Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix:密钥恢复数据清理

Browse Source
This commit is contained in:
waner 2026-05-20 17:58:11 +08:00
parent 155252ef49
commit abce8784db
8 changed files with 95 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/java/com/cisd/tms/modules/auth/repository/RoleUkeyBindingRepository.java
View File

@ -8,6 +8,8 @@ public interface RoleUkeyBindingRepository {
Optional<RoleUkeyBindingEntity> findById(Long id);
Optional<RoleUkeyBindingEntity> findByRoleCodeAndUidAndUkeySerial(String roleCode, Integer uid, String ukeySerial);
List<RoleUkeyBindingEntity> findActiveByRoleCodeAndUid(String roleCode, Integer uid);
List<RoleUkeyBindingEntity> findActiveByRoleCode(String roleCode);

9
src/main/java/com/cisd/tms/modules/auth/repository/impl/RoleUkeyBindingRepositoryImpl.java
View File

@ -1,5 +1,6 @@
package com.cisd.tms.modules.auth.repository.impl;
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
import com.cisd.tms.modules.auth.entity.RoleUkeyBindingEntity;
import com.cisd.tms.modules.auth.mapper.RoleUkeyBindingMapper;
import com.cisd.tms.modules.auth.repository.RoleUkeyBindingRepository;
@ -21,6 +22,14 @@ public class RoleUkeyBindingRepositoryImpl implements RoleUkeyBindingRepository
return Optional.ofNullable(roleUkeyBindingMapper.selectById(id));
}
@Override
public Optional<RoleUkeyBindingEntity> findByRoleCodeAndUidAndUkeySerial(String roleCode, Integer uid, String ukeySerial) {
return Optional.ofNullable(roleUkeyBindingMapper.selectOne(new LambdaQueryWrapper<RoleUkeyBindingEntity>()
.eq(RoleUkeyBindingEntity::getRoleCode, roleCode)
.eq(RoleUkeyBindingEntity::getUid, uid)
.eq(RoleUkeyBindingEntity::getUkeySerial, ukeySerial)));
}
@Override
public List<RoleUkeyBindingEntity> findActiveByRoleCodeAndUid(String roleCode, Integer uid) {
return roleUkeyBindingMapper.selectActiveByRoleCodeAndUid(roleCode, uid);

16
src/main/java/com/cisd/tms/modules/auth/service/impl/AuthAdminServiceImpl.java
View File

@ -312,10 +312,10 @@ public class AuthAdminServiceImpl implements AuthAdminService {
authFullAccountRepository.findByRoleCodeAndUid(targetRoleCode, uid)
.orElseThrow(() -> new BizException(ErrorCode.VALIDATE_FAILED.getCode(), "目标角色完整账号不存在"));
RoleUkeyBindingEntity binding = findReusableBinding(targetRoleCode, uid, ukeySerial, ukeyPubkey);
if (RoleCode.SUPER_ADMIN != targetRole) {
unbindActiveSeatBindings(targetRoleCode, uid);
}
RoleUkeyBindingEntity binding = findExistingActiveBinding(targetRoleCode, uid, ukeySerial, ukeyPubkey);
if (binding.getId() == null) {
binding.setId((long) Math.abs(Objects.hash(targetRoleCode, uid, ukeySerial, TraceIdUtil.newTraceId())));
binding.setRoleCode(targetRoleCode);
@ -340,15 +340,23 @@ public class AuthAdminServiceImpl implements AuthAdminService {
roleUkeyBindingRepository.update(binding);
}
private RoleUkeyBindingEntity findExistingActiveBinding(
private RoleUkeyBindingEntity findReusableBinding(
String roleCode,
Integer uid,
String ukeySerial,
String ukeyPubkey
) {
return roleUkeyBindingRepository.findByRoleCodeAndUidAndUkeySerial(roleCode, uid, ukeySerial)
.orElseGet(() -> findExistingActiveBinding(roleCode, uid, ukeyPubkey));
}
private RoleUkeyBindingEntity findExistingActiveBinding(
String roleCode,
Integer uid,
String ukeyPubkey
) {
return roleUkeyBindingRepository.findActiveByRoleCodeAndUid(roleCode, uid).stream()
.filter(binding -> Objects.equals(binding.getUkeySerial(), ukeySerial)
|| Objects.equals(binding.getUkeyPubkey(), ukeyPubkey))
.filter(binding -> Objects.equals(binding.getUkeyPubkey(), ukeyPubkey))
.findFirst()
.orElseGet(RoleUkeyBindingEntity::new);
}

20
src/main/java/com/cisd/tms/modules/mk/service/impl/LmkServiceImpl.java
View File

