完整性校验

guoshilong

2023-10-19 19d4609cdf15588ef37c77808d1fb27ab174aadc

完整性校验

 skjcmanager/skjcmanager-auth/src/main/java/cn/gistack/auth/service/BladeUserDetailsServiceImpl.java

@@ -197,9 +197,11 @@
            }

            //解码Base64
            String base64Decode = Base64Utils.getBase64Decode(encryptRes.getData().getData());
            String JSONstr = Base64Utils.getBase64Decode(encryptRes.getData().getData());

            UserSUPO userSUPO = JSONObject.parseObject(base64Decode, UserSUPO.class);
            pwdClient.verify(loginUserInfo.getMaced(),loginUserInfo.getSm4iv(),loginUserInfo.getKeyindexs(),JSONstr,loginUserInfo.getId().toString(),"blade_user");

            UserSUPO userSUPO = JSONObject.parseObject(JSONstr, UserSUPO.class);

            //若登录用户的电话、角色、部门与原加密数据不符，登录失败
            if (!(loginUserInfo.getPhone().equals(userSUPO.getPhone())  && loginUserInfo.getRoleId().equals(userSUPO.getRoleId())  && loginUserInfo.getDeptId().equals(userSUPO.getDeptId())) ){

 skjcmanager/skjcmanager-service-api/skjcmanager-pwd-api/src/main/java/cn/gistack/pwd/entity/VerifyOutput.java

New file
@@ -0,0 +1,58 @@
/*
 *      Copyright (c) 2018-2028, Chill Zhuang All rights reserved.
 *
 *  Redistribution and use in source and binary forms, with or without
 *  modification, are permitted provided that the following conditions are met:
 *
 *  Redistributions of source code must retain the above copyright notice,
 *  this list of conditions and the following disclaimer.
 *  Redistributions in binary form must reproduce the above copyright
 *  notice, this list of conditions and the following disclaimer in the
 *  documentation and/or other materials provided with the distribution.
 *  Neither the name of the dreamlu.net developer nor the names of its
 *  contributors may be used to endorse or promote products derived from
 *  this software without specific prior written permission.
 *  Author: Chill 庄骞 (smallchill@163.com)
 */
package cn.gistack.pwd.entity;

import com.baomidou.mybatisplus.annotation.TableName;
import lombok.Data;
import lombok.EqualsAndHashCode;
import org.springblade.core.mp.base.BaseEntity;
import org.springblade.core.tenant.mp.TenantEntity;

import java.util.Date;

/**
 * 加密校验实体类
 *
 * @author Chill
 */
@Data
@TableName("PWD_VERIFY_OUTPUT")
@EqualsAndHashCode(callSuper = true)
public class VerifyOutput extends BaseEntity {

    private static final long serialVersionUID = 1L;

    /**
     * 校验数据主键
     */
    private String dataId;

    /**
     * 校验表
     */
    private String source;

    /**
     * 校验结果
     */
    private String result;

    private String message;
    private String messageVerify;
    private String maced;

}

 skjcmanager/skjcmanager-service-api/skjcmanager-pwd-api/src/main/java/cn/gistack/pwd/fegin/IPwdClient.java

@@ -26,6 +26,8 @@
    String GET_ENCRYPT = API_PREFIX + "/getEncrypt";
    String GET_DECRYPT = API_PREFIX + "/getDecrypt";

    String VERIFY =  API_PREFIX + "/verify";

    @PostMapping(GET_CBCMACENCIPHER)
    R<CBCResultDTO> getCBCMacEncipher(@RequestParam("message")String message);

@@ -38,4 +40,12 @@
    @PostMapping(GET_DECRYPT)
    R<ResultDTO> getDecrypt(@RequestParam("sm4Iv")String sm4Iv, @RequestParam("keyIndex")String keyIndex, @RequestParam("message")String message);

    @PostMapping(VERIFY)
    R verify(@RequestParam("maced")String maced,
             @RequestParam("sm4Iv")String sm4Iv,
             @RequestParam("keyIndex")String keyIndex,
             @RequestParam("message")String message,
             @RequestParam("dataId")String dataId,
             @RequestParam("source")String source);

