else {
+ (None, None, None, config.registrar_port())
+ };
let ac = AgentRegistrationConfig {
contact_ip: config.contact_ip().to_string(),
contact_port: config.contact_port(),
registrar_ip: config.registrar_ip().to_string(),
- registrar_port: config.registrar_port(),
+ registrar_port,
enable_iak_idevid: config.enable_iak_idevid(),
ek_handle: config
.ek_handle()
@@ -114,7 +127,10 @@ mod tests {
use super::*;
use keylime::{
- config::get_testing_config,
+ config::{
+ get_testing_config, DEFAULT_REGISTRAR_PORT,
+ DEFAULT_REGISTRAR_TLS_PORT,
+ },
context_info::{AlgorithmConfigurationString, ContextInfo},
tpm::testing,
};
@@ -164,6 +180,7 @@ mod tests {
ca_cert: Some("/path/to/ca.pem".to_string()),
disable_tls: Some(false),
timeout: Some(5000),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
assert_eq!(tls_config.ca_cert, Some("/path/to/ca.pem".to_string()));
@@ -177,6 +194,7 @@ mod tests {
ca_cert: None,
disable_tls: None,
timeout: None,
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
assert_eq!(tls_config.ca_cert, None);
@@ -190,6 +208,7 @@ mod tests {
ca_cert: Some("/path/to/ca.pem".to_string()),
disable_tls: Some(true),
timeout: Some(10000),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
assert_eq!(tls_config.ca_cert, Some("/path/to/ca.pem".to_string()));
@@ -203,6 +222,7 @@ mod tests {
ca_cert: Some("".to_string()),
disable_tls: Some(false),
timeout: Some(0),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
assert_eq!(tls_config.ca_cert, Some("".to_string()));
@@ -233,6 +253,7 @@ mod tests {
ca_cert: Some("/path/to/ca.pem".to_string()),
disable_tls: Some(false),
timeout: Some(5000),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
// Test with None context_info but Some tls_config (should not register)
@@ -268,6 +289,7 @@ mod tests {
ca_cert: Some("/path/to/ca.pem".to_string()),
disable_tls: Some(false),
timeout: Some(5000),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
let result =
@@ -305,6 +327,7 @@ mod tests {
ca_cert: Some("/path/to/ca.pem".to_string()),
disable_tls: None,
timeout: Some(5000),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
let result =
@@ -342,6 +365,7 @@ mod tests {
ca_cert: Some("/path/to/ca.pem".to_string()),
disable_tls: Some(true),
timeout: Some(5000),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
let result =
@@ -413,6 +437,7 @@ mod tests {
ca_cert: Some("/path/to/ca.pem".to_string()),
disable_tls: None,
timeout: Some(0),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
assert_eq!(tls_config_zero.timeout, Some(0));
@@ -421,6 +446,7 @@ mod tests {
ca_cert: Some("/path/to/ca.pem".to_string()),
disable_tls: None,
timeout: Some(300000),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
assert_eq!(tls_config_large.timeout, Some(300000));
@@ -429,6 +455,7 @@ mod tests {
ca_cert: Some("/path/to/ca.pem".to_string()),
disable_tls: None,
timeout: None,
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
assert_eq!(tls_config_none.timeout, None);
}
@@ -439,32 +466,47 @@ mod tests {
ca_cert: Some("/ca.pem".to_string()),
disable_tls: Some(false),
timeout: Some(5000),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
});
- let (ca_cert, disable_tls, timeout) = if let Some(tls) = tls_config {
- (tls.ca_cert, tls.disable_tls, tls.timeout)
- } else {
- (None, None, None)
- };
+ let (ca_cert, disable_tls, timeout, registrar_port) =
+ if let Some(tls) = tls_config {
+ (
+ tls.ca_cert,
+ tls.disable_tls,
+ tls.timeout,
+ tls.registrar_tls_port,
+ )
+ } else {
+ (None, None, None, DEFAULT_REGISTRAR_PORT)
+ };
assert_eq!(ca_cert, Some("/ca.pem".to_string()));
assert_eq!(disable_tls, Some(false));
assert_eq!(timeout, Some(5000));
+ assert_eq!(registrar_port, DEFAULT_REGISTRAR_TLS_PORT);
}
#[actix_rt::test]
async fn test_tls_config_extraction_none() {
let tls_config: Option<RegistrarTlsConfig> = None;
- let (ca_cert, disable_tls, timeout) = if let Some(tls) = tls_config {
- (tls.ca_cert, tls.disable_tls, tls.timeout)
- } else {
- (None, None, None)
- };
+ let (ca_cert, disable_tls, timeout, registrar_port) =
+ if let Some(tls) = tls_config {
+ (
+ tls.ca_cert,
+ tls.disable_tls,
+ tls.timeout,
+ tls.registrar_tls_port,
+ )
+ } else {
+ (None, None, None, DEFAULT_REGISTRAR_PORT)
+ };
assert_eq!(ca_cert, None);
assert_eq!(disable_tls, None);
assert_eq!(timeout, None);
+ assert_eq!(registrar_port, DEFAULT_REGISTRAR_PORT);
}
#[tokio::test]
@@ -503,6 +545,7 @@ mod tests {
ca_cert: Some(ca_path.to_string_lossy().to_string()),
disable_tls: Some(false),
timeout: Some(5000),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
// Should fail due to invalid port, but TLS config should be processed
@@ -529,7 +572,7 @@ mod tests {
config.exponential_backoff_max_retries = None;
config.exponential_backoff_max_delay = None;
config.registrar_ip = "127.0.0.1".to_string();
- config.registrar_port = 8891;
+ config.registrar_port = DEFAULT_REGISTRAR_TLS_PORT;
