整理名字
This commit is contained in:
cheney
parent
ee8c42dc8e
commit
75150831c3
@ -58,9 +58,9 @@
|
||||
首块网卡MAC地址
|
||||
硬盘序列号
|
||||
}
|
||||
|
||||
设备指纹是设备指纹信息的 SM2 签名（pkcs1 格式）。
|
||||
~~设备指纹信息存储于文件 /home/tms/device/dev.info 文件，json 格式。~~
|
||||
设备指纹是设备指纹信息的 SM2 签名（pkcs1 格式）。
|
||||
|
||||
设备指纹存放于签名文件 /home/tms/device/dev.sign, pkcs1 格式。校验值 /home/tms/device/dev.sign.sm3。
|
||||
设备指纹密钥公钥存储于文件 /home/tms/device/dev.fingerprint.pub, 公钥格式。校验值 /home/tms/device/dev.fingerprint.pub.sm3。
|
||||
设备激活密钥公钥存储于文件 /home/tms/device/dev.active.pub, 公钥格式。校验值 /home/tms/device/dev.active.pub.sm3。
|
||||
@ -68,3 +68,6 @@
|
||||
|
||||
根证书校验证书 /home/tms/device/rootcert.sign
|
||||
应用完整性公钥 /home/tms/device/dev.mac.pub, 公钥格式。校验值 /home/tms/device/dev.mac.pub.sm3。
|
||||
|
||||
应用程序文件完整性校验文件列表 /home/tms/mac.list
|
||||
应用完整性签名 /home/tms/device/dev.mac.sign
|
||||
@ -1,5 +1,6 @@
|
||||
package com.sunyard.cisd.device.tool;
|
||||
|
||||
import java.io.File;
|
||||
import java.io.InputStream;
|
||||
import java.nio.charset.StandardCharsets;
|
||||
import java.security.PublicKey;
|
||||
@ -14,15 +15,26 @@ public class Main {
|
||||
private static final String PUBLIC_KEY_FILE = DEVICE_DIR + "/dev.fingerprint.pub";
|
||||
private static final String PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.fingerprint.pub.sm3";
|
||||
private static final String FINGERPRINT_DATA_FILE = DEVICE_DIR + "/dev.fingerprint.data";
|
||||
private static final String FINGERPRINT_PRIVATE_KEY_PATH = "/sm2_fingerprint_private_key.pem";
|
||||
private static final String FINGERPRINT_PUBLIC_KEY_PATH = "/sm2_fingerprint_public_key.pem";
|
||||
private static final String MAC_PRIVATE_KEY_PATH = "/sm2_mac_private_key.pem";
|
||||
private static final String MAC_PUBLIC_KEY_PATH = "/sm2_mac_public_key.pem";
|
||||
private static final String FINGERPRINT_PRIVATE_KEY_PATH = "/fingerprint_sm2_private_key.pem";
|
||||
private static final String FINGERPRINT_PUBLIC_KEY_PATH = "/fingerprint_sm2_public_key.pem";
|
||||
private static final String MAC_PRIVATE_KEY_PATH = "/mac_sm2_private_key.pem";
|
||||
private static final String MAC_PUBLIC_KEY_PATH = "/mac_sm2_public_key.pem";
|
||||
private static final String ROOT_CERT_FILE = "/CFCA_TEST_CS_SM2_CA.cer";
|
||||
private static final String ROOT_CERT_OUTPUT_FILE = DEVICE_DIR + "/CFCA_TEST_CS_SM2_CA.cer";
|
||||
private static final String ROOT_CERT_SIGN_FILE = DEVICE_DIR + "/rootcert.sign";
|
||||
private static final String MAC_PUBLIC_KEY_OUTPUT_FILE = DEVICE_DIR + "/dev.mac.pub";
|
||||
private static final String MAC_PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.mac.pub.sm3";
|
||||
private static final String MAC_LIST_FILE = "/home/tms/mac.list";
|
||||
private static final String MAC_SIGN_FILE = DEVICE_DIR + "/dev.mac.sign";
|
||||
|
||||
private static final String[] MAC_TARGETS = {
|
||||
"/home/tms/tms-framework.jar",
|
||||
"/home/tms/config",
|
||||
"/home/tms/libs",
|
||||
"/home/tms/web",
|
||||
"/home/tms/bin",
|
||||
"/home/tms/scripts/tms.sh"
|
||||
};
|
||||
|
||||
public static void main(String[] args) {
|
||||
if (args.length == 0) {
|
||||
@ -48,20 +60,10 @@ public class Main {
|
||||
verifyFingerprint();
|
||||
break;
|
||||
case "mac-gen":
|
||||
if (args.length < 3) {
|
||||
System.err.println("错误: mac-gen 需要两个参数 - 文件夹路径 和 输出文件路径");
|
||||
