From bed95d2009fe9236ddbb8d8fad8e1d3c68fb1639 Mon Sep 17 00:00:00 2001
From: yihzhou <468340218@qq.com>
Date: Mon, 5 Sep 2022 11:06:34 +0800
Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E7=AD=BE=E5=90=8D=E6=95=B0?=
 =?UTF-8?q?=E5=AD=97=E4=BF=A1=E5=B0=81=E3=80=81=E8=A7=A3=E7=AD=BE=E5=90=8D?=
 =?UTF-8?q?=E6=95=B0=E5=AD=97=E4=BF=A1=E5=B0=81=E6=8E=A5=E5=8F=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 DProto/6A.xml                                 |  55 ++++++-
 DProto/6B.xml                                 |  49 ++++--
 src/main/java/com/sunyard/SydApi.java         |   4 +-
 .../inf/customize/Syd4DigitalEnvelope.java    |  31 ++++
 .../java/racal/sunyard/main/SydApi4j.java     | 139 +++++++++++++++++-
 .../sunyard/sydapi/test/AAA4shangqing.java    |  57 +++++++
 6 files changed, 319 insertions(+), 16 deletions(-)
 create mode 100644 src/main/java/com/sunyard/inf/customize/Syd4DigitalEnvelope.java
 create mode 100644 src/test/java/com/sunyard/sydapi/test/AAA4shangqing.java

diff --git a/DProto/6A.xml b/DProto/6A.xml
index b914fcb..b63a7cd 100644
--- a/DProto/6A.xml
+++ b/DProto/6A.xml
@@ -72,6 +72,30 @@
             公钥加密的密钥格式3所需机构码长度，仅当格式3以及'P'存在时存在
         </orgCode>
 
+        <!-- 新增功能-->
+        <pSignFlag len="1" required="false" cn="可选字段">
+            签名数字信封标识符，存在则为P
+        </pSignFlag>
+
+        <signCertificateLen len="4" :value="signCertificateLen()"  cn="签名证书DN长度">
+            可选项，只针对"可选字段"为P时存在。
+        </signCertificateLen>
+
+        <signCertificateDn :len="strlen()" :if="hasOrgCN()" cn="签名证书DN">
+            可选项，只针对“证书模式”为1时有,只针对"可选字段"为P时存在。
+        </signCertificateDn>
+        <signCertificateModel len="1" cn="是否附带公钥信息">
+            <options>
+                <option cn="无需附带">
+                    <hex>0</hex>
+                </option>
+                <option cn="附带公钥信息">
+                    <hex>1</hex>
+                </option>
+            </options>
+        </signCertificateModel>
+
+
         <tailSep len="1" :if=" null != $packet.data.tail " cn="尾分隔">
             可选项。如果显示消息尾域，则该域必须显示。值为
             “X’19”。
@@ -172,17 +196,26 @@
             }
         }
 
+        function signCertificateLen(){
+            var data = $packet.data;
+            if( 'P' == $packet.data.pSignFlag ){
+                return data.signCertificateDn.length
+            }
+            return null;
+        }
+
+
         function getKeyLen() {
-            return Util.a2i( $final.getSection('data').getSection('keyLen') )
+            return Util.a2i( $final.getSection('data').getSection('keyLen') );
         }
 
         function lmkLen() {
             if(  Arrays.equals("L".getBytes(),
                     $final.getSection('data').getSection('lmkHead').getValue()
                     ) ){
-                return 64
+                return 64;
             }else{
-                return 32
+                return 32;
             }
         }
 
@@ -190,6 +223,8 @@
             return $packet.data.orgData.length
         }
 
+
+
         <![CDATA[
         function hasOrgCode() {
             if(2 == $packet.data.alg$option && 'P' == $packet.data.pFlag) {
@@ -199,11 +234,21 @@
             return false;
         }
 
