构建安全密钥缓存与进程间通信：借鉴SSH Agent的实践

type Checksum [ChecksumSize]byte

type SumKeyPair struct {
    Sum Checksum
    Key []byte
}

type KeyReply struct {
    Key       []byte
    Available bool
}

type Cache map[Checksum][]byte

// Fetches key that corresponds with file checksum
func (c Cache) RequestKey(sum Checksum, reply *KeyReply) error {
    reply.Key, reply.Available = c[sum]
    return nil
}

// Adds or updates key that corresponds with file checksum
func (c Cache) SetKey(pair SumKeyPair, reply *bool) error {
    _, *reply = c[pair.Sum]
    c[pair.Sum] = pair.Key
    return nil
}

// 示例：重新设计的代理服务接口（概念性）
type AgentService struct {
    keys Cache // 内部管理密钥
}

// Decrypts data using the key associated with the checksum
func (s AgentService) DecryptData(args struct{ Sum Checksum; EncryptedData []byte }, reply *[]byte) error {
    key, available := s.keys[args.Sum]
    if !available {
        return fmt.Errorf("key not found for checksum %x", args.Sum)
    }
    // Perform decryption using 'key' and 'args.EncryptedData'
    // For simplicity, actual decryption logic is omitted
    *reply = performDecryption(key, args.EncryptedData) 
    return nil
}

// SetKey 仍然可以保留，用于在用户提供正确密码后更新密钥
func (s AgentService) SetKey(pair SumKeyPair, reply *bool) error {
    _, *reply = s.keys[pair.Sum]
    s.keys[pair.Sum] = pair.Key
    return nil
}

package main

import (
    "fmt"
    "net"
    "os"
    "syscall"
)

// getPeerCred 从 UnixConn 获取对端的凭证信息
func getPeerCred(conn net.Conn) (*syscall.Ucred, error) {
    // 确保连接是 UnixConn 类型
    unixConn, ok := conn.(*net.UnixConn)
    if !ok {
        return nil, fmt.Errorf("connection is not a UnixConn")
    }

    // 获取文件描述符
    file, err := unixConn.File()
    if err != nil {
        return nil, err
    }
    defer file.Close() // 确保文件描述符被关闭

    // 使用 syscall.GetsockoptUcred 获取 Ucred 结构
    return syscall.GetsockoptUcred(int(file.Fd()), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
}

func main() {
    // 示例服务器端
    go func() {
        sockPath := "/tmp/my_secure_agent.sock"
        os.Remove(sockPath) // 清理旧的套接字文件
        l, err := net.Listen("unix", sockPath)
        if err != nil {
            fmt.Printf("Server listen error: %v\n", err)
            return
        }
        defer l.Close()
        fmt.Printf("Server listening on %s\n", sockPath)

        // 设置套接字文件权限
        if err := os.Chmod(sockPath, 0600); err != nil {
            fmt.Printf("Failed to set socket permissions: %v\n", err)
            return
        }

        for {
            conn, err := l.Accept()
            if err != nil {
                fmt.Printf("Server accept error: %v\n", err)
                continue
            }
            fmt.Printf("Server accepted connection from %s\n", conn.RemoteAddr())

            creds, err := getPeerCred(conn)
            if err != nil {
                fmt.Printf("Failed to get peer credentials: %v\n", err)
            } else {
                fmt.Printf("Peer credentials: PID=%d, UID=%d, GID=%d\n", creds.Pid, creds.Uid, creds.Gid)
                // 在这里可以根据 PID/UID/GID 决定是否允许通信
                if creds.Uid != uint32(os.Geteuid()) { // 示例：只允许与当前用户通信
                    fmt.Printf("Connection from unauthorized user (UID: %d), closing.\n", creds.Uid)
                    conn.Close()
                    continue
                }
            }

            // 正常处理连接...
            conn.Write([]byte("Hello from agent!"))
            conn.Close()
        }
    }()

    // 示例客户端端
    conn, err := net.Dial("unix", "/tmp/my_secure_agent.sock")
    if err != nil {
        fmt.Printf("Client dial error: %v\n", err)
        return
    }
    defer conn.Close()
    fmt.Println("Client connected to server.")

    buf := make([]byte, 1024)
    n, err := conn.Read(buf)
    if err != nil {
        fmt.Printf("Client read error: %v\n", err)
        return
    }
    fmt.Printf("Client received: %s\n", string(buf[:n]))

    // 保持主goroutine运行一段时间以便观察
    select {}
}