Ephemeral One Time/Build-Time gRPC TLS PKI system.

Overview

PkiSauce

Ephemeral Build Time TLS PKI saucing for your intra services GRPC (or not) communications.

Description

A simple attempt to avoid deploying complex PKI mechanisms, certificates signing, deployment, synchronisation, protecting the CA, etc.. while keeping a consistent and relatively "safe" to use PKI for your internal needs.

The idea is to build a PKI and leverage the common CI/CD dev habits to our advantage, allowing to integrate intra communication low overhead transport security.

While we're using it daily on our projects and we consider it safe for our needs, it is still sort of BETA and a WORK IN PROGRESS, it is NOT polished and not all features are baked in yet. Obviously, we welcome contributions & constructive ideas, that does NOT MEAN every idea or PR will be included or planned.

How it works

Simply, you define your services/elements/daemon and their relationships / interdependence, we define one entity as "daemon" (we're unix folk yes). You then say which one should access which grpc service/RPC call of another defined "daemon". pkisauce will generate the one time use PKI, which includes: the CA,cert/key, services cert/key and the policy code in an interceptor format for the output language supported.

Example myservices.conf:

daemon "servA" path "../cmd/grpc-pkscd" use go-grpc {
	pass "client1" on "Public" rpc any;
	pass "client2" on "Restricted" rpc { "CallThere" };
}

daemon "client1" path "../cmd/grpc-pkscc" use go-grpc {}
daemon "client2" path "../cmd/grpc-pkscc" use go-grpc {}

Run pkisauce myservices.conf to generate the appropriate helpers for your services in golang

see the example directory for an example on how to use it.

Requirements

  • golang 1.17+
  • gRPC services to use that on (but actually you could build a pem based pki only if you wish)
  • the go.mod stuff

Install

go install ermites.io/[email protected]
git clone...
cd pkisauce
go build -a

Features

  • mTLS 1.3+ communication.
  • no CA to handle (CA is destroyed after the build).
  • service communication consistency (avoid version conflicts between builds).
  • GRPC service/call granularity.
  • Generate TLS host only policies for non GRPC services.
  • TLS certificates/keys are using Curve25519.
  • TLS certificates/keys are generated, obfuscated & embedded in the generated code.
  • TLS certificates/keys are unpacked at runtime.
  • Golang GRPC policies are generated in unary interceptor code ready to be embedded your services.
  • Golang GRPC call granularity, daemonA can only call daemonB/ServiceX/Call1.
  • PEM generation support.
  • no additionnal dependencies in the generated code (beside GRPC obviously).

Usage

This will prepare one single Ephemeral PKI composed of pkisauce config files and generate TLS/GRPC helpers to apply the policy defined in those pkisauce conf files.

pkisauce [options] <conf1> <conf2> <conf3> ... <confN> 

all the files provided are considered part of the SAME PKI.

This cannot be applied everywhere.

Stating the obvious, but let's state it to be sure: this cannot be applied everywhere.

The various projects we work(ed) on were always coded, built, shipped & delivered as ONE, multiple layers and multiple services (30+) written, built & deployed as ONE release.

We are BSD people and adopting the BSD stance, in this model & using this tool removed many side effects and potential inconsistencies that could linger during various deployment in an iterative development process.

Also as mentioned earlier we are leveraging the CI/CD iteration habits to constantly update the trust and security of all components in the system, each release cancels out the previous trust and so on; it enforces consistency across all the communication between all clients/services.

The conclusion is: It is NOT adapted for every use case, it is a design choice for having strong transport security with minimal cost/design/deployment overhead.

TODO

  • Graph generation (dot, gephy, etc..) for document purposes.
  • TLS only policies should NOT include grpc dependencies.
  • minimize dependencies.
  • certificates properties configuration support (key type?)
  • better user controlled data inclusion as well as config/service wide (add user specific data in the generated certs)
  • proper debug template of this Ephemeral PKI (list other member of the PKI, only one detailed, etc..)
  • java/grpc helpers templates/generator
  • c++/grpc helpers templates/generator
  • C helpers templates/generator (tls only)
  • GRPC persistent connection load balancing included.
  • a much better config parse error handling (I am no antlr4 guru tbh...)
  • explore the possibility to use go-yacc (as it's sort of part of golang) instead, but it requires an external lexer.. (which is why i tried antlr4, no go-lex or go-flex)
  • implement much more comprehensive tests in policy, config and scramble
You might also like...
Go based grpc - grpc gateway micro service example

go-grpc-gateway-server This repository provides an example for go based microservice. Go micro services developed based on gRPC protobuf's and also us