let _guard = keylime::config::TestConfigGuard::new(config);
@@ -541,6 +584,7 @@ mod tests {
ca_cert: Some("/nonexistent/ca.pem".to_string()),
disable_tls: Some(false),
timeout: Some(5000),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
// Should fail due to missing certificate files
@@ -562,6 +606,7 @@ mod tests {
ca_cert: Some(ca_path.to_string_lossy().to_string()),
disable_tls: Some(false),
timeout: Some(10000),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
// Verify all fields are set correctly
@@ -571,6 +616,7 @@ mod tests {
);
assert_eq!(tls_config.disable_tls, Some(false));
assert_eq!(tls_config.timeout, Some(10000));
+ assert_eq!(tls_config.registrar_tls_port, DEFAULT_REGISTRAR_TLS_PORT);
}
#[tokio::test]
@@ -602,6 +648,7 @@ mod tests {
ca_cert: Some("".to_string()),
disable_tls: Some(false),
timeout: Some(5000),
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
};
let result =
diff --git a/keylime/src/config/base.rs b/keylime/src/config/base.rs
index c171c8592..31fdc44ef 100644
--- a/keylime/src/config/base.rs
+++ b/keylime/src/config/base.rs
@@ -36,6 +36,7 @@ pub static DEFAULT_IP: &str = "127.0.0.1";
pub static DEFAULT_PORT: u32 = 9002;
pub static DEFAULT_REGISTRAR_IP: &str = "127.0.0.1";
pub static DEFAULT_REGISTRAR_PORT: u32 = 8890;
+pub static DEFAULT_REGISTRAR_TLS_PORT: u32 = 8891;
pub static DEFAULT_REGISTRAR_TLS_ENABLED: bool = false;
pub static DEFAULT_REGISTRAR_TLS_CA_CERT: &str = "cv_ca/cacert.crt";
pub static DEFAULT_KEYLIME_DIR: &str = "/var/lib/keylime";
@@ -140,6 +141,7 @@ pub struct AgentConfig {
pub port: u32,
pub registrar_ip: String,
pub registrar_port: u32,
+ pub registrar_tls_port: u32,
pub registrar_tls_enabled: bool,
pub registrar_tls_ca_cert: String,
pub run_as: String,
@@ -318,6 +320,7 @@ impl Default for AgentConfig {
port: DEFAULT_PORT,
registrar_ip: DEFAULT_REGISTRAR_IP.to_string(),
registrar_port: DEFAULT_REGISTRAR_PORT,
+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT,
registrar_tls_enabled: DEFAULT_REGISTRAR_TLS_ENABLED,
registrar_tls_ca_cert: "default".to_string(),
revocation_actions: DEFAULT_REVOCATION_ACTIONS.to_string(),
diff --git a/keylime/src/config/push_model.rs b/keylime/src/config/push_model.rs
index 644051196..0e461c381 100644
--- a/keylime/src/config/push_model.rs
+++ b/keylime/src/config/push_model.rs
@@ -70,6 +70,7 @@ pub struct PushModelConfig {
registrar_api_versions: Vec<&str>,
registrar_ip: String,
registrar_port: u32,
+ registrar_tls_port: u32,
registrar_tls_enabled: bool,
registrar_tls_ca_cert: String,
tpm_encryption_alg: String,
@@ -113,6 +114,7 @@ mod tests {
assert_eq!(config.enable_iak_idevid(), DEFAULT_ENABLE_IAK_IDEVID);
assert_eq!(config.registrar_ip(), DEFAULT_REGISTRAR_IP);
assert_eq!(config.registrar_port(), DEFAULT_REGISTRAR_PORT);
+ assert_eq!(config.registrar_tls_port(), DEFAULT_REGISTRAR_TLS_PORT);
assert_eq!(
config.uefi_logs_evidence_version(),
DEFAULT_UEFI_LOGS_EVIDENCE_VERSION
diff --git a/keylime/src/config/testing.rs b/keylime/src/config/testing.rs
index 94b52f978..4f666fb33 100644
--- a/keylime/src/config/testing.rs
+++ b/keylime/src/config/testing.rs
@@ -58,7 +58,7 @@ fn apply_config_overrides(
) {
use crate::config::{
DEFAULT_CONTACT_PORT, DEFAULT_PORT, DEFAULT_REGISTRAR_PORT,
- DEFAULT_REVOCATION_NOTIFICATION_PORT,
+ DEFAULT_REGISTRAR_TLS_PORT, DEFAULT_REVOCATION_NOTIFICATION_PORT,
};
for (key, value) in overrides {
@@ -100,6 +100,10 @@ fn apply_config_overrides(
config.registrar_port =
value.parse().unwrap_or(DEFAULT_REGISTRAR_PORT);
}
+ "registrar_tls_port" => {
+ config.registrar_tls_port =
+ value.parse().unwrap_or(DEFAULT_REGISTRAR_TLS_PORT);
+ }
"run_as" => config.run_as = value,
"tpm_encryption_alg" => config.tpm_encryption_alg = value,
"tpm_hash_alg" => config.tpm_hash_alg = value,
From 734a87c458bd644828805eaffa994cb4b7e0bd98 Mon Sep 17 00:00:00 2001
From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Date: Tue, 10 Mar 2026 10:48:24 +0100
Subject: [PATCH 2/2] Use port constants instead of hardcoded values in tests
Replace hardcoded port numbers (8891) with DEFAULT_REGISTRAR_TLS_PORT in
registrar client tests for consistency.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
---
keylime/src/registrar_client.rs | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/keylime/src/registrar_client.rs b/keylime/src/registrar_client.rs
index 3fb2f9686..7750a381e 100644
--- a/keylime/src/registrar_client.rs
+++ b/keylime/src/registrar_client.rs
@@ -700,7 +700,10 @@ impl RegistrarClient {
#[cfg(test)]
mod tests {
use super::*;
- use crate::{agent_identity::AgentIdentityBuilder, crypto};
+ use crate::{
+ agent_identity::AgentIdentityBuilder,
+ config::DEFAULT_REGISTRAR_TLS_PORT, crypto,
+ };
use wiremock::matchers::{method, path};
use wiremock::{Mock, MockServer, ResponseTemplate};
@@ -1407,7 +1410,7 @@ mod tests {
}
if to_add.contains(&"registrar_port") {
- builder = builder.registrar_port(8891);
+ builder = builder.registrar_port(DEFAULT_REGISTRAR_TLS_PORT);
