SVIDStore disk plugin

conf/agent/agent_full.conf

@@ -268,6 +268,15 @@ plugins {
         }
     }
 
+    # SVIDStore "disk": An SVID store that stores the SVIDs on disk
+    SVIDStore "disk" {
+        plugin_data {
+            # directory: Base directory that is used to store the SVIDs.
+            # All stored files are under this path.
+            # directory = "/path/to/svids"
+        }
+    }
+
     # WorkloadAttestor "docker": A workload attestor which allows selectors
     # based on docker constructs such label and image_id.
     WorkloadAttestor "docker" {

doc/plugin_agent_svidstore_disk.md

@@ -0,0 +1,35 @@
+# Agent plugin: SVIDStore "disk"
+
+The `disk` plugin stores in disk the resulting X509-SVIDs of the entries that the agent is entitled to. 
+
+### Format
+
+The plugin stores the SVID in three different PEM encoded files: one for the certificate chain, one for the certificate key and one for the trust domain bundle. The file paths are specified through [selectors](#selectors).
+
+_Note: federated bundles are not stored by this plugin._
+
+### Configuration
+
+| Configuration        | Description | DEFAULT        | 
+| -------------------- | ----------- | -------------- | 
+| directory | Base directory that is used to store the SVIDs. All stored files are under this path. |  | 
+
+A sample configuration:
+
+```
+    SVIDStore "disk" {
+       plugin_data {
+           directory = "/path/to/svids"
+       }
+    }
+```
+
+### Selectors
+
+Selectors are used on `storable` entries to describre metadata that is needed by the `disk` plugin in order to store the SVIDs on disk. In case that a required selector is not provided, the plugin will return an error at execution time.
+
+| Selector                      | Example                                    | Required | Description                                    |
+| ----------------------------- | ------------------------------------------ | -------- | --------------------------------------------   |
+| `disk:certchainfile`      | `disk:certchainfile:tls.crt`   | x        | The file path relative to the base directory where the SVID certificate chain will be stored. |
+| `disk:keyfile` | `disk:keyfile:key.crt` | x        | The file path relative to the base directory where the SVID certificate key will be stored. |
+| `disk:bundlefile`     | `disk:bundlefile:ca.crt` | x        | The file path relative to the base directory where the CA certificates belonging to the Trust Domain of the SVID will be stored. |

go.mod

@@ -151,7 +151,7 @@ require (
 	go.opencensus.io v0.23.0 // indirect
 	go.uber.org/atomic v1.9.0
 	go.uber.org/goleak v1.1.11 // indirect
-	go.uber.org/multierr v1.6.0 // indirect
+	go.uber.org/multierr v1.6.0
 	go.uber.org/zap v1.19.0 // indirect
 	golang.org/x/crypto v0.0.0-20210915214749-c084706c2272
 	golang.org/x/net v0.0.0-20210917221730-978cfadd31cf

pkg/agent/catalog/svidstore.go

@@ -3,6 +3,7 @@ package catalog
 import (
 	"github.com/spiffe/spire/pkg/agent/plugin/svidstore"
 	"github.com/spiffe/spire/pkg/agent/plugin/svidstore/awssecretsmanager"
+	"github.com/spiffe/spire/pkg/agent/plugin/svidstore/disk"
 	"github.com/spiffe/spire/pkg/agent/plugin/svidstore/gcpsecretmanager"
 	"github.com/spiffe/spire/pkg/common/catalog"
 )
@@ -27,6 +28,7 @@ func (repo *svidStoreRepository) BuiltIns() []catalog.BuiltIn {
 	return []catalog.BuiltIn{
 		awssecretsmanager.BuiltIn(),
 		gcpsecretmanager.BuiltIn(),
+		disk.BuiltIn(),
 	}
 }
 

