使用Golang在Hyperledger Fabric中实现双向TLS认证

在Hyperledger Fabric Go SDK中，确实可以实现动态化的TLS配置，避免硬编码路径。以下是几种实现方式：

1. 使用环境变量配置TLS路径

package main

import (
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "io/ioutil"
    "os"

    "github.com/hyperledger/fabric-sdk-go/pkg/core/config"
    "github.com/hyperledger/fabric-sdk-go/pkg/fabsdk"
)

func loadTLSConfig() (*tls.Config, error) {
    // 从环境变量获取路径
    certPath := os.Getenv("FABRIC_TLS_CERT_PATH")
    keyPath := os.Getenv("FABRIC_TLS_KEY_PATH")
    caCertPath := os.Getenv("FABRIC_CA_CERT_PATH")

    if certPath == "" || keyPath == "" || caCertPath == "" {
        return nil, fmt.Errorf("TLS环境变量未设置")
    }

    // 加载客户端证书
    cert, err := tls.LoadX509KeyPair(certPath, keyPath)
    if err != nil {
        return nil, fmt.Errorf("加载客户端证书失败: %v", err)
    }

    // 加载CA证书
    caCert, err := ioutil.ReadFile(caCertPath)
    if err != nil {
        return nil, fmt.Errorf("加载CA证书失败: %v", err)
    }

    caCertPool := x509.NewCertPool()
    caCertPool.AppendCertsFromPEM(caCert)

    return &tls.Config{
        Certificates: []tls.Certificate{cert},
        RootCAs:      caCertPool,
        ServerName:   os.Getenv("FABRIC_TLS_SERVER_NAME"),
    }, nil
}

2. 动态配置Fabric SDK

package main

import (
    "encoding/json"
    "fmt"
    "io/ioutil"

    "github.com/hyperledger/fabric-sdk-go/pkg/core/config"
    "github.com/hyperledger/fabric-sdk-go/pkg/fabsdk"
)

type DynamicTLSConfig struct {
    TLSCertPath  string `json:"tlsCertPath"`
    TLSKeyPath   string `json:"tlsKeyPath"`
    TLSCACertPath string `json:"tlsCACertPath"`
    MSPID        string `json:"mspId"`
    UserName     string `json:"userName"`
}

func createDynamicConnectionProfile(configPath string) ([]byte, error) {
    // 读取动态配置
    configData, err := ioutil.ReadFile(configPath)
    if err != nil {
        return nil, fmt.Errorf("读取配置文件失败: %v", err)
    }

    var tlsConfig DynamicTLSConfig
    if err := json.Unmarshal(configData, &tlsConfig); err != nil {
        return nil, fmt.Errorf("解析配置失败: %v", err)
    }

    // 读取TLS证书内容
    tlsCert, err := ioutil.ReadFile(tlsConfig.TLSCertPath)
    if err != nil {
        return nil, fmt.Errorf("读取TLS证书失败: %v", err)
    }

    tlsKey, err := ioutil.ReadFile(tlsConfig.TLSKeyPath)
    if err != nil {
        return nil, fmt.Errorf("读取TLS私钥失败: %v", err)
    }

    caCert, err := ioutil.ReadFile(tlsConfig.TLSCACertPath)
    if err != nil {
        return nil, fmt.Errorf("读取CA证书失败: %v", err)
    }

    // 构建动态连接配置
    connectionProfile := map[string]interface{}{
        "organizations": map[string]interface{}{
            tlsConfig.MSPID: map[string]interface{}{
                "mspid": tlsConfig.MSPID,
                "users": map[string]interface{}{
                    tlsConfig.UserName: map[string]interface{}{
                        "cert": map[string]interface{}{
                            "pem": string(tlsCert),
                        },
                        "key": map[string]interface{}{
                            "pem": string(tlsKey),
                        },
                    },
                },
                "certificateAuthorities": []string{"ca.example.com"},
            },
        },
        "certificateAuthorities": map[string]interface{}{
            "ca.example.com": map[string]interface{}{
                "url": "https://localhost:7054",
                "caName": "ca.example.com",
                "tlsCACerts": map[string]interface{}{
                    "pem": []string{string(caCert)},
                },
                "httpOptions": map[string]interface{}{
                    "verify": true,
                },
            },
        },
    }

    return json.Marshal(connectionProfile)
}

func main() {
    // 动态创建连接配置
    configJSON, err := createDynamicConnectionProfile("tls-config.json")
    if err != nil {
        panic(err)
    }