+
+        function hasOrgCN() {
+            if(1 == $packet.data.certificateModel$option && 'P' == $packet.data.pSignFlag) {
+                return true;
+            }
+
+            return false;
+        }
+
+
         function orgCodeLen() {
             def len = $packet.data.orgCode.length();
             def data = new byte[2];
-            data[0] = (byte)(len >> 8 & 0xFF)
-            data[1] = (byte)(len & 0xFF)
+            data[0] = (byte)(len >> 8 & 0xFF);
+            data[1] = (byte)(len & 0xFF);
 
             return data;
         }
diff --git a/DProto/6B.xml b/DProto/6B.xml
index 0ba5f39..57dd00e 100644
--- a/DProto/6B.xml
+++ b/DProto/6B.xml
@@ -11,6 +11,18 @@
             可选，如果输入P代表使用PKCS7_SM2_SM4_ECB模式解密数字信封
         </pFlag>
 
+
+        <!--新增-->
+        <pSignFlag len="1" required="false" if="'P' == $packet.data.pFlag" cn="可选字段2">
+            如果输入P代表进行解封签名数字信封模式，必须当可选字段1为P时才可选
+        </pSignFlag>
+        <signCertificateLen len="4" :value="signCertificateLen()" if="'P' == $packet.data.pSignFlag" cn="签名证书内容长度">
+            根据证书模式，需要输入内容项的长度n，只针对可选字段2为P时存在
+        </signCertificateLen>
+        <signCertificateDn  :if="hasSign()" cn="签名证书DN">
+            X509证书的subject可选项，只针对“证书模式”为1时有，只针对可选字段2为P时存在
+        </signCertificateDn>
+
         <certificateModel len="1" cn="证书模式">
             <options>
                 <option cn="证书序号">
@@ -36,14 +48,16 @@
             可选项，只针对“证书模式”为 1时有。
         </certificateDn>
 
+
+
         <keyLen len="4" :value="keyLen()" cn="密钥密文长度">
             公钥加密的密钥密文长度
         </keyLen>
-
         <key :len="getKeyLen()" cn="密钥密文">
             公钥加密的密钥密文的 BASE64 编码
         </key>
 
+
         <keyType len="1" cn="加密密钥方案">
             LMK 下加密密钥的方案。
         </keyType>
@@ -57,6 +71,8 @@
         <tail maxLen="32" required="false" cn="尾部">
             可选项。最大长度为 32个字符。
         </tail>
+
+
     </data>
 
 	</req>
@@ -126,7 +142,7 @@
             对称密钥的密文，由 LMK30-31 保护。
         </lmk>
 
-        <keyCheck len="16" cn="密钥校验值">
+        <keyCheck len="32" cn="密钥校验值">
             密钥校验值
         </keyCheck>
 
@@ -155,15 +171,30 @@
         function certificateLen(){
             var data = $packet.data;
             if( 0 == data.certificateModel$option ){
-                return data.certificateSn.length()
+                return data.certificateSn.length
             }
             if( 1 == data.certificateModel$option ){
-                return data.certificateDn.length()
+                return data.certificateDn.length
             }
         }
 
+
+        function signCertificateLen(){
+            var data = $packet.data;
+            return data.signCertificateDn.length
+        }
+        <![CDATA[
+        function hasSign() {
+            if(1 == $packet.data.certificateModel$option && 'P' == $packet.data.pSignFlag) {
+                return true;
+            }
+            return false;
+        }
+        ]]>
+
+
         function keyLen() {
-            return $packet.data.key.length()
+            return $packet.data.key.length;
         }
 
 
@@ -175,17 +206,17 @@
             if(  Arrays.equals("L".getBytes(),
                     $final.getSection('data').getSection('lmkHead').getValue()
                     ) ){
-                return 64
+                return 64;
             }else{
-                return 32
+                return 32;
             }
         }
         function orgCodeLen() {
-            return Util.a2i( $final.getSection('data').getSection('orgCodeLen') )
+            return Util.a2i( $final.getSection('data').getSection('orgCodeLen') );
         }
 
         function oDataLen() {
-            return Util.a2i( $final.getSection('data').getSection('oDataLen') )
+            return Util.a2i( $final.getSection('data').getSection('oDataLen') );
         }
     </script>
 </packet>
diff --git a/src/main/java/com/sunyard/SydApi.java b/src/main/java/com/sunyard/SydApi.java
index 7629d73..7acace7 100644
--- a/src/main/java/com/sunyard/SydApi.java
+++ b/src/main/java/com/sunyard/SydApi.java
@@ -2,6 +2,7 @@ package com.sunyard;
 
