Implement tofu. Incorperate feedback

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

doc/plugin_server_nodeattestor_http_challenge.md

@@ -16,8 +16,9 @@ spiffe://<trust_domain>/spire/agent/http_challenge/<hostname>
 |-------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------|
 | `dns_patterns`          | A list of regular expressions to apply to the hostname being attested. If none match, attestation will fail. If unset, all hostnames are allowed.         |                                     |
 | `required_port`         | Set to a port number to require clients to listen only on that port. If unset, all port numbers are allowed                                               |                                     |
-| `allow_non_root_ports`  | Set to true to allow ports >= 1024 to be used by the agents with the advertised_port                                                                      | false                               |
+| `allow_non_root_ports`  | Set to true to allow ports >= 1024 to be used by the agents with the advertised_port                                                                      | true                                |
 | `agent_path_template`   | A URL path portion format of Agent's SPIFFE ID. Describe in text/template format.                                                                         | "{{ .PluginName }}/{{ .HostName }}" |
+| `tofu`                  | Trust on first use of the successful challenge. Can only be disabled if allow_non_root_ports=false or required_port < 1024                                | true                                |
 
 A sample configuration:
 
@@ -38,8 +39,8 @@ A sample configuration:
 
 ## Selectors
 
-| Selector | Example                        | Description            |
-|----------|--------------------------------|------------------------|
+| Selector | Example                                  | Description            |
+|----------|------------------------------------------|------------------------|
 | Hostname | `http_challenge:hostname:p1.example.com` | The Subject's Hostname |
 
 ## Agent Path Template
@@ -54,3 +55,15 @@ Some useful values are:
 | .PluginName           | The name of the plugin.             |
 | .HostName             | The hostname of the agent attested. |
 | .TrustDomain          | The configured trust domain.        |
+
+## Security Considerations
+
+Generally, tcp ports are accessable to any user of the node. As a result, it is possible for non-agent code running on a node to attest to the SPIRE Server, allowing it to obtain any workload identity that the node is authorized to run.
+
+To mitigate the associated risk, the `http_challenge` node attestor implements multiple features that can be used to minimize the risk.
+
+Trust On First Use (or TOFU) is one such option. For any given node, attestation may occur only once when enabled. Subsequent attestation attempts will be rejected.
+
+With TOFU, it is still possible for non-agent code to complete node attestation before SPIRE Agent can, however this condition is easily and quickly detectable as SPIRE Agent will fail to start, and both SPIRE Agent and SPIRE Server will log the occurrence. Such cases should be investigated as possible security incidents.
+
+You also can require the port to be a trusted port that only trusted user such as root can open (port number < 1024).

pkg/server/plugin/nodeattestor/httpchallenge/httpchallenge.go

@@ -7,12 +7,14 @@
 	"sync"
 
 	"github.com/hashicorp/hcl"
+        "github.com/hashicorp/go-hclog"
 	"github.com/spiffe/go-spiffe/v2/spiffeid"
 	nodeattestorv1 "github.com/spiffe/spire-plugin-sdk/proto/spire/plugin/server/nodeattestor/v1"
 	configv1 "github.com/spiffe/spire-plugin-sdk/proto/spire/service/common/config/v1"
 	"github.com/spiffe/spire/pkg/common/agentpathtemplate"
 	"github.com/spiffe/spire/pkg/common/catalog"
 	"github.com/spiffe/spire/pkg/common/plugin/httpchallenge"
+        nodeattestorbase "github.com/spiffe/spire/pkg/server/plugin/nodeattestor/base"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
@@ -39,21 +41,26 @@
 	allowNonRootPorts bool
 	dnsPatterns       []*regexp.Regexp
 	agentNamePattern  *regexp.Regexp
+	tofu              bool
 }
 
 type Config struct {
 	DNSPatterns       []string `hcl:"dns_patterns"`
 	RequiredPort      *int     `hcl:"required_port"`
 	AllowNonRootPorts *bool    `hcl:"allow_non_root_ports"`
 	AgentPathTemplate string   `hcl:"agent_path_template"`
+	TOFU              *bool    `hcl:"tofu"`
 }
 
 type Plugin struct {
+        nodeattestorbase.Base
 	nodeattestorv1.UnsafeNodeAttestorServer
 	configv1.UnsafeConfigServer
 
 	m      sync.Mutex
 	config *configuration
+
+        log hclog.Logger
 }
 
 func New() *Plugin {
@@ -144,12 +151,19 @@
 		return status.Errorf(codes.Internal, "failed to make spiffe id: %v", err)
 	}
 
+
+	if config.tofu {
+		if err := p.AssessTOFU(stream.Context(), spiffeid.String(), p.log); err != nil {
+			return err
+		}
+	}
+
 	return stream.Send(&nodeattestorv1.AttestResponse{
 		Response: &nodeattestorv1.AttestResponse_AgentAttributes{
 			AgentAttributes: &nodeattestorv1.AgentAttributes{
 				SpiffeId:       spiffeid.String(),
 				SelectorValues: buildSelectorValues(attestationData.HostName),
-				CanReattest:    true,
+				CanReattest:    !config.tofu,
 			},
 		},
 	})
@@ -195,18 +209,45 @@
 		allowNonRootPorts = *hclConfig.AllowNonRootPorts
 	}
 
+	tofu := true
+	if hclConfig.TOFU != nil {
+		tofu = *hclConfig.TOFU
+	}
+
+	mustUseTOFU := false
+	// User has explicitly asked for a required port that is untrusted
+	if hclConfig.RequiredPort != nil && *hclConfig.RequiredPort >= 1024 {
+		mustUseTOFU = true
+	// User has just chosen the defaults, any port is allowed
+	} else if hclConfig.AllowNonRootPorts == nil && hclConfig.RequiredPort == nil {
+		mustUseTOFU = true
+	// User explicitly set AllowNonRootPorts to true and no requried port specified
+	} else if hclConfig.AllowNonRootPorts != nil && *hclConfig.AllowNonRootPorts && hclConfig.RequiredPort == nil {
+		mustUseTOFU = true
+	}
+
+	if tofu == false && mustUseTOFU {
+		return nil, status.Errorf(codes.InvalidArgument, "you can not turn off trust on first use (TOFU) when non root ports are allowed")
+	}
+
 	p.setConfiguration(&configuration{
 		trustDomain:       trustDomain,
 		pathTemplate:      pathTemplate,
 		dnsPatterns:       dnsPatterns,
 		requiredPort:      hclConfig.RequiredPort,
 		allowNonRootPorts: allowNonRootPorts,
 		agentNamePattern:  agentNamePattern,
+		tofu:              tofu,
 	})
 
 	return &configv1.ConfigureResponse{}, nil
 }
 
+// SetLogger sets this plugin's logger
+func (p *Plugin) SetLogger(log hclog.Logger) {
+        p.log = log
+}
+
 func (p *Plugin) getConfig() (*configuration, error) {
 	p.m.Lock()
 	defer p.m.Unlock()