ruby-on-rails - Ruby 的 grpc(v1.3.2) gem SSL/TLS 连接问题与完全在 golang 中构建的 grpc 服务器

Question

最近，我尝试使用 ruby​​gem grpc 版本 1.3.2 作为 clinet 并连接到从 golang 构建的 grpc 服务器。我在 GRPC.IO 浏览了文档并在我的代码中使用它。

    irb(main):017:0> GRPC::Core::Credentials.new(File.read(CA_FILE_PATH))
NameError: uninitialized constant GRPC::Core::Credentials
        from (irb):17
        from /usr/local/share/gems/gems/railties-4.2.1/lib/rails/commands/console.rb:110:in `start'
        from /usr/local/share/gems/gems/railties-4.2.1/lib/rails/commands/console.rb:9:in `start'
        from /usr/local/share/gems/gems/railties-4.2.1/lib/rails/commands/commands_tasks.rb:68:in `console'
        from /usr/local/share/gems/gems/railties-4.2.1/lib/rails/commands/commands_tasks.rb:39:in `run_command!'
        from /usr/local/share/gems/gems/railties-4.2.1/lib/rails/commands.rb:17:in `<top (required)>'
        from bin/rails:4:in `require'
        from bin/rails:4:in `<main>'

但是他们的文档特别指出，

creds = GRPC::Core::Credentials.new(load_certs)  # load_certs typically loads a CA roots file
stub = Helloworld::Greeter::Stub.new('myservice.example.com', creds)

然后我遇到了 ChannelCredentials 并且 creds 应该是 ChannelCredentials 对象或符号(例如 :this_channel_is_insecure)。因此，我也尝试了一下。

我从 grpc gem 的源代码本身获取了以下函数。此函数在 rspec 测试用例中被调用以加载证书:

def load_certs
      data_dir = "#{Rails.root}/certs"
      files = ['ca.pem', 'server.key', 'server.pem']
      files.map { |f| File.open(File.join(data_dir, f)).read }
end

然后我试了一下，

channel_creds = GRPC::Core::ChannelCredentials.new(load_certs)
stub = Helloworld::Greeter::Stub.new('myservice.example.com', channel_creds)

但是上面的失败了

E0619 09:59:10.410575570   14208 ssl_transport_security.c:601] Could not load any root certificate.
E0619 09:59:10.410604954   14208 ssl_transport_security.c:1315] Cannot load server root certificates.
E0619 09:59:10.410622519   14208 security_connector.c:837]   Handshaker factory creation failed with TSI_INVALID_ARGUMENT.

我也试过:

channel_creds = GRPC::Core::ChannelCredentials.new(File.read(CA_FILE_PATH))
stub = Helloworld::Greeter::Stub.new('myservice.example.com', creds)

但我得到的只是来自日志或 rpc 服务器的错误:

2017/06/16 10:52:34 transport: http2Server.HandleStreams failed to receive the preface from client: EOF
2017/06/16 10:53:35 transport: http2Server.HandleStreams failed to receive the preface from client: EOF
2017/06/16 10:53:59 transport: http2Server.HandleStreams failed to receive the preface from client: EOF
2017/06/16 10:55:06 transport: http2Server.HandleStreams failed to receive the preface from client: EOF

有没有人成功尝试过这种启用了 SSL/TLS 的 Ruby 客户端 Golang 服务器组合？

Answer 1

creds is supposed to be either ChannelCredentials object or a symbol

是的，客户端 stub 构造函数的第二个参数(creds 参数)应该是 GRPC::Core::ChannelCredentials 对象或特别是 ::this_channel_is_insecure 符号(如果传递后者，将使用不安全的连接)。

我会注意到使用

的测试

def load_certs
  data_dir = "#{Rails.root}/certs"
  files = ['ca.pem', 'server.key', 'server.pem']
  files.map { |f| File.open(File.join(data_dir, f)).read }
end

实际上可能会产生误导，因为只有使用客户端的私钥和证书链(我认为该特定测试不使用 key 和证书链)构建 channel 凭证才有意义。

在 GRPC::Core::ChannelCredentials 构造函数上:

可以使用三种形式，(在 https://github.com/grpc/grpc/blob/master/src/ruby/ext/grpc/rb_channel_credentials.c#L128 中的构造函数代码上方有一条注释覆盖了它们)，但是选项是:

• Credentials.new()

• Credentials.new(pem_root_certs)

• Credentials.new(pem_root_certs、pem_private_key、pem_cert_chain)

在所有情况下，根文件、私钥和证书链参数都是 pem 编码的字符串。

请注意，如果未传递任何参数(使用 Credentials.new())，则将按照 this header comment 中的描述找到服务器根证书。 (请参阅服务器根证书参数为空时的行为描述)。最后一个构造函数仅在您希望客户端使用私钥和证书链时才需要。