}
let result = builder.build().await;
@@ -1475,13 +1478,13 @@ mod tests {
async fn test_builder_chaining_with_tls() {
let builder = RegistrarClientBuilder::new()
.registrar_address("127.0.0.1".to_string())
- .registrar_port(8891)
+ .registrar_port(DEFAULT_REGISTRAR_TLS_PORT)
.ca_certificate("/path/to/ca.pem".to_string())
.disable_tls(false)
.timeout(5000);
assert_eq!(builder.registrar_address, Some("127.0.0.1".to_string()));
- assert_eq!(builder.registrar_port, Some(8891));
+ assert_eq!(builder.registrar_port, Some(DEFAULT_REGISTRAR_TLS_PORT));
assert_eq!(
builder.ca_certificate,
Some("/path/to/ca.pem".to_string())

340
0004-rust-keylime-hash-before-certify.patch
View File

@ -1,340 +0,0 @@
From 6a6b1046a2fb5bd0a84982c7777268f4f9c14f25 Mon Sep 17 00:00:00 2001
From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Date: Mon, 11 May 2026 19:01:25 +0200
Subject: [PATCH] agent: Hash agent ID before TPM2_Certify qualifying data
SHA-256 hash the agent ID before passing it as qualifyingData to
TPM2_Certify when certifying the AK with the IAK. This produces a fixed
32-byte value that fits within TPM2B_DATA on all TPMs, including those
that only support SHA-256 (where the limit is 34 bytes).
Without this fix, UUID strings (36 bytes) and other agent IDs exceed the
TPM2B_DATA capacity on SHA-256-only TPMs, causing TPM_RC_SIZE errors
during registration.
Bumps the pull-mode API version to 2.6.
Fixes: https://github.com/keylime/rust-keylime/issues/1226
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
---
keylime-agent/src/api.rs | 21 +++++
keylime-agent/src/main.rs | 22 +----
keylime-push-model-agent/src/registration.rs | 2 -
keylime/src/agent_registration.rs | 88 +++++++++++++-------
keylime/src/config/base.rs | 2 +-
keylime/src/registrar_client.rs | 10 +++
keylime/src/tpm.rs | 23 +++--
7 files changed, 108 insertions(+), 60 deletions(-)
diff --git a/keylime-agent/src/api.rs b/keylime-agent/src/api.rs
index e9f4562dd..4d135a9b3 100644
--- a/keylime-agent/src/api.rs
+++ b/keylime-agent/src/api.rs
@@ -188,6 +188,25 @@ fn configure_api_v2_5(cfg: &mut web::ServiceConfig) {
)
}
+/// Configure the endpoints supported by API version 2.6
+///
+/// Version 2.6 has the same agent-side endpoints as 2.5. The version bump
+/// reflects a protocol change: the agent now SHA-256 hashes the agent ID
+/// before using it as qualifying data in TPM2_Certify (IAK-based AK
+/// certification). This ensures the qualifying data fits within the
+/// TPM2B_DATA size limit on SHA-256-only TPMs (34 bytes). The certify
+/// operation is deferred until after API version negotiation so the agent
+/// can fall back to raw UUID bytes when the registrar only supports 2.5.
+fn configure_api_v2_6(cfg: &mut web::ServiceConfig) {
+ let version = Version::from_str("2.6").expect("Invalid API version");
+ _ = cfg.app_data(web::Data::new(version));
+ configure_base_endpoints(cfg);
+ _ = cfg.service(
+ web::scope("/agent")
+ .configure(agent_handler::configure_agent_endpoints),
+ )
+}
+
/// Get a scope configured for the given API version
pub(crate) fn get_api_scope(version: &str) -> Result<Scope, APIError> {
match version {
@@ -201,6 +220,8 @@ pub(crate) fn get_api_scope(version: &str) -> Result<Scope, APIError> {
.configure(configure_api_v2_4)),
"2.5" => Ok(web::scope(format!("v{version}").as_ref())
.configure(configure_api_v2_5)),
+ "2.6" => Ok(web::scope(format!("v{version}").as_ref())
+ .configure(configure_api_v2_6)),
_ => Err(APIError::UnsupportedVersion(version.into())),
}
}
diff --git a/keylime-agent/src/main.rs b/keylime-agent/src/main.rs
index b05eed214..280a1ac88 100644
--- a/keylime-agent/src/main.rs
+++ b/keylime-agent/src/main.rs
@@ -87,7 +87,7 @@ use tss_esapi::{
handles::KeyHandle,
interface_types::algorithm::{AsymmetricAlgorithm, HashingAlgorithm},
interface_types::resource_handles::Hierarchy,
- structures::{Auth, Data, Digest, MaxBuffer, PublicBuffer},
+ structures::{Auth, Digest, MaxBuffer, PublicBuffer},
traits::Marshall,
Context,
};
@@ -494,24 +494,6 @@ async fn main() -> Result<()> {
None
};
- let (attest, signature) = if let Some(dev_id) = &mut device_id {
- let qualifying_data = Data::try_from(agent_uuid.as_bytes())?;
- let (attest, signature) =
- dev_id.certify(qualifying_data, ak_handle, &mut ctx)?;
-
- info!("AK certified with IAK.");
-
- // // For debugging certify(), the following checks the generated signature
- // let max_b = MaxBuffer::try_from(attest.clone().marshall()?)?;
- // let (hashed_attest, _) = ctx.inner.hash(max_b, HashingAlgorithm::Sha256, Hierarchy::Endorsement,)?;
- // println!("{:?}", hashed_attest);
- // println!("{:?}", signature);
- // println!("{:?}", ctx.inner.verify_signature(iak.as_ref().unwrap().handle, hashed_attest, signature.clone())?); //#[allow_ci]
- (Some(attest), Some(signature))
- } else {
- (None, None)
- };
-
// Load or generate RSA key pair for secure transmission of u, v keys.
