Cloud Native high performance security and privacy SQL proxy.

Overview

Fern proxy

With the advent of Cloud Native applications, architecture patterns evolved and emerged to take advantage of cloud computing, and build more scalable and resilient systems. Many challenges remain to be addressed, data security and privacy being one of them.

Fern proxy aims to fill the gap between applications and datastores, humbly providing one of the missing pieces for modern architectures where business logic is decoupled from specialized security and privacy components.

Functionality Overview

Pursuing the principles of {security,privacy}-by-{default,design} and decoupling business logic from security and privacy operations, Fern proxy sits between applications and datastores, providing off the shelf data encryption, data masking, and data tokenization features.

Features provided by Fern proxy are configurable, to only apply one or several transformations to the sole data requiring them. In a database context, operating at this granularity means Fern proxy can support several kinds of Row-level and Column-level security and privacy strategies.

For the time being, development in Fern proxy focuses on implementing core features to support and provide value in a PostgreSQL datastore scenario. Wire protocols and abstractions allowing other datastores will come later. Same goes for deployment and optimizations leveraging DaemonSets and eBPF.

Note: Fern proxy is definitely not ready yet for production.

Quickstart

If you are looking for a quick demo to see Fern proxy in action, you can go directly to the examples directory!

Otherwise, Fern proxy follows the Gazr approach, to ease evaluation, on-boarding, and development.

Most useful commands:

  • make run: locally run Fern proxy, built in a release mode
  • make watch: locally run Fern proxy with hot reloading on code changes

For completeness, execute make help to display all available commands.

Community and Contribution

Fern proxy is an ambitious project, and it can't reach its full potential without a supporting community. Feeling curious or even adventurous? Please have a look at our Community and Contribution Guidelines, as well as our Code of Conduct!

Security

We believe it is never too early to address security in a new project - especially when the project is a security and privacy component like Fern.

While Fern proxy is being designed and implemented with high security standards, nobody is perfect and mistakes can happen. If you think you found a security issue, let us know through our vulnerability reporting process.

License

Fern proxy is licensed under the Apache License, Version 2.0.

Comments
  • ci(makefile): use BuildKit plain output when `CI` env var is defined

    ci(makefile): use BuildKit plain output when `CI` env var is defined

    Force BuildKit to output in a text log friendly format when running in CI.

    Note: due to #3, changes introduced in this PR won't be taken into account until they reach dev or main branches. :shrug:

    :muscle: My Motivation:

    BuildKit should automatically adapt progress output format based on environment. Unfortunately something doesn't play well with CircleCI and the produced output - while great for TTY - is terrible for text logs, leading to thousands of garbage lines in CircleCI's job logs. We want CI job logs to be usable, not filled with garbage.

    :brain: My Solution:

    Based on Docker CLI doc and CircleCI built-in env variables doc, use BUILDKIT_PROGRESS=plain env variable when CI variable is set in the environment to force BuildKit output in a text log friendly format. CI seems to be an env variable commonly set by other CI providers (ex: GitLab, GitHub, Travis) for portability.

    A-ci-circleci C-enhacement 
    opened by ppiotr3k 0
  • ci(circleci): add code coverage measurement to pipeline

    ci(circleci): add code coverage measurement to pipeline

    Add code coverage measurement with results (HTML, LCOV):

    • available locally to developer
    • stored as build artifact by CI (only HTML report)
    • published to codecov.io by CI (only LCOV report)

    Note: due to #3, changes introduced in this PR won't be taken into account until they reach dev or main branches. :shrug:

    :muscle: My Motivation:

    Writing tests is essential to develop quality software. However, without code coverage the degree to which source code is executed by the test suite can't be really known. Adding code coverage enables to monitor the risk of introducing code with undetected software defects, and to enhance the test suite for code already in the codebase.

    :brain: My Solution:

    • make coverage use code instrumentation stabilized in rustc 1.61 to perform source-based coverage even accurate at branch level.

    • Code instrumentation requires additional compilation flags which are set leveraging current dev container. Profiling is performed by executing the test suite on resulting instrumented build artifacts.

    • grcov process resulting profiling files to produce reports in HTML and LCOV formats in .coverage directory at project's root.

    This design allows producing those coverage reports without "polluting" the env with profiling artifacts, while making them available to developer and CI jobs for further processing.

    Coverage measurements with defined settings seems to produce rather accurate results. Some derive macros and other logging statements needs to be further investigated for potentially additional tweaking.

    A-ci-circleci C-enhacement 
    opened by ppiotr3k 0
  • ci(circleci): define initial CircleCI configuration

    ci(circleci): define initial CircleCI configuration

    Use 'medium' resource class for pre-checks as this is where most heavy compilation work happens, yet the gain from using 'large' is not enough at this state of the project.

