终端管理系统主程序完整性自检

device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java

@@ -27,6 +27,9 @@ public class Main {
     public static final String MAC_LIST_FILE = "/home/tms/mac.list";
     public static final String MAC_SIGN_FILE = DEVICE_DIR + "/dev.mac.sign";
     
+    public static final String CMEP_MAC_LIST_FILE = "/home/cmep4i/cmep.mac.list";
+    public static final String CMEP_MAC_SIGN_FILE = "/home/cmep4i/cmep.mac.sign";
+    
     public static final String[] MAC_TARGETS = {
         "/home/tms/tms-framework.jar",
         "/home/tms/config",
@@ -36,6 +39,11 @@ public class Main {
         "/home/tms/scripts/tms.sh"
     };
     
+    public static final String[] CMEP_TARGETS = {
+        "/home/cmep4i/cmsp/CMEP-CMSP.jar",
+        "/home/cmep4i/cmtp/CMEP-CMSP.jar"
+    };
+    
     public static void main(String[] args) {
         if (args.length == 0) {
             printHelp();
@@ -59,12 +67,18 @@ public class Main {
                 case "fingerprint-vertify":
                     verifyFingerprint();
                     break;
-                case "mac-gen":
+                case "tms-mac-gen":
                     generateMAC();
                     break;
-                case "mac-vertify":
+                case "tms-mac-vertify":
                     verifyMAC();
                     break;
+                case "cmep-mac-gen":
+                    generateCMEPMAC();
+                    break;
+                case "cmep-mac-vertify":
+                    verifyCMEPMAC();
+                    break;
                 case "rootcert-mac-gen":
                     generateRootCertMAC();
                     break;
@@ -90,8 +104,10 @@ public class Main {
         System.out.println("  info                              - 获取并显示设备信息");
         System.out.println("  fingerprint-gen                   - 获取设备信息并生成设备指纹输出到文件");
         System.out.println("  fingerprint-vertify                - 获取设备信息并验证设备指纹");
-        System.out.println("  mac-gen                           - 生成系统文件MAC校验值并签名");
+        System.out.println("  tms-mac-gen                       - 生成TMS系统文件MAC校验值并签名");
-        System.out.println("  mac-vertify                       - 验证系统文件MAC校验值");
+        System.out.println("  tms-mac-vertify                   - 验证TMS系统文件MAC校验值");
+        System.out.println("  cmep-mac-gen                      - 生成CMEP文件MAC校验值并签名");
+        System.out.println("  cmep-mac-vertify                  - 验证CMEP文件MAC校验值");
         System.out.println("  rootcert-mac-gen                  - 生成根证书MAC签名");
         System.out.println("  rootcert-mac-vertify              - 验证根证书MAC签名");
         System.out.println();
@@ -316,8 +332,7 @@ public class Main {
             throw new IllegalArgumentException("根证书文件未找到: " + ROOT_CERT_FILE);
         }
 
-        byte[] certData = certInputStream.readAllBytes();
+        byte[] certData = readInputStream(certInputStream);
-        certInputStream.close();
 
         SM3Util.writeFile(ROOT_CERT_OUTPUT_FILE, certData);
         System.out.println("根证书已输出: " + ROOT_CERT_OUTPUT_FILE);
@@ -353,8 +368,7 @@ public class Main {
         if (certInputStream == null) {
             throw new IllegalArgumentException("根证书文件未找到: " + ROOT_CERT_FILE);
         }
-        byte[] certData = certInputStream.readAllBytes();
+        byte[] certData = readInputStream(certInputStream);
-        certInputStream.close();
 
         byte[] signature = SM3Util.readFileBytes(ROOT_CERT_SIGN_FILE);
 