System.out.println("用法: mac-gen <文件夹路径> <输出文件路径>");
|
||||
} else {
|
||||
generateMAC(args[1], args[2]);
|
||||
}
|
||||
generateMAC();
|
||||
break;
|
||||
case "mac-vertify":
|
||||
if (args.length < 3) {
|
||||
System.err.println("错误: mac-verify 需要两个参数 - 文件夹路径 和 SM3文件路径");
|
||||
System.out.println("用法: mac-verify <文件夹路径> <SM3文件路径>");
|
||||
} else {
|
||||
verifyMAC(args[1], args[2]);
|
||||
}
|
||||
verifyMAC();
|
||||
break;
|
||||
case "rootcert-mac-gen":
|
||||
generateRootCertMAC();
|
||||
@ -88,8 +90,8 @@ public class Main {
|
||||
System.out.println(" info - 获取并显示设备信息");
|
||||
System.out.println(" fingerprint-gen - 获取设备信息并生成设备指纹输出到文件");
|
||||
System.out.println(" fingerprint-vertify - 获取设备信息并验证设备指纹");
|
||||
System.out.println(" mac-gen <文件夹> <输出文件> - 对指定文件夹下所有文件计算SM3并输出到文件");
|
||||
System.out.println(" mac-vertify <文件夹> <SM3文件> - 验证指定文件夹下所有文件的SM3值");
|
||||
System.out.println(" mac-gen - 生成系统文件MAC校验值并签名");
|
||||
System.out.println(" mac-vertify - 验证系统文件MAC校验值");
|
||||
System.out.println(" rootcert-mac-gen - 生成根证书MAC签名");
|
||||
System.out.println(" rootcert-mac-vertify - 验证根证书MAC签名");
|
||||
System.out.println();
|
||||
@ -193,29 +195,117 @@ public class Main {
|
||||
System.out.println("总体验证: " + (dataMatch && signatureVerified));
|
||||
}
|
||||
|
||||
private static void generateMAC(String directoryPath, String outputFilePath) throws Exception {
|
||||
System.out.println("正在计算文件夹 SM3: " + directoryPath);
|
||||
Map<String, String> sm3Map = SM3Util.calculateDirectorySM3(directoryPath);
|
||||
|
||||
System.out.println("\n发现 " + sm3Map.size() + " 个文件:");
|
||||
for (Map.Entry<String, String> entry : sm3Map.entrySet()) {
|
||||
System.out.println(" " + entry.getKey() + " : " + entry.getValue());
|
||||
private static void generateMAC() throws Exception {
|
||||
System.out.println("=== 生成系统文件MAC校验值 ===");
|
||||
System.out.println("目标路径:");
|
||||
for (String target : MAC_TARGETS) {
|
||||
System.out.println(" " + target);
|
||||
}
|
||||
|
||||
SM3Util.writeSM3File(sm3Map, outputFilePath);
|
||||
System.out.println("\nSM3 文件已保存: " + outputFilePath);
|
||||
Map<String, String> sm3Map = new java.util.LinkedHashMap<>();
|
||||
|
||||
for (String target : MAC_TARGETS) {
|
||||
File file = new File(target);
|
||||
if (!file.exists()) {
|
||||
System.out.println("警告: 路径不存在 - " + target);
|
||||
continue;
|
||||
}
|
||||
|
||||
if (file.isFile()) {
|
||||
String sm3Value = SM3Util.sm3FileHex(target);
|
||||
sm3Map.put(target, sm3Value);
|
||||
System.out.println("文件: " + target + " -> " + sm3Value);
|
||||
} else if (file.isDirectory()) {
|
||||
Map<String, String> dirSm3Map = SM3Util.calculateDirectorySM3(target);
|
||||
for (Map.Entry<String, String> entry : dirSm3Map.entrySet()) {
|
||||
String absolutePath = target + "/" + entry.getKey();
|
||||
sm3Map.put(absolutePath, entry.getValue());
|
||||
System.out.println("文件: " + absolutePath + " -> " + entry.getValue());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
StringBuilder macListContent = new StringBuilder();
|
||||
for (Map.Entry<String, String> entry : sm3Map.entrySet()) {
|
||||
macListContent.append(entry.getKey()).append("|").append(entry.getValue()).append("\n");
|
||||
}
|
||||
|
||||
SM3Util.writeFile(MAC_LIST_FILE, macListContent.toString());
|
||||
System.out.println("\nMAC列表文件已保存: " + MAC_LIST_FILE);
|
||||
|
||||
