diff --git a/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java b/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java index f22f5d5..651b26a 100644 --- a/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java +++ b/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java @@ -27,6 +27,9 @@ public class Main { public static final String MAC_LIST_FILE = "/home/tms/mac.list"; public static final String MAC_SIGN_FILE = DEVICE_DIR + "/dev.mac.sign"; + public static final String CMEP_MAC_LIST_FILE = "/home/cmep4i/cmep.mac.list"; + public static final String CMEP_MAC_SIGN_FILE = "/home/cmep4i/cmep.mac.sign"; + public static final String[] MAC_TARGETS = { "/home/tms/tms-framework.jar", "/home/tms/config", @@ -36,6 +39,11 @@ public class Main { "/home/tms/scripts/tms.sh" }; + public static final String[] CMEP_TARGETS = { + "/home/cmep4i/cmsp/CMEP-CMSP.jar", + "/home/cmep4i/cmtp/CMEP-CMSP.jar" + }; + public static void main(String[] args) { if (args.length == 0) { printHelp(); @@ -59,12 +67,18 @@ public class Main { case "fingerprint-vertify": verifyFingerprint(); break; - case "mac-gen": + case "tms-mac-gen": generateMAC(); break; - case "mac-vertify": + case "tms-mac-vertify": verifyMAC(); break; + case "cmep-mac-gen": + generateCMEPMAC(); + break; + case "cmep-mac-vertify": + verifyCMEPMAC(); + break; case "rootcert-mac-gen": generateRootCertMAC(); break; @@ -90,8 +104,10 @@ public class Main { System.out.println(" info - 获取并显示设备信息"); System.out.println(" fingerprint-gen - 获取设备信息并生成设备指纹输出到文件"); System.out.println(" fingerprint-vertify - 获取设备信息并验证设备指纹"); - System.out.println(" mac-gen - 生成系统文件MAC校验值并签名"); - System.out.println(" mac-vertify - 验证系统文件MAC校验值"); + System.out.println(" tms-mac-gen - 生成TMS系统文件MAC校验值并签名"); + System.out.println(" tms-mac-vertify - 验证TMS系统文件MAC校验值"); + System.out.println(" cmep-mac-gen - 生成CMEP文件MAC校验值并签名"); + System.out.println(" cmep-mac-vertify - 验证CMEP文件MAC校验值"); System.out.println(" rootcert-mac-gen - 生成根证书MAC签名"); System.out.println(" rootcert-mac-vertify - 验证根证书MAC签名"); System.out.println(); @@ -316,8 +332,7 @@ public class Main { throw new IllegalArgumentException("根证书文件未找到: " + ROOT_CERT_FILE); } - byte[] certData = certInputStream.readAllBytes(); - certInputStream.close(); + byte[] certData = readInputStream(certInputStream); SM3Util.writeFile(ROOT_CERT_OUTPUT_FILE, certData); System.out.println("根证书已输出: " + ROOT_CERT_OUTPUT_FILE); @@ -353,8 +368,7 @@ public class Main { if (certInputStream == null) { throw new IllegalArgumentException("根证书文件未找到: " + ROOT_CERT_FILE); } - byte[] certData = certInputStream.readAllBytes(); - certInputStream.close(); + byte[] certData = readInputStream(certInputStream); byte[] signature = SM3Util.readFileBytes(ROOT_CERT_SIGN_FILE); @@ -365,4 +379,120 @@ public class Main { System.out.println("=== 验证结果 ==="); System.out.println("总体验证: " + (publicKeyValid && signatureVerified)); } + + private static byte[] readInputStream(InputStream is) throws Exception { + try { + java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream(); + byte[] buffer = new byte[8192]; + int len; + while ((len = is.read(buffer)) != -1) { + baos.write(buffer, 0, len); + } + return baos.toByteArray(); + } finally { + if (is != null) { + is.close(); + } + } + } + + private static void generateCMEPMAC() throws Exception { + System.out.println("=== 生成CMEP文件MAC校验值 ==="); + System.out.println("目标路径:"); + for (String target : CMEP_TARGETS) { + System.out.println(" " + target); + } + + Map sm3Map = new