@ -267,19 +267,11 @@ public class LmkServiceImpl implements LmkService {
if (deviceStatus != null) {
log.info("device status:{}/lmk seed mac:{}", deviceStatus.getFsmState(), recoveryResult.getLmkSeedMac());
}
clearKeyEntityRegistry();
runMasterKeySecurityMaintenance(masterKeyActivateEntity, "主密钥恢复后");
MasterKeyStateResult result = new MasterKeyStateResult();
result.setStatus(true);
result.setSeedMac(Hex.toHexString(recoveryResult.getLmkSeedMac()));
try {
masterKeyActivateEntity.setActivationStatus(false);
masterKeyActivateEntity.setEverInitialized(false);
masterKeyActivateRepository.update(masterKeyActivateEntity);
} catch (RuntimeException ex) {
log.error("主密钥恢复后更新激活记录失败", ex);
}
return result;
}
@ -642,29 +634,29 @@ public class LmkServiceImpl implements LmkService {
private void schedulePostMasterKeyInitMaintenance(MasterKeyActivateEntity masterKeyActivateEntity) {
try {
masterKeyPostInitExecutor.execute(() -> runPostMasterKeyInitMaintenance(masterKeyActivateEntity));
masterKeyPostInitExecutor.execute(() -> runMasterKeySecurityMaintenance(masterKeyActivateEntity, "主密钥初始化后"));
} catch (RuntimeException ex) {
log.error("提交主密钥初始化后置维护任务失败", ex);
}
}
private void runPostMasterKeyInitMaintenance(MasterKeyActivateEntity masterKeyActivateEntity) {
private void runMasterKeySecurityMaintenance(MasterKeyActivateEntity masterKeyActivateEntity, String operationName) {
try {
clearKeyEntityRegistry();
} catch (RuntimeException ex) {
log.error("主密钥初始化后清理实体密钥登记表失败", ex);
log.error("{}清理实体密钥登记表失败", operationName, ex);
}
try {
authSecurityResetService.resetAfterMasterKeyInitialized();
} catch (RuntimeException ex) {
log.error("主密钥初始化后重置认证状态失败", ex);
log.error("{}重置认证状态失败", operationName, ex);
}
try {
masterKeyActivateEntity.setActivationStatus(false);
masterKeyActivateEntity.setEverInitialized(false);
masterKeyActivateRepository.update(masterKeyActivateEntity);
} catch (RuntimeException ex) {
log.error("主密钥初始化后更新激活记录失败", ex);
log.error("{}更新激活记录失败", operationName, ex);
}
}

2
src/main/resources/application.yml
View File

@ -188,7 +188,7 @@ tms:
disk-usage-path: ${TMS_DEVICE_RUNTIME_STATUS_DISK_USAGE_PATH:/home/tms}
upgrade:
# 升级包解压和脚本执行暂存目录。
staging-root-dir: ${TMS_UPGRADE_STAGING_ROOT_DIR:/home/tmp/tms-upgrade-staging}
staging-root-dir: ${TMS_UPGRADE_STAGING_ROOT_DIR:/home/tms/tmp/tms-upgrade-staging}
# 升级任务统一日志目录。
log-dir: ${TMS_UPGRADE_LOG_DIR:/home/tms/tmp/tms-upgrade-logs}
# 升级包验签使用的公钥 PEM 文件路径；为空时升级预检会拒绝通过。

37
src/test/java/com/cisd/tms/modules/auth/service/AuthAdminServiceTest.java
View File

@ -190,6 +190,34 @@ class AuthAdminServiceTest {
&& item.getUnboundAt() != null));
}
@Test
void shouldRebindSingleSeatAdminSameSerialByReusingExistingBindingRow() {
InMemoryRoleAccountRepository roles = new InMemoryRoleAccountRepository();
InMemoryAuthFullAccountRepository accounts = new InMemoryAuthFullAccountRepository();
InMemoryRoleUkeyBindingRepository bindings = new InMemoryRoleUkeyBindingRepository();
roles.save(role(RoleCode.KEY_ADMIN, RoleAccountStatus.ACTIVE));
accounts.save(account(RoleCode.KEY_ADMIN, 1, "key-admin-01", "HASH-OLD", "SALT-OLD"));
RoleUkeyBindingEntity existing = binding(RoleCode.KEY_ADMIN, 1, "UK-SAME", "PUB-OLD", "SIG-OLD");
bindings.save(existing);
LmkService lmkService = Mockito.mock(LmkService.class);
Mockito.when(lmkService.exportIkPublicKeyHex()).thenReturn("IK-PUB-001");
Mockito.when(lmkService.signIk(Mockito.anyString())).thenReturn("ISSUE-SIGN-SAME");
UKeySignDTO dto = new UKeySignDTO();
dto.setPubKey("PUB-NEW");
dto.setUkeySerial("UK-SAME");
dto.setUid(1);
service(roles, accounts, bindings, lmkService)
.issueUkeyBindingSign(RoleCode.SUPER_ADMIN.getCode(), AuthLevel.FULL.name(), RoleCode.KEY_ADMIN.getCode(), dto);
Assertions.assertEquals(1, bindings.all().size());
RoleUkeyBindingEntity rebound = bindings.findActiveByRoleCodeAndUid(RoleCode.KEY_ADMIN.getCode(), 1).get(0);
Assertions.assertEquals(existing.getId(), rebound.getId());
Assertions.assertEquals("UK-SAME", rebound.getUkeySerial());
Assertions.assertEquals("PUB-NEW", rebound.getUkeyPubkey());
Assertions.assertEquals("ISSUE-SIGN-SAME", rebound.getIssuerSign());
}
@Test
void shouldBootstrapSuperAdminUkeyWithoutLoginContext() {
InMemoryRoleAccountRepository roles = new InMemoryRoleAccountRepository();
@ -506,6 +534,15 @@ class AuthAdminServiceTest {
.findFirst();
}
@Override
public Optional<RoleUkeyBindingEntity> findByRoleCodeAndUidAndUkeySerial(String roleCode, Integer uid, String ukeySerial) {
return store.stream()
.filter(entity -> roleCode.equals(entity.getRoleCode()))
.filter(entity -> uid.equals(entity.getUid()))
.filter(entity -> ukeySerial.equals(entity.getUkeySerial()))
.findFirst();
}
@Override
public List<RoleUkeyBindingEntity> findActiveByRoleCode(String roleCode) {
return store.stream()

