安全的加密密钥持久化与进程间通信教程

package main

import (
    "net"
    "net/rpc"
    "syscall"
    "fmt"
    "os"
    "sync"
)

const ChecksumSize = 32 // SHA-256

type Checksum [ChecksumSize]byte

// SumKeyPair 结构体用于传输文件校验和与密钥对
type SumKeyPair struct {
    Sum Checksum
    Key []byte
}

// KeyReply 结构体用于Agent返回密钥信息
type KeyReply struct {
    Key       []byte
    Available bool
}

// Cache 结构体代表Agent内部的密钥缓存
type Cache struct {
    mu    sync.RWMutex
    store map[Checksum][]byte
}

// NewCache 创建并初始化一个新的Cache实例
func NewCache() *Cache {
    return &Cache{
        store: make(map[Checksum][]byte),
    }
}

// RequestKey 方法：客户端请求对应文件校验和的密钥
// 注意：此方法在生产环境中通常不建议直接返回原始密钥
func (c *Cache) RequestKey(sum Checksum, reply *KeyReply) error {
    c.mu.RLock()
    defer c.mu.RUnlock()
    key, available := c.store[sum]
    reply.Key = key
    reply.Available = available
    return nil
}

// SetKey 方法：客户端设置或更新文件校验和对应的密钥
func (c *Cache) SetKey(pair SumKeyPair, reply *bool) error {
    c.mu.Lock()
    defer c.mu.Unlock()
    _, *reply = c.store[pair.Sum] // *reply indicates if key was updated (true) or added (false)
    c.store[pair.Sum] = pair.Key
    return nil
}

// getPeerCred 用于获取Unix域套接字对端的凭据信息
func getPeerCred(conn net.Conn) (*syscall.Ucred, error) {
    unixConn, ok := conn.(*net.UnixConn)
    if !ok {
        return nil, fmt.Errorf("connection is not a UnixConn")
    }
    file, err := unixConn.File()
    if err != nil {
        return nil, err
    }
    defer file.Close()
    return syscall.GetsockoptUcred(int(file.Fd()), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
}

// 示例：启动Agent服务
func main() {
    socketPath := "/tmp/keyagent.sock"
    // 清理旧的socket文件
    os.Remove(socketPath)

    listener, err := net.Listen("unix", socketPath)
    if err != nil {
        fmt.Printf("Error listening on socket: %v\n", err)
        return
    }
    defer listener.Close()
    fmt.Printf("Key Agent listening on %s\n", socketPath)

    // 设置socket文件权限，确保只有特定用户或组可以访问
    // os.Chmod(socketPath, 0600) // 示例：仅所有者可读写

    agentCache := NewCache()
    rpc.Register(agentCache)

    for {
        conn, err := listener.Accept()
        if err != nil {
            fmt.Printf("Error accepting connection: %v\n", err)
            continue
        }

        // 验证对端凭据
        creds, err := getPeerCred(conn)
        if err != nil {
            fmt.Printf("Failed to get peer credentials: %v\n", err)
            conn.Close()
            continue
        }
        fmt.Printf("Accepted connection from PID: %d, UID: %d, GID: %d\n", creds.Pid, creds.Uid, creds.Gid)

        // 在此处添加逻辑来根据creds.Uid或creds.Pid决定是否允许通信
        // 例如：只允许与Agent相同UID的进程通信
        if creds.Uid != uint32(os.Getuid()) {
            fmt.Printf("Unauthorized peer UID: %d. Closing connection.\n", creds.Uid)
            conn.Close()
            continue
        }

        go rpc.ServeConn(conn)
    }
}

import (
    "net"
    "syscall"
    "fmt"
)

// getPeerCred 用于获取Unix域套接字对端的凭据信息
func getPeerCred(conn net.Conn) (*syscall.Ucred, error) {
    unixConn, ok := conn.(*net.UnixConn)
    if !ok {
        return nil, fmt.Errorf("connection is not a UnixConn")
    }
    file, err := unixConn.File()
    if err != nil {
        return nil, err
    }
    defer file.Close()
    return syscall.GetsockoptUcred(int(file.Fd()), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
}