 
 import com.sunyard.inf.*;
+import com.sunyard.inf.customize.Syd4DigitalEnvelope;
 import com.sunyard.inf.customize.SydHAApi;
 import com.sunyard.inf.customize.SydQNUCApi;
 import com.sunyard.inf.customize.SydUnionPayApi;
@@ -14,7 +15,7 @@ import racal.sunyard.main.SydApiBuilder;
 public interface SydApi extends
         SydRawApi, SydCertApi, SydCryptionApi, SydGenApi,
         SydSVApi, SydHAApi, SydQNUCApi, SydPledge, SydPINOpt,
-        SydManufactureApi, SydZYOption, SydUnionPayApi {
+        SydManufactureApi, SydZYOption, SydUnionPayApi ,Syd4DigitalEnvelope{
 
     byte ALG_AES = 0x30;
     byte ALG_SM4 = 0x31;
@@ -101,6 +102,7 @@ public interface SydApi extends
     // 单例可以不实现
     void error();
 
+
     /**
      * 获取加密机cpu，内存，磁盘使用状况
      *
diff --git a/src/main/java/com/sunyard/inf/customize/Syd4DigitalEnvelope.java b/src/main/java/com/sunyard/inf/customize/Syd4DigitalEnvelope.java
new file mode 100644
index 0000000..4302e35
--- /dev/null
+++ b/src/main/java/com/sunyard/inf/customize/Syd4DigitalEnvelope.java
@@ -0,0 +1,31 @@
+package com.sunyard.inf.customize;
+/**
+ * 上清所数字信封类接口
+ */
+public interface Syd4DigitalEnvelope {
+
+        /**
+         * 产生对称密钥，通过清算所公钥证书加密生成数字信封。
+         * 上清所
+         * @param pcDnEN:  清算所的公钥证书
+         * @param pcDnSign：会员的私钥证书
+         * @param pcData:  明文数据。
+         * @return pcSignData:  签名数字信封
+         */
+       public String SYD_SignDigitalEnvelope (String pcDnEN, String pcDnSign, byte[] pcData);
+
+
+
+    /**
+         * 利用清算所公钥证书对签名数据进行验签。接收用会员的私钥证书解密数字信封，还原原文。
+         * 上清所
+         * @param pcDnDe: 会员的私钥证书
+         * @param pcDnVerify: 清算所公钥证书
+         * @param pcSignData:  签名数字信封数据。
+         * @return pcData：原数据
+         */
+       public  byte[] SYD_VerifyDigitalEnveloe(String pcDnDe, String pcDnVerify, String pcSignData );
+
+}
+
+
diff --git a/src/main/java/racal/sunyard/main/SydApi4j.java b/src/main/java/racal/sunyard/main/SydApi4j.java
index 1543fce..36ba6f2 100644
--- a/src/main/java/racal/sunyard/main/SydApi4j.java
+++ b/src/main/java/racal/sunyard/main/SydApi4j.java
@@ -2310,6 +2310,7 @@ public class SydApi4j implements SydApi {
         }
     }
 
+
     public RetWrap generateDEByDnHsm(String certSerial, byte[] oData) {
 
         certSerial = DnUtil.verifyDn( certSerial );
@@ -2923,6 +2924,142 @@ public class SydApi4j implements SydApi {
         return true;
     }
 
