type PerRPCCredentials

传token需要实现这个接口

  1. type PerRPCCredentials interface {
  2.     // GetRequestMetadata gets the current request metadata, refreshing
  3.     // tokens if required. This should be called by the transport layer on
  4.     // each request, and the data should be populated in headers or other
  5.     // context. If a status code is returned, it will be used as the status
  6.     // for the RPC. uri is the URI of the entry point for the request.
  7.     // When supported by the underlying implementation, ctx can be used for
  8.     // timeout and cancellation. Additionally, RequestInfo data will be
  9.     // available via ctx to this call.
  10.     // TODO(zhaoq): Define the set of the qualified keys instead of leaving
  11.     // it as an arbitrary string.
  12.     GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error)
  13.     // RequireTransportSecurity indicates whether the credentials requires
  14.     // transport security.
  15.     RequireTransportSecurity() bool
  16. }

type TransportCredentials

  1. type TransportCredentials interface {
  2.     // ClientHandshake does the authentication handshake specified by the
  3.     // corresponding authentication protocol on rawConn for clients. It returns
  4.     // the authenticated connection and the corresponding auth information
  5.     // about the connection.  The auth information should embed CommonAuthInfo
  6.     // to return additional information about the credentials. Implementations
  7.     // must use the provided context to implement timely cancellation.  gRPC
  8.     // will try to reconnect if the error returned is a temporary error
  9.     // (io.EOF, context.DeadlineExceeded or err.Temporary() == true).  If the
  10.     // returned error is a wrapper error, implementations should make sure that
  11.     // the error implements Temporary() to have the correct retry behaviors.
  12.     // Additionally, ClientHandshakeInfo data will be available via the context
  13.     // passed to this call.
  14.     //
  15.     // If the returned net.Conn is closed, it MUST close the net.Conn provided.
  16.     ClientHandshake(context.Context, string, net.Conn) (net.Conn, AuthInfo, error)
  17.     // ServerHandshake does the authentication handshake for servers. It returns
  18.     // the authenticated connection and the corresponding auth information about
  19.     // the connection. The auth information should embed CommonAuthInfo to return additional information
  20.     // about the credentials.
  21.     //
  22.     // If the returned net.Conn is closed, it MUST close the net.Conn provided.
  23.     ServerHandshake(net.Conn) (net.Conn, AuthInfo, error)
  24.     // Info provides the ProtocolInfo of this TransportCredentials.
  25.     Info() ProtocolInfo
  26.     // Clone makes a copy of this TransportCredentials.
  27.     Clone() TransportCredentials
  28.     // OverrideServerName overrides the server name used to verify the hostname on the returned certificates from the server.
  29.     // gRPC internals also use it to override the virtual hosting name if it is set.
  30.     // It must be called before dialing. Currently, this is only used by grpclb.
  31.     OverrideServerName(string) error
  32. }

func NewClientTLSFromFile(certFile, serverNameOverride string) (TransportCredentials, error)

  • NewClientTLSFromFile从客户机的输入证书文件构造TLS凭据。serverNameOverride仅用于测试。如果设置为非空字符串，它将覆盖请求中权限的虚拟主机名(例如:权限头字段)。

func NewServerTLSFromFile(certFile, keyFile string) (TransportCredentials, error)

  • NewServerTLSFromFile从服务器的输入证书文件和密钥文件构造TLS凭据

使用tls加密传输

1.安装openssl，使用openssl生成公钥与私钥

  1. 1.生成RSA私钥：openssl genrsa -out server.key 2048
  2. 命令的最后一个参数，将指定生成密钥的位数，如果没有指定，默认512
  3. 2.生成公钥 openssl req -new -x509 -sha256 -key server.key -out server.pem -days 3650
  4. openssl req：生成自签名证书，
  5. -new指生成证书请求、
  6. -sha256指使用sha256加密、
  7. -key指定私钥文件、
  8. -x509指输出证书、
  9. -days 3650为有效期
  11. 此后则输入证书拥有者信息
  12. Country Name (2 letter code) [AU]:CN
  13. State or Province Name (full name) [Some-State]:XxXx
  14. Locality Name (eg, city) []:XxXx
  15. Organization Name (eg, company) [Internet Widgits Pty Ltd]:XX Co. Ltd
  16. Organizational Unit Name (eg, section) []:Dev
  17. Common Name (e.g. server FQDN or YOUR name) []:go-grpc-example
  18. Email Address []:xxx@xxx.com

2.client端

  1. package main
  3. import (
  4.     "google.golang.org/grpc"
  5.     "grpcSSLCode/message"
  6.     "context"
  7.     "google.golang.org/grpc/grpclog"
  8.     "fmt"
  9.     "google.golang.org/grpc/credentials"
  10. )
  12. func main() {
  13.     //TLS连接
  14.     creds, err := credentials.NewClientTLSFromFile("./keys/server.pem", "go-grpc-example")
  15.     if err != nil {
  16.         panic(err.Error())
  17.     }
  19.     //1、Dail连接
  20.     conn, err := grpc.Dial("localhost:8092", grpc.WithTransportCredentials(creds))
  21.     if err != nil {
  22.         panic(err.Error())
  23.     }
  24.     defer conn.Close()
  25.     .....
  26. }

