📚 第5章：微服务安全与认证

微服务架构的分布式特性带来了独特的安全挑战。本章将深入探讨微服务环境中的安全策略、身份认证、授权机制和数据保护。

微服务安全概述

安全挑战

微服务架构面临的主要安全挑战包括：

1. 攻击面扩大：每个服务都是潜在的攻击入口
2. 服务间通信安全：内部网络不再是可信边界
3. 身份传播：用户身份需要在服务间安全传递
4. 分布式授权：权限控制分散在多个服务中
5. 数据保护：敏感数据在多个服务间流转

安全原则

# 微服务安全原则配置
apiVersion: v1
kind: ConfigMap
metadata:
  name: security-principles
  namespace: microservices
data:
  principles.yaml: |
    security_principles:
      # 零信任原则
      zero_trust:
        enabled: true
        verify_everything: true
        trust_nothing: true
        
      # 最小权限原则
      least_privilege:
        enabled: true
        default_deny: true
        explicit_grants: true
        
      # 深度防御
      defense_in_depth:
        enabled: true
        multiple_layers: true
        redundant_controls: true
        
      # 安全左移
      shift_left:
        enabled: true
        security_by_design: true
        early_testing: true
        
      # 持续监控
      continuous_monitoring:
        enabled: true
        real_time_alerts: true
        audit_logging: true

身份认证（Authentication）

JWT（JSON Web Token）认证

JWT是微服务环境中最常用的认证机制之一。

// JWT认证实现
package auth

import (
    "crypto/rsa"
    "crypto/x509"
    "encoding/pem"
    "errors"
    "fmt"
    "time"
    
    "github.com/golang-jwt/jwt/v5"
)

// JWTManager JWT管理器
type JWTManager struct {
    privateKey *rsa.PrivateKey
    publicKey  *rsa.PublicKey
    issuer     string
    expiration time.Duration
}

// Claims JWT声明
type Claims struct {
    UserID   string   `json:"user_id"`
    Username string   `json:"username"`
    Email    string   `json:"email"`
    Roles    []string `json:"roles"`
    Scopes   []string `json:"scopes"`
    jwt.RegisteredClaims
}

// NewJWTManager 创建JWT管理器
func NewJWTManager(privateKeyPEM, publicKeyPEM []byte, issuer string, expiration time.Duration) (*JWTManager, error) {
    // 解析私钥
    privateBlock, _ := pem.Decode(privateKeyPEM)
    if privateBlock == nil {
        return nil, errors.New("failed to decode private key PEM")
    }
    
    privateKey, err := x509.ParsePKCS1PrivateKey(privateBlock.Bytes)
    if err != nil {
        return nil, fmt.Errorf("failed to parse private key: %w", err)
    }
    
    // 解析公钥
    publicBlock, _ := pem.Decode(publicKeyPEM)
    if publicBlock == nil {
        return nil, errors.New("failed to decode public key PEM")
    }
    
    publicKeyInterface, err := x509.ParsePKIXPublicKey(publicBlock.Bytes)
    if err != nil {
        return nil, fmt.Errorf("failed to parse public key: %w", err)
    }
    
    publicKey, ok := publicKeyInterface.(*rsa.PublicKey)
    if !ok {
        return nil, errors.New("public key is not RSA")
    }
    
    return &JWTManager{
        privateKey: privateKey,
        publicKey:  publicKey,
        issuer:     issuer,
        expiration: expiration,
    }, nil
}

// GenerateToken 生成JWT令牌
func (jm *JWTManager) GenerateToken(userID, username, email string, roles, scopes []string) (string, error) {
    now := time.Now()
    claims := &Claims{
        UserID:   userID,
        Username: username,
        Email:    email,
        Roles:    roles,
        Scopes:   scopes,
        RegisteredClaims: jwt.RegisteredClaims{
            Issuer:    jm.issuer,
            Subject:   userID,
            Audience:  []string{"microservices"},
            ExpiresAt: jwt.NewNumericDate(now.Add(jm.expiration)),
            NotBefore: jwt.NewNumericDate(now),
            IssuedAt:  jwt.NewNumericDate(now),
            ID:        fmt.Sprintf("%s-%d", userID, now.Unix()),
        },
    }
    
    token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
    return token.SignedString(jm.privateKey)
}

// ValidateToken 验证JWT令牌
func (jm *JWTManager) ValidateToken(tokenString string) (*Claims, error) {
    token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
        if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
            return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
        }
        return jm.publicKey, nil
    })
    
    if err != nil {
        return nil, fmt.Errorf("failed to parse token: %w", err)
    }
    
    if !token.Valid {
        return nil, errors.New("invalid token")
    }
    
    claims, ok := token.Claims.(*Claims)
    if !ok {
        return nil, errors.New("invalid token claims")
    }
    
    return claims, nil
}

// RefreshToken 刷新JWT令牌
func (jm *JWTManager) RefreshToken(tokenString string) (string, error) {
    claims, err := jm.ValidateToken(tokenString)
    if err != nil {
        return "", fmt.Errorf("failed to validate token: %w", err)
    }
    
    // 检查令牌是否即将过期（在过期前30分钟内可以刷新）
    if time.Until(claims.ExpiresAt.Time) > 30*time.Minute {
        return "", errors.New("token is not eligible for refresh")
    }
    
    // 生成新令牌
    return jm.GenerateToken(claims.UserID, claims.Username, claims.Email, claims.Roles, claims.Scopes)
}

// TokenBlacklist 令牌黑名单
type TokenBlacklist struct {
    blacklist map[string]time.Time
    mutex     sync.RWMutex
}

func NewTokenBlacklist() *TokenBlacklist {
    return &TokenBlacklist{
        blacklist: make(map[string]time.Time),
    }
}

// AddToBlacklist 添加令牌到黑名单
func (tb *TokenBlacklist) AddToBlacklist(tokenID string, expiration time.Time) {
    tb.mutex.Lock()
    defer tb.mutex.Unlock()
    tb.blacklist[tokenID] = expiration
}

// IsBlacklisted 检查令牌是否在黑名单中
func (tb *TokenBlacklist) IsBlacklisted(tokenID string) bool {
    tb.mutex.RLock()
    defer tb.mutex.RUnlock()
    
    expiration, exists := tb.blacklist[tokenID]
    if !exists {
        return false
    }
    
    // 如果令牌已过期，从黑名单中移除
    if time.Now().After(expiration) {
        delete(tb.blacklist, tokenID)
        return false
    }
    
    return true
}

// CleanupExpired 清理过期的黑名单条目
func (tb *TokenBlacklist) CleanupExpired() {
    tb.mutex.Lock()
    defer tb.mutex.Unlock()
    
    now := time.Now()
    for tokenID, expiration := range tb.blacklist {
        if now.After(expiration) {
            delete(tb.blacklist, tokenID)
        }
    }
}

OAuth 2.0 和 OpenID Connect

OAuth 2.0 提供授权框架，OpenID Connect 在其基础上添加了身份认证层。

// OAuth 2.0 客户端实现
package oauth

import (
    "context"
    "crypto/rand"
    "encoding/base64"
    "encoding/json"
    "fmt"
    "net/http"
    "net/url"
    "strings"
    "time"
)

// OAuthConfig OAuth配置
type OAuthConfig struct {
    ClientID     string
    ClientSecret string
    RedirectURI  string
    AuthURL      string
    TokenURL     string
    UserInfoURL  string
    Scopes       []string
}

// OAuthClient OAuth客户端
type OAuthClient struct {
    config     OAuthConfig
    httpClient *http.Client
}

// TokenResponse 令牌响应
type TokenResponse struct {
    AccessToken  string `json:"access_token"`
    TokenType    string `json:"token_type"`
    ExpiresIn    int    `json:"expires_in"`
    RefreshToken string `json:"refresh_token"`
    Scope        string `json:"scope"`
    IDToken      string `json:"id_token,omitempty"`
}

// UserInfo 用户信息
type UserInfo struct {
    Sub           string `json:"sub"`
    Name          string `json:"name"`
    Email         string `json:"email"`
    EmailVerified bool   `json:"email_verified"`
    Picture       string `json:"picture"`
    Locale        string `json:"locale"`
}

func NewOAuthClient(config OAuthConfig) *OAuthClient {
    return &OAuthClient{
        config: config,
        httpClient: &http.Client{
            Timeout: 30 * time.Second,
        },
    }
}

