file-type

auth_server:使用Go语言的简易加密服务器API

ZIP文件

下载需积分: 9 | 12KB | 更新于2025-09-04 | 16 浏览量 | 0 下载量 举报 收藏
download 立即下载
auth_server是一个基于Go语言开发的服务器程序,其核心功能是提供API来安全地保存用户凭证信息。该服务主要使用CHACHA20加密算法来加密用户密码,并提供一个数据接口以供其他需要用户认证的应用程序访问。接下来将详细解析标题和描述中的知识点。 ### 标题解析:“auth_server” 该标题直接指明了本服务的主要职责,即作为身份验证服务器的角色。auth_server作为一个认证服务,其关键职责通常包括以下几个方面: 1. **用户凭证管理**:管理用户提交的凭证信息,包括用户名、密码等。 2. **数据加密**:使用加密技术来保护存储在服务器上的敏感信息,这里特指使用CHACHA20算法进行加密。 3. **API服务**:提供一个或多个API接口供其他应用程序或服务访问,以便进行用户认证、密码加密解密等相关操作。 4. **安全性**:考虑到信息的安全性,API必须在同一个服务器上进行,以便访问经过加密的用户信息。 ### 描述解析:“AUTH_SERVER” 描述提供了auth_server服务器运行的细节和操作指南,主要包含了如何运行该服务的指导,以及服务运行所需的基础环境和依赖。 1. **本地运行**:若要在本地执行auth_server,需要安装Go语言环境(golang)。描述中提到了一个名为`start.sh`的脚本,用于初始化和启动服务。这个脚本会创建一个名为`data`的目录,用以存放加密数据。同时,服务在运行时会使用一些硬编码的秘钥值对Cookie进行加密,并用它们来加密存储在服务器上的用户数据。 2. **在Docker中运行**:描述中还提供了如何将auth_server部署到Docker容器中的信息。首先需要构建镜像,然后运行容器,并将本地的`data`目录挂载到容器内的相应位置,确保数据持久化和可访问性。这种方法的好处是可以在不同的环境中快速部署相同配置的服务,提高项目的可移植性和可维护性。 ### 标签解析:“Go” Go语言(又称Golang)是由Google开发的一种静态类型、编译型语言,以其简洁、高效、安全和并发性能强大而闻名。本项目使用Go语言进行开发,表明了以下几个方面的特点: 1. **快速编译**:Go语言的编译速度非常快,这有助于快速开发和部署。 2. **并发处理**:Go语言内置的并发支持(goroutine和channel),适合用来开发需要处理大量并发请求的服务。 3. **标准库丰富**:Go语言的标准库提供了多种基础功能,包括网络通信、数据加密等,这使得开发者可以快速构建功能完善的应用程序。 4. **跨平台**:Go程序编译后可跨平台运行,无需修改代码即可在不同操作系统中部署。 ### 压缩包子文件的文件名称列表解析:“auth_server-master” 从给出的文件名称“auth_server-master”中,我们可以推断出该压缩包可能包含了auth_server项目的全部源代码以及相关文档。列表中的“-master”通常表示该版本是主分支的代码,可能代表最新的开发状态或是稳定的发布版本。 在文件列表中,我们可能还会见到以下几个文件或文件夹: - **start.sh**:用于启动auth_server服务的脚本文件。 - **build.sh**:用于构建auth_server项目的Docker镜像的脚本文件。 - **Dockerfile**:若存在,Dockerfile会定义如何从基础镜像创建auth_server的Docker镜像。 - **data**:预设的数据文件夹,用于存储加密后的用户凭证信息。 此外,还可能包括源代码文件、测试文件、配置文件以及项目依赖文件等。 综上所述,auth_server项目是一个使用Go语言开发的服务器程序,旨在为其他API提供加密的用户凭证存储功能,采用CHACHA20算法进行数据加密,并且提供了本地运行和Docker容器化部署两种方式。通过上述描述,我们可以得知该项目的运行环境、部署方式以及使用的编程语言,为进一步开发和使用该服务提供了基础。

