gRPC 延伸知识

2020-12-20 | 129 浏览

gRPC延伸知识

1.TLS

TLS（Transport Layer Security，安全传输层)

如果在外网暴露，需要加密传输，否则以性能优先

使用openssl生成密钥对

openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
...................+++
..............................+++
e is 65537 (0x10001)

openssl req -new -x509 -sha256 -key server.key -out server.pem -days 3650
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:Shanghai
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:Chen
Email Address []:[email protected]

复制密钥对到server目录，复制公钥到client目录

服务端配置

	// 监听网络
	ln, err := net.Listen("tcp", "127.0.0.1:3000")
	if err != nil {
		fmt.Println("网络异常：", err)
		return
	}

	// 从输入证书文件和密钥文件为服务端构造TLS凭证
	creds, err := credentials.NewServerTLSFromFile("server.pem", "server.key")
	if err != nil {
		log.Fatalf("Failed to generate credentials %v", err)
	}

客户端配置

	//从输入的证书文件中为客户端构造TLS凭证
	creds, err := credentials.NewClientTLSFromFile("server.pem", "Chen")
	if err != nil {
		log.Fatalf("Failed to create TLS credentials %v", err)
	}
	// 连接服务器
	conn, err := grpc.Dial("127.0.0.1:3000", grpc.WithTransportCredentials(creds))

	if err != nil {
		fmt.Println("连接服务器失败", err)
	}
	defer conn.Close()

2.Token认证

添加token到context，实现 PerRPCCredentials 接口

服务端取出token，完成验证

对照session的使用场景

3.数据验证

可以使用第三方插件 go-proto-validators

这个不是主流技术，数据输入验证理想的位置是前端，后端保存数据前可以再次验证，gRPC验证数据价值不大

DevOps