// GetAuthURL 获取授权URL
func (oc *OAuthClient) GetAuthURL(state string) string {
    params := url.Values{}
    params.Add("client_id", oc.config.ClientID)
    params.Add("redirect_uri", oc.config.RedirectURI)
    params.Add("response_type", "code")
    params.Add("scope", strings.Join(oc.config.Scopes, " "))
    params.Add("state", state)
    
    return fmt.Sprintf("%s?%s", oc.config.AuthURL, params.Encode())
}

// ExchangeCodeForToken 用授权码换取令牌
func (oc *OAuthClient) ExchangeCodeForToken(ctx context.Context, code string) (*TokenResponse, error) {
    data := url.Values{}
    data.Set("grant_type", "authorization_code")
    data.Set("client_id", oc.config.ClientID)
    data.Set("client_secret", oc.config.ClientSecret)
    data.Set("redirect_uri", oc.config.RedirectURI)
    data.Set("code", code)
    
    req, err := http.NewRequestWithContext(ctx, "POST", oc.config.TokenURL, strings.NewReader(data.Encode()))
    if err != nil {
        return nil, fmt.Errorf("failed to create request: %w", err)
    }
    
    req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
    req.Header.Set("Accept", "application/json")
    
    resp, err := oc.httpClient.Do(req)
    if err != nil {
        return nil, fmt.Errorf("failed to exchange code: %w", err)
    }
    defer resp.Body.Close()
    
    if resp.StatusCode != http.StatusOK {
        return nil, fmt.Errorf("token exchange failed with status: %d", resp.StatusCode)
    }
    
    var tokenResp TokenResponse
    if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
        return nil, fmt.Errorf("failed to decode token response: %w", err)
    }
    
    return &tokenResp, nil
}

// GetUserInfo 获取用户信息
func (oc *OAuthClient) GetUserInfo(ctx context.Context, accessToken string) (*UserInfo, error) {
    req, err := http.NewRequestWithContext(ctx, "GET", oc.config.UserInfoURL, nil)
    if err != nil {
        return nil, fmt.Errorf("failed to create request: %w", err)
    }
    
    req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))
    req.Header.Set("Accept", "application/json")
    
    resp, err := oc.httpClient.Do(req)
    if err != nil {
        return nil, fmt.Errorf("failed to get user info: %w", err)
    }
    defer resp.Body.Close()
    
    if resp.StatusCode != http.StatusOK {
        return nil, fmt.Errorf("user info request failed with status: %d", resp.StatusCode)
    }
    
    var userInfo UserInfo
    if err := json.NewDecoder(resp.Body).Decode(&userInfo); err != nil {
        return nil, fmt.Errorf("failed to decode user info: %w", err)
    }
    
    return &userInfo, nil
}

// RefreshAccessToken 刷新访问令牌
func (oc *OAuthClient) RefreshAccessToken(ctx context.Context, refreshToken string) (*TokenResponse, error) {
    data := url.Values{}
    data.Set("grant_type", "refresh_token")
    data.Set("client_id", oc.config.ClientID)
    data.Set("client_secret", oc.config.ClientSecret)
    data.Set("refresh_token", refreshToken)
    
    req, err := http.NewRequestWithContext(ctx, "POST", oc.config.TokenURL, strings.NewReader(data.Encode()))
    if err != nil {
        return nil, fmt.Errorf("failed to create request: %w", err)
    }
    
    req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
    req.Header.Set("Accept", "application/json")
    
    resp, err := oc.httpClient.Do(req)
    if err != nil {
        return nil, fmt.Errorf("failed to refresh token: %w", err)
    }
    defer resp.Body.Close()
    
    if resp.StatusCode != http.StatusOK {
        return nil, fmt.Errorf("token refresh failed with status: %d", resp.StatusCode)
    }
    
    var tokenResp TokenResponse
    if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
        return nil, fmt.Errorf("failed to decode token response: %w", err)
    }
    
    return &tokenResp, nil
}

// GenerateState 生成状态参数
func GenerateState() (string, error) {
    b := make([]byte, 32)
    _, err := rand.Read(b)
    if err != nil {
        return "", err
    }
    return base64.URLEncoding.EncodeToString(b), nil
}

多因素认证（MFA）

// 多因素认证实现
package mfa

import (
    "crypto/hmac"
    "crypto/rand"
    "crypto/sha1"
    "encoding/base32"
    "encoding/binary"
    "fmt"
    "math"
    "strings"
    "time"
)

// TOTPConfig TOTP配置
type TOTPConfig struct {
    Issuer      string
    AccountName string
    Secret      string
    Period      int
    Digits      int
    Algorithm   string
}

// MFAManager 多因素认证管理器
type MFAManager struct {
    config TOTPConfig
}

func NewMFAManager(issuer, accountName string) (*MFAManager, error) {
    secret, err := generateSecret()
    if err != nil {
        return nil, fmt.Errorf("failed to generate secret: %w", err)
    }
    
    return &MFAManager{
        config: TOTPConfig{
            Issuer:      issuer,
            AccountName: accountName,
            Secret:      secret,
            Period:      30,
            Digits:      6,
            Algorithm:   "SHA1",
        },
    }, nil
}

// GenerateSecret 生成密钥
func generateSecret() (string, error) {
    secret := make([]byte, 20)
    _, err := rand.Read(secret)
    if err != nil {
        return "", err
    }
    return base32.StdEncoding.EncodeToString(secret), nil
}

// GetQRCodeURL 获取二维码URL
func (mfa *MFAManager) GetQRCodeURL() string {
    return fmt.Sprintf(
        "otpauth://totp/%s:%s?secret=%s&issuer=%s&algorithm=%s&digits=%d&period=%d",
        mfa.config.Issuer,
        mfa.config.AccountName,
        mfa.config.Secret,
        mfa.config.Issuer,
        mfa.config.Algorithm,
        mfa.config.Digits,
        mfa.config.Period,
    )
}

// GenerateTOTP 生成TOTP码
func (mfa *MFAManager) GenerateTOTP(timestamp time.Time) (string, error) {
    return mfa.generateTOTPAtTime(timestamp)
}

// ValidateTOTP 验证TOTP码
func (mfa *MFAManager) ValidateTOTP(token string) bool {
    return mfa.ValidateTOTPWithSkew(token, 1)
}

// ValidateTOTPWithSkew 带时间偏移的TOTP验证
func (mfa *MFAManager) ValidateTOTPWithSkew(token string, skew int) bool {
    now := time.Now()
    
    for i := -skew; i <= skew; i++ {
        testTime := now.Add(time.Duration(i) * time.Duration(mfa.config.Period) * time.Second)
        expectedToken, err := mfa.generateTOTPAtTime(testTime)
        if err != nil {
            continue
        }
        
        if token == expectedToken {
            return true
        }
    }
    
    return false
}

func (mfa *MFAManager) generateTOTPAtTime(timestamp time.Time) (string, error) {
    secret, err := base32.StdEncoding.DecodeString(strings.ToUpper(mfa.config.Secret))
    if err != nil {
        return "", fmt.Errorf("failed to decode secret: %w", err)
    }
    
    counter := uint64(timestamp.Unix()) / uint64(mfa.config.Period)
    
    // 将计数器转换为8字节大端序
    buf := make([]byte, 8)
    binary.BigEndian.PutUint64(buf, counter)
    
    // 计算HMAC-SHA1
    h := hmac.New(sha1.New, secret)
    h.Write(buf)
    hash := h.Sum(nil)
    
    // 动态截取
    offset := hash[len(hash)-1] & 0x0F
    truncated := binary.BigEndian.Uint32(hash[offset:offset+4]) & 0x7FFFFFFF
    
    // 生成指定位数的代码
    code := truncated % uint32(math.Pow10(mfa.config.Digits))
    
    return fmt.Sprintf("%0*d", mfa.config.Digits, code), nil
}

// BackupCodes 备用代码管理
type BackupCodes struct {
    codes map[string]bool
}

func NewBackupCodes() *BackupCodes {
    return &BackupCodes{
        codes: make(map[string]bool),
    }
}

// GenerateBackupCodes 生成备用代码
func (bc *BackupCodes) GenerateBackupCodes(count int) ([]string, error) {
    codes := make([]string, count)
    
    for i := 0; i < count; i++ {
        code, err := generateBackupCode()
        if err != nil {
            return nil, fmt.Errorf("failed to generate backup code: %w", err)
        }
        codes[i] = code
        bc.codes[code] = false // false表示未使用
    }
    
    return codes, nil
}

// UseBackupCode 使用备用代码
func (bc *BackupCodes) UseBackupCode(code string) bool {
    used, exists := bc.codes[code]
    if !exists || used {
        return false
    }
    
    bc.codes[code] = true // 标记为已使用
    return true
}

func generateBackupCode() (string, error) {
    const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
    const length = 8
    
    b := make([]byte, length)
    _, err := rand.Read(b)
    if err != nil {
        return "", err
    }
    
    for i := range b {
        b[i] = charset[b[i]%byte(len(charset))]
    }
    
    return string(b), nil
}

授权机制（Authorization）

基于角色的访问控制（RBAC）

// RBAC实现
package rbac

import (
    "context"
    "fmt"
    "strings"
    "sync"
)

// Permission 权限
type Permission struct {
    Resource string `json:"resource"`
    Action   string `json:"action"`
}

func (p Permission) String() string {
    return fmt.Sprintf("%s:%s", p.Resource, p.Action)
}

// Role 角色
type Role struct {
    Name        string       `json:"name"`
    Description string       `json:"description"`
    Permissions []Permission `json:"permissions"`
}

// User 用户
type User struct {
    ID       string   `json:"id"`
    Username string   `json:"username"`
    Email    string   `json:"email"`
    Roles    []string `json:"roles"`
}