}

 skjcmanager/skjcmanager-service-api/skjcmanager-pwd-api/src/main/java/cn/gistack/pwd/fegin/PwdClientFallback.java

@@ -18,6 +18,11 @@
    }

    @Override
    public R<CBCResultDTO> getCBCMacEncipherVerify(String sm4Iv, String keyIndex, String message) {
        return R.fail("获取数据失败");
    }

    @Override
    public R<ResultDTO> getEncrypt(String sm4Iv, String keyIndex, String message) {
        return R.fail("获取数据失败");
    }
@@ -26,4 +31,9 @@
    public R<ResultDTO> getDecrypt(String sm4Iv, String keyIndex, String message) {
        return R.fail("获取数据失败");
    }

    @Override
    public R verify(String maced, String sm4Iv, String keyIndex, String message, String dataId, String source) {
        return R.fail("获取数据失败");
    }
}

 skjcmanager/skjcmanager-service-api/skjcmanager-user-api/src/main/java/cn/gistack/system/user/entity/UserEncipher.java

New file
@@ -0,0 +1,132 @@
/*
 *      Copyright (c) 2018-2028, Chill Zhuang All rights reserved.
 *
 *  Redistribution and use in source and binary forms, with or without
 *  modification, are permitted provided that the following conditions are met:
 *
 *  Redistributions of source code must retain the above copyright notice,
 *  this list of conditions and the following disclaimer.
 *  Redistributions in binary form must reproduce the above copyright
 *  notice, this list of conditions and the following disclaimer in the
 *  documentation and/or other materials provided with the distribution.
 *  Neither the name of the dreamlu.net developer nor the names of its
 *  contributors may be used to endorse or promote products derived from
 *  this software without specific prior written permission.
 *  Author: Chill 庄骞 (smallchill@163.com)
 */
package cn.gistack.system.user.entity;

import com.baomidou.mybatisplus.annotation.TableName;
import lombok.Data;
import lombok.EqualsAndHashCode;
import org.springblade.core.tenant.mp.TenantEntity;
import org.springframework.boot.autoconfigure.security.SecurityProperties;

import java.util.Date;

/**
 * 用户加密实体类
 *
 * @author Chill
 */
@Data
@TableName("blade_user_encipher")
@EqualsAndHashCode(callSuper = true)
public class UserEncipher extends TenantEntity {

    private static final long serialVersionUID = 1L;

    /**
     * 用户编号
     */
    private String code;
    /**
     * 用户平台
     */
    private Integer userType;
    /**
     * 账号
     */
    private String account;
    /**
     * 密码
     */
    private String password;
    /**
     * 昵称
     */
    private String name;
    /**
     * 真名
     */
    private String realName;
    /**
     * 头像
     */
    private String avatar;
    /**
     * 邮箱
     */
    private String email;
    /**
     * 手机
     */
    private String phone;
    /**
     * 生日
     */
    private Date birthday;
    /**
     * 性别
     */
    private Integer sex;
    /**
     * 角色id
     */
    private String roleId;
    /**
     * 部门id
     */
    private String deptId;
    /**
     * 岗位id
     */
    private String postId;

    /**以下4个为加密字段**/
    private String sm4iv;
    private String keyindexs;
    private String maced;
    private String encdata;

    public UserEncipher(User user){

        this.setCode(user.getCode());
        this.setUserType(user.getUserType());
        this.setAccount(user.getAccount());
        this.setPassword(user.getPassword());
        this.setName(user.getName());
        this.setRealName(user.getRealName());
        this.setAvatar(user.getAvatar());
        this.setEmail(user.getEmail());
//        this.setPhone(user.getPhone());
        this.setBirthday(user.getBirthday());
        this.setSex(user.getSex());
        this.setRoleId(user.getRoleId());
        this.setDeptId(user.getRoleId());
        this.setPostId(user.getPostId());

        this.setId(user.getId());
        this.setCreateDept(user.getCreateDept());
        this.setCreateUser(user.getCreateUser());
        this.setCreateTime(user.getCreateTime());
        this.setUpdateUser(user.getUpdateUser());
        this.setUpdateTime(user.getUpdateTime());
        this.setIsDeleted(user.getIsDeleted());
        this.setStatus(user.getStatus());
        this.setTenantId(user.getTenantId());