    // 创建SDK配置提供者
    configProvider := config.FromRaw(configJSON, "yaml")
    
    sdk, err := fabsdk.New(configProvider)
    if err != nil {
        panic(fmt.Sprintf("创建SDK失败: %v", err))
    }
    defer sdk.Close()

    fmt.Println("Fabric SDK已成功初始化")
}

3. 使用配置管理器

package main

import (
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "io/ioutil"
    "sync"
    "time"

    "github.com/hyperledger/fabric-sdk-go/pkg/common/providers/fab"
    "github.com/hyperledger/fabric-sdk-go/pkg/core/config"
    "github.com/hyperledger/fabric-sdk-go/pkg/fabsdk"
)

type TLSConfigManager struct {
    mu           sync.RWMutex
    tlsConfig    *tls.Config
    certPath     string
    keyPath      string
    caCertPath   string
    lastModified time.Time
}

func NewTLSConfigManager(certPath, keyPath, caCertPath string) *TLSConfigManager {
    return &TLSConfigManager{
        certPath:   certPath,
        keyPath:    keyPath,
        caCertPath: caCertPath,
    }
}

func (m *TLSConfigManager) GetTLSConfig() (*tls.Config, error) {
    m.mu.RLock()
    if m.tlsConfig != nil && !m.shouldReload() {
        config := m.tlsConfig
        m.mu.RUnlock()
        return config, nil
    }
    m.mu.RUnlock()

    return m.reloadTLSConfig()
}

func (m *TLSConfigManager) shouldReload() bool {
    // 检查文件是否被修改
    certInfo, err := os.Stat(m.certPath)
    if err != nil {
        return true
    }
    
    return certInfo.ModTime().After(m.lastModified)
}

func (m *TLSConfigManager) reloadTLSConfig() (*tls.Config, error) {
    m.mu.Lock()
    defer m.mu.Unlock()

    // 重新检查，避免重复加载
    if m.tlsConfig != nil && !m.shouldReload() {
        return m.tlsConfig, nil
    }

    // 加载证书文件
    cert, err := tls.LoadX509KeyPair(m.certPath, m.keyPath)
    if err != nil {
        return nil, fmt.Errorf("加载证书失败: %v", err)
    }

    caCert, err := ioutil.ReadFile(m.caCertPath)
    if err != nil {
        return nil, fmt.Errorf("加载CA证书失败: %v", err)
    }

    caCertPool := x509.NewCertPool()
    caCertPool.AppendCertsFromPEM(caCert)

    m.tlsConfig = &tls.Config{
        Certificates: []tls.Certificate{cert},
        RootCAs:      caCertPool,
        MinVersion:   tls.VersionTLS12,
    }

    certInfo, _ := os.Stat(m.certPath)
    m.lastModified = certInfo.ModTime()

    return m.tlsConfig, nil
}

// 使用示例
func main() {
    tlsManager := NewTLSConfigManager(
        "/path/to/client.crt",
        "/path/to/client.key", 
        "/path/to/ca.crt",
    )

    tlsConfig, err := tlsManager.GetTLSConfig()
    if err != nil {
        panic(err)
    }

    // 在Fabric配置中使用动态TLS配置
    configProvider := config.FromFile("connection-profile.yaml")
    
    sdk, err := fabsdk.New(configProvider, fabsdk.WithTLSConfig(tlsConfig))
    if err != nil {
        panic(fmt.Sprintf("创建SDK失败: %v", err))
    }
    defer sdk.Close()

    fmt.Println("使用动态TLS配置的Fabric SDK已初始化")
}

这些方法允许你在运行时动态加载和更新TLS证书，避免了硬编码路径的问题。第一种方法使用环境变量，第二种方法使用JSON配置文件，第三种方法提供了证书文件的热重载功能。