Add explicit connection context to tracing events

Record source identity, source peer, destination authority, gateway endpoint, and tunnel outcomes directly on gateway and sidecar events so logs are self-contained.

Author: sl5-guy

sidecar/src/bridge.rs

@@ -19,6 +19,7 @@ use tss_esapi::structures::{
 };
 use tss_esapi::tcti_ldr::TctiNameConf;
 use tss_esapi::{Context, tss2_esys};
+use x509_parser::oid_registry::Oid;
 use x509_parser::prelude::*;
 
 const PERSISTENT_HANDLE_START: u32 = 0x8100_0000;
@@ -60,17 +61,23 @@ pub fn parse_tpm_key_handle(value: &str) -> anyhow::Result<u32> {
 
 pub struct TpmClientIdentity {
     cert_chain: Vec<CertificateDer<'static>>,
+    source_identity: String,
     signing_key: Arc<TpmSigningKey>,
 }
 
 impl TpmClientIdentity {
-    pub fn load(tcti: &str, key_handle: u32, cert_path: &Path) -> anyhow::Result<Self> {
+    pub fn load(
+        tcti: &str,
+        key_handle: u32,
+        cert_path: &Path,
+        identity_ext_oid: &str,
+    ) -> anyhow::Result<Self> {
         let cert_chain = load_certs(cert_path)?;
-        let leaf_spki = certificate_spki(
-            cert_chain
-                .first()
-                .context("client certificate chain must contain a leaf certificate")?,
-        )?;
+        let leaf_cert = cert_chain
+            .first()
+            .context("client certificate chain must contain a leaf certificate")?;
+        let leaf_spki = certificate_spki(leaf_cert)?;
+        let source_identity = certificate_identity(leaf_cert, identity_ext_oid)?;
 
         let signing_key = Arc::new(TpmSigningKey::load(tcti, key_handle)?);
         ensure!(
@@ -80,10 +87,15 @@ impl TpmClientIdentity {
 
         Ok(Self {
             cert_chain,
+            source_identity,
             signing_key,
         })
     }
 
+    pub fn source_identity(&self) -> &str {
+        &self.source_identity
+    }
+
     pub fn resolver(self) -> Arc<dyn ResolvesClientCert> {
         Arc::new(StaticTpmClientCert {
             certified_key: Arc::new(CertifiedKey::new(self.cert_chain, self.signing_key)),
@@ -253,6 +265,29 @@ fn certificate_spki(cert: &CertificateDer<'_>) -> anyhow::Result<Vec<u8>> {
     Ok(cert.tbs_certificate.subject_pki.raw.to_vec())
 }
 
+fn certificate_identity(
+    cert: &CertificateDer<'_>,
+    identity_ext_oid: &str,
+) -> anyhow::Result<String> {
+    let oid = Oid::from_str(identity_ext_oid)
+        .map_err(|e| anyhow::anyhow!("invalid client identity extension OID: {e:?}"))?;
+    let (_, cert) =
+        X509Certificate::from_der(cert.as_ref()).context("parsing client certificate")?;
+    let ext = cert
+        .tbs_certificate
+        .extensions()
+        .iter()
+        .find(|ext| ext.oid == oid)
+        .with_context(|| format!("missing client identity extension {identity_ext_oid}"))?;
+    let (remaining, value) = x509_parser::asn1_rs::Utf8String::from_der(ext.value)
+        .context("decoding client identity extension as UTF8String")?;
+    ensure!(
+        remaining.is_empty(),
+        "client identity extension contains trailing bytes"
+    );
+    Ok(value.string().to_owned())
+}
+
 fn p256_spki_from_tpm_public(public: &Public) -> anyhow::Result<Vec<u8>> {
     let Public::Ecc {
         parameters, unique, ..

sidecar/src/identity.rs

@@ -17,6 +17,8 @@ use tracing::{error, info, warn};
 use crate::bridge::GatewayConnector;
 use crate::identity::{TpmClientIdentity, parse_tpm_key_handle};
 
+const DEFAULT_CLIENT_IDENTITY_EXT_OID: &str = "1.3.6.1.4.1.57264.1.1";
+
 #[derive(Parser)]
 #[command(
     name = "agent_gateway_sidecar",
@@ -35,6 +37,10 @@ struct Cli {
     #[arg(long)]
     client_cert: PathBuf,
 
+    /// Client certificate extension OID that contains the source identity
+    #[arg(long, default_value = DEFAULT_CLIENT_IDENTITY_EXT_OID)]
+    client_identity_ext_oid: String,
+
     /// TCTI string for the simulated TPM
     #[arg(long, default_value = "swtpm:host=127.0.0.1,port=2321")]
     tpm_tcti: String,
@@ -71,10 +77,17 @@ async fn main() -> anyhow::Result<()> {
     }
 
     let tpm_key_handle = parse_tpm_key_handle(&cli.tpm_key_handle)?;
-    let identity = TpmClientIdentity::load(&cli.tpm_tcti, tpm_key_handle, &cli.client_cert)?;
+    let identity = TpmClientIdentity::load(
+        &cli.tpm_tcti,
+        tpm_key_handle,
+        &cli.client_cert,
+        &cli.client_identity_ext_oid,
+    )?;
+    let source_identity = identity.source_identity().to_owned();
     let tls_config = build_client_config(identity, &cli.ca_cert)?;
 
     let (gateway_host, gateway_port) = parse_gateway_addr(&cli.gateway)?;
+    let gateway_endpoint = format_endpoint(&gateway_host, gateway_port);
     let gateway_sni = ServerName::try_from(gateway_host.clone())
         .context("gateway hostname is not a valid SNI value")?;
 