// The u, v keys are two halves of the key used to decrypt the workload after
// the Identity and Integrity Quotes sent by the agent are validated
@@ -645,8 +627,6 @@ async fn main() -> Result<()> {
agent_uuid: agent_uuid.clone(),
mtls_cert,
device_id,
- attest,
- signature,
ak_handle,
retry_config: Some(get_retry_config(&config)),
};
diff --git a/keylime-push-model-agent/src/registration.rs b/keylime-push-model-agent/src/registration.rs
index 0189cb15b..0cca01c17 100644
--- a/keylime-push-model-agent/src/registration.rs
+++ b/keylime-push-model-agent/src/registration.rs
@@ -109,8 +109,6 @@ pub async fn register_agent(
agent_uuid,
mtls_cert: None,
device_id: None, // TODO: Check how to proceed with device ID
- attest: None, // TODO: Check how to proceed with attestation, normally, no device ID means no attest
- signature: None, // TODO: Normally, no device ID means no signature
ak_handle: context_info.ak_handle,
retry_config,
};
diff --git a/keylime/src/agent_registration.rs b/keylime/src/agent_registration.rs
index 8a4fe0c3a..9e60f8cf2 100644
--- a/keylime/src/agent_registration.rs
+++ b/keylime/src/agent_registration.rs
@@ -9,10 +9,12 @@ use crate::{
tpm::{self},
};
use base64::{engine::general_purpose, Engine as _};
-use log::{error, info};
+use log::{error, info, warn};
use openssl::x509::X509;
use tss_esapi::{
- handles::KeyHandle, structures::PublicBuffer, traits::Marshall,
+ handles::KeyHandle,
+ structures::{Data, PublicBuffer},
+ traits::Marshall,
};
#[derive(Debug)]
@@ -44,14 +46,12 @@ pub struct AgentRegistration {
pub agent_uuid: String,
pub mtls_cert: Option<X509>,
pub device_id: Option<device_id::DeviceID>,
- pub attest: Option<tss_esapi::structures::Attest>,
- pub signature: Option<tss_esapi::structures::Signature>,
pub ak_handle: KeyHandle,
pub retry_config: Option<RetryConfig>,
}
pub async fn register_agent(
- aa: AgentRegistration,
+ mut aa: AgentRegistration,
ctx: &mut tpm::Context<'_>,
) -> Result<()> {
let iak_pub;
@@ -60,6 +60,28 @@ pub async fn register_agent(
let ek_pub =
&PublicBuffer::try_from(aa.ek_result.public.clone())?.marshall()?;
+ let ac = &aa.agent_registration_config;
+
+ // Build the registrar client first so we can query its supported API
+ // versions before performing TPM operations that depend on that version.
+ // Uses HTTPS if CA certificate is provided, otherwise plain HTTP.
+ let mut builder = RegistrarClientBuilder::new()
+ .registrar_address(ac.registrar_ip.clone())
+ .registrar_port(ac.registrar_port)
+ .retry_config(aa.retry_config.clone());
+
+ if let Some(ca_cert) = &ac.registrar_ca_cert {
+ builder = builder.ca_certificate(ca_cert.clone());
+ }
+ if let Some(disable_tls) = ac.registrar_disable_tls {
+ builder = builder.disable_tls(disable_tls);
+ }
+ if let Some(timeout) = ac.registrar_timeout {
+ builder = builder.timeout(timeout);
+ }
+
+ let mut registrar_client = builder.build().await?;
+
let mut ai_builder = AgentIdentityBuilder::new()
.ak_pub(ak_pub)
.ek_pub(ek_pub)
@@ -81,9 +103,7 @@ pub async fn register_agent(
// Set the IAK/IDevID related fields, if enabled
if aa.agent_registration_config.enable_iak_idevid {
- let (Some(dev_id), Some(attest), Some(signature)) =
- (&aa.device_id, aa.attest, aa.signature)
- else {
+ let Some(dev_id) = aa.device_id.as_mut() else {
error!("IDevID and IAK are enabled but could not be generated");
return Err(Error::ConfigurationGenericError(
"IDevID and IAK are enabled but could not be generated"
@@ -91,6 +111,36 @@ pub async fn register_agent(
));
};
+ // Hash the agent UUID (SHA-256) when the registrar supports API 2.6+.
+ // This keeps qualifying data within the TPM2B_DATA size limit on
+ // SHA-256-only TPMs (34 bytes). For registrars that only support 2.5
+ // or earlier, fall back to the raw UUID bytes for backward compat.
+ let qualifying_data = if registrar_client.supports_api_version("2.6")
+ {
+ let hash = crypto::hash(
+ aa.agent_uuid.as_bytes(),
+ openssl::hash::MessageDigest::sha256(),
+ )?;
+ Data::try_from(hash.as_slice())?
