save
This commit is contained in:
cheney
parent
95bd0604b6
commit
249d857dc1
@ -42,12 +42,12 @@ public class CertUtil {
|
||||
return (X509Certificate) CF.generateCertificate(new ByteArrayInputStream(certificateString.getBytes())); // 将文件流的证书转化为证书类
|
||||
}
|
||||
|
||||
public static String convertToPem(String cert) throws CertificateEncodingException {
|
||||
public static String convertToPem(X509Certificate cert) throws CertificateEncodingException {
|
||||
|
||||
String cert_begin = "-----BEGIN CERTIFICATE-----\n";
|
||||
String end_cert = "\n-----END CERTIFICATE-----";
|
||||
|
||||
byte[] derCert = cert.getBytes();
|
||||
byte[] derCert = cert.getEncoded();
|
||||
String pemCertPre = Base64.getMimeEncoder().encodeToString(derCert);
|
||||
String pemCert = cert_begin + pemCertPre + end_cert;
|
||||
return pemCert;
|
||||
|
||||
@ -1,8 +1,10 @@
|
||||
package com.cisd.tms.modules.openapi.service.impl;
|
||||
|
||||
import com.cisd.tms.integration.crypto.pcie.PcieSessionTemplate;
|
||||
import com.cisd.tms.integration.crypto.pcie.service.JnaPcieCryptoService;
|
||||
import com.cisd.tms.modules.cert.repository.CertificateRepository;
|
||||
import com.cisd.tms.modules.cert.service.CertificateService;
|
||||
import com.cisd.tms.modules.cert.support.CertUtil;
|
||||
import com.cisd.tms.modules.openapi.service.IOpenApiService;
|
||||
import com.cisd.tms.modules.openapi.service.dto.GenericCertificate;
|
||||
import com.sun.jna.Pointer;
|
||||
@ -23,6 +25,7 @@ import java.security.cert.X509Certificate;
|
||||
@RequiredArgsConstructor
|
||||
public class OpenApiService implements IOpenApiService {
|
||||
|
||||
private final PcieSessionTemplate sessionTemplate;
|
||||
private JnaPcieCryptoService sdf;
|
||||
private final CertificateService certificateService;
|
||||
|
||||
@ -45,50 +48,52 @@ public class OpenApiService implements IOpenApiService {
|
||||
byte[] hash = new byte[32]; // SM3 哈希长度为 32 字节
|
||||
IntByReference hashLength = new IntByReference();
|
||||
|
||||
// 使用空指针作为会话句柄（SDFSoft 支持）
|
||||
Pointer sessionHandle = Pointer.NULL;
|
||||
|
||||
// 默认的 SM2 用户 ID
|
||||
String userId = "1234567812345678";
|
||||
final String userId = "1234567812345678";
|
||||
|
||||
// 初始化哈希（包含公钥和用户 ID）
|
||||
int ret = sdf.SDF_HashInit(sessionHandle, 0, publicKey, userId, userId.length());
|
||||
if (ret != 0) {
|
||||
throw new RuntimeException("SDF_HashInit failed with code: " + ret);
|
||||
}
|
||||
return sessionTemplate.withSession("SM2Sign", (sdf, deviceHandle, sessionHandle) -> {
|
||||
|
||||
// 更新哈希（添加原始数据）
|
||||
ret = sdf.SDF_HashUpdate(sessionHandle, origBytes, origBytes.length);
|
||||
if (ret != 0) {
|
||||
throw new RuntimeException("SDF_HashUpdate failed with code: " + ret);
|
||||
}
|
||||
// 初始化哈希（包含公钥和用户 ID）
|
||||
sessionTemplate.ensureSuccess(
|
||||
"SDF_HashInit",
|
||||
sdf.SDF_HashInit(sessionHandle, 0, publicKey, userId.getBytes(), 16)
|
||||
);
|
||||
|
||||
// 完成哈希
|
||||
ret = sdf.SDF_HashFinal(sessionHandle, hash, hashLength);