byte[] signature = SM2Util.sign(macListContent.toString().getBytes(StandardCharsets.UTF_8), MAC_PRIVATE_KEY_PATH);
|
||||
SM3Util.writeFile(MAC_SIGN_FILE, signature);
|
||||
System.out.println("MAC签名文件已保存: " + MAC_SIGN_FILE);
|
||||
|
||||
PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
|
||||
boolean verified = SM2Util.verify(macListContent.toString().getBytes(StandardCharsets.UTF_8), signature, publicKey);
|
||||
System.out.println("\n签名验证结果: " + verified);
|
||||
}
|
||||
|
||||
private static void verifyMAC(String directoryPath, String sm3FilePath) throws Exception {
|
||||
System.out.println("正在验证文件夹 SM3: " + directoryPath);
|
||||
System.out.println("使用 SM3 文件: " + sm3FilePath);
|
||||
System.out.println();
|
||||
private static void verifyMAC() throws Exception {
|
||||
System.out.println("=== 验证系统文件MAC校验值 ===");
|
||||
|
||||
boolean verified = SM3Util.verifyDirectorySM3(directoryPath, sm3FilePath);
|
||||
PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
|
||||
byte[] savedSignature = SM3Util.readFileBytes(MAC_SIGN_FILE);
|
||||
String savedMacList = SM3Util.readFile(MAC_LIST_FILE);
|
||||
|
||||
boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey);
|
||||
System.out.println("MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败"));
|
||||
|
||||
if (!macListSignatureValid) {
|
||||
System.out.println("错误: mac.list 签名验证失败，可能被篡改！");
|
||||
System.out.println("\n=== 验证结果 ===");
|
||||
System.out.println("完整性验证: false");
|
||||
return;
|
||||
}
|
||||
|
||||
Map<String, String> savedSm3Map = SM3Util.readSM3File(MAC_LIST_FILE);
|
||||
|
||||
Map<String, String> currentSm3Map = new java.util.LinkedHashMap<>();
|
||||
for (String target : MAC_TARGETS) {
|
||||
File file = new File(target);
|
||||
if (!file.exists()) {
|
||||
continue;
|
||||
}
|
||||
|
||||
if (file.isFile()) {
|
||||
String sm3Value = SM3Util.sm3FileHex(target);
|
||||
currentSm3Map.put(target, sm3Value);
|
||||
} else if (file.isDirectory()) {
|
||||
Map<String, String> dirSm3Map = SM3Util.calculateDirectorySM3(target);
|
||||
for (Map.Entry<String, String> entry : dirSm3Map.entrySet()) {
|
||||
String absolutePath = target + "/" + entry.getKey();
|
||||
currentSm3Map.put(absolutePath, entry.getValue());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
boolean allMatch = true;
|
||||
|
||||
for (Map.Entry<String, String> entry : savedSm3Map.entrySet()) {
|
||||
String filePath = entry.getKey();
|
||||
String savedHash = entry.getValue();
|
||||
String currentHash = currentSm3Map.get(filePath);
|
||||
|
||||
if (currentHash == null) {
|
||||
System.out.println("文件缺失: " + filePath);
|
||||
allMatch = false;
|
||||
} else if (!savedHash.equals(currentHash)) {
|
||||
System.out.println("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")");
|
||||
allMatch = false;
|
||||
}
|
||||
}
|
||||
|
||||
for (String filePath : currentSm3Map.keySet()) {
|
||||
if (!savedSm3Map.containsKey(filePath)) {
|
||||
System.out.println("新增文件: " + filePath);
|
||||
allMatch = false;
|
||||
}
|
||||
}
|
||||
|
||||
System.out.println();
|
||||
System.out.println("=== 验证结果 ===");
|
||||
System.out.println("完整性验证: " + verified);
|
||||
System.out.println("完整性验证: " + allMatch);
|
||||
}
|
||||
|
||||
private static void generateRootCertMAC() throws Exception {
|
||||
|
||||
Loading…
Reference in New Issue
Block a user