    }

}

 skjcmanager/skjcmanager-service/skjcmanager-pwd/src/main/java/cn/gistack/pwd/feign/PwdClient.java

@@ -2,8 +2,10 @@

import cn.gistack.pwd.dto.CBCResultDTO;
import cn.gistack.pwd.dto.ResultDTO;
import cn.gistack.pwd.entity.VerifyOutput;
import cn.gistack.pwd.fegin.IPwdClient;
import cn.gistack.pwd.service.IPwdSendService;
import cn.gistack.pwd.service.IVerifyOutputService;
import lombok.AllArgsConstructor;
import org.springblade.core.tenant.annotation.NonDS;
import org.springblade.core.tool.api.R;
@@ -24,6 +26,7 @@
public class PwdClient implements IPwdClient {

    private final IPwdSendService pwdSendService;
    private final IVerifyOutputService verifyOutputService;

    @Override
    public R<CBCResultDTO> getCBCMacEncipher(String message) {
@@ -46,4 +49,10 @@
    public R<ResultDTO> getDecrypt(String sm4Iv, String keyIndex, String message) {
        return R.data(pwdSendService.getDecrypt(sm4Iv,keyIndex,message));
    }

    @Override
    @PostMapping(VERIFY)
    public R verify(String maced, String sm4Iv, String keyIndex, String message, String dataId, String source) {
        return R.data(verifyOutputService.verifyMaced(maced,sm4Iv,keyIndex,dataId,source,message));
    }
}

 skjcmanager/skjcmanager-service/skjcmanager-pwd/src/main/java/cn/gistack/pwd/mapper/VerifyOutputMapper.java

New file
@@ -0,0 +1,7 @@
package cn.gistack.pwd.mapper;

import cn.gistack.pwd.entity.VerifyOutput;
import com.baomidou.mybatisplus.core.mapper.BaseMapper;

public interface VerifyOutputMapper extends BaseMapper<VerifyOutput> {
}

 skjcmanager/skjcmanager-service/skjcmanager-pwd/src/main/java/cn/gistack/pwd/service/IVerifyOutputService.java

New file
@@ -0,0 +1,17 @@
package cn.gistack.pwd.service;

import cn.gistack.pwd.entity.VerifyOutput;
import org.springblade.core.mp.base.BaseService;

public interface IVerifyOutputService extends BaseService<VerifyOutput> {

    /**
     * 验证数据完整性
     * @param maced
     * @param dataId
     * @param source
     * @param message
     * @return
     */
    Boolean verifyMaced(String maced,String sm4Iv, String keyIndex,String dataId,String source,String message);
}

 skjcmanager/skjcmanager-service/skjcmanager-pwd/src/main/java/cn/gistack/pwd/service/impl/VerifyOutputServiceImpl.java

New file
@@ -0,0 +1,45 @@
package cn.gistack.pwd.service.impl;

import cn.gistack.pwd.dto.CBCResultDTO;
import cn.gistack.pwd.entity.VerifyOutput;
import cn.gistack.pwd.mapper.VerifyOutputMapper;
import cn.gistack.pwd.service.IPwdSendService;
import cn.gistack.pwd.service.IVerifyOutputService;
import lombok.AllArgsConstructor;
import org.springblade.core.mp.base.BaseServiceImpl;
import org.springframework.stereotype.Service;

@Service
@AllArgsConstructor
public class VerifyOutputServiceImpl extends BaseServiceImpl<VerifyOutputMapper, VerifyOutput> implements IVerifyOutputService {

    private final IPwdSendService pwdSendService;

    @Override
    public Boolean verifyMaced(String maced,String sm4Iv, String keyIndex,String dataId, String source, String message) {