+ } else {
+ let uuid_bytes = aa.agent_uuid.as_bytes();
+ if uuid_bytes.len() > 34 {
+ // TPM2B_DATA limit on SHA-256-only TPMs is 34 bytes.
+ // Raw UUID won't fit; the registrar must support 2.6+.
+ warn!(
+ "Agent UUID is {} bytes (max 34 for pre-2.6 registrar); \
+ registration will likely fail. Update the registrar to 2.6+.",
+ uuid_bytes.len()
+ );
+ }
+ Data::try_from(uuid_bytes)?
+ };
+
+ let (attest, signature) =
+ dev_id.certify(qualifying_data, aa.ak_handle, ctx)?;
+
+ info!("AK certified with IAK.");
+
iak_pub =
PublicBuffer::try_from(dev_id.iak_pubkey.clone())?.marshall()?;
idevid_pub = PublicBuffer::try_from(dev_id.idevid_pubkey.clone())?
@@ -115,28 +165,6 @@ pub async fn register_agent(
// Build the Agent Identity
let ai = ai_builder.build().await?;
- let ac = &aa.agent_registration_config;
-
- // Build the registrar client
- // Uses HTTPS if CA certificate is provided, otherwise plain HTTP
- let mut builder = RegistrarClientBuilder::new()
- .registrar_address(ac.registrar_ip.clone())
- .registrar_port(ac.registrar_port)
- .retry_config(aa.retry_config.clone());
-
- // Add TLS configuration if CA certificate is provided
- if let Some(ca_cert) = &ac.registrar_ca_cert {
- builder = builder.ca_certificate(ca_cert.clone());
- }
- if let Some(disable_tls) = ac.registrar_disable_tls {
- builder = builder.disable_tls(disable_tls);
- }
- if let Some(timeout) = ac.registrar_timeout {
- builder = builder.timeout(timeout);
- }
-
- let mut registrar_client = builder.build().await?;
-
// Request keyblob material
let keyblob = registrar_client.register_agent(&ai).await?;
diff --git a/keylime/src/config/base.rs b/keylime/src/config/base.rs
index 31fdc44ef..eb6cee993 100644
--- a/keylime/src/config/base.rs
+++ b/keylime/src/config/base.rs
@@ -20,7 +20,7 @@ use uuid::Uuid;
pub static CONFIG_VERSION: &str = "2.0";
pub static SUPPORTED_API_VERSIONS: &[&str] =
- &["2.1", "2.2", "2.3", "2.4", "2.5"];
+ &["2.1", "2.2", "2.3", "2.4", "2.5", "2.6"];
pub static DEFAULT_REGISTRAR_API_VERSIONS: &str = "default";
pub static DEFAULT_CONFIG: &str = "/etc/keylime/agent.conf";
diff --git a/keylime/src/registrar_client.rs b/keylime/src/registrar_client.rs
index 7750a381e..04523d1a0 100644
--- a/keylime/src/registrar_client.rs
+++ b/keylime/src/registrar_client.rs
@@ -400,6 +400,16 @@ struct Register<'a> {
}
impl RegistrarClient {
+ /// Check if the registrar supports the given API version.
+ ///
+ /// Returns `false` if the registrar did not advertise supported versions
+ /// (e.g., it does not expose a `/version` endpoint).
+ pub fn supports_api_version(&self, version: &str) -> bool {
+ self.supported_api_versions
+ .as_ref()
+ .is_some_and(|versions| versions.iter().any(|v| v == version))
+ }
+
async fn try_register_agent(
&self,
ai: &AgentIdentity<'_>,
diff --git a/keylime/src/tpm.rs b/keylime/src/tpm.rs
index fb5d843ec..50c94cf5f 100644
--- a/keylime/src/tpm.rs
+++ b/keylime/src/tpm.rs
@@ -3291,14 +3291,25 @@ pub mod tests {
.expect("failed to create IAK")
.handle;
- let qualifying_data = "some_uuid".as_bytes();
+ // Use a realistic UUID string (36 bytes) — the exact input size that
+ // triggers TPM_RC_SIZE on SHA-256-only TPMs without the hash fix.
