mianbin/ops-pro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

机器管理密钥、密钥密码，加密/解密

Browse Source
This commit is contained in:
zyj 2025-07-08 09:30:32 +08:00
parent eb7e756fd7
commit 495165a930
4 changed files with 143 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
modules/module-ci-machine/src/main/java/cd/casic/module/machine/component/WebSocketConnection.java
View File

@ -6,6 +6,7 @@ import cd.casic.module.machine.enums.AuthenticationType;
import cd.casic.module.machine.enums.ConnectionStatus;
import cd.casic.module.machine.enums.SSHChanelType;
import cd.casic.module.machine.service.SecretKeyService;
import cd.casic.module.machine.utils.CryptogramUtil;
import com.jcraft.jsch.Channel;
import com.jcraft.jsch.ChannelExec;
import com.jcraft.jsch.JSch;
@ -164,7 +165,8 @@ public class WebSocketConnection {
if (machineInfo.getSecretKeyId() == null) {
throw exception(SECRET_KEY_NULL);
}
String pubKeyContent = secretKeyService.getPublicKeyContent(machineInfo.getSecretKeyId());
//公钥解密
String pubKeyContent = CryptogramUtil.doDecrypt(secretKeyService.getPublicKeyContent(machineInfo.getSecretKeyId()));
// 验证秘钥格式
if (!pubKeyContent.startsWith("-----BEGIN")) {
log.error("无效的密钥格式{}", pubKeyContent);

26
modules/module-ci-machine/src/main/java/cd/casic/module/machine/dal/model/Keypair.java Normal file
View File

@ -0,0 +1,26 @@
package cd.casic.module.machine.dal.model;
/**
* 基于SM2的秘钥对
* （本项目中配置的，自己使用可根据自己的需求进行更换）
*
*/
public class Keypair {
/**
* 公钥
*/
public static String PUBLIC_KEY = "04298364ec840088475eae92a591e01284d1abefcda348b47eb324bb521bb03b0b2a5bc393f6b71dabb8f15c99a0050818b56b23f31743b93df9cf8948f15ddb54";
/**
* 私钥
*/
public static String PRIVATE_KEY = "3037723d47292171677ec8bd7dc9af696c7472bc5f251b2cec07e65fdef22e25";
/**
* SM4的对称秘钥（生产环境需要改成自己使用的）
* 16 进制字符串，要求为 128 比特
*/
public static String KEY = "0123456789abcdeffedcba9876543210";
}

5
modules/module-ci-machine/src/main/java/cd/casic/module/machine/service/impl/SecretKeyServiceImpl.java
View File

@ -8,6 +8,7 @@ import cd.casic.module.machine.dal.dataobject.SecretKeyDO;
import cd.casic.module.machine.dal.mysql.SecretKeyMapper;
import cd.casic.module.machine.service.MachineInfoService;
import cd.casic.module.machine.service.SecretKeyService;
import cd.casic.module.machine.utils.CryptogramUtil;
import com.google.common.annotations.VisibleForTesting;
import jakarta.annotation.Resource;
import org.springframework.stereotype.Service;
@ -50,6 +51,10 @@ public class SecretKeyServiceImpl implements SecretKeyService {
public Long createSecretKey(SecretKeyVO secretKeyVO) {
validateSecretKeyAdd(secretKeyVO);
SecretKeyDO secretKeyDO = BeanUtils.toBean(secretKeyVO, SecretKeyDO.class);
//密码加密
secretKeyDO.setPassword(CryptogramUtil.doEncrypt(secretKeyVO.getPassword()));
//公钥加密
secretKeyDO.setPublicKey(CryptogramUtil.doEncrypt(secretKeyVO.getPublic_key()));
secretKeyMapper.insert(secretKeyDO);
return secretKeyDO.getId();
}

109
modules/module-ci-machine/src/main/java/cd/casic/module/machine/utils/CryptogramUtil.java Normal file
View File

@ -0,0 +1,109 @@
package cd.casic.module.machine.utils;
import cd.casic.module.machine.dal.model.Keypair;
import cn.hutool.log.Log;
import com.antherd.smcrypto.sm2.Sm2;
import com.antherd.smcrypto.sm3.Sm3;
import com.antherd.smcrypto.sm4.Sm4;
import com.antherd.smcrypto.sm4.Sm4Options;
public class CryptogramUtil {
private static final Log log = Log.get();
/**
* 加密方法（Sm2 的专门针对前后端分离，非对称秘钥对的方式，暴露出去的公钥，对传输过程中的密码加个密）
*
* @author yubaoshan
* @param str 待加密数据
* @return 加密后的密文
*/
public static String doSm2Encrypt (String str) {
return Sm2.doEncrypt(str, Keypair.PUBLIC_KEY);
}
/**
* 解密方法
* 如果采用加密机的方法，用try catch 捕捉异常，返回原文值即可
*
* @author yubaoshan
* @param str 密文
* @return 解密后的明文
*/
public static String doSm2Decrypt (String str) {
// 解密
return Sm2.doDecrypt(str, Keypair.PRIVATE_KEY);
}
/**
* 加密方法
*
* @author yubaoshan
* @param str 待加密数据
* @return 加密后的密文
*/
public static String doEncrypt (String str) {
// SM4 加密 cbc模式
Sm4Options sm4Options4 = new Sm4Options();
sm4Options4.setMode("cbc");
sm4Options4.setIv("fedcba98765432100123456789abcdef");
return Sm4.encrypt(str, Keypair.KEY, sm4Options4);
}
/**
* 解密方法
* 如果采用加密机的方法，用try catch 捕捉异常，返回原文值即可
*
* @author yubaoshan
* @param str 密文
* @return 解密后的明文
*/
public static String doDecrypt (String str) {
// 解密，cbc 模式，输出 utf8 字符串
Sm4Options sm4Options8 = new Sm4Options();
sm4Options8.setMode("cbc");
sm4Options8.setIv("fedcba98765432100123456789abcdef");
String docString = Sm4.decrypt(str, Keypair.KEY, sm4Options8);
if (docString.isEmpty()) {
log.warn(">>> 字段解密失败，返回原文值：{}", str);
return str;
} else {
return docString;
}
}
/**
* 纯签名
*
* @author yubaoshan
* @param str 待签名数据
* @return 签名结果
*/
public static String doSignature (String str) {
return Sm2.doSignature(str, Keypair.PRIVATE_KEY);
}
/**
* 验证签名结果
*
* @author yubaoshan
* @param originalStr 签名原文数据
* @param str 签名结果
* @return 是否通过
*/
public static boolean doVerifySignature (String originalStr, String str) {
return Sm2.doVerifySignature(originalStr, str, Keypair.PUBLIC_KEY);
}
/**
* 通过杂凑算法取得hash值，用于做数据完整性保护
*
* @author yubaoshan
* @param str 字符串
* @return hash 值
*/
public static String doHashValue (String str) {
return Sm3.sm3(str);
}
}