Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

终端管理系统主程序完整性自检

Browse Source
This commit is contained in:
cheney 2026-05-15 14:46:08 +08:00
parent cd690bd2d9
commit a177277f04
2 changed files with 212 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

146
device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java
View File

@ -27,6 +27,9 @@ public class Main {
public static final String MAC_LIST_FILE = "/home/tms/mac.list";
public static final String MAC_SIGN_FILE = DEVICE_DIR + "/dev.mac.sign";
public static final String CMEP_MAC_LIST_FILE = "/home/cmep4i/cmep.mac.list";
public static final String CMEP_MAC_SIGN_FILE = "/home/cmep4i/cmep.mac.sign";
public static final String[] MAC_TARGETS = {
"/home/tms/tms-framework.jar",
"/home/tms/config",
@ -36,6 +39,11 @@ public class Main {
"/home/tms/scripts/tms.sh"
};
public static final String[] CMEP_TARGETS = {
"/home/cmep4i/cmsp/CMEP-CMSP.jar",
"/home/cmep4i/cmtp/CMEP-CMSP.jar"
};
public static void main(String[] args) {
if (args.length == 0) {
printHelp();
@ -59,12 +67,18 @@ public class Main {
case "fingerprint-vertify":
verifyFingerprint();
break;
case "mac-gen":
case "tms-mac-gen":
generateMAC();
break;
case "mac-vertify":
case "tms-mac-vertify":
verifyMAC();
break;
case "cmep-mac-gen":
generateCMEPMAC();
break;
case "cmep-mac-vertify":
verifyCMEPMAC();
break;
case "rootcert-mac-gen":
generateRootCertMAC();
break;
@ -90,8 +104,10 @@ public class Main {
System.out.println(" info - 获取并显示设备信息");
System.out.println(" fingerprint-gen - 获取设备信息并生成设备指纹输出到文件");
System.out.println(" fingerprint-vertify - 获取设备信息并验证设备指纹");
System.out.println(" mac-gen - 生成系统文件MAC校验值并签名");
System.out.println(" mac-vertify - 验证系统文件MAC校验值");
System.out.println(" tms-mac-gen - 生成TMS系统文件MAC校验值并签名");
System.out.println(" tms-mac-vertify - 验证TMS系统文件MAC校验值");
System.out.println(" cmep-mac-gen - 生成CMEP文件MAC校验值并签名");
System.out.println(" cmep-mac-vertify - 验证CMEP文件MAC校验值");
System.out.println(" rootcert-mac-gen - 生成根证书MAC签名");
System.out.println(" rootcert-mac-vertify - 验证根证书MAC签名");
System.out.println();
@ -316,8 +332,7 @@ public class Main {
throw new IllegalArgumentException("根证书文件未找到: " + ROOT_CERT_FILE);
}
byte[] certData = certInputStream.readAllBytes();
certInputStream.close();
byte[] certData = readInputStream(certInputStream);
SM3Util.writeFile(ROOT_CERT_OUTPUT_FILE, certData);
System.out.println("根证书已输出: " + ROOT_CERT_OUTPUT_FILE);
@ -353,8 +368,7 @@ public class Main {
if (certInputStream == null) {
throw new IllegalArgumentException("根证书文件未找到: " + ROOT_CERT_FILE);
}
byte[] certData = certInputStream.readAllBytes();
certInputStream.close();
byte[] certData = readInputStream(certInputStream);
byte[] signature = SM3Util.readFileBytes(ROOT_CERT_SIGN_FILE);
@ -365,4 +379,120 @@ public class Main {
System.out.println("=== 验证结果 ===");
System.out.println("总体验证: " + (publicKeyValid && signatureVerified));
}
private static byte[] readInputStream(InputStream is) throws Exception {
try {
java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream();
byte[] buffer = new byte[8192];
int len;
while ((len = is.read(buffer)) != -1) {
baos.write(buffer, 0, len);
}
return baos.toByteArray();
} finally {
if (is != null) {
is.close();
}
}
}
private static void generateCMEPMAC() throws Exception {
System.out.println("=== 生成CMEP文件MAC校验值 ===");
System.out.println("目标路径:");
for (String target : CMEP_TARGETS) {
System.out.println(" " + target);
}
Map<String, String> sm3Map = new java.util.LinkedHashMap<>();
for (String target : CMEP_TARGETS) {
File file = new File(target);
if (!file.exists()) {
System.out.println("警告: 路径不存在 - " + target);
continue;
}
if (file.isFile()) {
String sm3Value = SM3Util.sm3FileHex(target);
sm3Map.put(target, sm3Value);
System.out.println("文件: " + target + " -> " + sm3Value);
}
}
StringBuilder macListContent = new StringBuilder();
for (Map.Entry<String, String> entry : sm3Map.entrySet()) {
macListContent.append(entry.getKey()).append("|").append(entry.getValue()).append("\n");
}
SM3Util.writeFile(CMEP_MAC_LIST_FILE, macListContent.toString());
System.out.println("\nCMEP MAC列表文件已保存: " + CMEP_MAC_LIST_FILE);
byte[] signature = SM2Util.sign(macListContent.toString().getBytes(StandardCharsets.UTF_8), MAC_PRIVATE_KEY_PATH);
SM3Util.writeFile(CMEP_MAC_SIGN_FILE, signature);
System.out.println("CMEP MAC签名文件已保存: " + CMEP_MAC_SIGN_FILE);
PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
boolean verified = SM2Util.verify(macListContent.toString().getBytes(StandardCharsets.UTF_8), signature, publicKey);
System.out.println("\n签名验证结果: " + verified);
}
private static void verifyCMEPMAC() throws Exception {
System.out.println("=== 验证CMEP文件MAC校验值 ===");
PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
byte[] savedSignature = SM3Util.readFileBytes(CMEP_MAC_SIGN_FILE);
String savedMacList = SM3Util.readFile(CMEP_MAC_LIST_FILE);
boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey);
System.out.println("CMEP MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败"));
if (!macListSignatureValid) {
System.out.println("错误: cmep.mac.list 签名验证失败，可能被篡改！");
System.out.println("\n=== 验证结果 ===");
System.out.println("完整性验证: false");
return;
}
Map<String, String> savedSm3Map = SM3Util.readSM3File(CMEP_MAC_LIST_FILE);
Map<String, String> currentSm3Map = new java.util.LinkedHashMap<>();
for (String target : CMEP_TARGETS) {
File file = new File(target);
if (!file.exists()) {
continue;
}
if (file.isFile()) {
String sm3Value = SM3Util.sm3FileHex(target);
currentSm3Map.put(target, sm3Value);
}
}
boolean allMatch = true;
for (Map.Entry<String, String> entry : savedSm3Map.entrySet()) {
String filePath = entry.getKey();
String savedHash = entry.getValue();
String currentHash = currentSm3Map.get(filePath);
if (currentHash == null) {
System.out.println("文件缺失: " + filePath);
allMatch = false;
} else if (!savedHash.equals(currentHash)) {
System.out.println("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")");
allMatch = false;
}
}
for (String filePath : currentSm3Map.keySet()) {
if (!savedSm3Map.containsKey(filePath)) {
System.out.println("新增文件: " + filePath);
allMatch = false;
}
}
System.out.println();
System.out.println("=== 验证结果 ===");
System.out.println("完整性验证: " + allMatch);
}
}

