无需使用http.Serve即可激活Go TLS套接字服务器服务

Question

我有以下代码和systemd单元文件。我正在尝试做的是激活监听器，而不必使用http.Serve接受和接收传入连接。如果我将ln，err：= tls.Listen（“tcp”，listen，config）更改为ln，错误：= activation.TLSListener（config）我看到我可以接收数据的唯一方法是使用http.Serve。我在使用ln时遇到的错误，错误：= activation.TLSListeners。（config）是ln.Accept undefined（type [] net.Listener没有字段或方法Accept）

package main

import (
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "io"
    "io/ioutil"
    "log"
    "net"
    "time"

    "github.com/coreos/go-systemd/daemon"
    "github.com/coreos/go-systemd/journal"
    "github.com/coreos/go-systemd/activation"
)

func createServerConfig(ca, crt, key string) (*tls.Config, error) {
    caCertPEM, err := ioutil.ReadFile(ca)
    if err != nil {
        return nil, err
    }

    roots := x509.NewCertPool()
    ok := roots.AppendCertsFromPEM(caCertPEM)
    if !ok {
        panic("failed to parse root certificate")
    }

    cert, err := tls.LoadX509KeyPair(crt, key)
    if err != nil {
        return nil, err
    }
    return &tls.Config{
        Certificates: []tls.Certificate{cert},
        ClientAuth:   tls.RequireAndVerifyClientCert,
        ClientCAs:    roots,
    }, nil
}

const (
    ca  = "/home/ajames/Shortcuts/Link to MainGoFolder/Workspace/servicecode/tls-server/certs/ca-chain.cert.pem"
    crt = "/home/ajames/Shortcuts/Link to MainGoFolder/Workspace/servicecode/tls-server/certs/tls-server2-SAN.pem"
    key = "/home/ajames/Shortcuts/Link to MainGoFolder/Workspace/servicecode/tls-server/certs/tls-server2-SAN.key"
    listen = "127.0.0.1:4433"
)

func main() {

    if journal.Enabled() {
        journal.Print(journal.PriInfo, "all systems ready...")
    }

    p := fmt.Println
    now := time.Now()
    p(now)

    config, err := createServerConfig(ca, crt, key)
    if err != nil {
        log.Fatal("config failed: %s", err.Error())
    }

    ln, err := tls.Listen("tcp", listen, config)
    if err != nil {
        log.Fatal("listen failed: %s", err.Error())
    }
    daemon.SdNotify(false, "READY=1")
    log.Printf("listen on %s", listen)

    go func() {
        interval, err := daemon.SdWatchdogEnabled(false)
        if err != nil || interval == 0 {
            return
        }
        for {
            daemon.SdNotify(false, "WATCHDOG=1")
            time.Sleep(interval / 3)
        }
    }()

    for {
        conn, err := ln.Accept()
        if err != nil {
            log.Fatal("accept failed: %s", err.Error())
            break
        }
        log.Printf("connection open: %s", conn.RemoteAddr())
        //printConnState(conn.(*tls.Conn))

        go func(c net.Conn) {
            wr, _ := io.Copy(c, c)
            c.Close()
            log.Printf("connection close: %s, written: %d", conn.RemoteAddr(), wr)
        }(conn)
    }
}


[Unit]
Description=tls server service
After=network.target tls-server.socket
Requires=tls-server.socket

[Service]
Type=notify
WatchdogSec=30s
StandardInput=socket
StandardError=journal
ExecStart=/usr/local/bin/tls-server
NonBlocking=true
Restart=on-failure

[Install]
WantedBy=multi-user.target


[Unit]
Description=tls server socket
StartLimitIntervalSec=10
PartOf=tls-server.service
After=network.target

[Socket]
ListenStream=127.0.0.1:4433
NoDelay=true
Accept=true
ReusePort=true
MaxConnections=200
Writable=true

[Install]
WantedBy=sockets.target

Answer 1

I found a solution that works. The answer came from https://www.darkcoding.net/software/systemd-socket-activation-in-go/.

My new code looks like this

package main

import (
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "io"
    "io/ioutil"
    "log"
    "net"
    "os"
    "strconv"
    "time"

    "github.com/coreos/go-systemd/journal"
)

func createServerConfig(ca, crt, key string) (*tls.Config, error) {
    caCertPEM, err := ioutil.ReadFile(ca)
    if err != nil {
        return nil, err
    }`enter code here`

    roots := x509.NewCertPool()
    ok := roots.AppendCertsFromPEM(caCertPEM)
    if !ok {
        panic("failed to parse root certificate")
    }

    cert, err := tls.LoadX509KeyPair(crt, key)
    if err != nil {
        return nil, err
    }
    return &tls.Config{
        Certificates: []tls.Certificate{cert},
        ClientAuth:   tls.RequireAndVerifyClientCert,
        ClientCAs:    roots,
    }, nil
}

const (
    ca          = "/usr/local/bin/certs/ca-chain.cert.pem"
    crt         = "/usr/local/bin/certs/tls-server2-SAN.pem"
    key         = "/usr/local/bin/certs/tls-server2-SAN.key"
    BUFFER_SIZE = 1024`enter code here`
)

func main() {
    if journal.Enabled() {
        journal.Print(journal.PriInfo, "all systems ready...")
    }

    p := fmt.Println
    now := time.Now()
    p(now)

    config, err := createServerConfig(ca, crt, key)
    if err != nil {
        log.Fatal("config failed: %s", err.Error())
    }
    if os.Getenv("LISTEN_PID") == strconv.Itoa(os.Getpid()) {
        // systemd run
        f := os.NewFile(3, "from systemd")
        ln, err := net.FileListener(f)
        if err != nil {
            log.Fatal(err)
        }
        tlsListener := tls.NewListener(ln, config)
        for {
            conn, err := tlsListener.Accept()
            if err != nil {
                log.Fatal("accept failed: %s", err.Error())
                break
            }
            log.Printf("connection open: %s", conn.RemoteAddr())
            //printConnState(conn.(*tls.Conn))
            go func(c net.Conn) {
                wr, _ := io.Copy(c, c)
                c.Close()
                log.Printf("connection close: %s, written: %d", conn.RemoteAddr(), wr)
            }(conn)
        }`enter code here`
    }
}