Implement a Keymaker Proxy, and actually make use of Ingress cidr_ipv4 #349

New issue

Open

opened 2026-07-01 08:22:03 +00:00 by ryansquared · 2 comments

ryansquared commented

2026-07-01 08:22:03 +00:00

(Migrated from codeberg.org)

Current status — 2026-09-24

Partially implemented: enclave replacement is available; hosted Keymaker access and actual CIDR enforcement remain open.

Platform 1f7e296 includes restart policy parsing, propagation and Nitro process supervision. Locksmith 9f702bb configures Keymaker for automatic replacement. Nine mocked Nitro lifecycle/bootstrap tests and four configuration tests passed on September 23; these are not live-Nitro evidence. Restart behavior and acceptance.

Remaining:

Preserve/enforce source CIDRs in effective managed and BYOC ingress, including relevant HTTP, application and internal recovery paths. Current port extraction/generated rules do not satisfy the restriction.
Restrict hosted generation to authenticated authorized callers and the intended API network boundary; repeated unauthenticated consumption of replacement instances must be prevented.
Verify restrictions survive instance replacement and cannot be bypassed through direct/proxied paths; document intended public recryptor access separately from restricted issuance/generation.
Record real-Nitro repeated generation/termination/replacement, same-endpoint continuity, concurrent callers and lost-response behavior; coordinate termination failure handling with Locksmith #2.

Scope clarification accepted in #384: Keymaker owns one-shot serialization/reset. The additional Platform semaphore/queue in the original proposal is no longer required. Platform must continue making bounded attempts without automatically replaying generation POSTs.

Original proposal and motivation

We need a Keymaker proxy that semaphores incoming requests so there's only one in flight to the enclave. The enclave should be a self-nuking Keymaker instance that's only accessible from API. This would mean we need to configure ingress {} blocks in caution.hcl to actually make use of the cidr_ipv4. Currently, we deploy a resource "aws_security_group" in deployment.rs. Short term, what we can do, is replace the cidr_blocks in the Terraform with the provided CIDR from cidr_ipv4 from caution.hcl, for HTTP, platform_internal_ingress, and dynamic "ingress".

When a client wants to generate a key:

cli verifies the bundle
cli sends a request to api
api holds onto the request until it gets permission from the semaphore
api contacts the keymaker instance, waits until it's ready, and sends one request
keymaker receives the request, generates entropy, and then reboots
- NOTE: we need to implement rebootable enclaves. we don't have that feature currently.
api receives the bundle and sends it to cli
when api returns it to cli, the semaphore is dropped, and the request awaiting the next semaphore may commence
cli handles the response using existing code

## Current status — 2026-09-24 **Partially implemented: enclave replacement is available; hosted Keymaker access and actual CIDR enforcement remain open.** Platform [1f7e296](https://codeberg.org/caution/platform/commit/1f7e2963932ac616ba6c4f0e9553112cb548ce72) includes restart policy parsing, propagation and Nitro process supervision. Locksmith [9f702bb](https://codeberg.org/caution/locksmith/commit/9f702bbf465bc4968e0fa57adcbbc366a1c6977c) configures Keymaker for automatic replacement. Nine mocked Nitro lifecycle/bootstrap tests and four configuration tests passed on September 23; these are not live-Nitro evidence. [Restart behavior and acceptance](https://codeberg.org/caution/platform/src/commit/1f7e2963932ac616ba6c4f0e9553112cb548ce72/docs/enclave-restarts.md). Remaining: - Preserve/enforce source CIDRs in effective managed and BYOC ingress, including relevant HTTP, application and internal recovery paths. Current port extraction/generated rules do not satisfy the restriction. - Restrict hosted generation to authenticated authorized callers and the intended API network boundary; repeated unauthenticated consumption of replacement instances must be prevented. - Verify restrictions survive instance replacement and cannot be bypassed through direct/proxied paths; document intended public recryptor access separately from restricted issuance/generation. - Record real-Nitro repeated generation/termination/replacement, same-endpoint continuity, concurrent callers and lost-response behavior; coordinate termination failure handling with [Locksmith #2](https://codeberg.org/caution/locksmith/issues/2). Scope clarification accepted in [#384](https://codeberg.org/caution/platform/issues/384): Keymaker owns one-shot serialization/reset. The additional Platform semaphore/queue in the original proposal is no longer required. Platform must continue making bounded attempts without automatically replaying generation POSTs. ## Original proposal and motivation We need a Keymaker proxy that semaphores incoming requests so there's only one in flight to the enclave. The enclave should be a self-nuking Keymaker instance that's only accessible from API. This would mean we need to configure `ingress {}` blocks in `caution.hcl` to actually make use of the `cidr_ipv4`. Currently, we deploy a `resource "aws_security_group"` in `deployment.rs`. Short term, what we can do, is replace the `cidr_blocks` in the Terraform with the provided CIDR from `cidr_ipv4` from `caution.hcl`, for HTTP, platform_internal_ingress, and dynamic "ingress". When a client wants to generate a key: - cli verifies the bundle - cli sends a request to api - api holds onto the request until it gets permission from the semaphore - api contacts the keymaker instance, waits until it's ready, and sends one request - keymaker receives the request, generates entropy, and then reboots - NOTE: we need to implement rebootable enclaves. we don't have that feature currently. - api receives the bundle and sends it to cli - when api returns it to cli, the semaphore is dropped, and the request awaiting the next semaphore may commence - cli handles the response using existing code

ryansquared commented

2026-07-01 08:22:52 +00:00

(Migrated from codeberg.org)

This prevents the potential Denial of Service from selfnuke by requiring clients to be logged in before acquiring the semaphore.

caution-bot commented

2026-07-10 20:31:36 +00:00

(Migrated from codeberg.org)

Backlog duplicate audit: #80 (IP safelisting) appears to be the earlier, underspecified version of the ingress CIDR work tracked here. Keeping this as the primary ticket because it explicitly covers applying ingress.cidr_ipv4/CIDR safelisting to enclave ingress; #80 is being closed in favor of this issue.