+ let agent_uuid = "d432fbb3-d2f1-4a97-9ef7-75bd81c00000";
+ let qualifying_data = crate::crypto::hash(
+ agent_uuid.as_bytes(),
+ openssl::hash::MessageDigest::sha256(),
+ )
+ .unwrap(); //#[allow_ci]
+
+ let data = Data::try_from(qualifying_data.as_slice()).unwrap(); //#[allow_ci]
+ let (attest, _signature) = ctx
+ .certify_credential_with_iak(data, ak_handle, iak_handle)
+ .expect("certify_credential_with_iak failed");
- let r = ctx.certify_credential_with_iak(
- Data::try_from(qualifying_data).unwrap(), //#[allow_ci]
- ak_handle,
- iak_handle,
+ assert_eq!(
+ attest.extra_data().value(),
+ qualifying_data.as_slice(),
+ "extra_data in Attest must equal the SHA-256 hash of the agent UUID"
);
- assert!(r.is_ok(), "Result: {r:?}");
// Flush context to free TPM memory
let r = ctx.flush_context(ek_handle.into());

713
0200-rust-keylime-bump-tss-esapi.patch
View File

@ -1,713 +0,0 @@
diff --git a/Cargo.toml b/Cargo.toml
index e52ad57..ab39a8e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,8 +39,8 @@ once_cell = "1.19.0"
openssl = "0.10.15"
pest = "2"
pest_derive = "2"
-picky-asn1-der = "0.4"
-picky-asn1-x509 = "0.12"
+picky-asn1-der = "0.5"
+picky-asn1-x509 = "0.15"
predicates = { version = "3.1.3" }
pretty_env_logger = "0.5"
rand = "0.9.2"
@@ -56,7 +56,7 @@ static_assertions = "1"
tempfile = "3.4.0"
thiserror = "2.0"
tokio = {version = "1", features = ["rt", "sync", "macros"]}
-tss-esapi = {version = "7.6.0", features = ["generate-bindings"]}
+tss-esapi = {version = "7.7.0", features = ["generate-bindings"]}
url = "2.5.4"
uuid = {version = "1.3", features = ["v4"]}
zip = {version = "0.6", default-features = false, features= ["deflate"]}
diff --git a/Cargo.lock b/Cargo.lock
index 516097c..d466f3f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -30,7 +30,7 @@ dependencies = [
"actix-service",
"actix-tls",
"actix-utils",
- "bitflags 2.4.0",
+ "bitflags 2.11.1",
"bytes",
"bytestring",
"derive_more",
@@ -343,12 +343,6 @@ dependencies = [
"windows-targets 0.52.6",
]
-[[package]]
-name = "base64"
-version = "0.21.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
-
[[package]]
name = "base64"
version = "0.22.1"
@@ -357,17 +351,15 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
[[package]]
name = "bindgen"
-version = "0.66.1"
+version = "0.72.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2b84e06fc203107bfbad243f4aba2af864eb7db3b1cf46ea0a023b0b433d2a7"
+checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.11.1",
"cexpr",
"clang-sys",
- "lazy_static",
- "lazycell",
+ "itertools",
"log",
- "peeking_take_while",
"prettyplease",
"proc-macro2",
"quote",
@@ -375,14 +367,27 @@ dependencies = [
"rustc-hash",
"shlex",
"syn 2.0.106",
- "which",
]
[[package]]
name = "bitfield"
-version = "0.14.0"
+version = "0.19.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21ba6517c6b0f2bf08be60e187ab64b038438f22dd755614d8fe4d4098c46419"
+dependencies = [
+ "bitfield-macros",
+]
+
+[[package]]
+name = "bitfield-macros"
+version = "0.19.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d7e60934ceec538daadb9d8432424ed043a904d8e0243f3c6446bce549a46ac"
+checksum = "f48d6ace212fdf1b45fd6b566bb40808415344642b76c3224c07c8df9da81e97"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.106",
+]
[[package]]
name = "bitflags"
@@ -392,9 +397,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
[[package]]
name = "bitflags"
-version = "2.4.0"
+version = "2.11.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
[[package]]
name = "block-buffer"
@@ -721,15 +726,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cea14ef9355e3beab063703aa9dab15afd25f0667c341310c1e5274bb1d0da18"
dependencies = [
"libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
]
-[[package]]
-name = "error-chain"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9435d864e017c3c6afeac1654189b06cdb491cf2ff73dbf0d73b0f292f42ff8"
-
[[package]]
name = "fastrand"
version = "2.2.0"
@@ -902,10 +901,23 @@ checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
dependencies = [
"cfg-if",
"libc",
- "r-efi",
+ "r-efi 5.2.0",
"wasi 0.14.2+wasi-0.2.4",
]
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "wasip2",
+ "wasip3",
+]
+
[[package]]
name = "gimli"
version = "0.31.1"
@@ -961,6 +973,9 @@ name = "hashbrown"
version = "0.15.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
[[package]]
name = "heck"
@@ -1102,7 +1117,7 @@ version = "0.1.20"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
dependencies = [
- "base64 0.22.1",
+ "base64",
"bytes",
"futures-channel",
"futures-util",
@@ -1261,6 +1276,12 @@ dependencies = [
"syn 2.0.106",
]
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
[[package]]
name = "idna"
version = "1.0.3"
@@ -1296,6 +1317,7 @@ checksum = "f2481980430f9f78649238835720ddccc57e52df14ffce1c6f37391d61b563e9"
dependencies = [
"equivalent",
"hashbrown",
+ "serde",
]
[[package]]
@@ -1331,6 +1353,15 @@ version = "1.70.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
[[package]]
name = "itoa"
version = "1.0.3"
@@ -1355,7 +1386,7 @@ dependencies = [
"actix-web",
"anyhow",
"async-trait",
- "base64 0.22.1",
+ "base64",
"byteorder",
"chrono",
"config",
@@ -1385,7 +1416,6 @@ dependencies = [
"uuid",
"wiremock",
"zip",
- "zmq",
]
[[package]]
@@ -1404,7 +1434,7 @@ version = "0.2.9"
dependencies = [
"actix-rt",
"actix-web",
- "base64 0.22.1",
+ "base64",
"cfg-if",
"clap",
"config",
@@ -1423,7 +1453,6 @@ dependencies = [