相关推荐

filetype

pgbouncer/src/client.c 里有部分内容: #include "bouncer.h" #include "pam.h" #include "scram.h" #include <usual/pgutil.h> #include <usual/crypto/sm3.h> static const char *hdr2hex(const struct MBuf *data, char *buf, unsigned buflen) { const uint8_t *bin = data->data + data->read_pos; unsigned int dlen; dlen = mbuf_avail_for_read(data); return bin2hex(bin, dlen, buf, buflen); } static bool check_client_passwd(PgSocket *client, const char *passwd) { char md5[MD5_PASSWD_LEN + 1]; PgUser *user = client->auth_user; int auth_type = client->client_auth_type; /* disallow empty passwords */ if (!*passwd || !*user->passwd) return false; switch (auth_type) { case AUTH_PLAIN: switch (get_password_type(user->passwd)) { case PASSWORD_TYPE_PLAINTEXT: return strcmp(user->passwd, passwd) == 0; case PASSWORD_TYPE_MD5: pg_md5_encrypt(passwd, user->name, strlen(user->name), md5); return strcmp(user->passwd, md5) == 0; case PASSWORD_TYPE_SCRAM_SHA_256: return scram_verify_plain_password(client, user->name, passwd, user->passwd); case PASSWORD_TYPE_SM3: { char sm3hash[SM3_DIGEST_LENGTH*2 + 1]; pg_sm3_encrypt(passwd, "", 0, sm3hash); return strcmp(user->passwd, sm3hash) == 0; } default: return false; } case AUTH_MD5: if (strlen(passwd) != MD5_PASSWD_LEN) return false; if (get_password_type(user->passwd) == PASSWORD_TYPE_PLAINTEXT) pg_md5_encrypt(user->passwd, user->name, strlen(user->name), user->passwd); pg_md5_encrypt(user->passwd + 3, (char *)client->tmp_login_salt, 4, md5); return strcmp(md5, passwd) == 0; case AUTH_SM3: { char salt[5]; char sm3hash[SM3_DIGEST_LENGTH*2 + 1]; // 从临时存储获取盐值 memcpy(salt, client->tmp_login_salt, 4); salt[4] = '\0'; // 生成客户端哈希 pg_sm3_encrypt(passwd, salt, 4, sm3hash); // 验证流程 return pg_sm3_verify(user->passwd + 3, salt, sm3hash, user->passwd + 3 + 8); } } return false; } static bool send_client_authreq(PgSocket *client) { int res; int auth_type = client->client_auth_type; if (auth_type == AUTH_MD5) { uint8_t saltlen = 4; get_random_bytes((void*)client->tmp_login_salt, saltlen); SEND_generic(res, client, 'R', "ib", AUTH_MD5, client->tmp_login_salt, saltlen); } else if (auth_type == AUTH_SM3) { // 生成SM3认证需要的盐值 uint8_t saltlen = 8; get_random_bytes((void*)client->tmp_login_salt, saltlen); SEND_generic(res, client, 'R', "ib", AUTH_SM3, client->tmp_login_salt, saltlen); } else if (auth_type == AUTH_PLAIN || auth_type == AUTH_PAM) { SEND_generic(res, client, 'R', "i", AUTH_PLAIN); } else if (auth_type == AUTH_SCRAM_SHA_256) { SEND_generic(res, client, 'R', "iss", AUTH_SASL, "SCRAM-SHA-256", ""); } else { return false; } if (!res) disconnect_client(client, false, "failed to send auth req"); return res; } static void start_auth_request(PgSocket *client, const char *username) { int res; PktBuf *buf; /* have to fetch user info from db */ client->pool = get_pool(client->db, client->db->auth_user); if (!find_server(client)) { client->wait_for_user_conn = true; return; } slog_noise(client, "doing auth_conn query"); client->wait_for_user_conn = false; client->wait_for_user = true; if (!sbuf_pause(&client->sbuf)) { release_server(client->link); disconnect_client(client, true, "pause failed"); return; } client->link->ready = 0; res = 0; buf = pktbuf_dynamic(512); if (buf) { pktbuf_write_ExtQuery(buf, cf_auth_query, 1, username); res = pktbuf_send_immediate(buf, client->link); pktbuf_free(buf); /* * Should do instead: * res = pktbuf_send_queued(buf, client->link); * but that needs better integration with SBuf. */ } if (!res) disconnect_server(client->link, false, "unable to send login query"); } static bool login_via_cert(PgSocket *client) { struct tls *tls = client->sbuf.tls; if (!tls) { disconnect_client(client, true, "TLS connection required"); return false; } if (!tls_peer_cert_provided(client->sbuf.tls)) { disconnect_client(client, true, "TLS client certificate required"); return false; } log_debug("TLS cert login: %s", tls_peer_cert_subject(client->sbuf.tls)); if (!tls_peer_cert_contains_name(client->sbuf.tls, client->auth_user->name)) { disconnect_client(client, true, "TLS certificate name mismatch"); return false; } /* login successful */ return finish_client_login(client); } static bool login_as_unix_peer(PgSocket *client) { if (!pga_is_unix(&client->remote_addr)) goto fail; if (!check_unix_peer_name(sbuf_socket(&client->sbuf), client->auth_user->name)) goto fail; return finish_client_login(client); fail: disconnect_client(client, true, "unix socket login rejected"); return false; } static bool finish_set_pool(PgSocket *client, bool takeover) { PgUser *user = client->auth_user; bool ok = false; int auth; /* pool user may be forced */ if (client->db->forced_user) { user = client->db->forced_user; } client->pool = get_pool(client->db, user); if (!client->pool) { disconnect_client(client, true, "no memory for pool"); return false; } if (cf_log_connections) { if (client->sbuf.tls) { char infobuf[96] = ""; tls_get_connection_info(client->sbuf.tls, infobuf, sizeof infobuf); slog_info(client, "login attempt: db=%s user=%s tls=%s", client->db->name, client->auth_user->name, infobuf); } else { slog_info(client, "login attempt: db=%s user=%s tls=no", client->db->name, client->auth_user->name); } } if (!check_fast_fail(client)) return false; if (takeover) return true; if (client->pool->db->admin) { if (!admin_post_login(client)) return false; } if (client->own_user) return finish_client_login(client); auth = cf_auth_type; if (auth == AUTH_HBA) { auth = hba_eval(parsed_hba, &client->remote_addr, !!client->sbuf.tls, client->db->name, client->auth_user->name); } if (auth == AUTH_MD5 && get_password_type(client->auth_user->passwd) == PASSWORD_TYPE_SM3) { auth = AUTH_SM3; } if (auth == AUTH_MD5) { if (get_password_type(client->auth_user->passwd) == PASSWORD_TYPE_SCRAM_SHA_256) auth = AUTH_SCRAM_SHA_256; } /* remember method */ client->client_auth_type = auth; switch (auth) { case AUTH_ANY: case AUTH_TRUST: ok = finish_client_login(client); break; case AUTH_PLAIN: case AUTH_MD5: case AUTH_PAM: case AUTH_SCRAM_SHA_256: case AUTH_SM3: ok = send_client_authreq(client); break; case AUTH_CERT: ok = login_via_cert(client); break; case AUTH_PEER: ok = login_as_unix_peer(client); break; default: disconnect_client(client, true, "login rejected"); ok = false; } return ok; } 讲下添加的涉及sm3的代码的正确性

