支持TLS传输国密 #290
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,16 +2,23 @@ package p2p | |
|
|
||
| import ( | ||
| "crypto/rand" | ||
| defaulttls "crypto/tls" | ||
| defaultx509 "crypto/x509" | ||
| "encoding/base64" | ||
| "encoding/pem" | ||
| "errors" | ||
| "io/ioutil" | ||
| math_rand "math/rand" | ||
| "os" | ||
| "path/filepath" | ||
| "strings" | ||
| "sync" | ||
| "time" | ||
|
|
||
| tls "github.com/tjfoc/gmsm/gmtls" | ||
| "github.com/tjfoc/gmsm/gmtls/gmcredentials" | ||
| "github.com/tjfoc/gmsm/x509" | ||
|
|
||
| iaddr "github.com/ipfs/go-ipfs-addr" | ||
| "github.com/libp2p/go-libp2p-core/crypto" | ||
| "github.com/libp2p/go-libp2p-core/peer" | ||
|
|
@@ -20,32 +27,85 @@ import ( | |
| "github.com/xuperchain/xupercore/kernel/network/config" | ||
| ) | ||
|
|
||
| // serverName 为key,缓存 creds | ||
| var serverNameMap = make(map[string]credentials.TransportCredentials) | ||
|
|
||
| //修改全局变量 serverNameMap 加锁 | ||
| var mu sync.Mutex | ||
|
|
||
| func NewTLS(path, serviceName string) (credentials.TransportCredentials, error) { | ||
|
|
||
| if len(serviceName) < 1 { | ||
|
There was a problem hiding this comment. 去掉 ServerName 为空的判断，标准库TLS 是允许ServerName 为空的
|
||
| return nil, errors.New("serviceName is empty") | ||
| } | ||
|
|
||
| //如果缓存中有值 | ||
| if creds, ok := serverNameMap[serviceName]; ok { | ||
|
There was a problem hiding this comment. serverNameMap 对应性能等没有实质性的作用，反而增加了代码的复杂度。
|
||
| return creds, nil | ||
| } | ||
|
|
||
| mu.Lock() | ||
| defer mu.Unlock() | ||
| //读取 cacert.pem 证书 | ||
| bs, err := ioutil.ReadFile(filepath.Join(path, "cacert.pem")) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| cacert, err := ioutil.ReadFile(filepath.Join(path, "cacert.pem")) | ||
|
There was a problem hiding this comment. bs 和 cacert 是同样的内容，不需要重复读取 |
||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| pb, _ := pem.Decode(cacert) | ||
| x509cert, err := x509.ParseCertificate(pb.Bytes) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| if strings.Contains(strings.ToLower(x509cert.SignatureAlgorithm.String()), "sm") { //国密 | ||
|
There was a problem hiding this comment. 修改判断是否使用国密的逻辑，区分客户端和服务端 SSL/TLS 握手区分服务端和客户端，具体流程如图所示 其中，ClientHello 结构中包含了客户端支持的加密套件，服务端根据自身的支持的加密套件和客户端支持的加密套件返回对应的加密套件协商结果。 ClientHello 字段参考下图 客户端是否使用国密可以通过以下方案判断
服务端通过如下方案 |
||
| certPool := x509.NewCertPool() | ||
| ok := certPool.AppendCertsFromPEM(bs) | ||
| if !ok { | ||
| return nil, err | ||
| } | ||
| certificate, err := tls.LoadX509KeyPair(filepath.Join(path, "cert.pem"), filepath.Join(path, "private.key")) | ||
|
There was a problem hiding this comment. gmtls 中的 x509 证书兼容标准的 RSA x509 解析，同一个证书只需要加载和解析一次，可以参考官方示例 |
||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| creds := gmcredentials.NewTLS( | ||
| &tls.Config{ | ||
| GMSupport: tls.NewGMSupport(), | ||
| ServerName: serviceName, | ||
| Certificates: []tls.Certificate{certificate, certificate}, | ||
| RootCAs: certPool, | ||
| ClientCAs: certPool, | ||
| ClientAuth: tls.RequireAndVerifyClientCert, | ||
| }) | ||
| serverNameMap[serviceName] = creds | ||
| return creds, nil | ||
| } else { //非国密 | ||
| certPool := defaultx509.NewCertPool() | ||
| ok := certPool.AppendCertsFromPEM(bs) | ||
| if !ok { | ||
| return nil, err | ||
| } | ||
|
|
||
| certificate, err := defaulttls.LoadX509KeyPair(filepath.Join(path, "cert.pem"), filepath.Join(path, "private.key")) | ||
|
|
||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| creds := credentials.NewTLS( | ||
| &defaulttls.Config{ | ||
| ServerName: serviceName, | ||
| Certificates: []defaulttls.Certificate{certificate}, | ||
| RootCAs: certPool, | ||
| ClientCAs: certPool, | ||
| ClientAuth: defaulttls.RequireAndVerifyClientCert, | ||
| }) | ||
| serverNameMap[serviceName] = creds | ||
| return creds, nil | ||
| } | ||
|
|
||
| } | ||
|
|
||
| // GenerateKeyPairWithPath generate xuper net key pair | ||
|
|
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
全局变量的读写最好加锁进行保护
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
好的