"tss-esapi",
"uuid",
"zip",
- "zmq",
]
[[package]]
@@ -1476,10 +1505,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
[[package]]
-name = "lazycell"
-version = "1.3.0"
+name = "leb128fmt"
+version = "0.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
[[package]]
name = "libc"
@@ -1547,17 +1576,6 @@ version = "2.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
-[[package]]
-name = "metadeps"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73b122901b3a675fac8cecf68dcb2f0d3036193bc861d1ac0e1c337f7d5254c2"
-dependencies = [
- "error-chain",
- "pkg-config",
- "toml 0.2.1",
-]
-
[[package]]
name = "mime"
version = "0.3.16"
@@ -1633,7 +1651,7 @@ version = "0.50.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
]
[[package]]
@@ -1702,7 +1720,7 @@ version = "0.10.73"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.11.1",
"cfg-if",
"foreign-types",
"libc",
@@ -1775,12 +1793,6 @@ version = "0.2.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8835116a5c179084a830efb3adc117ab007512b535bc1a21c991d3b32a6b44dd"
-[[package]]
-name = "peeking_take_while"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
-
[[package]]
name = "percent-encoding"
version = "2.3.1"
@@ -1833,9 +1845,9 @@ dependencies = [
[[package]]
name = "picky-asn1"
-version = "0.8.0"
+version = "0.10.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "295eea0f33c16be21e2a98b908fdd4d73c04dd48c8480991b76dbcf0cb58b212"
+checksum = "2ff038f9360b934342fb3c0a1d6e82c438a2624b51c3c6e3e6d7cf252b6f3ee3"
dependencies = [
"oid",
"serde",
@@ -1844,9 +1856,9 @@ dependencies = [
[[package]]
name = "picky-asn1-der"
-version = "0.4.1"
+version = "0.5.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5df7873a9e36d42dadb393bea5e211fe83d793c172afad5fb4ec846ec582793f"
+checksum = "d413165e4bf7f808b9a27cbaba657657a2921f0965db833f488c4d4be96dcd2e"
dependencies = [
"picky-asn1",
"serde",
@@ -1855,11 +1867,11 @@ dependencies = [
[[package]]
name = "picky-asn1-x509"
-version = "0.12.0"
+version = "0.15.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c5f20f71a68499ff32310f418a6fad8816eac1a2859ed3f0c5c741389dd6208"
+checksum = "859d4117bd1b1dc5646359ee7243c50c5000c0920ea2d1fb120335a2f4c684b8"
dependencies = [
- "base64 0.21.7",
+ "base64",
"oid",
"picky-asn1",
"picky-asn1-der",
@@ -1908,9 +1920,9 @@ dependencies = [
[[package]]
name = "prettyplease"
-version = "0.2.16"
+version = "0.2.37"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a41cf62165e97c7f814d2221421dbb9afcbcdb0a88068e5ea206e19951c2cbb5"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
dependencies = [
"proc-macro2",
"syn 2.0.106",
@@ -1918,9 +1930,9 @@ dependencies = [
[[package]]
name = "proc-macro2"
-version = "1.0.92"
+version = "1.0.106"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
dependencies = [
"unicode-ident",
]
@@ -1940,6 +1952,12 @@ version = "5.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
[[package]]
name = "rand"
version = "0.9.2"
@@ -2007,7 +2025,7 @@ version = "0.13.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ab3f43e3283ab1488b624b44b0e988d0acea0b3214e694730a055cb6b2efa801"
dependencies = [
- "base64 0.22.1",
+ "base64",
"bytes",
"futures-core",
"http 1.4.0",
@@ -2088,9 +2106,9 @@ checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
[[package]]
name = "rustc-hash"
-version = "1.1.0"
+version = "2.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
[[package]]
name = "rustix"
@@ -2098,11 +2116,11 @@ version = "1.0.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.11.1",
"errno",
"libc",
"linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
]
[[package]]
@@ -2161,6 +2179,12 @@ dependencies = [
"libc",
]
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
[[package]]
name = "serde"
version = "1.0.228"
@@ -2553,12 +2577,6 @@ dependencies = [
"tracing",
]
-[[package]]
-name = "toml"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "736b60249cb25337bc196faa43ee12c705e426f3d55c214d73a4e7be06f92cb4"
-
[[package]]
name = "toml"
version = "0.5.9"
@@ -2628,7 +2646,7 @@ version = "0.6.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.11.1",
"bytes",
"futures-util",
"http 1.4.0",
@@ -2734,13 +2752,13 @@ dependencies = [
[[package]]
name = "tss-esapi"
-version = "7.6.0"
+version = "7.7.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ea9ccde878b029392ac97b5be1f470173d06ea41d18ad0bb3c92794c16a0f2"
+checksum = "3f10b25a84912b894d0e6d68f4a3771c923e9c44ddaaed7920cde92ed28aa84e"
dependencies = [
"bitfield",
"enumflags2",
- "getrandom 0.2.16",
+ "getrandom 0.4.2",
"hostname-validator",
"log",
"mbox",
@@ -2757,9 +2775,9 @@ dependencies = [
[[package]]
name = "tss-esapi-sys"
-version = "0.5.0"
+version = "0.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "535cd192581c2ec4d5f82e670b1d3fbba6a23ccce8c85de387642051d7cad5b5"
+checksum = "a7f972672926a3d3d18ecc04524720e4d20b7d1664a3fb73dbf7d4274196dbd9"
dependencies = [
"bindgen",
"pkg-config",
@@ -2873,6 +2891,24 @@ dependencies = [
"wit-bindgen-rt",
]
+[[package]]
+name = "wasip2"
+version = "1.0.3+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+dependencies = [
+ "wit-bindgen 0.57.1",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen 0.51.0",
+]
+
[[package]]
name = "wasm-bindgen"
version = "0.2.100"
@@ -2943,6 +2979,40 @@ dependencies = [
"unicode-ident",
]
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags 2.11.1",
+ "hashbrown",
+ "indexmap",
+ "semver",
+]
+