pkg/agent/plugin/svidstore/disk/disk.go

@@ -0,0 +1,311 @@
+package disk
+
+import (
+	"context"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/hcl"
+	configv1 "github.com/spiffe/spire-plugin-sdk/proto/spire/service/common/config/v1"
+	"github.com/spiffe/spire/pkg/agent/plugin/svidstore"
+	"github.com/spiffe/spire/pkg/common/catalog"
+	"github.com/spiffe/spire/pkg/common/diskutil"
+	"github.com/spiffe/spire/pkg/common/telemetry"
+	svidstorev1 "github.com/spiffe/spire/proto/spire/plugin/agent/svidstore/v1"
+	"go.uber.org/multierr"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+const (
+	pluginName = "disk"
+	attrName   = "user.spire-svid"
+)
+
+type certFile struct {
+	filePath string
+	pemBytes []byte
+}
+
+type diskStore struct {
+	certChain certFile
+	key       certFile
+	bundle    certFile
+}
+
+func BuiltIn() catalog.BuiltIn {
+	return builtin(New())
+}
+
+func builtin(p *DiskPlugin) catalog.BuiltIn {
+	return catalog.MakeBuiltIn(pluginName,
+		svidstorev1.SVIDStorePluginServer(p),
+		configv1.ConfigServiceServer(p),
+	)
+}
+
+func New() *DiskPlugin {
+	return &DiskPlugin{}
+}
+
+type configuration struct {
+	Directory string `hcl:"directory" json:"directory"`
+}
+
+type DiskPlugin struct {
+	svidstorev1.UnsafeSVIDStoreServer
+	configv1.UnsafeConfigServer
+
+	log         hclog.Logger
+	config      *configuration
+	trustDomain string
+	mtx         sync.RWMutex
+}
+
+// SetLogger sets the logger used by the plugin
+func (p *DiskPlugin) SetLogger(log hclog.Logger) {
+	p.mtx.Lock()
+	defer p.mtx.Unlock()
+
+	p.log = log
+}
+
+// Configure configures the plugin
+func (p *DiskPlugin) Configure(ctx context.Context, req *configv1.ConfigureRequest) (*configv1.ConfigureResponse, error) {
+	config := &configuration{}
+	if err := hcl.Decode(config, req.HclConfiguration); err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "unable to decode configuration: %v", err)
+	}
+
+	p.mtx.Lock()
+	defer p.mtx.Unlock()
+
+	p.trustDomain = req.CoreConfiguration.TrustDomain
+	p.config = config
+	if config.Directory == "" {
+		return nil, status.Error(codes.InvalidArgument, "a directory must be configured")
+	}
+
+	return &configv1.ConfigureResponse{}, nil
+}
+
+// PutX509SVID stores the specified X509-SVID in the configured location
+func (p *DiskPlugin) PutX509SVID(ctx context.Context, req *svidstorev1.PutX509SVIDRequest) (*svidstorev1.PutX509SVIDResponse, error) {
+	log := p.log.With(telemetry.SPIFFEID, req.Svid.SpiffeID)
+
+	config, err := p.getConfig()
+	if err != nil {
+		return nil, err
+	}
+
+	diskStore, err := newDiskStore(req.Metadata, config.Directory)
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	diskStore.certChain.pemBytes = certChainPEMBytes(req.Svid.CertChain)
+	diskStore.key.pemBytes = keyPEMBytes(req.Svid.PrivateKey)
+	diskStore.bundle.pemBytes = certChainPEMBytes(req.Svid.Bundle)
+
+	log.With("cert_chain_file_path", diskStore.certChain.filePath).Debug("Writing certificate chain file")
+	if err := diskStore.certChain.write(p.trustDomain); err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to write certificate chain file: %v", err)
+	}
+
+	log.With("key_file_path", diskStore.key.filePath).Debug("Writing key file")
+	if err := diskStore.key.write(p.trustDomain); err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to write key file: %v", err)
+	}
+
+	log.With("bundle_file_path", diskStore.bundle.filePath).Debug("Writing bundle file")
+	if err := diskStore.bundle.write(p.trustDomain); err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to write bundle file: %v", err)
+	}
+
+	return &svidstorev1.PutX509SVIDResponse{}, nil
+}
+
+// DeleteX509SVID deletes the specified stored X509-SVID
+func (p *DiskPlugin) DeleteX509SVID(ctx context.Context, req *svidstorev1.DeleteX509SVIDRequest) (*svidstorev1.DeleteX509SVIDResponse, error) {
+	config, err := p.getConfig()
+	if err != nil {
+		return nil, err
+	}
+	diskStore, err := newDiskStore(req.Metadata, config.Directory)
+	if err != nil {
+		return nil, err
+	}
+
+	if errRemoveCertChain := diskStore.certChain.delete(); errRemoveCertChain != nil {
+		if os.IsNotExist(errRemoveCertChain) {
+			p.log.With("file_path", diskStore.certChain.filePath).Warn("Could not delete certificate chain file. File not found")
+		} else {
+			err = multierr.Append(err, fmt.Errorf("failed to delete certificate chain file: %w", errRemoveCertChain))
+		}
+	}
+	if errRemoveKey := diskStore.key.delete(); errRemoveKey != nil {
