服务端grpc的tls证书配置 about gost

[ginuerzh]

支持

[Tsukimeizi]

刚刚测试了一下，客户端有个报错

服务端：gost -L "grpc://:3001?certFile=/root/xxxx.pub.pem&keyFile=/root/xxxx.pub.key"
{"level":"warning","msg":"load TLS certificate files failed, use random generated certificate","time":"2022-02-13T17:52:25+08:00"}
{"handler":"auto","kind":"service","level":"info","listener":"grpc","msg":"listening on [::]:3001/tcp","service":"service-0","time":"2022-02-13T17:52:25+08:00"}

客户端：gost -L auto://:1080 -F "grpc://xxxx.pub:3001?secure=true&serverName=xxxx.pub"
{"level":"warning","msg":"load TLS certificate files failed, use random generated certificate","time":"2022-02-13T17:56:24+08:00"}
{"handler":"auto","kind":"service","level":"info","listener":"tcp","msg":"listening on [::]:1080/tcp","service":"service-0","time":"2022-02-13T17:56:24+08:00"}
{"handler":"auto","kind":"handler","level":"info","listener":"tcp","local":"127.0.0.1:1080","msg":"127.0.0.1:58990 <> 127.0.0.1:1080","remote":"127.0.0.1:58990","service":"service-0","time":"2022-02-13T17:56:25+08:00"}
{"handler":"auto","kind":"handler","level":"info","listener":"tcp","local":"127.0.0.1:1080","msg":"127.0.0.1:58991 <> 127.0.0.1:1080","remote":"127.0.0.1:58991","service":"service-0","time":"2022-02-13T17:56:25+08:00"}
{"handler":"auto","kind":"handler","level":"info","listener":"tcp","local":"127.0.0.1:1080","msg":"127.0.0.1:58990 <> 127.0.0.1:1080","remote":"127.0.0.1:58990","service":"service-0","time":"2022-02-13T17:56:25+08:00","type":"socks5"}
{"handler":"auto","kind":"handler","level":"info","listener":"tcp","local":"127.0.0.1:1080","msg":"127.0.0.1:58991 <> 127.0.0.1:1080","remote":"127.0.0.1:58991","service":"service-0","time":"2022-02-13T17:56:25+08:00","type":"socks5"}
{"cmd":"connect","dst":"www.google.com:443/tcp","handler":"auto","kind":"handler","level":"info","listener":"tcp","local":"127.0.0.1:1080","msg":"127.0.0.1:58990 >> www.google.com:443","remote":"127.0.0.1:58990","service":"service-0","time":"2022-02-13T17:56:25+08:00","type":"socks5"}
{"cmd":"connect","dst":"www.gstatic.com:443/tcp","handler":"auto","kind":"handler","level":"info","listener":"tcp","local":"127.0.0.1:1080","msg":"127.0.0.1:58991 >> www.gstatic.com:443","remote":"127.0.0.1:58991","service":"service-0","time":"2022-02-13T17:56:25+08:00","type":"socks5"}
{"chain":"chain-0","connector":"http","dialer":"grpc","hop":"hop-0","kind":"dialer","level":"error","msg":"ClientConn's authority from transport creds "xxxx.pub" and dial option "xxxx.pub:3001" don't match","node":"node-0","time":"2022-02-13T17:56:25+08:00"}
{"handler":"auto","kind":"handler","level":"error","listener":"tcp","msg":"route(retry=0) ClientConn's authority from transport creds "xxxx.pub" and dial option "xxxx.pub:3001" don't match","service":"service-0","time":"2022-02-13T17:56:25+08:00","type":"socks5"}

[Tsukimeizi]

更新到edca3e0a5518b9aef22fa310e47130ae6b4765e0测试

客户端：
gost -L auto://:1080 -F "grpc://xxxx.top:3001?secure=true"
通过域名连接正常

gost -L auto://:1080 -F "grpc://8.218.x.x:3001?secure=true&serverName=xxxx.top"
通过IP连接+serverName参数报错
{"level":"warning","msg":"load TLS certificate files failed, use random generated certificate","time":"2022-02-13T21:25:53+08:00"}
{"handler":"auto","kind":"service","level":"info","listener":"tcp","msg":"listening on [::]:1080/tcp","service":"service-0","time":"2022-02-13T21:25:53+08:00"}
{"handler":"auto","kind":"handler","level":"info","listener":"tcp","local":"127.0.0.1:1080","msg":"127.0.0.1:63083 <> 127.0.0.1:1080","remote":"127.0.0.1:63083","service":"service-0","time":"2022-02-13T21:25:55+08:00"}
{"handler":"auto","kind":"handler","level":"info","listener":"tcp","local":"127.0.0.1:1080","msg":"127.0.0.1:63084 <> 127.0.0.1:1080","remote":"127.0.0.1:63084","service":"service-0","time":"2022-02-13T21:25:55+08:00"}
{"handler":"auto","kind":"handler","level":"info","listener":"tcp","local":"127.0.0.1:1080","msg":"127.0.0.1:63083 <> 127.0.0.1:1080","remote":"127.0.0.1:63083","service":"service-0","time":"2022-02-13T21:25:55+08:00","type":"socks5"}
{"cmd":"connect","dst":"github.com:443/tcp","handler":"auto","kind":"handler","level":"info","listener":"tcp","local":"127.0.0.1:1080","msg":"127.0.0.1:63083 >> github.com:443","remote":"127.0.0.1:63083","service":"service-0","time":"2022-02-13T21:25:55+08:00","type":"socks5"}
{"chain":"chain-0","connector":"http","dialer":"grpc","hop":"hop-0","kind":"dialer","level":"error","msg":"ClientConn's authority from transport creds "xxxx.top" and dial option "8.218.x.x" don't match","node":"node-0","time":"2022-02-13T21:25:55+08:00"}
{"handler":"auto","kind":"handler","level":"error","listener":"tcp","msg":"route(retry=0) ClientConn's authority from transport creds "xxxx.top" and dial option "8.218.x.x" don't match","service":"service-0","time":"2022-02-13T21:25:55+08:00","type":"socks5"}

有个问题，通过域名连接是不是每次连接服务端都要做域名解析，而使用IP+serverName可以少一次解析？

[ginuerzh]

如果IP是固定的，可以通过域名IP映射来避免解析：

gost -L auto://:1080 -F "grpc://xxxx.top:3001?secure=true&hosts=xxx.top:1.2.3.4"

[Tsukimeizi]

搞定，谢谢。