源码 grpc 认证 鸭子模型 函数返回值为接口 TSL SSL 传输压缩 自定义证书传输加密 自定义令牌身份认证

源码 grpc  认证 鸭子模型 

Authentication | gRPC https://www.grpc.io/docs/guides/auth/#authenticate-with-google

将谷歌的认证实现，改成定义的认证实现

perRPC, _ := oauth.NewServiceAccountFromFile("service-account.json", scope)

google.golang.org/grpc@v1.43.0/credentials/oauth/oauth.go:192

// NewServiceAccountFromFile constructs the PerRPCCredentials using the JSON key file
// of a Google Developers service account.
func NewServiceAccountFromFile(keyFile string, scope ...string) (credentials.PerRPCCredentials, error) {
   jsonKey, err := ioutil.ReadFile(keyFile)
   if err != nil {
      return nil, fmt.Errorf("credentials: failed to read the service account key file: %v", err)
   }
   return NewServiceAccountFromKey(jsonKey, scope...)
}

关注返回值

google.golang.org/grpc@v1.43.0/credentials/credentials.go:38

// PerRPCCredentials defines the common interface for the credentials which need to
// attach security information to every RPC (e.g., oauth2).
type PerRPCCredentials interface {
   // GetRequestMetadata gets the current request metadata, refreshing
   // tokens if required. This should be called by the transport layer on
   // each request, and the data should be populated in headers or other
   // context. If a status code is returned, it will be used as the status
   // for the RPC. uri is the URI of the entry point for the request.
   // When supported by the underlying implementation, ctx can be used for
   // timeout and cancellation. Additionally, RequestInfo data will be
   // available via ctx to this call.
   // TODO(zhaoq): Define the set of the qualified keys instead of leaving
   // it as an arbitrary string.
   GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error)
   // RequireTransportSecurity indicates whether the credentials requires
   // transport security.
   RequireTransportSecurity() bool
}

其中原返回值为Google的逻辑

// NewServiceAccountFromKey constructs the PerRPCCredentials using the JSON key slice
// from a Google Developers service account.
func NewServiceAccountFromKey(jsonKey []byte, scope ...string) (credentials.PerRPCCredentials, error) {
   config, err := google.JWTConfigFromJSON(jsonKey, scope...)
   if err != nil {
      return nil, err
   }
   return &serviceAccount{config: config}, nil
}

实现方法

type T struct {
}

func NewCustomerPerRPCCredentials() (PerRPCCredentials, error) {
   return &T{}, nil
}
func (t *T) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) {
   return nil, nil
}

func (t *T) RequireTransportSecurity() bool {
   return true
}

perRPC, err := NewCustomerPerRPCCredentials()

 鸭子能走路，能走路的就是鸭子。

 google.golang.org/grpc@v1.43.0/credentials/oauth/oauth.go:151

// serviceAccount represents PerRPCCredentials via JWT signing key.
type serviceAccount struct {
   mu     sync.Mutex
   config *jwt.Config
   t      *oauth2.Token
}

func (s *serviceAccount) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) {
   s.mu.Lock()
   defer s.mu.Unlock()
   if !s.t.Valid() {
      var err error
      s.t, err = s.config.TokenSource(ctx).Token()
      if err != nil {
         return nil, err
      }
   }
   ri, _ := credentials.RequestInfoFromContext(ctx)
   if err := credentials.CheckSecurityLevel(ri.AuthInfo, credentials.PrivacyAndIntegrity); err != nil {
      return nil, fmt.Errorf("unable to transfer serviceAccount PerRPCCredentials: %v", err)
   }
   return map[string]string{
      "authorization": s.t.Type() + " " + s.t.AccessToken,
   }, nil
}

func (s *serviceAccount) RequireTransportSecurity() bool {
   return true
}

google.golang.org/grpc v1.43.0
google.golang.org/protobuf v1.27.1

package grpc

import (
   "context"
   "crypto/tls"
   "crypto/x509"
   "google.golang.org/grpc"
   "google.golang.org/grpc/credentials"
   "google.golang.org/grpc/encoding/gzip"
   "io/ioutil"
   "time"
)

type T struct {
   AccessToken string
}

func NewCustomerPerRPCCredentials(AccessToken string) (credentials.PerRPCCredentials, error) {
   return &T{AccessToken: AccessToken}, nil
}
func (t *T) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) {
   m := map[string]string{}
   m["AccessToken"] = t.AccessToken
   return m, nil
}

func (t *T) RequireTransportSecurity() bool {
   return true
}

func NewConn() (conn *grpc.ClientConn) {
   certFile := "../cert/server1_cert.pem"
   //creds, err := credentials.NewClientTLSFromFile(certFile, "")
   b, err := ioutil.ReadFile(certFile)
   if err != nil {
      panic(err)
   }
   creds_cp := x509.NewCertPool()
   if !creds_cp.AppendCertsFromPEM(b) {
      panic("credentials: failed to append certificates")
   }
   creds, err := credentials.NewTLS(&tls.Config{ServerName: "", RootCAs: creds_cp, InsecureSkipVerify: true}), nil
   if err != nil {
      panic(err)
   }
   perRPC, err := NewCustomerPerRPCCredentials("Val-ak123")
   if err != nil {
      panic(err)
   }

   bytes := 1024 * 1024 * 4 * 4
   cp := grpc.ConnectParams{}
   cp.MinConnectTimeout = 16 * time.Second

   co := []grpc.CallOption{grpc.UseCompressor(gzip.Name)}

   opts := []grpc.DialOption{
      grpc.WithTransportCredentials(creds),
      grpc.WithBlock(),
      grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(bytes)),
      grpc.WithConnectParams(cp),
      grpc.WithDefaultCallOptions(co...),
      grpc.WithPerRPCCredentials(perRPC),
   }
   grpc.UseCompressor(gzip.Name)
   conn, err = grpc.Dial("1.24.14.14:12345", opts...)
   if err != nil {
      panic(err)
   }
   return conn
}

证书不被信任

InsecureSkipVerify: true,         // test server certificate is not trusted.

Go/src/crypto/tls/example_test.go:99

client := &http.Client{
   Transport: &http.Transport{
      TLSClientConfig: &tls.Config{
         KeyLogWriter: w,

         Rand:               zeroSource{}, // for reproducible output; don't do this.
         InsecureSkipVerify: true,         // test server certificate is not trusted.
      },
   },
}

// InsecureSkipVerify controls whether a client verifies the server's
// certificate chain and host name. If InsecureSkipVerify is true, crypto/tls
// accepts any certificate presented by the server and any host name in that
// certificate. In this mode, TLS is susceptible to machine-in-the-middle
// attacks unless custom verification is used. This should be used only for
// testing or in combination with VerifyConnection or VerifyPeerCertificate.
InsecureSkipVerify bool

Go/src/crypto/tls/common.go:646

Go当中TLS/SSL 证书的实践 - 知乎 https://zhuanlan.zhihu.com/p/338688506