filetype

pgbouncer/include/bouncer.h 有 struct PgSocket { struct List head; /* list header */ PgSocket *link; /* the dest of packets */ PgPool *pool; /* parent pool, if NULL not yet assigned */ PgUser *auth_user; /* presented login, for client it may differ from pool->user */ int client_auth_type; /* auth method decided by hba */ SocketState state:8; /* this also specifies socket location */ bool ready:1; /* server: accepts new query */ bool idle_tx:1; /* server: idling in tx */ bool close_needed:1; /* server: this socket must be closed ASAP */ bool setting_vars:1; /* server: setting client vars */ bool exec_on_connect:1; /* server: executing connect_query */ bool resetting:1; /* server: executing reset query from auth login; don't release on flush */ bool copy_mode:1; /* server: in copy stream, ignores any Sync packets */ bool wait_for_welcome:1;/* client: no server yet in pool, cannot send welcome msg */ bool wait_for_user_conn:1;/* client: waiting for auth_conn server connection */ bool wait_for_user:1; /* client: waiting for auth_conn query results */ bool wait_for_auth:1; /* client: waiting for external auth (PAM) to be completed */ bool suspended:1; /* client/server: if the socket is suspended */ bool admin_user:1; /* console client: has admin rights */ bool own_user:1; /* console client: client with same uid on unix socket */ bool wait_for_response:1;/* console client: waits for completion of PAUSE/SUSPEND cmd */ bool wait_sslchar:1; /* server: waiting for ssl response: S/N */ int expect_rfq_count; /* client: count of ReadyForQuery packets client should see */ usec_t connect_time; /* when connection was made */ usec_t request_time; /* last activity time */ usec_t query_start; /* query start moment */ usec_t xact_start; /* xact start moment */ usec_t wait_start; /* waiting start moment */ uint8_t cancel_key[BACKENDKEY_LEN]; /* client: generated, server: remote */ PgAddr remote_addr; /* ip:port for remote endpoint */ PgAddr local_addr; /* ip:port for local endpoint */ union { struct DNSToken *dns_token; /* ongoing request */ PgDatabase *db; /* cache db while doing auth query */ }; struct ScramState { char *client_nonce; char *client_first_message_bare; char *client_final_message_without_proof; char *server_nonce; char *server_first_message; uint8_t *SaltedPassword; char cbind_flag; int iterations; char *salt; /* base64-encoded */ uint8_t StoredKey[32]; /* SHA256_DIGEST_LENGTH */ uint8_t ServerKey[32]; } scram_state; VarCache vars; /* state of interesting server parameters */ SBuf sbuf; /* stream buffer, must be last */ }; 对于 tmp_login_salt ,pgbouncer/include/bouncer.h 有: /* where the salt is temporarily stored */ #define tmp_login_salt cancel_key 结合这些,重新审视下: static bool send_client_authreq(PgSocket *client) { int res; int auth_type = client->client_auth_type; if (auth_type == AUTH_MD5) { uint8_t saltlen = 4; get_random_bytes((void*)client->tmp_login_salt, saltlen); SEND_generic(res, client, 'R', "ib", AUTH_MD5, client->tmp_login_salt, saltlen); } else if (auth_type == AUTH_SM3) { // 生成SM3认证需要的盐值 uint8_t saltlen = 8; get_random_bytes((void*)client->tmp_login_salt, saltlen); SEND_generic(res, client, 'R', "ib", AUTH_SM3, client->tmp_login_salt, saltlen); } else if (auth_type == AUTH_PLAIN || auth_type == AUTH_PAM) { SEND_generic(res, client, 'R', "i", AUTH_PLAIN); } else if (auth_type == AUTH_SCRAM_SHA_256) { SEND_generic(res, client, 'R', "iss", AUTH_SASL, "SCRAM-SHA-256", ""); } else { return false; } if (!res) disconnect_client(client, false, "failed to send auth req"); return res; } 的添加的sm3部分