[[package]]
name = "wasmtimer"
version = "0.4.3"
@@ -2967,17 +3037,6 @@ dependencies = [
"wasm-bindgen",
]
-[[package]]
-name = "which"
-version = "4.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c831fbbee9e129a8cf93e7747a82da9d95ba8e16621cae60ec2cdc849bacb7b"
-dependencies = [
- "either",
- "libc",
- "once_cell",
-]
-
[[package]]
name = "winapi"
version = "0.3.9"
@@ -3361,7 +3420,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "08db1edfb05d9b3c1542e521aea074442088292f00b5f28e435c714a98f85031"
dependencies = [
"assert-json-diff",
- "base64 0.22.1",
+ "base64",
"deadpool",
"futures",
"http 1.4.0",
@@ -3377,13 +3436,107 @@ dependencies = [
"url",
]
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
[[package]]
name = "wit-bindgen-rt"
version = "0.39.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
dependencies = [
- "bitflags 2.4.0",
+ "bitflags 2.11.1",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn 2.0.106",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.106",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags 2.11.1",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
]
[[package]]
@@ -3497,25 +3650,3 @@ dependencies = [
"crossbeam-utils",
"flate2",
]
-
-[[package]]
-name = "zmq"
-version = "0.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aad98a7a617d608cd9e1127147f630d24af07c7cd95ba1533246d96cbdd76c66"
-dependencies = [
- "bitflags 1.3.2",
- "libc",
- "log",
- "zmq-sys",
-]
-
-[[package]]
-name = "zmq-sys"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d33a2c51dde24d5b451a2ed4b488266df221a5eaee2ee519933dc46b9a9b3648"
-dependencies = [
- "libc",
- "metadeps",
-]

18
keylime-agent-rust.spec
View File

@ -15,7 +15,7 @@
%endif
Name: keylime-agent-rust
Version: 0.2.9
Version: 0.2.10
Release: %{?autorelease}%{!?autorelease:1%{?dist}}
Summary: The Keylime agent
@ -55,22 +55,13 @@ Source0: %{url}/archive/refs/tags/v%{version}.tar.gz
# Rename the vendor.tar.zstd tarball to rust-keylime-%%{version}-vendor.tar.zstd
Source1: rust-keylime-%{version}-vendor.tar.zstd
## (0-99) General patches
# Drop completely the legacy-python-actions feature
# Downstream-only: Drop completely the legacy-python-actions feature
Patch1: 0001-rust-keylime-metadata.patch
# Do not require /usr/libexec/keylime to be present
# Downstream-only: Do not require /usr/libexec/keylime to be present
Patch2: 0002-rust-keylime-do-not-require-usr-libexec.patch
# Use the correct registrar port when TLS is enabled
# Backported from https://github.com/keylime/rust-keylime/pull/1204
Patch3: 0003-rust-keylime-registrar-tls-port.patch
# Hash UUID before using as qualifying data for IAK-based AK certification
# Backported from https://github.com/keylime/rust-keylime/pull/1239
Patch4: 0004-rust-keylime-hash-before-certify.patch
## (100-199) Patches for building from system Rust libraries (Fedora)
## (200+) Patches for building from vendored Rust libraries (RHEL)
# Bump tss-esapi to version 7.7.0 to fix build with clang 22
# Backported from https://github.com/keylime/rust-keylime/pull/1236
Patch200: 0200-rust-keylime-bump-tss-esapi.patch
ExclusiveArch: %{rust_arches}
@ -179,7 +170,8 @@ The Keylime IMA emulator for testing with emulated TPM
%if 0%{?bundled_rust_deps}
# Source1 is vendored dependencies
%cargo_prep -v vendor
%autopatch -m 200 -p1
# Add back the line below if patches are added (do not forget the '%')
# autopatch -m 200 -p1
%else
# Add back the line below if patches are added (do not forget the '%')
# autopatch -m 100 -M 199 -p1

29
rust-keylime-enable-logging-keylime-lib.patch
View File

@ -1,29 +0,0 @@
From 43db7bdf66a11658614be63f06d74e379a18e0d8 Mon Sep 17 00:00:00 2001
From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
Date: Tue, 21 Jan 2025 15:31:00 +0100
Subject: [PATCH] dist: Enable logging for keylime library in the service
Set the logging level as INFO for the keylime library in the systemd
service file.
Some of the messages were moved from main to the library and would not
be logged without this setting.
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
---
dist/systemd/system/keylime_agent.service | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/dist/systemd/system/keylime_agent.service b/dist/systemd/system/keylime_agent.service
index c5df621d..7ec1a7a1 100644
--- a/dist/systemd/system/keylime_agent.service
+++ b/dist/systemd/system/keylime_agent.service
@@ -17,7 +17,7 @@ ExecStart=/usr/bin/keylime_agent
TimeoutSec=60s
Restart=on-failure
RestartSec=120s
-Environment="RUST_LOG=keylime_agent=info"
+Environment="RUST_LOG=keylime_agent=info,keylime=info"
# If using swtpm with tpm2-abrmd service, uncomment the line below to set TCTI
# variable on the service environment
#Environment="TCTI=tabrmd:"

4
sources
View File

@ -1,2 +1,2 @@
SHA512 (v0.2.9.tar.gz) = f51ce187462278328a96a05dfb6315167bd3be154cb1c9ad933de33d246e696b25bb487071a824ed552456016bb64154e89f5f8a0dc76b94eb896be0f4787e9f
SHA512 (rust-keylime-0.2.9-vendor.tar.zstd) = 6bd6b38697cde0a5220d21620efb459b04a40f04ef60dc0520fac52971c5ffc3665e7d75f303e63979896b43012087b7be3e4a5149d4bedf7c6167321e2b4e3d
SHA512 (v0.2.10.tar.gz) = c61c7276330fb039cb2b161b9888af9112436039b7884e73828de586ffa31d587b0e069faa45e59f9954e724d5f8e606e1c0f8ddf2fce975e89fef0120f5ddca
SHA512 (rust-keylime-0.2.10-vendor.tar.zstd) = 5bd657091bd5b0cbe7a936b74e53c049ea8262ee1b34f94fae2045fc3ac2b9e1312c3d571ab31f2fc71786dbb70989ce0c0b3a3dba4efb9c754a3c6ec68dd941