This project implements p11-kit RPC server protocol, allowing Go programs to act as a PKCS #11 module without the need for cgo

Overview

PKCS #11 modules in Go without cgo

Go Reference

This project implements p11-kit RPC server protocol, allowing Go programs to act as a PKCS #11 module without the need for cgo. Clients load the p11-kit-client.so shared library, then communicate over RPC to the Go server.

       ------------------------
       | client (e.g. Chrome) |
       ------------------------
                 |
     (PKCS #11 - shared library)
                 ↓ 
        ---------------------
        | p11-kit-client.so |
        ---------------------
                 |
        (RPC over unix socket)
                 ↓ 
---------------------------------------
| github.com/google/go-p11-kit/p11kit |
---------------------------------------

Demo

The example directory contains a demo server that reads keys and certificates from disk and serves them on a unix socket. To build and start the server, run the following commands:

go build -o bin/example-p11-kit-server ./example/example-p11-kit-server
./bin/example-p11-kit-server --priv example/priv.pem --pub example/pub.pem --cert example/cert.pem

The server will print out an environment variable to set similar to:

export P11_KIT_SERVER_ADDRESS=unix:path=/tmp/1056705225/p11kit.sock

In another shell, export the environment variable, and use p11-kit-client.so to query the example server:

$ export P11_KIT_SERVER_ADDRESS=unix:path=/tmp/1056705225/p11kit.sock
$ pkcs11-tool --module /usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-client.so --list-slots
Available slots:
Slot 0 (0x1): example-slot
  token label        : example
  token manufacturer : go-p11-kit
  token model        : example-server
  token flags        : token initialized, readonly
  hardware version   : 0.1
  firmware version   : 0.1
  serial num         : 12345678
  pin min/max        : 0/0
$ pkcs11-tool --module /usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-client.so --list-objects
Using slot 0 with a present token (0x1)
Certificate Object; type = X.509 cert
  subject:    DN: CN=test
Private Key Object; RSA
  Usage:      decrypt, sign
  Access:     none
Public Key Object; RSA 256 bits
  Usage:      encrypt, verify
  Access:     none
Issues
  • Functions missing to support gnutls or managed p11-kit modules

    Functions missing to support gnutls or managed p11-kit modules

    https://github.com/google/go-p11-kit/pull/20 includes additional context here.

    $ cat /usr/share/p11-kit/modules/gop11kit.module 
    remote: |/home/gerow/repos/go-p11-kit/bin/example-p11-kit-server --priv /home/gerow/repos/go-p11-kit/example/priv.pem --pub /home/gerow/repos/go-p11-kit/example/pub.pem --cert /home/gerow/repos/go-p11-kit/example/cert.pem --stdio
    
    $ p11tool --list-all
    warning: no token URL was provided for this operation; the available tokens are:
    
    pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=System%20Trust
    pkcs11:model=example-server;manufacturer=go-p11-kit;serial=12345678;token=example
    2022/04/27 16:41:37 Handling over stdio: read request: reading request header: EOF
    
    $ gnutls-cli google.com --app-proto=https --x509keyfile='pkcs11:model=example-server;manufacturer=go-p11-kit;serial=12345678;token=example' --x509certfile='pkcs11:model=example-server;manufacturer=go-p11-kit;serial=12345678;token=example'
    Processed 141 CA certificate(s).
    2022/04/27 16:42:49 Error with C_GetSessionInfo: CKR_FUNCTION_NOT_SUPPORTED
    Token 'example' with URL 'pkcs11:model=example-server;manufacturer=go-p11-kit;serial=12345678;token=example' requires user PIN
    Enter PIN: 
    2022/04/27 16:42:52 Error with C_Login: CKR_FUNCTION_NOT_SUPPORTED
    *** Error loading cert file.
    2022/04/27 16:42:52 Handling over stdio: read request: reading request header: EOF
    

    Seems we should just need to add support for C_GetSessionInfo if we want to be able to convince gnutls that we don't need a pin for the token.

    opened by gerow 7
  • example server: support serving over stdio

    example server: support serving over stdio

    This chnage adds an "stdio" flag to the example server in order to support remote p11-kit module entries, which dynamically launch a managed server for clients that support it. This includes clients that use gnutls.

    See pkcs11.conf(5) for details on what the remote entry is meant to do.

    This is still a WIP as I think gnutls and p11-kit in managed mode still have trouble accessing go-p11-kit remote modules when configured in this manner.

    opened by gerow 3
  • example: use SetCertificate to add cert attributes

    example: use SetCertificate to add cert attributes

    This allows gnutls and p11-kit to properly enumerate objects on example server. This is a bit hacky, just assuming that if we're passing multiple certs and keys that the cert properties are meant to align by index, but it's just an example server, so we can probably take some liberties.

    Fixes #21.

    opened by gerow 1
  • pkcs11: fix return value for invalid attributes

    pkcs11: fix return value for invalid attributes

    C_GetAttributeValue should return CKR_ATTRIBUTE_TYPE_INVALID in the case that one or more of the attributes requested aren't valid for the given object, so this fixes that.

    When using gnutls this actually manifests as a segfault, as it assumes in the CKR_OK case that all the returned buffers are valid, but p11-kit "helpfully" sets the "length" value for invalid buffers to -1, which gnutls interprets as a uint, which means it tries to read a very large amount of memory before eventually failing.

    Addresses part of #21.

    opened by gerow 0
  • fix signECDSA signature encoding.

    fix signECDSA signature encoding.