+    /**
+     * 产生对称密钥，通过清算所公钥证书加密生成数字信封。
+     * 上清所
+     * @param pcDnEN:  清算所的公钥证书
+     * @param pcDnSign：会员的私钥证书
+     * @param pcData:  明文数据。
+     * @return pcSignData:  签名数字信封
+     */
+    @Override
+    public String SYD_SignDigitalEnvelope(String pcDnEN, String pcDnSign, byte[] pcData){
+         // 获取协议
+        Proto6A proto = new Proto6A();
+        // 填充数据
+        PacketSN sn = PacketSN.gen();
+        HashMap<String, Object> packet = new HashMap<String, Object>();
+        packet.put("header", sn.getSn().array());
+        HashMap<String, Object> data = new HashMap<String, Object>();
+        try {  data.put("alg$option", 3);
+            //data.put("pFlag", "P");
+            data.put("certificateModel$option", 1);
+            data.put("certificateDn", pcDnEN.getBytes("GBK"));
+
+            data.put("orgData", pcData);
+            // data.put("orgDataLen", pcData.length);
+            data.put("keyType", "S");
+            data.put("pSignFlag", "P");
+            //data.put("signCertificateLen", pcDnSign.length());
+            data.put("signCertificateDn", pcDnSign.getBytes("GBK"));
+            data.put("signCertificateModel$option", 0);
+
+        }catch (Exception e){
+            e.printStackTrace();
+        }
+
+
+
+
+        packet.put("data", data);
+        // 渲染发送 耗时长
+        ByteBuffer bb = proto.rend(packet);
+        synchronized (this) {
+            // 响应解析
+            bb = syncRead(syncSend(bb));
+        }
+        //ProtocolParser parser = pset.getProtocolResParse();
+        Packet p = proto.parse(bb);
+
+        Map<String, Object> ret = p.toMap();
+        if (
+                !Arrays.equals(sn.getSn().array(), ((PacketSection) ret.get("header")).getBytes())
+        ) {
+            throw new SydApiException("包序号不匹配", -4);
+        }
+        ret = (Map<String, Object>) ret.get("data");
+        PacketSection error = (PacketSection) ret.get("error");
+        if (!"00".equals(error.getString())) {
+            throw new SydApiException(error.getInfo(), error.autoInt());
+        }
+        RetWrap rw = new RetWrap();
+        rw.put(SydApi.RET_CIPHER_KEY, ((PacketSection) ret.get("key")).getString());
+        rw.put(SydApi.RET_KCV, ((PacketSection) ret.get("keyCheck")).getString());
+        return (String) rw.get("CipherKey");
+    }
+    /**
+     * 利用清算所公钥证书对签名数据进行验签。接收用会员的私钥证书解密数字信封，还原原文。
+     * 上清所
+     * @param pcDnDe: 会员的私钥证书
+     * @param pcDnVerify: 清算所公钥证书
+     * @param pcSignData:  签名数字信封数据。
+     * @return pcData：原数据
+     */
+    @Override
+    public byte[] SYD_VerifyDigitalEnveloe(String pcDnDe, String pcDnVerify, String pcSignData) {
+        // 获取协议
+        Proto6B proto = new Proto6B();
+        // 填充数据
+        PacketSN sn = PacketSN.gen();
+        HashMap<String, Object> packet = new HashMap<String, Object>();
+        packet.put("header", sn.getSn().array());
+        HashMap<String, Object> data = new HashMap<String, Object>();
+        try {
+            data.put("pFlag", "P");
+            data.put("pSignFlag", "P");
+            //data.put("signCertificateLen", pcDnDe.length());
+            data.put("signCertificateDn", pcDnDe.getBytes("GBK"));
+            data.put("certificateModel$option", 1);
+            //data.put("certificateLen", pcDnVerify.length());
+            data.put("certificateDn", pcDnVerify.getBytes("GBK"));
+            data.put("key", pcSignData.getBytes("GBK"));
+            data.put("keyType", "S");
+        }catch(Exception e){
+            e.printStackTrace();
+        }
+
+        packet.put("data", data);
+        // 渲染发送
+        ByteBuffer bb = proto.rend(packet);
+        synchronized (this) {
+            // 响应解析
+            bb = syncRead(syncSend(bb));
+        }
+
+        //ProtocolParser parser = pset.getProtocolResParse();
+        Packet p = proto.parse(bb);
+
+        Map<String, Object> ret = p.toMap();
+        if (
+                !Arrays.equals(sn.getSn().array(), ((PacketSection) ret.get("header")).getBytes())
+        ) {
+            throw new SydApiException("包序号不匹配", -4);
+        }
+        ret = (Map<String, Object>) ret.get("data");
+        PacketSection error = (PacketSection) ret.get("error");
+        if (!"00".equals(error.getString())) {
+            throw new SydApiException(error.getInfo(), error.autoInt());
+        }
+        RetWrap rw = new RetWrap();
+        rw.put("oData", ((PacketSection) ret.get("oData")).getBytes());
+        byte[] odata =  (byte[])rw.get("oData");
+        return odata;
+
+//        int orgCodeLen = Util.a2i(((PacketSection) ret.get("orgCodeLen")).getBytes(), 10);
+//        if (orgCodeLen != 0) {
+//            rw.put("orgCode", ((PacketSection) ret.get("orgCode")).getBytes());
+//        }
+//
+//        rw.put(SydApi.RET_SESSION_KEY, (((PacketSection) ret.get("lmkHead")).getString() +
+//                ((PacketSection) ret.get("lmk")).getString()).getBytes()
+//        );
+//
+
+    }
+
+
+
+
     /**
      * 用指定的证书私钥对指定的数据进行数字签名。
      * 网联
@@ -3207,7 +3344,6 @@ public class SydApi4j implements SydApi {
 
