diff --git a/119_multiple_addresses_for_server.md b/119_multiple_addresses_for_server.md new file mode 100644 index 0000000..71660d7 --- /dev/null +++ b/119_multiple_addresses_for_server.md @@ -0,0 +1,296 @@ + +# Enhancement-119: Multiple Addresses for Server + + + + + + +- [Enhancement-119: Multiple Addresses for Server](#enhancement-119-multiple-addresses-for-server) + - [Release Signoff Checklist](#release-signoff-checklist) + - [Summary](#summary) + - [Motivation](#motivation) + - [Goals](#goals) + - [Availability:](#availability) + - [Security:](#security) + - [Non-Goals](#non-goals) + - [Proposal](#proposal) + - [User Stories (optional)](#user-stories-optional) + - [Story 1](#story-1) + - [Story 2](#story-2) + - [Notes/Constraints/Caveats (optional)](#notesconstraintscaveats-optional) + - [Risks and Mitigations](#risks-and-mitigations) + - [Design Details](#design-details) + - [1. Pull mode, 1 group, 1 server per group:](#1-pull-mode-1-group-1-server-per-group) + - [2. Push mode, 1 group, 1 server per group:](#2-push-mode-1-group-1-server-per-group) + - [3. Push mode, 1 group, multiple servers per group:](#3-push-mode-1-group-multiple-servers-per-group) + - [4. Push mode, multiple groups, multiple servers per group:](#4-push-mode-multiple-groups-multiple-servers-per-group) + - [Test Plan](#test-plan) + - [Upgrade / Downgrade Strategy](#upgrade--downgrade-strategy) + - [Dependencie requirements](#dependencie-requirements) + - [Drawbacks](#drawbacks) + - [Alternatives](#alternatives) + - [Infrastructure Needed (optional)](#infrastructure-needed-optional) + + +## Release Signoff Checklist + + + +- [ ] Enhancement issue in release milestone, which links to pull request in [keylime/enhancements] +- [ ] Core members have approved the issue with the label `implementable` +- [ ] Design details are appropriately documented +- [ ] Test plan is in place +- [ ] User-facing documentation has been created in [keylime/keylime-docs] + + + +## Summary + + + +This will add support for allowing users to specify multiple Registrar addresses in the pull model, and multiple Registrar and Verifier addresses in the push model. When an agent communicates with the Registrar, it will randomly select a Registrar address from the list provided by the user. If the connection fails, it will reselect until a successful connection is made. In the push model, where the agent must initiate the verification, the agent will use the same process for choosing a verifier. + +This will be an iterative set of enhancements, split into 3 changes: +1. Enable a list of Registrars and Verifiers to be given in the config, with the agent randomly selecting from the Registrars, and in the push model the Verifiers as well, and using that address, re-selecting after connection failures. +2. Add a config option to specify the number of Registrars and Verifiers to communicate with. +3. Allow Registrars and Verifiers to be specified in a list form with each list item being a block of Registrar and Verifier addresses that share a backend, and require a number or Registrar/Verifier blocks to attest to. + +## Motivation + + + +### Goals + + +There are two main goals for this enhancement. +#### Availability: +By allowing lists of Registrars and Verifiers we can increase availiability by enabling the agent to fallback to alternative addresses in the case that a Registrar or Verifier cannot be contacted. + +#### Security: +By adding the option of requiring a certain amount of Registrar/Verifier blocks to attest to, and enabling attestation to platforms with separate backends we remove the single point of failure that is currently present and so increase security. + +### Non-Goals + + + +## Proposal + + + +### User Stories (optional) + + + +#### Story 1 + +#### Story 2 + +### Notes/Constraints/Caveats (optional) + + + +### Risks and Mitigations + + + +## Design Details + + +---WIP--- + +The agent config will need to be adapted. +A new config option to replace `registrar_ip` and `registrar_port` will be added, called `servers` (?). Each address till be specified as `"[scheme://]host[:port]"` with scheme and port optional. If just host is given, eg. `n.n.n.n` then default Keylime ports and protocols will be used, if host and port is provided, eg. `n.n.n.n:pppp` then just the default protocol will be used. + +This will accept the following configurations: +##### 1. Pull mode, 1 group, 1 server per group: + + [[servers]] + registrars = [ "reg1.example.com" ] + +##### 2. Push mode, 1 group, 1 server per group: + + [[servers]] + registrars = [ "reg1.example.com" ] + verifiers = [ "ver1.example.com" ] + +###### 3. Push mode, 1 group, multiple servers per group: + + [[servers]] + registrars = [ "reg1.example.com", "reg2.example.com" ] + verifiers = [ "ver1.example.com", "ver2.example.com" ] + +###### 4. Push mode, multiple groups, multiple servers per group: + + [[servers]] + registrars = [ "reg1.example.com", "reg2.example.com" ] + verifiers = [ "ver1.example.com", "ver2.example.com" ] + + [[servers]] + registrars = [ "reg3.example.com", "reg4.example.com" ] + verifiers = [ "ver3.example.com", "ver4.example.com" ] + + [[servers]] + registrars = [ "reg6.example.com" ] + verifiers = [ "ver6.example.com" ] + +If Pull mode is being used but verifier addresses are provided, a config warning will be emitted noting that the specified verifier addresses will not be used. + +If Push mode is being used and no verifier addresses are given, an error specifying that no verifier address has been provided will be given. + +A new config option `verification_duplication = 1`(?) will be added, which will allow a user to specify how many of the blocks to register and verify with. This would require option 4 for `servers` config option so that there are at least 2 backends, and the maximum value would be equal to the number of backends, requiring registration and verification to all backends. The default will be 1, and changing this value will result in a (warning/error) in the situation where only one block is given, or the config is like 1-3. + +### Test Plan + + +We will need to ensure the "blocks" of addresses are respected and that addresses aren't mixed. We should also ensure that various formats in the config file are compatible, for example allowing protocol to be specified (https://n.n.n.n:pppp), ports to be recognized, and defaults applied if they are missing (n.n.n.n should default to standard Keylime ports and protocol). + +### Upgrade / Downgrade Strategy + + + +### Dependencie requirements + + + +## Drawbacks + + + +## Alternatives + + + +## Infrastructure Needed (optional) + +