    CPU usage saturation during pre-checks (fresh cache) with:

    • 'large' : 15sec/1min45 (14%),
    • 'medium': 60sec/2min30 (40%). ('small' would has better saturation but total time would exceed 5min)

    Use 'small' resource class for build-native as with 'medium' CPU usage barely reach 50%, and with 'small' 100% is achieved but during only a very short amount of time (<15sec).

    Fixes: #1

    A-ci-circleci C-enhacement 
    opened by ppiotr3k 0
  • `sqlparser-rs` fails on PostgreSQL statements with `RETURNING` clause

    `sqlparser-rs` fails on PostgreSQL statements with `RETURNING` clause

    :monocle_face: Bug I observed:

    When using a RETURNING PostgreSQL clause in a statement, sqlparser-rs which is used to build the Query AST fails:

    Err(ParserError("Expected end of statement, found: RETURNING"))
    

    And since the Query AST can't be built, Fern proxy fails processing the query, which therefore isn't passed down to proxied Datastore.

    :smiley: Behavior I expected:

    Instead, I would expect the Query AST to be built as with any other statements not containing a RETURNING clause.

    :gift: Something I'd like to add:

    Issue is known already: sqlparser-rs/sqlparser-rs#60

    A-fern-proxy C-bug S-awaiting-dependency 
    opened by ppiotr3k 0
  • ci(circleci): add commit linting to enforce project guidelines

    ci(circleci): add commit linting to enforce project guidelines

    :exploding_head: Problem I want to solve:

    When collaborating on a project, it is important to ensure contribution guidelines defined for said project are being followed. Manually checking each contribution for compliance with project guidelines may become exhaustive, and become a source of frustration both for contributors and reviewers. Having the fastest possible feedback loop for commit linting is crucial for a pleasant experience.

    :smiley: Solution I would like:

    For this problem, I would like to:

    • enforce Fern project's Conventional Commits guidelines in CI, for all branches / pull requests
    • be able for developer - i.e. opt-in usage - to locally check if commit / branch is OK with guidelines prior pushing it to a remote branch, should they want a great DX / short feedback loop
    • be as non-invasive of developer's env as possible, leveraging our Gazr / containers setup as much as possible
    • provide interactive guidance if wanted by developer to easily write commit messages aligned with project's guidelines

    :thinking: Alternatives I've considered:

    Honestly none, I'm quite opinionated on the Developer Experience (DX) expectations for this one. :sweat_smile:

    :gift: Something I'd like to add:

    Some example resources worth looking at:

    • https://commitlint.js.org/
    • https://commitizen.github.io/cz-cli/
    • https://circleci.com/developer/orbs/orb/conventional-changelog/commitlint
    E-easy A-ci-circleci C-feature-accepted good first issue 
    opened by ppiotr3k 0
  • Using GitHub's Rebase and Merge dismiss commits' signatures

    Using GitHub's Rebase and Merge dismiss commits' signatures

    :monocle_face: Bug I observed:

    When using GitHub's Rebase and Merge feature to keep a linear history, original commits' crypto signatures are dismissed.

    :smiley: Behavior I expected:

    Instead, given an up-to-date branch (enforced by settings) with crypto signed commits, I would expect to have those crypto signatures preserved when using GitHub's Rebase and Merge feature on a pull request.

    :gift: Something I'd like to add:

    Seems to be a known problem, apparently already notified to GitHub's engineering team:

    • https://github.com/community/community/discussions/10410
    • https://github.com/orgs/community/discussions/5524

    :hourglass_flowing_sand: As the issue is directly with the GitHub's Rebase and Merge feature, either a different merging strategy must be used, or it should be accepted to have those crypto signatures dismissed until GitHub have it fixed.

    C-bug E-medium A-github S-awaiting-dependency 
    opened by ppiotr3k 2
  • ci(circleci): trigger `build-container` on pull request to `dev`

    ci(circleci): trigger `build-container` on pull request to `dev`

    :monocle_face: Bug I observed:

    When making PR #2, related CI execution didn't trigger the build-container step, and actually even completely skipped a CI run, pointing to checks performed on the ci-circleci branch prior to PR to dev.

    :smiley: Behavior I expected:

    Instead, I would expect to see the pipeline workflow involving build-container on a PR to dev, so merge can be done with confidence.

    :gift: Something I'd like to add:

    Fixing the typo in build-container step was easy, but pushing code directly to dev while trying to introduce a proper Gitflow wasn't great. In the future, would be great to have a specific workflow to test changes introduced specifically on Makefile, Dockerfile, etc.