3.服务端

  1. package main
  3. import (
  4.     "context"
  5.     "grpcSSLCode/message"
  6.     "fmt"
  7.     "google.golang.org/grpc"
  8.     "google.golang.org/grpc/credentials"
  9.     "google.golang.org/grpc/grpclog"
  10.     "net"
  11. )
  13. type MathManager struct {
  14. }
  16. func (mm *MathManager) AddMethod(ctx context.Context, request *message.RequestArgs) (response *message.Response, err error) {
  17.     ....
  18.     return response, nil
  19. }
  21. func main() {
  22.     grpc.WithPerRPCCredentials()
  23.     //TLS认证
  24.     creds, err := credentials.NewServerTLSFromFile("./keys/server.pem", "./keys/server.key")
  25.     if err != nil {
  26.         grpclog.Fatal("加载在证书文件失败", err)
  27.     }
  29.     //实例化grpc server, 开启TLS认证
  30.     server := grpc.NewServer(grpc.Creds(creds))
  32.     message.RegisterMathServiceServer(server, new(MathManager))
  34.     lis, err := net.Listen("tcp", ":8092")
  35.     if err != nil {
  36.         panic(err.Error())
  37.     }
  38.     server.Serve(lis)
  39. }

使用Token+tls

1.client端

  1. package main
  3. import (
  4.     "google.golang.org/grpc"
  5.     "gRPCTokenCode/message"
  6.     "context"
  7.     "google.golang.org/grpc/grpclog"
  8.     "fmt"
  9.     "google.golang.org/grpc/credentials"
  10. )
  12. //token认证
  13. type TokenAuthentication struct {
  14.     AppKey    string
  15.     AppSecret string
  16. }
  18. //组织token认证的metadata信息
  19. func (ta *TokenAuthentication) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) {
  20.     return map[string]string{
  21.         "appid":    ta.AppKey,
  22.         "appkey": ta.AppSecret,
  23.     }, nil
  24. }
  26. //是否基于TLS认证进行安全传输
  27. func (a *TokenAuthentication) RequireTransportSecurity() bool {
  28.     return true
  29. }
  31. func main() {
  33.     //TLS连接
  34.     creds, err := credentials.NewClientTLSFromFile("./keys/server.pem", "go-grpc-example")
  35.     if err != nil {
  36.         panic(err.Error())
  37.     }
  39.     auth := TokenAuthentication{
  40.         AppKey:    "hello1",
  41.         AppSecret: "20190812",
  42.     }
  44.     //1、Dail连接
  45.     conn, err := grpc.Dial("localhost:8093", grpc.WithTransportCredentials(creds), grpc.WithPerRPCCredentials(&auth))
  46.     if err != nil {
  47.         panic(err.Error())
  48.     }
  50.     defer conn.Close()
  51.     ...
  52. }

2.server端

  1. package main
  3. import (
  4.     "context"
  5.     "gRPCTokenCode/message"
  6.     "fmt"
  7.     "google.golang.org/grpc"
  8.     "google.golang.org/grpc/credentials"
  9.     "google.golang.org/grpc/grpclog"
  10.     "net"
  11.     "google.golang.org/grpc/codes"
  12.     "google.golang.org/grpc/status"
  13.     "google.golang.org/grpc/metadata"
  14. )
  16. type MathManager struct {
  17. }
  19. func (mm *MathManager) AddMethod(ctx context.Context, request *message.RequestArgs) (response *message.Response, err error) {
  21.     //通过metadata
  22.     md, exist := metadata.FromIncomingContext(ctx)
  23.     if !exist {
  24.         return nil, status.Errorf(codes.Unauthenticated, "无Token认证信息")
  25.     }
  27.     var appKey string
  28.     var appSecret string
  30.     if key, ok := md["appid"]; ok {
  31.         appKey = key[0]
  32.     }
  34.     if secret, ok := md["appkey"]; ok {
  35.         appSecret = secret[0]
  36.     }
  38.     if appKey != "hello" || appSecret != "20190812" {
  39.         return nil, status.Errorf(codes.Unauthenticated, "Token 不合法")
  40.     }
  42.     ....
  43.     return response, nil
  44. }
  46. func main() {
  47.     //TLS认证
  48.     creds, err := credentials.NewServerTLSFromFile("./keys/server.pem", "./keys/server.key")
  49.     if err != nil {
  50.         grpclog.Fatal("加载在证书文件失败", err)
  51.     }
  53.     //实例化grpc server, 开启TLS认证
  54.     server := grpc.NewServer(grpc.Creds(creds),grpc.UnaryInterceptor())
  56.     message.RegisterMathServiceServer(server, new(MathManager))
  58.     lis, err := net.Listen("tcp", ":8093")
  59.     if err != nil {
  60.         panic(err.Error())
  61.     }
  62.     .....
  63.     server.Serve(lis)
  64. }