@@ -365,4 +379,120 @@ public class Main {
         System.out.println("=== 验证结果 ===");
         System.out.println("总体验证: " + (publicKeyValid && signatureVerified));
     }
+    
+    private static byte[] readInputStream(InputStream is) throws Exception {
+        try {
+            java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream();
+            byte[] buffer = new byte[8192];
+            int len;
+            while ((len = is.read(buffer)) != -1) {
+                baos.write(buffer, 0, len);
+            }
+            return baos.toByteArray();
+        } finally {
+            if (is != null) {
+                is.close();
+            }
+        }
+    }
+    
+    private static void generateCMEPMAC() throws Exception {
+        System.out.println("=== 生成CMEP文件MAC校验值 ===");
+        System.out.println("目标路径:");
+        for (String target : CMEP_TARGETS) {
+            System.out.println("  " + target);
+        }
+
+        Map<String, String> sm3Map = new java.util.LinkedHashMap<>();
+        
+        for (String target : CMEP_TARGETS) {
+            File file = new File(target);
+            if (!file.exists()) {
+                System.out.println("警告: 路径不存在 - " + target);
+                continue;
+            }
+            
+            if (file.isFile()) {
+                String sm3Value = SM3Util.sm3FileHex(target);
+                sm3Map.put(target, sm3Value);
+                System.out.println("文件: " + target + " -> " + sm3Value);
+            }
+        }
+
+        StringBuilder macListContent = new StringBuilder();
+        for (Map.Entry<String, String> entry : sm3Map.entrySet()) {
+            macListContent.append(entry.getKey()).append("|").append(entry.getValue()).append("\n");
+        }
+        
+        SM3Util.writeFile(CMEP_MAC_LIST_FILE, macListContent.toString());
+        System.out.println("\nCMEP MAC列表文件已保存: " + CMEP_MAC_LIST_FILE);
+
+        byte[] signature = SM2Util.sign(macListContent.toString().getBytes(StandardCharsets.UTF_8), MAC_PRIVATE_KEY_PATH);
+        SM3Util.writeFile(CMEP_MAC_SIGN_FILE, signature);
+        System.out.println("CMEP MAC签名文件已保存: " + CMEP_MAC_SIGN_FILE);
+        
+        PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
+        boolean verified = SM2Util.verify(macListContent.toString().getBytes(StandardCharsets.UTF_8), signature, publicKey);
+        System.out.println("\n签名验证结果: " + verified);
+    }
+    
+    private static void verifyCMEPMAC() throws Exception {
+        System.out.println("=== 验证CMEP文件MAC校验值 ===");
+
+        PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
+        byte[] savedSignature = SM3Util.readFileBytes(CMEP_MAC_SIGN_FILE);
+        String savedMacList = SM3Util.readFile(CMEP_MAC_LIST_FILE);
+
+        boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey);
+        System.out.println("CMEP MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败"));
+        
+        if (!macListSignatureValid) {
+            System.out.println("错误: cmep.mac.list 签名验证失败，可能被篡改！");
+            System.out.println("\n=== 验证结果 ===");
+            System.out.println("完整性验证: false");
+            return;
+        }
+
+        Map<String, String> savedSm3Map = SM3Util.readSM3File(CMEP_MAC_LIST_FILE);
+        
+        Map<String, String> currentSm3Map = new java.util.LinkedHashMap<>();
+        for (String target : CMEP_TARGETS) {
+            File file = new File(target);
+            if (!file.exists()) {
+                continue;
+            }
+            
+            if (file.isFile()) {
+                String sm3Value = SM3Util.sm3FileHex(target);
+                currentSm3Map.put(target, sm3Value);
+            }
+        }
+
+        boolean allMatch = true;
+        
+        for (Map.Entry<String, String> entry : savedSm3Map.entrySet()) {
+            String filePath = entry.getKey();
+            String savedHash = entry.getValue();
+            String currentHash = currentSm3Map.get(filePath);
+            
+            if (currentHash == null) {
+                System.out.println("文件缺失: " + filePath);
+                allMatch = false;
+            } else if (!savedHash.equals(currentHash)) {
+                System.out.println("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")");
+                allMatch = false;
+            }
+        }
+
+        for (String filePath : currentSm3Map.keySet()) {
+            if (!savedSm3Map.containsKey(filePath)) {
+                System.out.println("新增文件: " + filePath);
+                allMatch = false;
+            }
+        }
+
+        System.out.println();
+        System.out.println("=== 验证结果 ===");
+        System.out.println("完整性验证: " + allMatch);
+    }
 }

src/main/java/com/cisd/tms/modules/system/service/impl/SelfCheckServiceImpl.java

@@ -177,19 +177,19 @@ public class SelfCheckServiceImpl implements SelfCheckService {
 
     private boolean doVerifyTmsIntegrity() {
         try {
-            System.out.println("=== 验证系统文件MAC校验值 ===");
+            log.info("=== 验证系统文件MAC校验值 ===");
 
             PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
             byte[] savedSignature = SM3Util.readFileBytes(MAC_SIGN_FILE);
             String savedMacList = SM3Util.readFile(MAC_LIST_FILE);
 
             boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey);
-            System.out.println("MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败"));
+            log.info("MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败"));
 
             if (!macListSignatureValid) {
-                System.out.println("错误: mac.list 签名验证失败，可能被篡改！");
+                log.info("错误: mac.list 签名验证失败，可能被篡改！");
-                System.out.println("\n=== 验证结果 ===");
+                log.info("\n=== 验证结果 ===");
-                System.out.println("完整性验证: false");
+                log.info("完整性验证: false");
                 return false;
             }
 
@@ -222,24 +222,24 @@ public class SelfCheckServiceImpl implements SelfCheckService {
                 String currentHash = currentSm3Map.get(filePath);
 
                 if (currentHash == null) {
-                    System.out.println("文件缺失: " + filePath);
+                    log.info("文件缺失: " + filePath);
                     allMatch = false;
                 } else if (!savedHash.equals(currentHash)) {
-                    System.out.println("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")");
+                    log.info("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")");
                     allMatch = false;
                 }
             }
 
             for (String filePath : currentSm3Map.keySet()) {
                 if (!savedSm3Map.containsKey(filePath)) {
-                    System.out.println("新增文件: " + filePath);
+                    log.info("新增文件: " + filePath);
                     allMatch = false;
                 }
             }
 
-            System.out.println();
+            log.info("");
-            System.out.println("=== 验证结果 ===");
+            log.info("=== 验证结果 ===");
-            System.out.println("完整性验证: " + allMatch);
+            log.info("完整性验证: " + allMatch);
             return allMatch;
         } catch (Exception e) {
             log.error("[ERROR] {} - {}", CHECK_TMS_INTEGRITY, e.getMessage());
@@ -248,6 +248,68 @@ public class SelfCheckServiceImpl implements SelfCheckService {
     }
 
     private boolean doVerifyStandardTransceiverIntegrity() {
+        try {
+            log.info("=== 验证CMEP文件MAC校验值 ===");
+
+            PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
+            byte[] savedSignature = SM3Util.readFileBytes(CMEP_MAC_SIGN_FILE);
+            String savedMacList = SM3Util.readFile(CMEP_MAC_LIST_FILE);
+
+            boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey);
+            log.info("CMEP MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败"));
+
+            if (!macListSignatureValid) {
+                log.info("错误: cmep.mac.list 签名验证失败，可能被篡改！");
+                log.info("\n=== 验证结果 ===");
+                log.info("完整性验证: false");
                 return false;
             }
+
+            Map<String, String> savedSm3Map = SM3Util.readSM3File(CMEP_MAC_LIST_FILE);
+
+            Map<String, String> currentSm3Map = new java.util.LinkedHashMap<>();
+            for (String target : CMEP_TARGETS) {
+                File file = new File(target);
+                if (!file.exists()) {
+                    continue;
+                }
+
+                if (file.isFile()) {
+                    String sm3Value = SM3Util.sm3FileHex(target);
+                    currentSm3Map.put(target, sm3Value);
+                }
+            }
+
+            boolean allMatch = true;
+
+            for (Map.Entry<String, String> entry : savedSm3Map.entrySet()) {
+                String filePath = entry.getKey();
+                String savedHash = entry.getValue();
+                String currentHash = currentSm3Map.get(filePath);
+
+                if (currentHash == null) {
+                    log.info("文件缺失: " + filePath);
+                    allMatch = false;
+                } else if (!savedHash.equals(currentHash)) {
+                    log.info("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")");
+                    allMatch = false;
+                }
+            }
+
+            for (String filePath : currentSm3Map.keySet()) {
+                if (!savedSm3Map.containsKey(filePath)) {
+                    log.info("新增文件: " + filePath);
+                    allMatch = false;
+                }
+            }
+
+            log.info("");
+            log.info("=== 验证结果 ===");
+            log.info("完整性验证: " + allMatch);
+            return allMatch;
+        } catch (Exception e) {
+            log.error("[ERROR] {} - {}", CHECK_STANDARD_TRANSCEIVER, e.getMessage());
+            return false;
+        }
+    }
 }