     }
 
-
     // 测试通过
     @Override
     public RetWrap SM3Hash(int packSn, String userId, byte[] publicKey, byte[] msg, byte[] filterData) {
@@ -5497,6 +5633,7 @@ public class SydApi4j implements SydApi {
 
 
     /**
+
      * 使用SM4算法进行加密，其中加密模式为CBC,
      * Ⅳ使用缺省值0X 00000000000000000000000000000000,
      * 补位模式为 PKCS5 PADDING 。
diff --git a/src/test/java/com/sunyard/sydapi/test/AAA4shangqing.java b/src/test/java/com/sunyard/sydapi/test/AAA4shangqing.java
new file mode 100644
index 0000000..62d5428
--- /dev/null
+++ b/src/test/java/com/sunyard/sydapi/test/AAA4shangqing.java
@@ -0,0 +1,57 @@
+package com.sunyard.sydapi.test;
+
+import com.sunyard.RetWrap;
+import com.sunyard.SydApi;
+import com.sunyard.cert.X509;
+import com.sunyard.proto.Util;
+import racal.sunyard.main.SydApi4j;
+import racal.sunyard.main.SydApiBuilder;
+
+public class AAA4shangqing {
+    private static final String orgData = "12345678";
+    private static final String publicKey = "034200043EDA3A107B7CC35CC005C7FBF0BB4E6B43A07EE14E360603D22ECA2A600B2D0FA03055D400D1240300F54648B849D13F50B330FF14351B5645B13686820A65BB";
+    private static final String pcDnEN ="C=CN,O=CFCA OCA1,OU=YCCA,OU=Individual-2,CN=YCCA@黄金交易所@Zhuangj@1";
+
+    public static void main(String[] args) {
+        System.setProperty("com.sunyard.sydapi4j.debug", "true");
+        long startTime = System.currentTimeMillis();    //获取开始时间
+        SydApiBuilder builder = new SydApiBuilder().setIp("192.168.0.100");
+        SydApi4j api = (SydApi4j) builder.build();
+
+        try {
+
+            /**
+             * 产生对称密钥，通过清算所公钥证书加密生成数字信封。
+             * 上清所   SYD_SignDzigitalEnvelope (String pcDnEN, String pcDnSign, byte[] pcData);
+             * @param pcDnEN:  清算所的公钥证书
+             * @param pcDnSign：会员的私钥证书
+             * @param pcData:  明文数据。
+             * @return pcSignData:  签名数字信封
+             */
+            String pcSignData= api.SYD_SignDigitalEnvelope(pcDnEN,pcDnEN, orgData.getBytes("GBK"));
+            System.out.println("签名数字信封："+pcSignData);
+
+            /**
+             * 利用清算所公钥证书对签名数据进行验签。接收用会员的私钥证书解密数字信封，还原原文。
+             * 上清所  byte[] SYD_VerifyDigitalEnveloe(String pcDnDe, String pcDnVerify, String pcSignData );
+             * @param pcDnDe: 会员的私钥证书
+             * @param pcDnVerify: 清算所公钥证书
+             * @param pcSignData:  签名数字信封数据。
+             * @return pcData：原数据
+             */
+
+            byte[] oData =api.SYD_VerifyDigitalEnveloe(pcDnEN,pcDnEN,pcSignData);
+            System.out.println("原数据："+ Util.bytes2HexString(oData));
+
+
+
+        }
+        catch (Exception e) {
+            e.printStackTrace();
+        }finally {
+            long endTime = System.currentTimeMillis();    //获取结束时间
+            System.out.println("程序运行时间：" + (endTime - startTime) + "ms");    //输出程序运行时间
+        }
+
+    }
+}