+		if os.IsNotExist(errRemoveKey) {
+			p.log.With("file_path", diskStore.key.filePath).Warn("Could not delete key file. File not found")
+		} else {
+			err = multierr.Append(err, fmt.Errorf("failed to delete key file: %w", errRemoveKey))
+		}
+	}
+	if errRemoveBundle := diskStore.bundle.delete(); errRemoveBundle != nil {
+		if os.IsNotExist(errRemoveBundle) {
+			p.log.With("file_path", diskStore.bundle.filePath).Warn("Could not delete bundle file. File not found")
+		} else {
+			err = multierr.Append(err, fmt.Errorf("failed to delete bundle file: %w", errRemoveBundle))
+		}
+	}
+
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "error deleting SVID: %v", err)
+	}
+
+	return &svidstorev1.DeleteX509SVIDResponse{}, nil
+}
+
+func (p *DiskPlugin) getConfig() (*configuration, error) {
+	p.mtx.RLock()
+	defer p.mtx.RUnlock()
+	if p.config == nil {
+		return nil, status.Error(codes.FailedPrecondition, "not configured")
+	}
+	return p.config, nil
+}
+
+func (c *certFile) write(attrValue string) error {
+	if err := validateXattr(c.filePath, attrValue); err != nil {
+		return err
+	}
+
+	if err := createBaseDirectoryIfNeeded(c.filePath); err != nil {
+		return err
+	}
+
+	if err := diskutil.AtomicWriteFile(c.filePath, c.pemBytes, 0600); err != nil {
+		return err
+	}
+	if err := setxattr(c.filePath, attrName, []byte(attrValue)); err != nil {
+		return fmt.Errorf("failed to set extended attribute to file: %w", err)
+	}
+
+	return nil
+}
+
+func (c *certFile) delete() error {
+	return os.Remove(c.filePath)
+}
+
+func getFileMetadata(metadataMap map[string]string, key string) (string, error) {
+	value := metadataMap[key]
+	if value == "" {
+		return "", status.Errorf(codes.InvalidArgument, "%s must be specified", key)
+	}
+	if containsDotDot(value) {
+		return "", status.Errorf(codes.InvalidArgument, "invalid %s", key)
+	}
+
+	return value, nil
+}
+
+func newDiskStore(metaData []string, dir string) (*diskStore, error) {
+	metadataMap, err := svidstore.ParseMetadata(metaData)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "error parsing metadata: %v", err)
+	}
+
+	certChainFilePath, err := getFileMetadata(metadataMap, "certchainfile")
+	if err != nil {
+		return nil, err
+	}
+
+	keyFilePath, err := getFileMetadata(metadataMap, "keyfile")
+	if err != nil {
+		return nil, err
+	}
+
+	bundleFilePath, err := getFileMetadata(metadataMap, "bundlefile")
+	if err != nil {
+		return nil, err
+	}
+
+	return &diskStore{
+		certChain: certFile{filePath: filepath.Join(dir, certChainFilePath)},
+		key:       certFile{filePath: filepath.Join(dir, keyFilePath)},
+		bundle:    certFile{filePath: filepath.Join(dir, bundleFilePath)},
+	}, nil
+}
+
+// validateXattr validates that the specified file has
+// an extended attribute (https://en.wikipedia.org/wiki/Extended_file_attributes)
+// set by this plugin, with the trust domain as the value.
+// This is a best-effort attempt to avoid collisions with other systems.
+// Some platforms do not support this mechanism.
+func validateXattr(filePath, attrValue string) error {
+	if _, statErr := os.Stat(filePath); os.IsNotExist(statErr) {
+		return nil
+	}
+
+	dest := make([]byte, len(attrValue))
+	err := getxattr(filePath, attrName, dest)
+	if err != nil {
+		return fmt.Errorf("validation error: %w", err)
+	}
+	if string(dest) != attrValue {
+		return errors.New("validation error: attribute mismatch")
+	}
+
+	return nil
+}
+
+func keyPEMBytes(privateKey []byte) (pemData []byte) {
+	b := &pem.Block{
+		Type:  "PRIVATE KEY",
+		Bytes: privateKey,
+	}
+
+	return pem.EncodeToMemory(b)
+}
+
+func certChainPEMBytes(certChain [][]byte) (pemData []byte) {
+	for _, cert := range certChain {
+		b := &pem.Block{
+			Type:  "CERTIFICATE",
+			Bytes: cert,
+		}
+		pemData = append(pemData, pem.EncodeToMemory(b)...)
+	}
+
+	return pemData
+}
+
+func createBaseDirectoryIfNeeded(filePath string) error {
+	baseDir := filepath.Dir(filePath)
+	if _, statErr := os.Stat(baseDir); os.IsNotExist(statErr) {
+		if err := os.MkdirAll(baseDir, 0755); err != nil {
+			return status.Errorf(codes.Internal, "error creating directory: %v", err)
+		}
+	}
+	return nil
+}
+
+func containsDotDot(v string) bool {
+	if !strings.Contains(v, "..") {
+		return false
+	}
+	for _, ent := range strings.FieldsFunc(v, isSlashRune) {
+		if ent == ".." {
+			return true
+		}
+	}
+	return false
+}
+
+func isSlashRune(r rune) bool { return r == '/' || r == '\\' }