        CBCResultDTO cbcMacEncipher = pwdSendService.getCBCMacEncipher(sm4Iv, keyIndex, message);

        String newMaced = cbcMacEncipher.getMaced();

        String result = "验证成功，数据未被篡改";


        boolean equals = maced.equals(newMaced);
        //不等于
        if (!equals){
            result = "验证失败，数据已被篡改";
        }

        VerifyOutput verifyOutput = new VerifyOutput();

        verifyOutput.setDataId(dataId);
        verifyOutput.setSource(source);
        verifyOutput.setResult(result);
        verifyOutput.setMessage(message);
        verifyOutput.setMessageVerify(newMaced);
        verifyOutput.setMaced(maced);

        return save(verifyOutput);
    }
}

 skjcmanager/skjcmanager-service/skjcmanager-sm/src/main/java/cn/gistack/sm/jcsb/service/impl/DangerReportServiceImpl.java

@@ -1,5 +1,6 @@
package cn.gistack.sm.jcsb.service.impl;

import cn.gistack.common.utils.Base64Utils;
import cn.gistack.pwd.dto.CBCResultDTO;
import cn.gistack.pwd.dto.ResultDTO;
import cn.gistack.pwd.fegin.IPwdClient;
@@ -136,11 +137,15 @@
        newEntity.setId(item.getId());

        R<ResultDTO> res = pwdClient.getDecrypt(item.getSm4iv(), item.getKeyindexs(), item.getEncdata());

        if (res.getCode() == 200){
            newEntity.setBase64Data(res.getData().getData());
            newEntity.setCreateTime(item.getCreateTime());
        }

        String  jsonStr = Base64Utils.getBase64Decode(res.getData().getData());
        pwdClient.verify(item.getMaced(),item.getSm4iv(),item.getKeyindexs(),jsonStr,id,"sm_danger_report");

        return newEntity;
    }


 skjcmanager/skjcmanager-service/skjcmanager-sm/src/main/java/cn/gistack/sm/log/mapper/SmLogManageMapper.xml

@@ -42,6 +42,9 @@
               L.STATUS,
               L.IS_DELETED,
               L.SOURCE,
               L.SM4IV,
               L.KEYINDEXS,
               L.MACED,
               U.real_name createUserName
        FROM SM_LOG_MANAGE L
        LEFT JOIN BLADE_USER U ON U.ID = L.CREATE_USER

 skjcmanager/skjcmanager-service/skjcmanager-sm/src/main/java/cn/gistack/sm/log/service/impl/ISmLogManageServiceImpl.java

@@ -1,6 +1,7 @@
package cn.gistack.sm.log.service.impl;

import cn.gistack.pwd.dto.CBCResultDTO;
import cn.gistack.pwd.dto.ResultDTO;
import cn.gistack.pwd.fegin.IPwdClient;
import cn.gistack.sm.log.entity.SmLogManage;
import cn.gistack.sm.log.mapper.SmLogManageMapper;
@@ -46,7 +47,24 @@

    @Override
    public IPage<SmLogManageVO> selectPage(IPage<SmLogManageVO> page, SmLogManageVO smLogManage) {
        return page.setRecords(baseMapper.selectMyPage(page,smLogManage));
        List<SmLogManageVO> list = baseMapper.selectMyPage(page, smLogManage);

        list.forEach(smLogManageVO ->{
            SmLogManage log = new SmLogManage();

            log.setIp(smLogManageVO.getIp());
            log.setOperationDescription(smLogManageVO.getOperationDescription());
            log.setUrl(smLogManageVO.getUrl());
            log.setSource(smLogManage.getSource());

            String message = JSONObject.toJSONString(log);
             pwdClient.verify(smLogManageVO.getMaced(),
                 smLogManageVO.getSm4iv(),
                 smLogManageVO.getKeyindexs(),
                 message,smLogManageVO.getId().toString(),"sm_log_manage");
        });

        return page.setRecords(list);
    }

    @Override

 skjcmanager/skjcmanager-service/skjcmanager-user/src/main/java/cn/gistack/system/user/mapper/UserEncipherMapper.java