// RBACManager RBAC管理器
type RBACManager struct {
    roles map[string]*Role
    users map[string]*User
    mutex sync.RWMutex
}

func NewRBACManager() *RBACManager {
    return &RBACManager{
        roles: make(map[string]*Role),
        users: make(map[string]*User),
    }
}

// CreateRole 创建角色
func (rbac *RBACManager) CreateRole(name, description string, permissions []Permission) error {
    rbac.mutex.Lock()
    defer rbac.mutex.Unlock()
    
    if _, exists := rbac.roles[name]; exists {
        return fmt.Errorf("role %s already exists", name)
    }
    
    rbac.roles[name] = &Role{
        Name:        name,
        Description: description,
        Permissions: permissions,
    }
    
    return nil
}

// AssignRoleToUser 为用户分配角色
func (rbac *RBACManager) AssignRoleToUser(userID, roleName string) error {
    rbac.mutex.Lock()
    defer rbac.mutex.Unlock()
    
    user, exists := rbac.users[userID]
    if !exists {
        return fmt.Errorf("user %s not found", userID)
    }
    
    if _, exists := rbac.roles[roleName]; !exists {
        return fmt.Errorf("role %s not found", roleName)
    }
    
    // 检查用户是否已有该角色
    for _, role := range user.Roles {
        if role == roleName {
            return nil // 已有该角色
        }
    }
    
    user.Roles = append(user.Roles, roleName)
    return nil
}

// CheckPermission 检查权限
func (rbac *RBACManager) CheckPermission(userID string, permission Permission) bool {
    rbac.mutex.RLock()
    defer rbac.mutex.RUnlock()
    
    user, exists := rbac.users[userID]
    if !exists {
        return false
    }
    
    // 检查用户的所有角色
    for _, roleName := range user.Roles {
        role, exists := rbac.roles[roleName]
        if !exists {
            continue
        }
        
        // 检查角色的权限
        for _, perm := range role.Permissions {
            if perm.Resource == permission.Resource && perm.Action == permission.Action {
                return true
            }
            
            // 支持通配符权限
            if perm.Resource == "*" || perm.Action == "*" {
                return true
            }
        }
    }
    
    return false
}

// GetUserPermissions 获取用户所有权限
func (rbac *RBACManager) GetUserPermissions(userID string) []Permission {
    rbac.mutex.RLock()
    defer rbac.mutex.RUnlock()
    
    user, exists := rbac.users[userID]
    if !exists {
        return nil
    }
    
    permissionSet := make(map[string]Permission)
    
    for _, roleName := range user.Roles {
        role, exists := rbac.roles[roleName]
        if !exists {
            continue
        }
        
        for _, perm := range role.Permissions {
            permissionSet[perm.String()] = perm
        }
    }
    
    permissions := make([]Permission, 0, len(permissionSet))
    for _, perm := range permissionSet {
        permissions = append(permissions, perm)
    }
    
    return permissions
}

// CreateUser 创建用户
func (rbac *RBACManager) CreateUser(id, username, email string) error {
    rbac.mutex.Lock()
    defer rbac.mutex.Unlock()
    
    if _, exists := rbac.users[id]; exists {
        return fmt.Errorf("user %s already exists", id)
    }
    
    rbac.users[id] = &User{
        ID:       id,
        Username: username,
        Email:    email,
        Roles:    []string{},
    }
    
    return nil
}

// AuthorizationMiddleware 授权中间件
type AuthorizationMiddleware struct {
    rbacManager *RBACManager
}

func NewAuthorizationMiddleware(rbacManager *RBACManager) *AuthorizationMiddleware {
    return &AuthorizationMiddleware{
        rbacManager: rbacManager,
    }
}

// RequirePermission 要求特定权限的中间件
func (am *AuthorizationMiddleware) RequirePermission(resource, action string) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            // 从请求上下文中获取用户ID
            userID := getUserIDFromContext(r.Context())
            if userID == "" {
                http.Error(w, "Unauthorized", http.StatusUnauthorized)
                return
            }
            
            permission := Permission{
                Resource: resource,
                Action:   action,
            }
            
            if !am.rbacManager.CheckPermission(userID, permission) {
                http.Error(w, "Forbidden", http.StatusForbidden)
                return
            }
            
            next.ServeHTTP(w, r)
        })
    }
}

// RequireRole 要求特定角色的中间件
func (am *AuthorizationMiddleware) RequireRole(roleName string) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            userID := getUserIDFromContext(r.Context())
            if userID == "" {
                http.Error(w, "Unauthorized", http.StatusUnauthorized)
                return
            }
            
            user, exists := am.rbacManager.users[userID]
            if !exists {
                http.Error(w, "User not found", http.StatusUnauthorized)
                return
            }
            
            hasRole := false
            for _, role := range user.Roles {
                if role == roleName {
                    hasRole = true
                    break
                }
            }
            
            if !hasRole {
                http.Error(w, "Insufficient privileges", http.StatusForbidden)
                return
            }
            
            next.ServeHTTP(w, r)
        })
    }
}

// 从上下文中获取用户ID的辅助函数
func getUserIDFromContext(ctx context.Context) string {
    if userID, ok := ctx.Value("user_id").(string); ok {
        return userID
    }
    return ""
}

属性基于访问控制（ABAC）

ABAC提供了比RBAC更灵活的访问控制机制。

// ABAC实现
package abac

import (
    "context"
    "encoding/json"
    "fmt"
    "reflect"
    "strconv"
    "strings"
    "time"
)

// Attribute 属性
type Attribute struct {
    Name  string      `json:"name"`
    Value interface{} `json:"value"`
    Type  string      `json:"type"`
}

// Subject 主体（用户）
type Subject struct {
    ID         string      `json:"id"`
    Attributes []Attribute `json:"attributes"`
}

// Resource 资源
type Resource struct {
    ID         string      `json:"id"`
    Type       string      `json:"type"`
    Attributes []Attribute `json:"attributes"`
}

// Action 动作
type Action struct {
    Name       string      `json:"name"`
    Attributes []Attribute `json:"attributes"`
}

// Environment 环境
type Environment struct {
    Attributes []Attribute `json:"attributes"`
}

// PolicyRule 策略规则
type PolicyRule struct {
    ID          string `json:"id"`
    Name        string `json:"name"`
    Description string `json:"description"`
    Target      Target `json:"target"`
    Condition   string `json:"condition"`
    Effect      string `json:"effect"` // "permit" or "deny"
    Priority    int    `json:"priority"`
}

// Target 目标
type Target struct {
    Subjects    []AttributeMatch `json:"subjects"`
    Resources   []AttributeMatch `json:"resources"`
    Actions     []AttributeMatch `json:"actions"`
    Environment []AttributeMatch `json:"environment"`
}

// AttributeMatch 属性匹配
type AttributeMatch struct {
    Name     string      `json:"name"`
    Operator string      `json:"operator"` // "eq", "ne", "gt", "lt", "gte", "lte", "in", "contains"
    Value    interface{} `json:"value"`
}

// PolicyDecision 策略决策
type PolicyDecision struct {
    Decision string   `json:"decision"` // "permit", "deny", "indeterminate"
    Reasons  []string `json:"reasons"`
}

// ABACEngine ABAC引擎
type ABACEngine struct {
    policies []PolicyRule
}

func NewABACEngine() *ABACEngine {
    return &ABACEngine{
        policies: make([]PolicyRule, 0),
    }
}

// AddPolicy 添加策略
func (engine *ABACEngine) AddPolicy(policy PolicyRule) {
    engine.policies = append(engine.policies, policy)
    
    // 按优先级排序
    for i := len(engine.policies) - 1; i > 0; i-- {
        if engine.policies[i].Priority > engine.policies[i-1].Priority {
            engine.policies[i], engine.policies[i-1] = engine.policies[i-1], engine.policies[i]
        } else {
            break
        }
    }
}

// Evaluate 评估访问请求
func (engine *ABACEngine) Evaluate(ctx context.Context, subject Subject, resource Resource, action Action, environment Environment) PolicyDecision {
    var reasons []string
    
    for _, policy := range engine.policies {
        if engine.matchesTarget(policy.Target, subject, resource, action, environment) {
            if engine.evaluateCondition(policy.Condition, subject, resource, action, environment) {
                decision := policy.Effect
                reason := fmt.Sprintf("Policy %s (%s) applied", policy.Name, policy.ID)
                reasons = append(reasons, reason)
                
                return PolicyDecision{
                    Decision: decision,
                    Reasons:  reasons,
                }
            }
        }
    }
    
    // 默认拒绝
    return PolicyDecision{
        Decision: "deny",
        Reasons:  []string{"No applicable policy found, default deny"},
    }
}

// matchesTarget 检查是否匹配目标
func (engine *ABACEngine) matchesTarget(target Target, subject Subject, resource Resource, action Action, environment Environment) bool {
    // 检查主体匹配
    if len(target.Subjects) > 0 {
        if !engine.matchesAttributes(target.Subjects, subject.Attributes) {
            return false
        }
    }
    