    PKCS11 use raw R, S value as signature, crypto.Signer.Sign return the DER encoded R, S sequence. Convert DER sequence to raw R, S and pad to same length. http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cs01/pkcs11-curr-v2.40-cs01.html#_Toc399398879

    opened by cradiator 0
Releases(v0.3.0)
Owner
Google
Google ❤️ Open Source
Google
Fastglue is an opinionated, bare bones wrapper that glues together fasthttp and fasthttprouter to act as a micro HTTP framework.

fastglue Overview fastglue is an opinionated, bare bones wrapper that glues together fasthttp and fasthttprouter to act as a micro HTTP framework. It

Zerodha Technology 71 Jun 14, 2022
RPC explained by writing simple RPC framework in 300 lines of pure Golang.

Simple GoRPC Learning RPC basic building blocks by building a simple RPC framework in Golang from scratch. RPC In Simple Term Service A wants to call

Ankur Anand 544 Jul 24, 2022
This is an example to demonstrate implementation golang microservices using domain driven design principles and sugestions from go-kit

go-kit DDD Domain Driven Design is prevelent and rising standard for organizing your microservice code. This design architecture emphasis on Code orga

Sourabh Mandal 1 Feb 9, 2022
This tool generates Go language bindings of services in protobuf definition files for go-kit

protoc-gen-go-kit This tool generates Go language bindings of services in protobuf definition files for go-kit. Installation $ go install github.com/x

X64FUN 1 Nov 9, 2021
Astro Starter Kit: Docs Site

Astro Starter Kit: Docs Site npm init astro -- --template docs Features ✅ Full Markdown support ✅ Responsive mobile-friendly design ✅ Sidebar navigat

Connor McCutcheon 2 Apr 10, 2022
Awpark - Development kit via Alfred Workflow

AWPark Alfred Workflow for engineer. Alfred Workflow Store Search and install Wo

null 48 Jul 26, 2022
Realworld implementation written with Go using go-kit!

This project is an implementation of the RealWorld project using Go utilizing go-kit as an application framework. The project heavily utilizes Docker

Joey McKenzie 12 Aug 6, 2022
Kratos is a microservice-oriented governance framework implements by golang

Kratos is a microservice-oriented governance framework implements by golang, which offers convenient capabilities to help you quickly build a bulletproof application from scratch.

Kratos 18.5k Jul 30, 2022
Kratos is a microservice-oriented governance framework implements by golang,

Kratos is a microservice-oriented governance framework implements by golang, which offers convenient capabilities to help you quickly build a bulletproof application from scratch.

Kratos 18.5k Aug 4, 2022
A code generator that turns plain old Go services into RPC-enabled (micro)services with robust HTTP APIs.

Frodo is a code generator and runtime library that helps you write RPC-enabled (micro) services and APIs.

Monadic 19 Jul 22, 2022
Automatic Service Mesh and RPC generation for Go micro services, it's a humble alternative to gRPC with Istio.

Mesh RPC MeshRPC provides automatic Service Mesh and RPC generation for Go micro services, it's a humble alternative to gRPC with Istio. In a nutshell

AstraNet Toolkit 68 Apr 19, 2022
stack-rpc 快速开发包

Micro 快速开发工具包 项目进行中 本仓库旨在提供面向 stack-rpc 生产环境的快速开发包。 目录 快速开始示例 控制台示例 以最常见的登录流程为例,实现一个场景简单,但包含微服务各种治理能力的示例 Hipster Shop示例 参考GoogleCloudPlatform/microser

Stack Labs 383 Jul 26, 2022
Kitex byte-dance internal Golang microservice RPC framework with high performance and strong scalability, customized extensions for byte internal.

Kitex 字节跳动内部的 Golang 微服务 RPC 框架,具有高性能、强可扩展的特点,针对字节内部做了定制扩展。

CloudWeGo 4.7k Aug 1, 2022
Solution & Framework for JSON-RPC over HTTP

JROH Solution & Framework for JSON-RPC over HTTP Why not OpenAPI? OpenAPI addresses the definition of RESTful APIs, when it comes to JSON-RPCs, some i

Go Toolkit 11 Mar 13, 2022
Golang client for Ethereum and Flashbots JSON-RPC API calls.

Flashbots RPC client Fork of ethrpc with additional Flashbots RPC methods: FlashbotsGetUserStats FlashbotsCallBundle FlashbotsSendBundle FlashbotsSimu

Chris Hager 79 Aug 3, 2022
Rpcx-framework - An RPC microservices framework based on rpcx, simple and easy to use, ultra fast and efficient, powerful, service discovery, service governance, service layering, version control, routing label registration.

RPCX Framework An RPC microservices framework based on rpcx. Features: simple and easy to use, ultra fast and efficient, powerful, service discovery,

ZYallers 1 Jan 5, 2022
Poc-krakend: Allows you to create, modify and delete enpoints in "configuration.json" without restart the application.

poc-krakend Description This POC is for test dynamic (Hot reload) routes in krakend. Allows you to create, modify and delete enpoints in "configuratio

Arturo Elias 4 Jan 26, 2022
UPBit Auto Trading with OpenAPI Golang Module

Go-Bit! UPBit Auto Trading System with OpenAPI 이 레포지토리는 upbit를 위한 자동매매 프로그램을 개발하기 위해 제공하는 go module입니다. Features 구현 작업 진행상황 Sample Code Template shiel

Seongmin Kim 12 Jun 27, 2022
The starter code for Module 3: Surfstore

Surfstore This is the starter code for Module 3: Surfstore. Before you get start

null 0 Feb 13, 2022