New file
@@ -0,0 +1,7 @@
package cn.gistack.system.user.mapper;

import cn.gistack.system.user.entity.UserEncipher;
import com.baomidou.mybatisplus.core.mapper.BaseMapper;

public interface UserEncipherMapper extends BaseMapper<UserEncipher> {
}

 skjcmanager/skjcmanager-service/skjcmanager-user/src/main/java/cn/gistack/system/user/mapper/UserEncipherMapper.xml

New file
@@ -0,0 +1,7 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="cn.gistack.system.user.mapper.UserEncipherMapper">



</mapper>

 skjcmanager/skjcmanager-service/skjcmanager-user/src/main/java/cn/gistack/system/user/service/IUserEncipherService.java

New file
@@ -0,0 +1,8 @@
package cn.gistack.system.user.service;

import cn.gistack.system.user.entity.User;
import cn.gistack.system.user.entity.UserEncipher;
import org.springblade.core.mp.base.BaseService;

public interface IUserEncipherService extends BaseService<UserEncipher> {
}

 skjcmanager/skjcmanager-service/skjcmanager-user/src/main/java/cn/gistack/system/user/service/impl/UserEncipherServiceImpl.java

New file
@@ -0,0 +1,14 @@
package cn.gistack.system.user.service.impl;

import cn.gistack.system.user.entity.User;
import cn.gistack.system.user.entity.UserEncipher;
import cn.gistack.system.user.mapper.UserEncipherMapper;
import cn.gistack.system.user.mapper.UserMapper;
import cn.gistack.system.user.service.IUserEncipherService;
import cn.gistack.system.user.service.IUserService;
import org.springblade.core.mp.base.BaseServiceImpl;
import org.springframework.stereotype.Service;

@Service
public class UserEncipherServiceImpl extends BaseServiceImpl<UserEncipherMapper, UserEncipher> implements IUserEncipherService {
}

 skjcmanager/skjcmanager-service/skjcmanager-user/src/main/java/cn/gistack/system/user/service/impl/UserServiceImpl.java

@@ -32,6 +32,7 @@
import cn.gistack.system.user.excel.UserExcel;
import cn.gistack.system.user.mapper.UserMapper;
import cn.gistack.system.user.service.IUserDeptService;
import cn.gistack.system.user.service.IUserEncipherService;
import cn.gistack.system.user.service.IUserOauthService;
import cn.gistack.system.user.service.IUserService;
import cn.gistack.system.user.supo.UserSUPO;
@@ -82,6 +83,8 @@
    private final BladeTenantProperties tenantProperties;

    private final IPwdClient pwdClient;

    private final IUserEncipherService userEncipherService;

    @Override
    @Transactional(rollbackFor = Exception.class)
@@ -145,10 +148,13 @@


    @Override
    @Transactional(rollbackFor = Exception.class)
    public boolean save(User entity) {
        //对User进行加密
        encryptUserInfo(entity);
        return super.save(entity);
        boolean saveUser = super.save(entity);
        boolean saveUserEncipher = userEncipherService.save(new UserEncipher(entity));
        return saveUserEncipher && saveUser;
    }

    @Override
@@ -174,11 +180,14 @@
    }

    @Override
    @Transactional(rollbackFor = Exception.class)
    public boolean updateById(User entity) {

        encryptUserInfo(entity);
        boolean updateUser = super.updateById(entity);
        boolean updateUserEncipher = userEncipherService.updateById(new UserEncipher(entity));

        return super.updateById(entity);
        return updateUser&&updateUserEncipher;
    }

    private boolean submitUserDept(User user) {
@@ -381,7 +390,7 @@
        if (Func.contains(Func.toLongArray(userIds), AuthUtil.getUserId())) {
            throw new ServiceException("不能删除本账号!");
        }
        return deleteLogic(Func.toLongList(userIds));
        return deleteLogic(Func.toLongList(userIds)) && userEncipherService.deleteLogic(Func.toLongList(userIds));
    }

    @Override