meta_data field in the event dictionary is a string

[aplanas]

Environment

• OS / version: Any
• Processor architecture: Any
• TPM Manufacturer: vTPM
• Keylime version: 6.1.0

Description

During the execution of the local_action_*.py code, I try to inspect the meta_data field, that is expected to be a dictionary. This field is a string of a dictionary and cannot be accessed. The same happen for tpm_policy and vtpm_policy:

{
  'type': 'revocation',
  'ip': 'domain-name',
  'agent_id': 'UUID',
  'port': 9002,
  'tpm_policy': '{"22": ["0000000000000000000000000000000000000001", "0000000000000000000000000000000000000000000000000000000000000001", "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001", "ffffffffffffffffffffffffffffffffffffffff", "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"], "mask": "0x400400"}',
  'vtpm_policy': '{"23": ["ffffffffffffffffffffffffffffffffffffffff", "0000000000000000000000000000000000000000"], "15": ["0000000000000000000000000000000000000000"], "mask": "0x808000"}',
  'meta_data': '{"cert_serial": 152009338122921836161313840385527081431663682861, "subject": "/C=US/ST=MA/L=Lexington/O=MITLL/OU=53/CN=UUID"}',
  'event_time': 'Mon Jul 19 15:33:20 2021'
}

All the nested dictionaries are converted to string.

[aplanas]

To be honest I am scared to change the code, I found inconsistencies in the naming of the fields (meta_data / metadata, for example), and is created the agent dictionary in multiple places.

Also the auto-ipsec demo deserialize the text field explicitly in the local_actions, that seems weird.

[THS-on]

Yes the naming should be consistent. The verifier API uses metadata and internally for the agent in the database meta_data is used. Changing the names would break the verifier or revocation API but I don't know if parts outside of Keylime consume that data in production.

That this field is a string instead of a dictionary is because this data is added by the tenant and there all nested structures are converted to strings (same happens with for example the tpm_policy). I think in general this fine for saving those entries in the database without changing the db schema to reflect dynamic fields for those entries.
We should add documentation how those API messages are encoded.

The verifier itself does nothing with the metadata information other sending it with an revocation event. Currently the only part of Keylime that consumes this information is ca_util.py which revokes the specified certificate if a revocation message is send.

[maugustosilva]

From my part, I would support a PR that modifies the database schema in a way that: a) changes the column name from meta_data to metadata and b) changes the column type from String to JSONPickleType.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed after 7 days if no further activity occurs. Thank you for your contributions.