    // 检查资源匹配
    if len(target.Resources) > 0 {
        resourceAttrs := append(resource.Attributes, Attribute{Name: "type", Value: resource.Type, Type: "string"})
        if !engine.matchesAttributes(target.Resources, resourceAttrs) {
            return false
        }
    }
    
    // 检查动作匹配
    if len(target.Actions) > 0 {
        actionAttrs := append(action.Attributes, Attribute{Name: "name", Value: action.Name, Type: "string"})
        if !engine.matchesAttributes(target.Actions, actionAttrs) {
            return false
        }
    }
    
    // 检查环境匹配
    if len(target.Environment) > 0 {
        if !engine.matchesAttributes(target.Environment, environment.Attributes) {
            return false
        }
    }
    
    return true
}

// matchesAttributes 检查属性匹配
func (engine *ABACEngine) matchesAttributes(matches []AttributeMatch, attributes []Attribute) bool {
    for _, match := range matches {
        found := false
        for _, attr := range attributes {
            if attr.Name == match.Name {
                if engine.evaluateAttributeMatch(match, attr) {
                    found = true
                    break
                }
            }
        }
        if !found {
            return false
        }
    }
    return true
}

// evaluateAttributeMatch 评估属性匹配
func (engine *ABACEngine) evaluateAttributeMatch(match AttributeMatch, attr Attribute) bool {
    switch match.Operator {
    case "eq":
        return reflect.DeepEqual(attr.Value, match.Value)
    case "ne":
        return !reflect.DeepEqual(attr.Value, match.Value)
    case "gt":
        return engine.compareValues(attr.Value, match.Value) > 0
    case "lt":
        return engine.compareValues(attr.Value, match.Value) < 0
    case "gte":
        return engine.compareValues(attr.Value, match.Value) >= 0
    case "lte":
        return engine.compareValues(attr.Value, match.Value) <= 0
    case "in":
        if values, ok := match.Value.([]interface{}); ok {
            for _, v := range values {
                if reflect.DeepEqual(attr.Value, v) {
                    return true
                }
            }
        }
        return false
    case "contains":
        attrStr := fmt.Sprintf("%v", attr.Value)
        matchStr := fmt.Sprintf("%v", match.Value)
        return strings.Contains(attrStr, matchStr)
    default:
        return false
    }
}

// compareValues 比较值
func (engine *ABACEngine) compareValues(a, b interface{}) int {
    // 简化的比较实现，实际应用中需要更完善的类型处理
    aStr := fmt.Sprintf("%v", a)
    bStr := fmt.Sprintf("%v", b)
    
    // 尝试数值比较
    if aNum, err := strconv.ParseFloat(aStr, 64); err == nil {
        if bNum, err := strconv.ParseFloat(bStr, 64); err == nil {
            if aNum > bNum {
                return 1
            } else if aNum < bNum {
                return -1
            }
            return 0
        }
    }
    
    // 字符串比较
    if aStr > bStr {
        return 1
    } else if aStr < bStr {
        return -1
    }
    return 0
}

// evaluateCondition 评估条件（简化实现）
func (engine *ABACEngine) evaluateCondition(condition string, subject Subject, resource Resource, action Action, environment Environment) bool {
    if condition == "" {
        return true
    }
    
    // 这里应该实现一个完整的表达式解析器
    // 为了简化，我们只处理一些基本的条件
    
    // 示例："time.hour >= 9 AND time.hour <= 17"
    if strings.Contains(condition, "time.hour") {
        currentHour := time.Now().Hour()
        
        if strings.Contains(condition, ">= 9 AND") && strings.Contains(condition, "<= 17") {
            return currentHour >= 9 && currentHour <= 17
        }
    }
    
    // 示例："subject.department == resource.department"
    if condition == "subject.department == resource.department" {
        subjectDept := engine.getAttributeValue(subject.Attributes, "department")
        resourceDept := engine.getAttributeValue(resource.Attributes, "department")
        return reflect.DeepEqual(subjectDept, resourceDept)
    }
    
    return true
}

// getAttributeValue 获取属性值
func (engine *ABACEngine) getAttributeValue(attributes []Attribute, name string) interface{} {
    for _, attr := range attributes {
        if attr.Name == name {
            return attr.Value
        }
    }
    return nil
}

// ABACMiddleware ABAC中间件
type ABACMiddleware struct {
    engine *ABACEngine
}

func NewABACMiddleware(engine *ABACEngine) *ABACMiddleware {
    return &ABACMiddleware{
        engine: engine,
    }
}

// Authorize 授权中间件
func (middleware *ABACMiddleware) Authorize(resourceType, actionName string) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            // 构建主体
            subject := Subject{
                ID: getUserIDFromContext(r.Context()),
                Attributes: []Attribute{
                    {Name: "role", Value: "user", Type: "string"},
                    {Name: "department", Value: "engineering", Type: "string"},
                },
            }
            
            // 构建资源
            resource := Resource{
                ID:   r.URL.Path,
                Type: resourceType,
                Attributes: []Attribute{
                    {Name: "path", Value: r.URL.Path, Type: "string"},
                    {Name: "method", Value: r.Method, Type: "string"},
                },
            }
            
            // 构建动作
            action := Action{
                Name: actionName,
                Attributes: []Attribute{
                    {Name: "method", Value: r.Method, Type: "string"},
                },
            }
            
            // 构建环境
            environment := Environment{
                Attributes: []Attribute{
                    {Name: "time", Value: time.Now(), Type: "datetime"},
                    {Name: "ip", Value: r.RemoteAddr, Type: "string"},
                },
            }
            
            // 评估访问请求
            decision := middleware.engine.Evaluate(r.Context(), subject, resource, action, environment)
            
            if decision.Decision != "permit" {
                w.Header().Set("Content-Type", "application/json")
                w.WriteHeader(http.StatusForbidden)
                json.NewEncoder(w).Encode(map[string]interface{}{
                    "error":   "Access denied",
                    "reasons": decision.Reasons,
                })
                return
            }
            
            next.ServeHTTP(w, r)
        })
    }
}

// 使用示例
func ExampleABAC() {
    engine := NewABACEngine()
    
    // 添加策略：工作时间内允许访问
    policy1 := PolicyRule{
        ID:          "policy-1",
        Name:        "Business Hours Access",
        Description: "Allow access during business hours",
        Target: Target{
            Actions: []AttributeMatch{
                {Name: "name", Operator: "eq", Value: "read"},
            },
        },
        Condition: "time.hour >= 9 AND time.hour <= 17",
        Effect:    "permit",
        Priority:  1,
    }
    
    // 添加策略：管理员总是允许
    policy2 := PolicyRule{
        ID:          "policy-2",
        Name:        "Admin Access",
        Description: "Allow admin access anytime",
        Target: Target{
            Subjects: []AttributeMatch{
                {Name: "role", Operator: "eq", Value: "admin"},
            },
        },
        Condition: "",
        Effect:    "permit",
        Priority:  2,
    }
    
    engine.AddPolicy(policy1)
    engine.AddPolicy(policy2)
    
    // 创建中间件
    middleware := NewABACMiddleware(engine)
    
    // 在HTTP路由中使用
    // http.Handle("/api/data", middleware.Authorize("data", "read")(dataHandler))
}

API安全

API网关安全

# API网关安全配置
apiVersion: v1
kind: ConfigMap
metadata:
  name: api-gateway-security
  namespace: microservices
data:
  security.yaml: |
    security:
      # 速率限制
      rate_limiting:
        enabled: true
        global_limit: 1000  # 每秒请求数
        per_user_limit: 100
        burst_size: 50
        
      # CORS配置
      cors:
        enabled: true
        allowed_origins:
          - "https://app.example.com"
          - "https://admin.example.com"
        allowed_methods:
          - GET
          - POST
          - PUT
          - DELETE
          - OPTIONS
        allowed_headers:
          - Authorization
          - Content-Type
          - X-Requested-With
        max_age: 86400
        
      # 请求验证
      request_validation:
        enabled: true
        max_body_size: 1048576  # 1MB
        content_type_validation: true
        schema_validation: true
        
      # 响应安全头
      security_headers:
        enabled: true
        headers:
          X-Content-Type-Options: "nosniff"
          X-Frame-Options: "DENY"
          X-XSS-Protection: "1; mode=block"
          Strict-Transport-Security: "max-age=31536000; includeSubDomains"
          Content-Security-Policy: "default-src 'self'"
          
      # IP白名单/黑名单
      ip_filtering:
        enabled: true
        whitelist:
          - "10.0.0.0/8"
          - "172.16.0.0/12"
          - "192.168.0.0/16"
        blacklist:
          - "192.168.1.100"
          
      # API密钥管理
      api_keys:
        enabled: true
        header_name: "X-API-Key"
        query_param: "api_key"
        validation_endpoint: "http://auth-service:8080/validate-key"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-gateway
  namespace: microservices
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api-gateway
  template:
    metadata:
      labels:
        app: api-gateway
    spec:
      containers:
      - name: gateway
        image: nginx:1.21-alpine
        ports:
        - containerPort: 80
        - containerPort: 443
        volumeMounts:
        - name: config
          mountPath: /etc/nginx/conf.d
        - name: security-config
          mountPath: /etc/security
        env:
        - name: RATE_LIMIT_ENABLED
          value: "true"
        - name: AUTH_SERVICE_URL
          value: "http://auth-service:8080"
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "200m"
      volumes:
      - name: config
        configMap:
          name: nginx-config
      - name: security-config
        configMap:
          name: api-gateway-security