java.util.LinkedHashMap<>(); + + for (String target : CMEP_TARGETS) { + File file = new File(target); + if (!file.exists()) { + System.out.println("警告: 路径不存在 - " + target); + continue; + } + + if (file.isFile()) { + String sm3Value = SM3Util.sm3FileHex(target); + sm3Map.put(target, sm3Value); + System.out.println("文件: " + target + " -> " + sm3Value); + } + } + + StringBuilder macListContent = new StringBuilder(); + for (Map.Entry entry : sm3Map.entrySet()) { + macListContent.append(entry.getKey()).append("|").append(entry.getValue()).append("\n"); + } + + SM3Util.writeFile(CMEP_MAC_LIST_FILE, macListContent.toString()); + System.out.println("\nCMEP MAC列表文件已保存: " + CMEP_MAC_LIST_FILE); + + byte[] signature = SM2Util.sign(macListContent.toString().getBytes(StandardCharsets.UTF_8), MAC_PRIVATE_KEY_PATH); + SM3Util.writeFile(CMEP_MAC_SIGN_FILE, signature); + System.out.println("CMEP MAC签名文件已保存: " + CMEP_MAC_SIGN_FILE); + + PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH); + boolean verified = SM2Util.verify(macListContent.toString().getBytes(StandardCharsets.UTF_8), signature, publicKey); + System.out.println("\n签名验证结果: " + verified); + } + + private static void verifyCMEPMAC() throws Exception { + System.out.println("=== 验证CMEP文件MAC校验值 ==="); + + PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH); + byte[] savedSignature = SM3Util.readFileBytes(CMEP_MAC_SIGN_FILE); + String savedMacList = SM3Util.readFile(CMEP_MAC_LIST_FILE); + + boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey); + System.out.println("CMEP MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败")); + + if (!macListSignatureValid) { + System.out.println("错误: cmep.mac.list 签名验证失败，可能被篡改！"); + System.out.println("\n=== 验证结果 ==="); + System.out.println("完整性验证: false"); + return; + } + + Map savedSm3Map = SM3Util.readSM3File(CMEP_MAC_LIST_FILE); + + Map currentSm3Map = new java.util.LinkedHashMap<>(); + for (String target : CMEP_TARGETS) { + File file = new File(target); + if (!file.exists()) { + continue; + } + + if (file.isFile()) { + String sm3Value = SM3Util.sm3FileHex(target); + currentSm3Map.put(target, sm3Value); + } + } + + boolean allMatch = true; + + for (Map.Entry entry : savedSm3Map.entrySet()) { + String filePath = entry.getKey(); + String savedHash = entry.getValue(); + String currentHash = currentSm3Map.get(filePath); + + if (currentHash == null) { + System.out.println("文件缺失: " + filePath); + allMatch = false; + } else if (!savedHash.equals(currentHash)) { + System.out.println("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")"); + allMatch = false; + } + } + + for (String filePath : currentSm3Map.keySet()) { + if (!savedSm3Map.containsKey(filePath)) { + System.out.println("新增文件: " + filePath); + allMatch = false; + } + } + + System.out.println(); + System.out.println("=== 验证结果 ==="); + System.out.println("完整性验证: " + allMatch); + } } diff --git a/src/main/java/com/cisd/tms/modules/system/service/impl/SelfCheckServiceImpl.java b/src/main/java/com/cisd/tms/modules/system/service/impl/SelfCheckServiceImpl.java index 18c70f2..17b86ab 100644 --- a/src/main/java/com/cisd/tms/modules/system/service/impl/SelfCheckServiceImpl.java +++ b/src/main/java/com/cisd/tms/modules/system/service/impl/SelfCheckServiceImpl.java @@ -177,19 +177,19 @@ public class SelfCheckServiceImpl implements SelfCheckService { private boolean doVerifyTmsIntegrity() { try { - System.out.println("=== 验证系统文件MAC校验值 ==="); + log.info("=== 验证系统文件MAC校验值 ==="); PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH); byte[] savedSignature = SM3Util.readFileBytes(MAC_SIGN_FILE); String savedMacList = SM3Util.readFile(MAC_LIST_FILE); boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey); - System.out.println("MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败")); + log.info("MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败")); if (!macListSignatureValid) { - System.out.println("错误: mac.list 签名验证失败，可能被篡改！"); - System.out.println("\n=== 验证结果 ==="); - System.out.println("完整性验证: false"); + log.info("错误: mac.list 签名验证失败，可能被篡改！"); + log.info("\n=== 验证结果 ==="); + log.info("完整性验证: false"); return false; } @@ -222,24 +222,24 @@ public class SelfCheckServiceImpl implements SelfCheckService { String currentHash = currentSm3Map.get(filePath); if (currentHash == null) { - System.out.println("文件缺失: " + filePath); + log.info("文件缺失: " + filePath); allMatch = false; } else if (!savedHash.equals(currentHash)) { - System.out.println("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")"); + log.info("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")"); allMatch = false; } } for (String filePath : currentSm3Map.keySet()) { if (!savedSm3Map.containsKey(filePath)) { - System.out.println("新增文件: " + filePath); + log.info("新增文件: " + filePath); allMatch = false; } } - System.out.println(); - System.out.println("=== 验证结果 ==="); - System.out.println("完整性验证: " + allMatch); + log.info(""); + log.info("=== 验证结果 ==="); + log.info("完整性验证: " + allMatch); return allMatch; } catch (Exception e) { log.error("[ERROR] {} - {}", CHECK_TMS_INTEGRITY, e.getMessage()); @@ -248,6 +248,68 @@ public class SelfCheckServiceImpl implements SelfCheckService { } private boolean doVerifyStandardTransceiverIntegrity() { - return false; + try { + log.info("=== 验证CMEP文件MAC校验值 ==="); + + PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH); + byte[] savedSignature = SM3Util.readFileBytes(CMEP_MAC_SIGN_FILE); + String savedMacList = SM3Util.readFile(CMEP_MAC_LIST_FILE); + + boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey); + log.info("CMEP MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败")); + + if (!macListSignatureValid) { + log.info("错误: cmep.mac.list 签名验证失败，可能被篡改！"); + log.info("\n=== 验证结果 ==="); + log.info("完整性验证: false"); + return false; + } + + Map savedSm3Map = SM3Util.readSM3File(CMEP_MAC_LIST_FILE); + + Map currentSm3Map = new java.util.LinkedHashMap<>(); + for (String target : CMEP_TARGETS) { + File file = new File(target); + if (!file.exists()) { + continue; + } + + if (file.isFile()) { + String sm3Value = SM3Util.sm3FileHex(target); + currentSm3Map.put(target, sm3Value); + } + } + + boolean allMatch = true; + + for (Map.Entry entry : savedSm3Map.entrySet()) { + String filePath = entry.getKey(); + String savedHash = entry.getValue(); + String currentHash = currentSm3Map.get(filePath); + + if (currentHash == null) { + log.info("文件缺失: " + filePath); + allMatch = false; + } else if (!savedHash.equals(currentHash)) { + log.info("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")"); + allMatch = false; + } + } + + for (String filePath : currentSm3Map.keySet()) { + if (!savedSm3Map.containsKey(filePath)) { + log.info("新增文件: " + filePath); + allMatch = false; + } + } + + log.info(""); + log.info("=== 验证结果 ==="); + log.info("完整性验证: " + allMatch); + return allMatch; + } catch (Exception e) { + log.error("[ERROR] {} - {}", CHECK_STANDARD_TRANSCEIVER, e.getMessage()); + return false; + } } } \ No newline at end of file