@@ -83,10 +96,17 @@ async fn main() -> anyhow::Result<()> {
         gateway_sni,
         gateway_host,
         gateway_port,
+        gateway_endpoint.clone(),
+        source_identity.clone(),
     ));
 
     let listener = TcpListener::bind(cli.listen).await?;
-    info!(listen = %cli.listen, gateway = %cli.gateway, "sidecar ready");
+    info!(
+        source_identity = %source_identity,
+        listen = %cli.listen,
+        gateway_endpoint = %gateway_endpoint,
+        "sidecar ready"
+    );
 
     loop {
         let (stream, peer) = match listener.accept().await {
@@ -100,8 +120,8 @@ async fn main() -> anyhow::Result<()> {
 
         let connector = connector.clone();
         tokio::spawn(async move {
-            if let Err(e) = bridge::serve_connection(stream, connector).await {
-                error!(%peer, error = %e, "connection error");
+            if let Err(e) = bridge::serve_connection(stream, peer, connector).await {
+                error!(source_peer_addr = %peer, error = %e, "connection error");
             }
         });
     }
@@ -158,6 +178,14 @@ fn parse_gateway_addr(addr: &str) -> anyhow::Result<(String, u16)> {
     }
 }
 
+fn format_endpoint(host: &str, port: u16) -> String {
+    if host.contains(':') {
+        format!("[{host}]:{port}")
+    } else {
+        format!("{host}:{port}")
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -183,6 +211,12 @@ mod tests {
         assert_eq!(port, 8443);
     }
 
+    #[test]
+    fn format_endpoint_brackets_ipv6() {
+        assert_eq!(format_endpoint("127.0.0.1", 8443), "127.0.0.1:8443");
+        assert_eq!(format_endpoint("::1", 8443), "[::1]:8443");
+    }
+
     #[test]
     fn parse_rejects_missing_port() {
         assert!(parse_gateway_addr("127.0.0.1").is_err());

sidecar/src/main.rs

@@ -83,21 +83,21 @@ async fn serve_loop(
             let tls_stream = match acceptor.accept(tcp_stream).await {
                 Ok(s) => s,
                 Err(e) => {
-                    error!(%peer_addr, error = %e, "TLS handshake failed");
+                    error!(source_peer_addr = %peer_addr, error = %e, "TLS handshake failed");
                     return;
                 }
             };
 
             let peer_certs = proxy::extract_peer_certs(tls_stream.get_ref().1);
-            let service = make_svc.make_service(peer_certs);
+            let service = make_svc.make_service(peer_certs, peer_addr);
 
             let io = hyper_util::rt::TokioIo::new(tls_stream);
             if let Err(e) = hyper_util::server::conn::auto::Builder::new(TokioExecutor::new())
                 .http2_only()
                 .serve_connection_with_upgrades(io, service)
                 .await
             {
-                error!(%peer_addr, error = %e, "connection error");
+                error!(source_peer_addr = %peer_addr, error = %e, "connection error");
             }
         });
     }

src/main.rs

@@ -14,8 +14,13 @@ pub struct RequestContext {
 }
 
 pub enum PolicyDecision {
-    Allow,
-    Deny { reason: String },
+    Allow {
+        source_identity: String,
+    },
+    Deny {
+        source_identity: Option<String>,
+        reason: String,
+    },
 }
 
 #[async_trait]
@@ -126,6 +131,7 @@ impl PolicyEngine for TomlPolicyEngine {
         // remaining entries are intermediates used for chain-of-trust validation.
         let Some(peer_cert_der) = ctx.peer_certificates.first() else {
             return PolicyDecision::Deny {
+                source_identity: None,
                 reason: "no client certificate".into(),
             };
         };
@@ -134,6 +140,7 @@ impl PolicyEngine for TomlPolicyEngine {
             Ok((_, cert)) => cert,
             Err(e) => {
                 return PolicyDecision::Deny {
+                    source_identity: None,
                     reason: format!("failed to parse client certificate: {e}"),
                 };
             }
@@ -146,6 +153,7 @@ impl PolicyEngine for TomlPolicyEngine {
             .find(|e| e.oid == self.client_ext_oid)
         else {
             return PolicyDecision::Deny {
+                source_identity: None,
                 reason: format!("missing required extension {}", self.client_ext_oid),
             };
         };
@@ -154,20 +162,23 @@ impl PolicyEngine for TomlPolicyEngine {
             Ok((remaining, v)) => {
                 if !remaining.is_empty() {
                     return PolicyDecision::Deny {
+                        source_identity: None,
                         reason: "extension value contains trailing bytes".into(),
                     };
                 }
                 v.string()
             }
             Err(e) => {
                 return PolicyDecision::Deny {
+                    source_identity: None,
                     reason: format!("failed to decode extension as UTF8String: {e}"),
                 };
             }
         };
 
         let Some(allowed) = self.rules.get(&ext_value) else {
             return PolicyDecision::Deny {
+                source_identity: Some(ext_value.to_owned()),
                 reason: format!("no rules for extension value {ext_value:?}"),
             };
         };
@@ -176,14 +187,18 @@ impl PolicyEngine for TomlPolicyEngine {
             Ok(d) => d,
             Err(e) => {
                 return PolicyDecision::Deny {
+                    source_identity: Some(ext_value.to_owned()),
                     reason: format!("invalid destination: {e}"),
                 };
             }
         };
         if allowed.contains(&normalized_dest) {
-            PolicyDecision::Allow
+            PolicyDecision::Allow {
+                source_identity: ext_value.to_owned(),
+            }
         } else {
             PolicyDecision::Deny {
+                source_identity: Some(ext_value.to_owned()),
                 reason: format!(
                     "destination {:?} not allowed for {:?}",
                     ctx.destination, ext_value