From 249d857dc10e98d50b66a70e8c757e64599d611a Mon Sep 17 00:00:00 2001 From: cheney Date: Thu, 30 Apr 2026 10:23:18 +0800 Subject: [PATCH] save --- .../tms/modules/cert/support/CertUtil.java | 4 +- .../openapi/service/impl/OpenApiService.java | 67 ++++++++++--------- 2 files changed, 38 insertions(+), 33 deletions(-) diff --git a/src/main/java/com/cisd/tms/modules/cert/support/CertUtil.java b/src/main/java/com/cisd/tms/modules/cert/support/CertUtil.java index f8cb5f3..7124cab 100644 --- a/src/main/java/com/cisd/tms/modules/cert/support/CertUtil.java +++ b/src/main/java/com/cisd/tms/modules/cert/support/CertUtil.java @@ -42,12 +42,12 @@ public class CertUtil { return (X509Certificate) CF.generateCertificate(new ByteArrayInputStream(certificateString.getBytes())); // 将文件流的证书转化为证书类 } - public static String convertToPem(String cert) throws CertificateEncodingException { + public static String convertToPem(X509Certificate cert) throws CertificateEncodingException { String cert_begin = "-----BEGIN CERTIFICATE-----\n"; String end_cert = "\n-----END CERTIFICATE-----"; - byte[] derCert = cert.getBytes(); + byte[] derCert = cert.getEncoded(); String pemCertPre = Base64.getMimeEncoder().encodeToString(derCert); String pemCert = cert_begin + pemCertPre + end_cert; return pemCert; diff --git a/src/main/java/com/cisd/tms/modules/openapi/service/impl/OpenApiService.java b/src/main/java/com/cisd/tms/modules/openapi/service/impl/OpenApiService.java index 0ace31b..77cc765 100644 --- a/src/main/java/com/cisd/tms/modules/openapi/service/impl/OpenApiService.java +++ b/src/main/java/com/cisd/tms/modules/openapi/service/impl/OpenApiService.java @@ -1,8 +1,10 @@ package com.cisd.tms.modules.openapi.service.impl; +import com.cisd.tms.integration.crypto.pcie.PcieSessionTemplate; import com.cisd.tms.integration.crypto.pcie.service.JnaPcieCryptoService; import com.cisd.tms.modules.cert.repository.CertificateRepository; import com.cisd.tms.modules.cert.service.CertificateService; +import com.cisd.tms.modules.cert.support.CertUtil; import com.cisd.tms.modules.openapi.service.IOpenApiService; import com.cisd.tms.modules.openapi.service.dto.GenericCertificate; import com.sun.jna.Pointer; @@ -23,6 +25,7 @@ import java.security.cert.X509Certificate; @RequiredArgsConstructor public class OpenApiService implements IOpenApiService { + private final PcieSessionTemplate sessionTemplate; private JnaPcieCryptoService sdf; private final CertificateService certificateService; @@ -45,50 +48,52 @@ public class OpenApiService implements IOpenApiService { byte[] hash = new byte[32]; // SM3 哈希长度为 32 字节 IntByReference hashLength = new IntByReference(); - // 使用空指针作为会话句柄（SDFSoft 支持） - Pointer sessionHandle = Pointer.NULL; - // 默认的 SM2 用户 ID - String userId = "1234567812345678"; + final String userId = "1234567812345678"; - // 初始化哈希（包含公钥和用户 ID） - int ret = sdf.SDF_HashInit(sessionHandle, 0, publicKey, userId, userId.length()); - if (ret != 0) { - throw new RuntimeException("SDF_HashInit failed with code: " + ret); - } + return sessionTemplate.withSession("SM2Sign", (sdf, deviceHandle, sessionHandle) -> { - // 更新哈希（添加原始数据） - ret = sdf.SDF_HashUpdate(sessionHandle, origBytes, origBytes.length); - if (ret != 0) { - throw new RuntimeException("SDF_HashUpdate failed with code: " + ret); - } + // 初始化哈希（包含公钥和用户 ID） + sessionTemplate.ensureSuccess( + "SDF_HashInit", + sdf.SDF_HashInit(sessionHandle, 0, publicKey, userId.getBytes(), 16) + ); - // 完成哈希 - ret = sdf.SDF_HashFinal(sessionHandle, hash, hashLength); - if (ret != 0) { - throw new RuntimeException("SDF_HashFinal failed with code: " + ret); - } + // 更新哈希（添加原始数据） + sessionTemplate.ensureSuccess( + "SDF_HashUpdate", + sdf.SDF_HashUpdate(sessionHandle, origBytes, origBytes.length) + ); - // 使用 SDF 接口进行 SM2 签名 - byte[] signature = new byte[64]; // SM2 签名长度为 64 字节 - ret = sdf.SDF_InternalSign_ECC(sessionHandle, keyIndex, hash, hashLength.getValue(), signature); - if (ret != 0) { - throw new RuntimeException("SDF_InternalSign_ECC failed with code: " + ret); - } + // 完成哈希 + sessionTemplate.ensureSuccess( + "SDF_HashFinal", + sdf.SDF_HashFinal(sessionHandle, hash, hashLength) + ); + + // 使用 SDF 接口进行 SM2 签名 + byte[] signature = new byte[64]; // SM2 签名长度为 64 字节 + sessionTemplate.ensureSuccess( + "SDF_InternalSign_ECC", + sdf.SDF_InternalSign_ECC(sessionHandle, keyIndex, hash, hashLength.getValue(), signature) + ); + + // 返回 Base64 编码的签名 + return new String(Base64.encode(signature)); + }); - // 返回 Base64 编码的签名 - return new String(Base64.encode(signature)); } catch (Exception e) { e.printStackTrace(); throw new RuntimeException("Raw sign failed: " + e.getMessage(), e); } } + @Override public boolean rawVerify(byte[] origBytes, String certStr, String dn) { try { // 获取证书 - X509Certificate cert = certManager.getCertificate(dn); + X509Certificate cert = certificateService.getBySubjectDn(dn); if (cert == null) { return false; } @@ -141,7 +146,7 @@ public class OpenApiService implements IOpenApiService { try { // 获取密钥对和证书 KeyPair keyPair = certManager.getKeyPair(dn); - X509Certificate cert = certManager.getCertificate(dn); + X509Certificate cert = certificateService.getBySubjectDn(dn); if (keyPair == null || cert == null) { throw new RuntimeException("Certificate not found for DN: " + dn); } @@ -198,7 +203,7 @@ public class OpenApiService implements IOpenApiService { // 验证证书有效性（检查有效期） cert.checkValidity(new java.util.Date()); - return new GenericCertificate(cert); + return CertUtil.convertToPem(cert); } } catch (org.bouncycastle.cms.CMSSignerDigestMismatchException e) { // 签名验证失败（数据不匹配），不打印堆栈信息 @@ -238,7 +243,7 @@ public class OpenApiService implements IOpenApiService { // 只验证签名是否正确，不检查证书有效期 try { if (signerInfo.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider("BC").build(cert.getPublicKey()))) { - return new GenericCertificate(cert); + return CertUtil.convertToPem(cert); } } catch (org.bouncycastle.cms.CMSSignerDigestMismatchException e) { // 签名验证失败（数据不匹配），不打印堆栈信息