GolangRPC加密方法与安全指南

package main
import (
"crypto/tls"
"net"
"net/rpc"
)
type Arith int
func (t Arith) Multiply(args Args, reply int) error {
reply = args.A * args.B
return nil
}
type Args struct{ A, B int }
func main() {
arith := new(Arith)
rpc.Register(arith)
cert, err := tls.LoadX509KeyPair("cert.pem", "key.pem")
if err != nil {
    panic(err)
}

config := &tls.Config{Certificates: []tls.Certificate{cert}}
listener, err := tls.Listen("tcp", ":1234", config)
if err != nil {
    panic(err)
}
defer listener.Close()

for {
    conn, err := listener.Accept()
    if err != nil {
        continue
    }
    go rpc.ServeConn(conn)
}
}

package main
import (
"crypto/tls"
"crypto/x509"
"net/rpc"
)
func main() {
cert, err := x509.SystemCertPool()
if err != nil {
panic(err)
}
// 或者加载自定义CA证书
// cert := x509.NewCertPool()
// ca, _ := ioutil.ReadFile("ca-cert.pem")
// cert.AppendCertsFromPEM(ca)
config := &tls.Config{RootCAs: cert}
conn, err := tls.Dial("tcp", "localhost:1234", config)
if err != nil {
    panic(err)
}
defer conn.Close()

client := rpc.NewClient(conn)
defer client.Close()

args := &Args{7, 8}
var reply int
err = client.Call("Arith.Multiply", args, &reply)
if err != nil {
    panic(err)
}
println("Result:", reply)
}

config := &tls.Config{
    Certificates: []tls.Certificate{cert},
    ClientAuth:   tls.RequireAndVerifyClientCert,
    ClientCAs:    clientCertPool, // 包含合法客户端证书的CA池
}

config := &tls.Config{
    RootCAs:      cert,
    Certificates: []tls.Certificate{clientCert},
}

creds, err := credentials.NewServerTLSFromFile("cert.pem", "key.pem")
if err != nil {
    log.Fatal(err)
}
s := grpc.NewServer(grpc.Creds(creds))