API安全中间件

// API安全中间件实现
package apisecurity

import (
    "context"
    "crypto/subtle"
    "encoding/json"
    "fmt"
    "net"
    "net/http"
    "strconv"
    "strings"
    "sync"
    "time"
    
    "golang.org/x/time/rate"
)

// SecurityConfig 安全配置
type SecurityConfig struct {
    RateLimiting     RateLimitConfig     `json:"rate_limiting"`
    CORS             CORSConfig          `json:"cors"`
    RequestValidation RequestValidationConfig `json:"request_validation"`
    SecurityHeaders  SecurityHeadersConfig   `json:"security_headers"`
    IPFiltering      IPFilteringConfig       `json:"ip_filtering"`
    APIKeys          APIKeysConfig           `json:"api_keys"`
}

// RateLimitConfig 速率限制配置
type RateLimitConfig struct {
    Enabled       bool `json:"enabled"`
    GlobalLimit   int  `json:"global_limit"`
    PerUserLimit  int  `json:"per_user_limit"`
    BurstSize     int  `json:"burst_size"`
}

// CORSConfig CORS配置
type CORSConfig struct {
    Enabled        bool     `json:"enabled"`
    AllowedOrigins []string `json:"allowed_origins"`
    AllowedMethods []string `json:"allowed_methods"`
    AllowedHeaders []string `json:"allowed_headers"`
    MaxAge         int      `json:"max_age"`
}

// RequestValidationConfig 请求验证配置
type RequestValidationConfig struct {
    Enabled               bool `json:"enabled"`
    MaxBodySize          int  `json:"max_body_size"`
    ContentTypeValidation bool `json:"content_type_validation"`
    SchemaValidation     bool `json:"schema_validation"`
}

// SecurityHeadersConfig 安全头配置
type SecurityHeadersConfig struct {
    Enabled bool              `json:"enabled"`
    Headers map[string]string `json:"headers"`
}

// IPFilteringConfig IP过滤配置
type IPFilteringConfig struct {
    Enabled   bool     `json:"enabled"`
    Whitelist []string `json:"whitelist"`
    Blacklist []string `json:"blacklist"`
}

// APIKeysConfig API密钥配置
type APIKeysConfig struct {
    Enabled            bool   `json:"enabled"`
    HeaderName         string `json:"header_name"`
    QueryParam         string `json:"query_param"`
    ValidationEndpoint string `json:"validation_endpoint"`
}

// SecurityMiddleware 安全中间件
type SecurityMiddleware struct {
    config      SecurityConfig
    rateLimiter *RateLimiter
    ipChecker   *IPChecker
    apiKeyValidator *APIKeyValidator
}

func NewSecurityMiddleware(config SecurityConfig) *SecurityMiddleware {
    return &SecurityMiddleware{
        config:          config,
        rateLimiter:     NewRateLimiter(config.RateLimiting),
        ipChecker:       NewIPChecker(config.IPFiltering),
        apiKeyValidator: NewAPIKeyValidator(config.APIKeys),
    }
}

// Apply 应用安全中间件
func (sm *SecurityMiddleware) Apply(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        // IP过滤
        if sm.config.IPFiltering.Enabled {
            if !sm.ipChecker.IsAllowed(r.RemoteAddr) {
                http.Error(w, "IP not allowed", http.StatusForbidden)
                return
            }
        }
        
        // CORS处理
        if sm.config.CORS.Enabled {
            sm.handleCORS(w, r)
            if r.Method == "OPTIONS" {
                return
            }
        }
        
        // 速率限制
        if sm.config.RateLimiting.Enabled {
            if !sm.rateLimiter.Allow(r) {
                http.Error(w, "Rate limit exceeded", http.StatusTooManyRequests)
                return
            }
        }
        
        // API密钥验证
        if sm.config.APIKeys.Enabled {
            if !sm.apiKeyValidator.Validate(r) {
                http.Error(w, "Invalid API key", http.StatusUnauthorized)
                return
            }
        }
        
        // 请求验证
        if sm.config.RequestValidation.Enabled {
            if !sm.validateRequest(r) {
                http.Error(w, "Invalid request", http.StatusBadRequest)
                return
            }
        }
        
        // 设置安全头
        if sm.config.SecurityHeaders.Enabled {
            sm.setSecurityHeaders(w)
        }
        
        next.ServeHTTP(w, r)
    })
}

// RateLimiter 速率限制器
type RateLimiter struct {
    config      RateLimitConfig
    globalLimiter *rate.Limiter
    userLimiters  map[string]*rate.Limiter
    mutex         sync.RWMutex
}

func NewRateLimiter(config RateLimitConfig) *RateLimiter {
    return &RateLimiter{
        config:        config,
        globalLimiter: rate.NewLimiter(rate.Limit(config.GlobalLimit), config.BurstSize),
        userLimiters:  make(map[string]*rate.Limiter),
    }
}

func (rl *RateLimiter) Allow(r *http.Request) bool {
    // 全局速率限制
    if !rl.globalLimiter.Allow() {
        return false
    }
    
    // 用户级速率限制
    userID := getUserIDFromRequest(r)
    if userID != "" {
        rl.mutex.RLock()
        userLimiter, exists := rl.userLimiters[userID]
        rl.mutex.RUnlock()
        
        if !exists {
            rl.mutex.Lock()
            userLimiter = rate.NewLimiter(rate.Limit(rl.config.PerUserLimit), rl.config.BurstSize)
            rl.userLimiters[userID] = userLimiter
            rl.mutex.Unlock()
        }
        
        return userLimiter.Allow()
    }
    
    return true
}

// IPChecker IP检查器
type IPChecker struct {
    config    IPFilteringConfig
    whitelist []*net.IPNet
    blacklist []*net.IPNet
}

func NewIPChecker(config IPFilteringConfig) *IPChecker {
    checker := &IPChecker{
        config: config,
    }
    
    // 解析白名单
    for _, cidr := range config.Whitelist {
        _, ipnet, err := net.ParseCIDR(cidr)
        if err == nil {
            checker.whitelist = append(checker.whitelist, ipnet)
        }
    }
    
    // 解析黑名单
    for _, cidr := range config.Blacklist {
        _, ipnet, err := net.ParseCIDR(cidr)
        if err == nil {
            checker.blacklist = append(checker.blacklist, ipnet)
        }
    }
    
    return checker
}

func (ic *IPChecker) IsAllowed(remoteAddr string) bool {
    ip, _, err := net.SplitHostPort(remoteAddr)
    if err != nil {
        ip = remoteAddr
    }
    
    clientIP := net.ParseIP(ip)
    if clientIP == nil {
        return false
    }
    
    // 检查黑名单
    for _, blackNet := range ic.blacklist {
        if blackNet.Contains(clientIP) {
            return false
        }
    }
    
    // 如果有白名单，检查白名单
    if len(ic.whitelist) > 0 {
        for _, whiteNet := range ic.whitelist {
            if whiteNet.Contains(clientIP) {
                return true
            }
        }
        return false
    }
    
    return true
}

// APIKeyValidator API密钥验证器
type APIKeyValidator struct {
    config APIKeysConfig
    client *http.Client
}

func NewAPIKeyValidator(config APIKeysConfig) *APIKeyValidator {
    return &APIKeyValidator{
        config: config,
        client: &http.Client{
            Timeout: 5 * time.Second,
        },
    }
}

func (akv *APIKeyValidator) Validate(r *http.Request) bool {
    // 从头部获取API密钥
    apiKey := r.Header.Get(akv.config.HeaderName)
    
    // 如果头部没有，从查询参数获取
    if apiKey == "" {
        apiKey = r.URL.Query().Get(akv.config.QueryParam)
    }
    
    if apiKey == "" {
        return false
    }
    
    // 验证API密钥（这里简化为固定密钥，实际应该调用验证服务）
    validKeys := []string{"valid-api-key-1", "valid-api-key-2"}
    for _, validKey := range validKeys {
        if subtle.ConstantTimeCompare([]byte(apiKey), []byte(validKey)) == 1 {
            return true
        }
    }
    
    return false
}

// 辅助函数
func (sm *SecurityMiddleware) handleCORS(w http.ResponseWriter, r *http.Request) {
    origin := r.Header.Get("Origin")
    
    // 检查允许的源
    allowed := false
    for _, allowedOrigin := range sm.config.CORS.AllowedOrigins {
        if allowedOrigin == "*" || allowedOrigin == origin {
            allowed = true
            break
        }
    }
    
    if allowed {
        w.Header().Set("Access-Control-Allow-Origin", origin)
        w.Header().Set("Access-Control-Allow-Methods", strings.Join(sm.config.CORS.AllowedMethods, ", "))
        w.Header().Set("Access-Control-Allow-Headers", strings.Join(sm.config.CORS.AllowedHeaders, ", "))
        w.Header().Set("Access-Control-Max-Age", strconv.Itoa(sm.config.CORS.MaxAge))
    }
}

func (sm *SecurityMiddleware) validateRequest(r *http.Request) bool {
    // 检查请求体大小
    if r.ContentLength > int64(sm.config.RequestValidation.MaxBodySize) {
        return false
    }
    