86
src/main/java/com/cisd/tms/modules/system/service/impl/SelfCheckServiceImpl.java
View File

@ -177,19 +177,19 @@ public class SelfCheckServiceImpl implements SelfCheckService {
private boolean doVerifyTmsIntegrity() {
try {
System.out.println("=== 验证系统文件MAC校验值 ===");
log.info("=== 验证系统文件MAC校验值 ===");
PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
byte[] savedSignature = SM3Util.readFileBytes(MAC_SIGN_FILE);
String savedMacList = SM3Util.readFile(MAC_LIST_FILE);
boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey);
System.out.println("MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败"));
log.info("MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败"));
if (!macListSignatureValid) {
System.out.println("错误: mac.list 签名验证失败，可能被篡改！");
System.out.println("\n=== 验证结果 ===");
System.out.println("完整性验证: false");
log.info("错误: mac.list 签名验证失败，可能被篡改！");
log.info("\n=== 验证结果 ===");
log.info("完整性验证: false");
return false;
}
@ -222,24 +222,24 @@ public class SelfCheckServiceImpl implements SelfCheckService {
String currentHash = currentSm3Map.get(filePath);
if (currentHash == null) {
System.out.println("文件缺失: " + filePath);
log.info("文件缺失: " + filePath);
allMatch = false;
} else if (!savedHash.equals(currentHash)) {
System.out.println("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")");
log.info("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")");
allMatch = false;
}
}
for (String filePath : currentSm3Map.keySet()) {
if (!savedSm3Map.containsKey(filePath)) {
System.out.println("新增文件: " + filePath);
log.info("新增文件: " + filePath);
allMatch = false;
}
}
System.out.println();
System.out.println("=== 验证结果 ===");
System.out.println("完整性验证: " + allMatch);
log.info("");
log.info("=== 验证结果 ===");
log.info("完整性验证: " + allMatch);
return allMatch;
} catch (Exception e) {
log.error("[ERROR] {} - {}", CHECK_TMS_INTEGRITY, e.getMessage());
@ -248,6 +248,68 @@ public class SelfCheckServiceImpl implements SelfCheckService {
}
private boolean doVerifyStandardTransceiverIntegrity() {
return false;
try {
log.info("=== 验证CMEP文件MAC校验值 ===");
PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
byte[] savedSignature = SM3Util.readFileBytes(CMEP_MAC_SIGN_FILE);
String savedMacList = SM3Util.readFile(CMEP_MAC_LIST_FILE);
boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey);
log.info("CMEP MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败"));
if (!macListSignatureValid) {
log.info("错误: cmep.mac.list 签名验证失败，可能被篡改！");
log.info("\n=== 验证结果 ===");
log.info("完整性验证: false");
return false;
}
Map<String, String> savedSm3Map = SM3Util.readSM3File(CMEP_MAC_LIST_FILE);
Map<String, String> currentSm3Map = new java.util.LinkedHashMap<>();
for (String target : CMEP_TARGETS) {
File file = new File(target);
if (!file.exists()) {
continue;
}
if (file.isFile()) {
String sm3Value = SM3Util.sm3FileHex(target);
currentSm3Map.put(target, sm3Value);
}
}
boolean allMatch = true;
for (Map.Entry<String, String> entry : savedSm3Map.entrySet()) {
String filePath = entry.getKey();
String savedHash = entry.getValue();
String currentHash = currentSm3Map.get(filePath);
if (currentHash == null) {
log.info("文件缺失: " + filePath);
allMatch = false;
} else if (!savedHash.equals(currentHash)) {
log.info("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")");
allMatch = false;
}
}
for (String filePath : currentSm3Map.keySet()) {
if (!savedSm3Map.containsKey(filePath)) {
log.info("新增文件: " + filePath);
allMatch = false;
}
}
log.info("");
log.info("=== 验证结果 ===");
log.info("完整性验证: " + allMatch);
return allMatch;
} catch (Exception e) {
log.error("[ERROR] {} - {}", CHECK_STANDARD_TRANSCEIVER, e.getMessage());
return false;
}
}
}