Go语言中基于自签名证书和公钥校验的安全双向认证连接实现

package main

import (
    "crypto/tls"
    "crypto/x509"
    "io/ioutil"
    "log"
    "net"
    "bytes" // 用于公钥比对
)

// loadCertificateAndKey loads the certificate and key files.
func loadCertificateAndKey(certFile, keyFile string) (tls.Certificate, error) {
    cert, err := tls.LoadX509KeyPair(certFile, keyFile)
    if err != nil {
        return tls.Certificate{}, err
    }
    return cert, nil
}

// createTLSConfig creates a tls.Config suitable for both client and server,
// with specific adjustments for client/server roles.
func createTLSConfig(myCert tls.Certificate, isServer bool, knownPeerPublicKey []byte) *tls.Config {
    config := &tls.Config{
        Certificates: []tls.Certificate{myCert}, // 加载自身的证书
        // 对于自签名证书，我们不进行传统的CA链验证，而是依赖后续的公钥比对。
        // 因此，在客户端侧，通常会设置 InsecureSkipVerify 为 true。
        // 但请注意，这仅表示跳过证书链验证，不代表完全不验证对端身份。
        // 真正的身份验证将在连接建立后通过比对公钥完成。
        InsecureSkipVerify: true, // 客户端通常需要设置为 true，因为没有CA来验证服务器证书
    }

    if isServer {
        // 服务器端需要验证客户端证书，以实现双向认证
        config.ClientAuth = tls.RequireAnyClientCert // 要求客户端提供证书
    }

    // 如果有需要，可以在这里添加其他配置，例如CipherSuites等
    return config
}

// startServer starts a TLS server on the given address.
func startServer(addr string, myCert tls.Certificate, knownClientPublicKey []byte) {
    config := createTLSConfig(myCert, true, knownClientPublicKey) // isServer = true
    listener, err := tls.Listen("tcp", addr, config)
    if err != nil {
        log.Fatalf("Server: Failed to start TLS listener: %v", err)
    }
    defer listener.Close()
    log.Printf("Server: Listening on %s", addr)

    for {
        conn, err := listener.Accept()
        if err != nil {
            log.Printf("Server: Failed to accept connection: %v", err)
            continue
        }
        go handleConnection(conn, knownClientPublicKey, true)
    }
}

// startClient connects to a TLS server.
func startClient(addr string, myCert tls.Certificate, knownServerPublicKey []byte) {
    config := createTLSConfig(myCert, false, knownServerPublicKey) // isServer = false
    conn, err := tls.Dial("tcp", addr, config)
    if err != nil {
        log.Fatalf("Client: Failed to dial TLS server: %v", err)
    }
    defer conn.Close()
    log.Printf("Client: Connected to %s", addr)

    handleConnection(conn, knownServerPublicKey, false)
}

// handleConnection processes a TLS connection, including peer public key verification.
func handleConnection(conn net.Conn, knownPeerPublicKey []byte, isServer bool) {
    defer conn.Close()

    tlsConn, ok := conn.(*tls.Conn)
    if !ok {
        log.Printf("Error: Connection is not a TLS connection.")
        return
    }

    // 确保TLS握手已完成
    err := tlsConn.Handshake()
    if err != nil {
        log.Printf("Error during TLS handshake: %v", err)
        return
    }

    // 获取连接状态
    state := tlsConn.ConnectionState()

    // 检查对等方是否提供了证书
    if len(state.PeerCertificates) == 0 {
        log.Printf("Error: Peer did not provide a certificate for authentication.")
        return
    }

    // 提取对等方的第一个证书（通常只有一个）
    peerCert := state.PeerCertificates[0]

    // 从证书中提取公钥
    peerPublicKeyBytes, err := x509.MarshalPKIXPublicKey(peerCert.PublicKey)
    if err != nil {
        log.Printf("Error marshalling peer public key: %v", err)
        return
    }

    // 比对提取到的公钥与预设的已知公钥
    if !bytes.Equal(peerPublicKeyBytes, knownPeerPublicKey) {
        log.Printf("Authentication failed: Peer public key mismatch.")
        log.Printf("Expected public key: %x", knownPeerPublicKey)
        log.Printf("Received public key: %x", peerPublicKeyBytes)
        return
    }

    log.Printf("Authentication successful: Peer public key matches.")
    // 至此，连接已加密且对等方身份已验证。可以进行安全通信。

    // 示例：发送和接收数据
    if isServer {
        _, err := conn.Write([]byte("Hello from server!\n"))
        if err != nil {
            log.Printf("Server: Write error: %v", err)
        }
        buf := make([]byte, 1024)
        n, err := conn.Read(buf)
        if err != nil {
            log.Printf("Server: Read error: %v", err)
            return
        }
        log.Printf("Server: Received: %s", string(buf[:n]))
    } else { // Client
        buf := make([]byte, 1024)
        n, err := conn.Read(buf)
        if err != nil {
            log.Printf("Client: Read error: %v", err)
            return
        }
        log.Printf("Client: Received: %s", string(buf[:n]))
        _, err = conn.Write([]byte("Hello from client!\n"))
        if err != nil {
            log.Printf("Client: Write error: %v", err)
        }
    }
}

// Helper function to extract public key from a .crt file
func getPublicKeyFromCertFile(certFile string) ([]byte, error) {
    certPEMBlock, err := ioutil.ReadFile(certFile)
    if err != nil {
        return nil, err
    }
    cert, err := x509.ParseCertificate(certPEMBlock)
    if err != nil {
        // Try parsing as PEM block if direct parse fails (e.g. if it's a bundle)
        block, _ := pem.Decode(certPEMBlock)
        if block == nil || block.Type != "CERTIFICATE" {
            return nil, fmt.Errorf("failed to decode PEM block containing certificate")