9
src/test/java/com/cisd/tms/modules/auth/service/AuthServiceTest.java
View File

@ -510,6 +510,15 @@ class AuthServiceTest {
.findFirst();
}
@Override
public Optional<RoleUkeyBindingEntity> findByRoleCodeAndUidAndUkeySerial(String roleCode, Integer uid, String ukeySerial) {
return store.stream()
.filter(entity -> roleCode.equals(entity.getRoleCode()))
.filter(entity -> uid.equals(entity.getUid()))
.filter(entity -> ukeySerial.equals(entity.getUkeySerial()))
.findFirst();
}
@Override
public List<RoleUkeyBindingEntity> findActiveByRoleCode(String roleCode) {
return store.stream()

22
src/test/java/com/cisd/tms/modules/mk/service/LmkServiceTest.java
View File

@ -379,6 +379,7 @@ class LmkServiceTest {
PcieCryptoService pcieCryptoService = Mockito.mock(PcieCryptoService.class);
MasterKeyActivateRepository masterKeyActivateRepository = Mockito.mock(MasterKeyActivateRepository.class);
MasterKeyInitProperties properties = configuredPins("MTIzNDU2Nzg=", "ODc2NTQzMjE=");
allowMasterKeyInit(masterKeyActivateRepository);
MasterKeyRecoveryResult recoveryResult = new MasterKeyRecoveryResult();
recoveryResult.setLmkSeedMac(hex("1112131415161718"));
recoveryResult.setDeviceStatus(new DeviceStatusResult());
@ -414,21 +415,36 @@ class LmkServiceTest {
}
@Test
void shouldClearKeyEntityRegistryAfterMasterKeyRecoverySucceeds() {
void shouldRunSecurityCleanupAfterMasterKeyRecoverySucceeds() {
PcieCryptoService pcieCryptoService = Mockito.mock(PcieCryptoService.class);
MasterKeyActivateRepository masterKeyActivateRepository = Mockito.mock(MasterKeyActivateRepository.class);
AuthSecurityResetService authSecurityResetService = Mockito.mock(AuthSecurityResetService.class);
KeyEntityRepository keyEntityRepository = Mockito.mock(KeyEntityRepository.class);
MasterKeyInitProperties properties = configuredPins("MTIzNDU2Nzg=", "ODc2NTQzMjE=");
allowMasterKeyInit(masterKeyActivateRepository);
MasterKeyRecoveryResult recoveryResult = new MasterKeyRecoveryResult();
recoveryResult.setLmkSeedMac(hex("1112131415161718"));
Mockito.when(pcieCryptoService.recoverMasterKeyMaterial(Mockito.any())).thenReturn(recoveryResult);
LmkService service = new LmkServiceImpl(pcieCryptoService, properties, () -> { }, masterKeyActivateRepository, keyEntityRepository);
LmkService service = new LmkServiceImpl(
pcieCryptoService,
properties,
authSecurityResetService,
masterKeyActivateRepository,
keyEntityRepository
);
service.recoverKeyPackets(List.of(recoverPacketFixture(1), recoverPacketFixture(2)));
InOrder inOrder = Mockito.inOrder(pcieCryptoService, keyEntityRepository);
InOrder inOrder = Mockito.inOrder(
pcieCryptoService,
keyEntityRepository,
authSecurityResetService,
masterKeyActivateRepository
);
inOrder.verify(pcieCryptoService).recoverMasterKeyMaterial(Mockito.any());
inOrder.verify(keyEntityRepository).deleteAll();
inOrder.verify(authSecurityResetService).resetAfterMasterKeyInitialized();
inOrder.verify(masterKeyActivateRepository).update(Mockito.any());
}
@Test