Simple grpc web and grpc transcoding with Envoy
Simple grpc web and grpc transcoding with Envoy

gRPC Web and gRPC Transcoding with Envoy This is a simple stand-alone set of con

Go-grpc - This is grpc server for golang.

go-grpc This is grpc server for golang. protocのインストール brew install protoc Golang用のプラグインのインストール go install google.golang.org/protobuf/cmd/protoc-gen-go

GRPC - Creating a gRPC service from scratch

#Go gRPC services course Creating a gRPC service from scratch Command line colle

Totem - A Go library that can turn a single gRPC stream into bidirectional unary gRPC servers

Totem is a Go library that can turn a single gRPC stream into bidirectional unar

Grpc-gateway-map-null - gRPC Gateway test using nullable values in map

Demonstrate gRPC gateway behavior with nullable values in maps Using grpc-gatewa

Todo-app-grpc - Go/GRPC codebase containing RealWorld examples (CRUD, auth, advanced patterns, etc)

Go/GRPC codebase containing RealWorld examples (CRUD, auth, advanced patterns, e

GRPC - A client-server mockup, using gRPC to expose functionality.

gRPC This is a mockup application that I built to help me visualise and understand the basic concepts of gRPC. In this exchange, the client can use a

Raft-grpc-demo - Some example code for how to use Hashicorp's Raft implementation with gRPC

raft-grpc-example This is some example code for how to use Hashicorp's Raft impl

Owner
Ermites.IO
Datacraft & Security Engineering
Ermites.IO
Http-server - A HTTP server and can be accessed via TLS and non-TLS mode

Application server.go runs a HTTP/HTTPS server on the port 9090. It gives you 4

Vedant Pareek 0 Feb 3, 2022
protoc-gen-grpc-gateway-ts is a Typescript client generator for the grpc-gateway project. It generates idiomatic Typescript clients that connect the web frontend and golang backend fronted by grpc-gateway.

protoc-gen-grpc-gateway-ts protoc-gen-grpc-gateway-ts is a Typescript client generator for the grpc-gateway project. It generates idiomatic Typescript

gRPC Ecosystem 91 Nov 18, 2022
Using Wireshark to decrypt TLS gRPC Client-Server protobuf messages

Using Wireshark to decrypt TLS gRPC Client-Server protobuf messages Sample client server in golang that demonstrates how to decode protobuf messages f

null 4 Sep 8, 2022
Orion - a small lightweight framework written around grpc/protobuf with the aim to shorten time to build microservices at Carousell.

Orion Orion is a small lightweight framework written around grpc/protobuf with the aim to shorten time to build microservices at Carousell. It is deri

Carousell 149 Nov 16, 2022
Monitors the expiry time of tls certificates and exports prometheus metrics

Certificate Monitor Monitors the expiry time of tls certificates and exports prometheus metrics. Target domains can be automatically discovered via in

appvia 3 Feb 7, 2022
A pair of local reverse proxies (one in Windows, one in Linux) for Tailscale on WSL2

tailscale-wsl2 TL;DR Running two reverse proxies (one in Windows, one in the WSL2 Linux VM), the Windows Tailscale daemon can be accessed via WSL2: $

Danny Hermes 29 Nov 16, 2022
Building microservice to list products of one ecommerce using golang and gRPC

Building microservice to list products of one ecommerce using golang and grpc Command for generate protobuf $ protoc -I ./protos/... file.proto --go_o

Isaque Veras 2 Mar 26, 2022
A suite of gRPC debugging tools. Like Fiddler/Charles but for gRPC.

grpc-tools A suite of tools for gRPC debugging and development. Like Fiddler/Charles but for gRPC! The main tool is grpc-dump which transparently inte

Bradley Kemp 1.1k Nov 25, 2022
grpc-http1: A gRPC via HTTP/1 Enabling Library for Go

grpc-http1: A gRPC via HTTP/1 Enabling Library for Go This library enables using all the functionality of a gRPC server even if it is exposed behind a

StackRox 88 Nov 20, 2022
Server and client implementation of the grpc go libraries to perform unary, client streaming, server streaming and full duplex RPCs from gRPC go introduction

Description This is an implementation of a gRPC client and server that provides route guidance from gRPC Basics: Go tutorial. It demonstrates how to u

Joram Wambugu 0 Nov 24, 2021