    // 检查内容类型
    if sm.config.RequestValidation.ContentTypeValidation {
        contentType := r.Header.Get("Content-Type")
        if r.Method == "POST" || r.Method == "PUT" {
            if !strings.Contains(contentType, "application/json") && 
               !strings.Contains(contentType, "application/x-www-form-urlencoded") {
                return false
            }
        }
    }
    
    return true
}

func (sm *SecurityMiddleware) setSecurityHeaders(w http.ResponseWriter) {
    for name, value := range sm.config.SecurityHeaders.Headers {
        w.Header().Set(name, value)
    }
}

func getUserIDFromRequest(r *http.Request) string {
    // 从JWT令牌或其他认证机制中提取用户ID
    // 这里简化实现
    return r.Header.Get("X-User-ID")
}

传输层安全

TLS/SSL配置

# TLS证书配置
apiVersion: v1
kind: Secret
metadata:
  name: tls-secret
  namespace: microservices
type: kubernetes.io/tls
data:
  tls.crt: LS0tLS1CRUdJTi... # Base64编码的证书
  tls.key: LS0tLS1CRUdJTi... # Base64编码的私钥
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: microservices-ingress
  namespace: microservices
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1.2 TLSv1.3"
    nginx.ingress.kubernetes.io/ssl-ciphers: "ECDHE-RSA-AES128-GCM-SHA256,ECDHE-RSA-AES256-GCM-SHA384"
spec:
  tls:
  - hosts:
    - api.example.com
    secretName: tls-secret
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-gateway
            port:
              number: 80

Go语言TLS服务器实现

// TLS服务器实现
package tlsserver

import (
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "io/ioutil"
    "log"
    "net/http"
    "time"
)

// TLSConfig TLS配置
type TLSConfig struct {
    CertFile     string   `json:"cert_file"`
    KeyFile      string   `json:"key_file"`
    CAFile       string   `json:"ca_file"`
    MinVersion   uint16   `json:"min_version"`
    MaxVersion   uint16   `json:"max_version"`
    CipherSuites []uint16 `json:"cipher_suites"`
    ClientAuth   tls.ClientAuthType `json:"client_auth"`
}

// TLSServer TLS服务器
type TLSServer struct {
    config     TLSConfig
    tlsConfig  *tls.Config
    httpServer *http.Server
}

func NewTLSServer(config TLSConfig, handler http.Handler) (*TLSServer, error) {
    server := &TLSServer{
        config: config,
    }
    
    // 创建TLS配置
    tlsConfig, err := server.createTLSConfig()
    if err != nil {
        return nil, fmt.Errorf("failed to create TLS config: %v", err)
    }
    
    server.tlsConfig = tlsConfig
    server.httpServer = &http.Server{
        Addr:         ":8443",
        Handler:      handler,
        TLSConfig:    tlsConfig,
        ReadTimeout:  15 * time.Second,
        WriteTimeout: 15 * time.Second,
        IdleTimeout:  60 * time.Second,
    }
    
    return server, nil
}

// createTLSConfig 创建TLS配置
func (server *TLSServer) createTLSConfig() (*tls.Config, error) {
    // 加载服务器证书
    cert, err := tls.LoadX509KeyPair(server.config.CertFile, server.config.KeyFile)
    if err != nil {
        return nil, fmt.Errorf("failed to load server certificate: %v", err)
    }
    
    tlsConfig := &tls.Config{
        Certificates: []tls.Certificate{cert},
        MinVersion:   server.config.MinVersion,
        MaxVersion:   server.config.MaxVersion,
        CipherSuites: server.config.CipherSuites,
        ClientAuth:   server.config.ClientAuth,
    }
    
    // 如果需要客户端认证，加载CA证书
    if server.config.ClientAuth != tls.NoClientCert && server.config.CAFile != "" {
        caCert, err := ioutil.ReadFile(server.config.CAFile)
        if err != nil {
            return nil, fmt.Errorf("failed to read CA certificate: %v", err)
        }
        
        caCertPool := x509.NewCertPool()
        if !caCertPool.AppendCertsFromPEM(caCert) {
            return nil, fmt.Errorf("failed to parse CA certificate")
        }
        
        tlsConfig.ClientCAs = caCertPool
    }
    
    return tlsConfig, nil
}

// Start 启动TLS服务器
func (server *TLSServer) Start() error {
    log.Printf("Starting TLS server on %s", server.httpServer.Addr)
    return server.httpServer.ListenAndServeTLS("", "")
}

// Stop 停止TLS服务器
func (server *TLSServer) Stop() error {
    return server.httpServer.Close()
}

// 使用示例
func ExampleTLSServer() {
    // 创建处理器
    mux := http.NewServeMux()
    mux.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
        w.WriteHeader(http.StatusOK)
        w.Write([]byte("OK"))
    })
    
    // TLS配置
    config := TLSConfig{
        CertFile:   "/etc/ssl/certs/server.crt",
        KeyFile:    "/etc/ssl/private/server.key",
        CAFile:     "/etc/ssl/certs/ca.crt",
        MinVersion: tls.VersionTLS12,
        MaxVersion: tls.VersionTLS13,
        CipherSuites: []uint16{
            tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
            tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
            tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
        },
        ClientAuth: tls.RequireAndVerifyClientCert,
    }
    
    // 创建TLS服务器
    server, err := NewTLSServer(config, mux)
    if err != nil {
        log.Fatal(err)
    }
    
    // 启动服务器
    if err := server.Start(); err != nil {
        log.Fatal(err)
    }
}

数据加密

数据加密实现

// 数据加密实现
package encryption

import (
    "crypto/aes"
    "crypto/cipher"
    "crypto/rand"
    "crypto/rsa"
    "crypto/sha256"
    "crypto/x509"
    "encoding/base64"
    "encoding/pem"
    "errors"
    "fmt"
    "io"
)

// EncryptionService 加密服务
type EncryptionService struct {
    aesKey    []byte
    rsaPrivateKey *rsa.PrivateKey
    rsaPublicKey  *rsa.PublicKey
}

func NewEncryptionService(aesKey []byte, rsaPrivateKeyPEM, rsaPublicKeyPEM string) (*EncryptionService, error) {
    service := &EncryptionService{
        aesKey: aesKey,
    }
    
    // 解析RSA私钥
    if rsaPrivateKeyPEM != "" {
        block, _ := pem.Decode([]byte(rsaPrivateKeyPEM))
        if block == nil {
            return nil, errors.New("failed to decode RSA private key")
        }
        
        privateKey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
        if err != nil {
            return nil, fmt.Errorf("failed to parse RSA private key: %v", err)
        }
        
        service.rsaPrivateKey = privateKey
    }
    
    // 解析RSA公钥
    if rsaPublicKeyPEM != "" {
        block, _ := pem.Decode([]byte(rsaPublicKeyPEM))
        if block == nil {
            return nil, errors.New("failed to decode RSA public key")
        }
        
        publicKey, err := x509.ParsePKIXPublicKey(block.Bytes)
        if err != nil {
            return nil, fmt.Errorf("failed to parse RSA public key: %v", err)
        }
        
        rsaPublicKey, ok := publicKey.(*rsa.PublicKey)
        if !ok {
            return nil, errors.New("not an RSA public key")
        }
        
        service.rsaPublicKey = rsaPublicKey
    }
    
    return service, nil
}

// EncryptAES AES加密
func (service *EncryptionService) EncryptAES(plaintext []byte) (string, error) {
    block, err := aes.NewCipher(service.aesKey)
    if err != nil {
        return "", fmt.Errorf("failed to create AES cipher: %v", err)
    }
    
    // 创建GCM模式
    gcm, err := cipher.NewGCM(block)
    if err != nil {
        return "", fmt.Errorf("failed to create GCM: %v", err)
    }
    
    // 生成随机nonce
    nonce := make([]byte, gcm.NonceSize())
    if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
        return "", fmt.Errorf("failed to generate nonce: %v", err)
    }
    