    C-bug A-ci-circleci E-medium S-awaiting-dependency 
    opened by ppiotr3k 1
Releases(v0.1.0)
  • v0.1.0(Sep 24, 2022)

    🎁 New features

    • Proxying PostgreSQL flows for simple Query cycles (SSL/TLS not supported)
    • Data masking using either a fixed-length or shape-preserving caviar strategy

    Full Changelog: https://github.com/fern-proxy/fern-proxy/commits/v0.1.0

    Source code(tar.gz)
    Source code(zip)
Owner
Fern
Cloud Native high performance security and privacy SQL proxy.
Fern
MASQ Network 121 Dec 20, 2022
The High Performance Proxy/Load Balancer

Silverwind-The Next Generation High-Performance Proxy English 简体中文 The Silverwind is a high-performance reverse proxy/load balancer. And it could be a

null 112 Apr 7, 2023
server security proxy write by Rust

server-security-proxy server security proxy write by Rust how to use config toml file

baoyachi. Aka Rust Hairy crabs 3 May 24, 2021
UDP proxy with Proxy Protocol and mmproxy support

udppp UDP proxy with Proxy Protocol and mmproxy support. Features Async Support Proxy Protocol V2 SOCKET preserve client IP addresses in L7 proxies(mm

b23r0 10 Dec 18, 2022
Web3-proxy: a fast caching and load balancing proxy for web3 (Ethereum or similar) JsonRPC servers.

web3-proxy Web3-proxy is a fast caching and load balancing proxy for web3 (Ethereum or similar) JsonRPC servers. Signed transactions (eth_sendRawTrans

null 55 Jan 8, 2023
Rust client for NATS, the cloud native messaging system.

A Rust client for the NATS messaging system. Status Motivation Rust may be the most interesting new language the NATS ecosystem has seen. We believe t

NATS - The Cloud Native Messaging System 651 Jan 3, 2023
Proxy sentry request to a sentry server using a tunnel/proxy endpoint

Sentry Tunnel This is a proxy that forwards tunneled sentry requests to the real sentry server. The implementation is based on the explanation provide

Paul FLORENCE 14 Dec 20, 2022
Lightweight proxy that allows redirect HTTP(S) traffic through a proxy.

Proxyswarm Proxyswarm is a lightweight proxy that allows redirect HTTP(S) traffic through a proxy. WARNING: This app isn't recomended for download lar

Jorge Alejandro Jimenez Luna 4 Apr 16, 2022
A TCP proxy using HTTP - Reach SSH behind a Nginx reverse proxy

?? TCP over HTTP ?? The Questions ?? What does it do? You can proxy TCP traffic over HTTP. A basic setup would be: [Your TCP target] <--TCP-- [Exit No

Julian 185 Dec 15, 2022
An end-to-end encrypted, anonymous IP-hiding, decentralized, audio/video/file sharing/offline messaging multi-device platform built for both communications and application security and performance.

An end-to-end encrypted, anonymous IP-hiding, decentralized, audio/video/file sharing/offline messaging multi-device platform built for both communications and application security and performance.

null 2 Apr 27, 2022
A high performence Socks5 proxy server with bind/reverse support implementation by Rust.

rsocx A high performence Socks5 proxy server with bind/reverse support implementation by Rust Features Async-std No unsafe code Single executable Linu

b23r0 259 Jan 6, 2023
Volo is a high-performance and strong-extensibility Rust RPC framework that helps developers build microservices.

Volo is a high-performance and strong-extensibility Rust RPC framework that helps developers build microservices.

CloudWeGo 1.3k Jan 2, 2023
A high-performance, lightweight, and cross-platform QUIC library

TQUIC English | 中文 TQUIC is a high-performance, lightweight, and cross-platform library for the IETF QUIC protocol. Advantages High performance: TQUIC

Tencent 11 Oct 27, 2023
High-performance link shortener

shorty High-performance link shortener written in Rust ?? Hosting In addition to being easy to build from source, shorty is available as a Docker imag

Caleb Denio 49 Jan 3, 2023
A high performance TCP SYN port scanner.

Armada A High-Performance TCP SYN scanner What is Armada? Armada is a high performance TCP SYN scanner. This is equivalent to the type of scanning tha

resync 259 Dec 19, 2022
Drpc-Correct, high performance, robust, easy use Remote invocation framework

Drpc - Correct, high performance, robust, easy use Remote invocation framework

darkrpc 30 Dec 17, 2022
High performance I/O framework written by Rust inspired by Netty

Introduction Retty is a High performance I/O framework written by Rust inspired by Netty 基于mio的IO多路复用高并发、高性能网络通信开发框架 Feature Rayon 线程池包装 EventLoop / E

lgphp 9 Dec 25, 2022
A high performance/low-overhead OpenMetrics library for Rust

* * * EXPERIMENTAL * * * discreet-metrics A high-performance/low-overhead metrics library aiming to conform with OpenMetrics and to satisfy the follow

null 2 Sep 14, 2022
🚀 10x easier, 🚀 10x cheaper, 🚀 high performance, 🚀 petabyte scale - Elasticsearch/Splunk/Datadog alternative for 🚀 (logs, metrics, traces).

?? 10x easier, ?? 10x cheaper, ?? petabyte scale - Elasticsearch/Splunk/Datadog alternative for ?? (logs, metrics, traces). ZincObserve ZincObserve is

Zinc Labs Inc. 80 Feb 22, 2023