filetype

# spring server.servlet.contextPath=${SERVER_SERVLET_CONTEXTPATH:/nacos} server.contextPath=/nacos server.port=${NACOS_APPLICATION_PORT:8848} server.tomcat.accesslog.max-days=30 server.tomcat.accesslog.pattern=%h %l %u %t "%r" %s %b %D %{User-Agent}i %{Request-Source}i spring.datasource.platform=${SPRING_DATASOURCE_PLATFORM:""} nacos.cmdb.dumpTaskInterval=3600 nacos.cmdb.eventTaskInterval=10 nacos.cmdb.labelTaskInterval=300 nacos.cmdb.loadDataAtStart=false db.num=${MYSQL_DATABASE_NUM:1} db.url.0=jdbc:mysql://${MYSQL_SERVICE_HOST}:${MYSQL_SERVICE_PORT:3306}/${MYSQL_SERVICE_DB_NAME}?${MYSQL_SERVICE_DB_PARAM:characterEncoding=utf8&connectTimeout=1000&socketTimeout=3000&autoReconnect=true&useSSL=false} db.url.1=jdbc:mysql://${MYSQL_SERVICE_HOST}:${MYSQL_SERVICE_PORT:3306}/${MYSQL_SERVICE_DB_NAME}?${MYSQL_SERVICE_DB_PARAM:characterEncoding=utf8&connectTimeout=1000&socketTimeout=3000&autoReconnect=true&useSSL=false} db.user=${MYSQL_SERVICE_USER} db.password=${MYSQL_SERVICE_PASSWORD} ### The auth system to use, currently only 'nacos' and 'ldap' is supported: nacos.core.auth.system.type=${NACOS_AUTH_SYSTEM_TYPE:nacos} ### worked when nacos.core.auth.system.type=nacos ### The token expiration in seconds: nacos.core.auth.plugin.nacos.token.expire.seconds=${NACOS_AUTH_TOKEN_EXPIRE_SECONDS:18000} ### The default token: nacos.core.auth.plugin.nacos.token.secret.key=${NACOS_AUTH_TOKEN:SecretKey012345678901234567890123456789012345678901234567890123456789} ### Turn on/off caching of auth information. By turning on this switch, the update of auth information would have a 15 seconds delay. nacos.core.auth.caching.enabled=${NACOS_AUTH_CACHE_ENABLE:false} nacos.core.auth.enable.userAgentAuthWhite=${NACOS_AUTH_USER_AGENT_AUTH_WHITE_ENABLE:false} nacos.core.auth.server.identity.key=${NACOS_AUTH_IDENTITY_KEY:serverIdentity} nacos.core.auth.server.identity.value=${NACOS_AUTH_IDENTITY_VALUE:security} server.tomcat.accesslog.enabled=${TOMCAT_ACCESSLOG_ENABLED:false} # default current work di

陳二二
  • 粉丝: 45
上传资源 快速赚钱