    // 加密
    ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)
    
    return base64.StdEncoding.EncodeToString(ciphertext), nil
}

// DecryptAES AES解密
func (service *EncryptionService) DecryptAES(ciphertextBase64 string) ([]byte, error) {
    ciphertext, err := base64.StdEncoding.DecodeString(ciphertextBase64)
    if err != nil {
        return nil, fmt.Errorf("failed to decode base64: %v", err)
    }
    
    block, err := aes.NewCipher(service.aesKey)
    if err != nil {
        return nil, fmt.Errorf("failed to create AES cipher: %v", err)
    }
    
    gcm, err := cipher.NewGCM(block)
    if err != nil {
        return nil, fmt.Errorf("failed to create GCM: %v", err)
    }
    
    nonceSize := gcm.NonceSize()
    if len(ciphertext) < nonceSize {
        return nil, errors.New("ciphertext too short")
    }
    
    nonce, ciphertext := ciphertext[:nonceSize], ciphertext[nonceSize:]
    
    plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
    if err != nil {
        return nil, fmt.Errorf("failed to decrypt: %v", err)
    }
    
    return plaintext, nil
}

// EncryptRSA RSA加密
func (service *EncryptionService) EncryptRSA(plaintext []byte) (string, error) {
    if service.rsaPublicKey == nil {
        return "", errors.New("RSA public key not available")
    }
    
    ciphertext, err := rsa.EncryptOAEP(sha256.New(), rand.Reader, service.rsaPublicKey, plaintext, nil)
    if err != nil {
        return "", fmt.Errorf("failed to encrypt with RSA: %v", err)
    }
    
    return base64.StdEncoding.EncodeToString(ciphertext), nil
}

// DecryptRSA RSA解密
func (service *EncryptionService) DecryptRSA(ciphertextBase64 string) ([]byte, error) {
    if service.rsaPrivateKey == nil {
        return nil, errors.New("RSA private key not available")
    }
    
    ciphertext, err := base64.StdEncoding.DecodeString(ciphertextBase64)
    if err != nil {
        return nil, fmt.Errorf("failed to decode base64: %v", err)
    }
    
    plaintext, err := rsa.DecryptOAEP(sha256.New(), rand.Reader, service.rsaPrivateKey, ciphertext, nil)
    if err != nil {
        return nil, fmt.Errorf("failed to decrypt with RSA: %v", err)
    }
    
    return plaintext, nil
}

// HashPassword 密码哈希
func (service *EncryptionService) HashPassword(password string) string {
    hash := sha256.Sum256([]byte(password))
    return base64.StdEncoding.EncodeToString(hash[:])
}

// VerifyPassword 验证密码
func (service *EncryptionService) VerifyPassword(password, hashedPassword string) bool {
    return service.HashPassword(password) == hashedPassword
}

// 使用示例
func ExampleEncryption() {
    // AES密钥（32字节用于AES-256）
    aesKey := []byte("12345678901234567890123456789012")
    
    // RSA密钥对（示例）
    rsaPrivateKeyPEM := `-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----`
    
    rsaPublicKeyPEM := `-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----`
    
    // 创建加密服务
    encService, err := NewEncryptionService(aesKey, rsaPrivateKeyPEM, rsaPublicKeyPEM)
    if err != nil {
        log.Fatal(err)
    }
    
    // AES加密示例
    plaintext := []byte("sensitive data")
    encrypted, err := encService.EncryptAES(plaintext)
    if err != nil {
        log.Fatal(err)
    }
    
    decrypted, err := encService.DecryptAES(encrypted)
    if err != nil {
        log.Fatal(err)
    }
    
    fmt.Printf("Original: %s\n", plaintext)
    fmt.Printf("Encrypted: %s\n", encrypted)
    fmt.Printf("Decrypted: %s\n", decrypted)
}

安全审计与监控

审计日志配置

# 审计日志配置
apiVersion: v1
kind: ConfigMap
metadata:
  name: audit-config
  namespace: microservices
data:
  audit-policy.yaml: |
    apiVersion: audit.k8s.io/v1
    kind: Policy
    rules:
    # 记录所有认证失败
    - level: Metadata
      namespaces: ["microservices"]
      verbs: ["create", "update", "patch", "delete"]
      resources:
      - group: ""
        resources: ["secrets", "configmaps"]
    
    # 记录所有API访问
    - level: Request
      namespaces: ["microservices"]
      verbs: ["get", "list", "create", "update", "patch", "delete"]
      resources:
      - group: "apps"
        resources: ["deployments", "services"]
    
    # 记录权限变更
    - level: RequestResponse
      resources:
      - group: "rbac.authorization.k8s.io"
        resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: fluentd-config
  namespace: microservices
data:
  fluent.conf: |
    <source>
      @type tail
      path /var/log/audit.log
      pos_file /var/log/fluentd-audit.log.pos
      tag kubernetes.audit
      format json
      time_key timestamp
      time_format %Y-%m-%dT%H:%M:%S.%NZ
    </source>
    
    <filter kubernetes.audit>
      @type grep
      <regexp>
        key verb
        pattern ^(create|update|delete|patch)$
      </regexp>
    </filter>
    
    <match kubernetes.audit>
      @type elasticsearch
      host elasticsearch.logging.svc.cluster.local
      port 9200
      index_name audit-logs
      type_name _doc
      include_tag_key true
      tag_key @log_name
      flush_interval 1s
    </match>

安全监控实现

// 安全监控实现
package monitoring

import (
    "context"
    "encoding/json"
    "fmt"
    "log"
    "net/http"
    "sync"
    "time"
)

// SecurityEvent 安全事件
type SecurityEvent struct {
    ID          string                 `json:"id"`
    Timestamp   time.Time              `json:"timestamp"`
    Type        string                 `json:"type"`
    Severity    string                 `json:"severity"`
    Source      string                 `json:"source"`
    UserID      string                 `json:"user_id"`
    IP          string                 `json:"ip"`
    UserAgent   string                 `json:"user_agent"`
    Resource    string                 `json:"resource"`
    Action      string                 `json:"action"`
    Result      string                 `json:"result"`
    Message     string                 `json:"message"`
    Metadata    map[string]interface{} `json:"metadata"`
}

// SecurityMonitor 安全监控器
type SecurityMonitor struct {
    events     []SecurityEvent
    mutex      sync.RWMutex
    alertRules []AlertRule
    notifiers  []Notifier
}

// AlertRule 告警规则
type AlertRule struct {
    ID          string        `json:"id"`
    Name        string        `json:"name"`
    Description string        `json:"description"`
    Condition   string        `json:"condition"`
    Threshold   int           `json:"threshold"`
    TimeWindow  time.Duration `json:"time_window"`
    Severity    string        `json:"severity"`
    Enabled     bool          `json:"enabled"`
}

// Notifier 通知器接口
type Notifier interface {
    Notify(ctx context.Context, alert Alert) error
}

// Alert 告警
type Alert struct {
    ID          string                 `json:"id"`
    RuleID      string                 `json:"rule_id"`
    RuleName    string                 `json:"rule_name"`
    Timestamp   time.Time              `json:"timestamp"`
    Severity    string                 `json:"severity"`
    Message     string                 `json:"message"`
    Events      []SecurityEvent        `json:"events"`
    Metadata    map[string]interface{} `json:"metadata"`
}

func NewSecurityMonitor() *SecurityMonitor {
    return &SecurityMonitor{
        events:     make([]SecurityEvent, 0),
        alertRules: make([]AlertRule, 0),
        notifiers:  make([]Notifier, 0),
    }
}

// LogEvent 记录安全事件
func (monitor *SecurityMonitor) LogEvent(event SecurityEvent) {
    monitor.mutex.Lock()
    defer monitor.mutex.Unlock()
    
    event.ID = fmt.Sprintf("event-%d", time.Now().UnixNano())
    event.Timestamp = time.Now()
    
    monitor.events = append(monitor.events, event)
    
    // 检查告警规则
    go monitor.checkAlertRules(event)
    
    // 记录到日志
    eventJSON, _ := json.Marshal(event)
    log.Printf("Security Event: %s", eventJSON)
}

// AddAlertRule 添加告警规则
func (monitor *SecurityMonitor) AddAlertRule(rule AlertRule) {
    monitor.mutex.Lock()
    defer monitor.mutex.Unlock()
    
    monitor.alertRules = append(monitor.alertRules, rule)
}

// AddNotifier 添加通知器
func (monitor *SecurityMonitor) AddNotifier(notifier Notifier) {
    monitor.mutex.Lock()
    defer monitor.mutex.Unlock()
    
    monitor.notifiers = append(monitor.notifiers, notifier)
}

// checkAlertRules 检查告警规则
func (monitor *SecurityMonitor) checkAlertRules(event SecurityEvent) {
    monitor.mutex.RLock()
    rules := make([]AlertRule, len(monitor.alertRules))
    copy(rules, monitor.alertRules)
    monitor.mutex.RUnlock()
    
    for _, rule := range rules {
        if !rule.Enabled {
            continue
        }
        
        if monitor.evaluateRule(rule, event) {
            alert := Alert{
                ID:        fmt.Sprintf("alert-%d", time.Now().UnixNano()),
                RuleID:    rule.ID,
                RuleName:  rule.Name,
                Timestamp: time.Now(),
                Severity:  rule.Severity,
                Message:   fmt.Sprintf("Alert triggered: %s", rule.Description),
                Events:    []SecurityEvent{event},
                Metadata:  map[string]interface{}{"rule": rule},
            }
            
            monitor.sendAlert(alert)
        }
    }
}

// evaluateRule 评估规则
func (monitor *SecurityMonitor) evaluateRule(rule AlertRule, event SecurityEvent) bool {
    // 简化的规则评估实现
    switch rule.Condition {
    case "failed_login":
        return event.Type == "authentication" && event.Result == "failure"
    case "unauthorized_access":
        return event.Type == "authorization" && event.Result == "denied"
    case "suspicious_activity":
        return event.Severity == "high"
    default:
        return false
    }
}