|
||||
if (ret != 0) {
|
||||
throw new RuntimeException("SDF_HashFinal failed with code: " + ret);
|
||||
}
|
||||
// 更新哈希（添加原始数据）
|
||||
sessionTemplate.ensureSuccess(
|
||||
"SDF_HashUpdate",
|
||||
sdf.SDF_HashUpdate(sessionHandle, origBytes, origBytes.length)
|
||||
);
|
||||
|
||||
// 使用 SDF 接口进行 SM2 签名
|
||||
byte[] signature = new byte[64]; // SM2 签名长度为 64 字节
|
||||
ret = sdf.SDF_InternalSign_ECC(sessionHandle, keyIndex, hash, hashLength.getValue(), signature);
|
||||
if (ret != 0) {
|
||||
throw new RuntimeException("SDF_InternalSign_ECC failed with code: " + ret);
|
||||
}
|
||||
// 完成哈希
|
||||
sessionTemplate.ensureSuccess(
|
||||
"SDF_HashFinal",
|
||||
sdf.SDF_HashFinal(sessionHandle, hash, hashLength)
|
||||
);
|
||||
|
||||
// 使用 SDF 接口进行 SM2 签名
|
||||
byte[] signature = new byte[64]; // SM2 签名长度为 64 字节
|
||||
sessionTemplate.ensureSuccess(
|
||||
"SDF_InternalSign_ECC",
|
||||
sdf.SDF_InternalSign_ECC(sessionHandle, keyIndex, hash, hashLength.getValue(), signature)
|
||||
);
|
||||
|
||||
// 返回 Base64 编码的签名
|
||||
return new String(Base64.encode(signature));
|
||||
});
|
||||
|
||||
// 返回 Base64 编码的签名
|
||||
return new String(Base64.encode(signature));
|
||||
} catch (Exception e) {
|
||||
e.printStackTrace();
|
||||
throw new RuntimeException("Raw sign failed: " + e.getMessage(), e);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@Override
|
||||
public boolean rawVerify(byte[] origBytes, String certStr, String dn) {
|
||||
try {
|
||||
// 获取证书
|
||||
X509Certificate cert = certManager.getCertificate(dn);
|
||||
X509Certificate cert = certificateService.getBySubjectDn(dn);
|
||||
if (cert == null) {
|
||||
return false;
|
||||
}
|
||||
@ -141,7 +146,7 @@ public class OpenApiService implements IOpenApiService {
|
||||
try {
|
||||
// 获取密钥对和证书
|
||||
KeyPair keyPair = certManager.getKeyPair(dn);
|
||||
X509Certificate cert = certManager.getCertificate(dn);
|
||||
X509Certificate cert = certificateService.getBySubjectDn(dn);
|
||||
if (keyPair == null || cert == null) {
|
||||
throw new RuntimeException("Certificate not found for DN: " + dn);
|
||||
}
|
||||
@ -198,7 +203,7 @@ public class OpenApiService implements IOpenApiService {
|
||||
// 验证证书有效性（检查有效期）
|
||||
cert.checkValidity(new java.util.Date());
|
||||
|
||||
return new GenericCertificate(cert);
|
||||
return CertUtil.convertToPem(cert);
|
||||
}
|
||||
} catch (org.bouncycastle.cms.CMSSignerDigestMismatchException e) {
|
||||
// 签名验证失败（数据不匹配），不打印堆栈信息
|
||||
@ -238,7 +243,7 @@ public class OpenApiService implements IOpenApiService {
|
||||
// 只验证签名是否正确，不检查证书有效期
|
||||
try {
|
||||
if (signerInfo.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider("BC").build(cert.getPublicKey()))) {
|
||||
return new GenericCertificate(cert);
|
||||
return CertUtil.convertToPem(cert);
|
||||
}
|
||||
} catch (org.bouncycastle.cms.CMSSignerDigestMismatchException e) {
|
||||
// 签名验证失败（数据不匹配），不打印堆栈信息
|
||||
|
||||
Loading…
Reference in New Issue
Block a user