// sendAlert 发送告警
func (monitor *SecurityMonitor) sendAlert(alert Alert) {
    monitor.mutex.RLock()
    notifiers := make([]Notifier, len(monitor.notifiers))
    copy(notifiers, monitor.notifiers)
    monitor.mutex.RUnlock()
    
    for _, notifier := range notifiers {
        go func(n Notifier) {
            ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
            defer cancel()
            
            if err := n.Notify(ctx, alert); err != nil {
                log.Printf("Failed to send alert: %v", err)
            }
        }(notifier)
    }
}

// GetEvents 获取事件
func (monitor *SecurityMonitor) GetEvents(filter EventFilter) []SecurityEvent {
    monitor.mutex.RLock()
    defer monitor.mutex.RUnlock()
    
    var filteredEvents []SecurityEvent
    
    for _, event := range monitor.events {
        if monitor.matchesFilter(event, filter) {
            filteredEvents = append(filteredEvents, event)
        }
    }
    
    return filteredEvents
}

// EventFilter 事件过滤器
type EventFilter struct {
    StartTime *time.Time `json:"start_time"`
    EndTime   *time.Time `json:"end_time"`
    Type      string     `json:"type"`
    Severity  string     `json:"severity"`
    UserID    string     `json:"user_id"`
    Source    string     `json:"source"`
}

// matchesFilter 检查事件是否匹配过滤器
func (monitor *SecurityMonitor) matchesFilter(event SecurityEvent, filter EventFilter) bool {
    if filter.StartTime != nil && event.Timestamp.Before(*filter.StartTime) {
        return false
    }
    
    if filter.EndTime != nil && event.Timestamp.After(*filter.EndTime) {
        return false
    }
    
    if filter.Type != "" && event.Type != filter.Type {
        return false
    }
    
    if filter.Severity != "" && event.Severity != filter.Severity {
        return false
    }
    
    if filter.UserID != "" && event.UserID != filter.UserID {
        return false
    }
    
    if filter.Source != "" && event.Source != filter.Source {
        return false
    }
    
    return true
}

// EmailNotifier 邮件通知器
type EmailNotifier struct {
    SMTPHost string
    SMTPPort int
    Username string
    Password string
    From     string
    To       []string
}

func (notifier *EmailNotifier) Notify(ctx context.Context, alert Alert) error {
    // 实现邮件发送逻辑
    log.Printf("Sending email alert: %s", alert.Message)
    return nil
}

// SlackNotifier Slack通知器
type SlackNotifier struct {
    WebhookURL string
    Channel    string
}

func (notifier *SlackNotifier) Notify(ctx context.Context, alert Alert) error {
    // 实现Slack消息发送逻辑
    log.Printf("Sending Slack alert: %s", alert.Message)
    return nil
}

// SecurityMiddleware 安全监控中间件
type SecurityMiddleware struct {
    monitor *SecurityMonitor
}

func NewSecurityMiddleware(monitor *SecurityMonitor) *SecurityMiddleware {
    return &SecurityMiddleware{
        monitor: monitor,
    }
}

func (middleware *SecurityMiddleware) LogRequest(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        start := time.Now()
        
        // 创建响应记录器
        recorder := &responseRecorder{
            ResponseWriter: w,
            statusCode:     http.StatusOK,
        }
        
        // 处理请求
        next.ServeHTTP(recorder, r)
        
        // 记录安全事件
        event := SecurityEvent{
            Type:      "api_access",
            Severity:  middleware.getSeverity(recorder.statusCode),
            Source:    "api_gateway",
            UserID:    getUserIDFromRequest(r),
            IP:        r.RemoteAddr,
            UserAgent: r.UserAgent(),
            Resource:  r.URL.Path,
            Action:    r.Method,
            Result:    middleware.getResult(recorder.statusCode),
            Message:   fmt.Sprintf("%s %s - %d", r.Method, r.URL.Path, recorder.statusCode),
            Metadata: map[string]interface{}{
                "duration_ms": time.Since(start).Milliseconds(),
                "status_code": recorder.statusCode,
                "request_size": r.ContentLength,
            },
        }
        
        middleware.monitor.LogEvent(event)
    })
}

// responseRecorder 响应记录器
type responseRecorder struct {
    http.ResponseWriter
    statusCode int
}

func (recorder *responseRecorder) WriteHeader(statusCode int) {
    recorder.statusCode = statusCode
    recorder.ResponseWriter.WriteHeader(statusCode)
}

// 辅助函数
func (middleware *SecurityMiddleware) getSeverity(statusCode int) string {
    if statusCode >= 500 {
        return "high"
    } else if statusCode >= 400 {
        return "medium"
    }
    return "low"
}

func (middleware *SecurityMiddleware) getResult(statusCode int) string {
    if statusCode >= 200 && statusCode < 300 {
        return "success"
    }
    return "failure"
}

// 使用示例
func ExampleSecurityMonitoring() {
    // 创建安全监控器
    monitor := NewSecurityMonitor()
    
    // 添加告警规则
    rule := AlertRule{
        ID:          "rule-1",
        Name:        "Failed Login Attempts",
        Description: "Multiple failed login attempts detected",
        Condition:   "failed_login",
        Threshold:   5,
        TimeWindow:  5 * time.Minute,
        Severity:    "high",
        Enabled:     true,
    }
    monitor.AddAlertRule(rule)
    
    // 添加通知器
    emailNotifier := &EmailNotifier{
        SMTPHost: "smtp.example.com",
        SMTPPort: 587,
        Username: "alerts@example.com",
        Password: "password",
        From:     "alerts@example.com",
        To:       []string{"admin@example.com"},
    }
    monitor.AddNotifier(emailNotifier)
    
    // 创建安全中间件
    securityMiddleware := NewSecurityMiddleware(monitor)
    
    // 在HTTP路由中使用
    mux := http.NewServeMux()
    mux.HandleFunc("/api/login", func(w http.ResponseWriter, r *http.Request) {
        // 登录逻辑
        w.WriteHeader(http.StatusOK)
    })
    
    // 应用安全监控中间件
    handler := securityMiddleware.LogRequest(mux)
    
    // 启动服务器
    // http.ListenAndServe(":8080", handler)
}

本章总结

本章深入探讨了微服务架构中的安全与认证机制，涵盖了以下核心内容：

主要内容回顾

1. 微服务安全概述

   • 分析了微服务架构面临的安全挑战
   • 介绍了零信任安全模型和深度防御策略
   • 提供了安全原则的配置示例

2. 身份认证机制

   • JWT认证：实现了完整的JWT令牌生成、验证和中间件
   • OAuth 2.0：提供了OAuth客户端和OpenID Connect的实现
   • 多因素认证：实现了TOTP和短信验证的MFA系统

3. 授权机制

   • RBAC：基于角色的访问控制，包含权限、角色和用户管理
   • ABAC：属性基于访问控制，支持复杂的策略规则
   • 提供了授权中间件和策略引擎的实现

4. API安全

   • API网关安全配置，包括速率限制、CORS、请求验证
   • 安全中间件实现，涵盖IP过滤、API密钥管理
   • 安全头和请求验证的最佳实践

5. 传输层安全

   • TLS/SSL配置和证书管理
   • Go语言TLS服务器的完整实现
   • 客户端认证和加密套件配置

6. 数据加密

   • AES对称加密和RSA非对称加密
   • 密码哈希和验证机制
   • 加密服务的统一接口设计

7. 安全审计与监控

   • Kubernetes审计日志配置
   • 安全事件监控和告警系统
   • 多种通知渠道的集成

最佳实践

1. 认证策略

   • 使用短期JWT令牌配合刷新令牌机制
   • 实施多因素认证提高安全性
   • 采用OAuth 2.0标准化认证流程

2. 授权设计

   • 遵循最小权限原则
   • 使用RBAC进行基础权限管理
   • 在复杂场景下采用ABAC策略

3. 传输安全

   • 强制使用TLS 1.2以上版本
   • 配置强加密套件
   • 实施证书轮换和管理

4. 数据保护

   • 敏感数据必须加密存储
   • 使用强密码策略
   • 实施数据脱敏和匿名化

5. 监控审计

   • 记录所有安全相关事件
   • 建立实时告警机制
   • 定期进行安全审计

技术要点

• 零信任架构：不信任任何网络位置，验证每个请求
• 深度防御：多层安全控制，防止单点失效
• 安全左移：在开发阶段就考虑安全问题
• 持续监控：实时检测和响应安全威胁

通过本章的学习，您应该能够： - 设计和实现完整的微服务安全架构 - 选择合适的认证和授权机制 - 配置传输层和数据层安全 - 建立有效的安全监控体系

---

下一章预告：第六章将探讨微服务的监控与可观测性，包括指标收集、日志聚合、分布式追踪、健康检查等内容，帮助您构建可观测的微服务系统。