271 lines
7.1 KiB
Markdown
271 lines
7.1 KiB
Markdown
```go
|
||
package ymt_v3_generate
|
||
|
||
import (
|
||
"bytes"
|
||
"crypto"
|
||
"crypto/aes"
|
||
"crypto/rand"
|
||
"crypto/rsa"
|
||
"crypto/sha256"
|
||
"crypto/x509"
|
||
"encoding/base64"
|
||
"encoding/json"
|
||
"encoding/pem"
|
||
"errors"
|
||
"fmt"
|
||
"reflect"
|
||
"sort"
|
||
"strings"
|
||
)
|
||
|
||
// EncryptType 加密类型
|
||
type EncryptType string
|
||
|
||
const (
|
||
EncryptTypeAES EncryptType = "aes" // AES ECB模式
|
||
EncryptTypeSM4 EncryptType = "sm4" // SM4 CBC模式（暂未实现，仅占位）
|
||
)
|
||
|
||
// Crypto 加密工具
|
||
type Crypto struct {
|
||
key []byte
|
||
encryptType EncryptType
|
||
}
|
||
|
||
// NewCrypto 创建加密工具
|
||
func NewCrypto(key string, encryptType EncryptType) *Crypto {
|
||
return &Crypto{
|
||
key: []byte(key),
|
||
encryptType: encryptType,
|
||
}
|
||
}
|
||
|
||
// Encrypt 加密明文，返回base64编码的密文
|
||
func (c *Crypto) Encrypt(plaintext []byte) (string, error) {
|
||
switch c.encryptType {
|
||
case EncryptTypeAES:
|
||
return c.aesECBEncrypt(plaintext)
|
||
case EncryptTypeSM4:
|
||
return "", errors.New("SM4 encryption not implemented")
|
||
default:
|
||
return "", fmt.Errorf("unsupported encrypt type: %s", c.encryptType)
|
||
}
|
||
}
|
||
|
||
// Decrypt 解密密文（base64编码），返回明文
|
||
func (c *Crypto) Decrypt(ciphertext string) ([]byte, error) {
|
||
cipherData, err := base64.StdEncoding.DecodeString(ciphertext)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("base64 decode failed: %w", err)
|
||
}
|
||
switch c.encryptType {
|
||
case EncryptTypeAES:
|
||
return c.aesECBDecrypt(cipherData)
|
||
case EncryptTypeSM4:
|
||
return nil, errors.New("SM4 decryption not implemented")
|
||
default:
|
||
return nil, fmt.Errorf("unsupported encrypt type: %s", c.encryptType)
|
||
}
|
||
}
|
||
|
||
// aesECBEncrypt AES ECB模式加密
|
||
func (c *Crypto) aesECBEncrypt(plaintext []byte) (string, error) {
|
||
block, err := aes.NewCipher(c.key)
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
// PKCS7填充
|
||
plaintext = pkcs7Pad(plaintext, block.BlockSize())
|
||
ciphertext := make([]byte, len(plaintext))
|
||
// ECB模式：直接分组加密
|
||
for start := 0; start < len(plaintext); start += block.BlockSize() {
|
||
block.Encrypt(ciphertext[start:start+block.BlockSize()], plaintext[start:start+block.BlockSize()])
|
||
}
|
||
return base64.StdEncoding.EncodeToString(ciphertext), nil
|
||
}
|
||
|
||
// aesECBDecrypt AES ECB模式解密
|
||
func (c *Crypto) aesECBDecrypt(ciphertext []byte) ([]byte, error) {
|
||
block, err := aes.NewCipher(c.key)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
if len(ciphertext)%block.BlockSize() != 0 {
|
||
return nil, errors.New("ciphertext is not a multiple of block size")
|
||
}
|
||
plaintext := make([]byte, len(ciphertext))
|
||
for start := 0; start < len(ciphertext); start += block.BlockSize() {
|
||
block.Decrypt(plaintext[start:start+block.BlockSize()], ciphertext[start:start+block.BlockSize()])
|
||
}
|
||
// 去除PKCS7填充
|
||
plaintext, err = pkcs7Unpad(plaintext, block.BlockSize())
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
return plaintext, nil
|
||
}
|
||
|
||
// pkcs7Pad PKCS7填充
|
||
func pkcs7Pad(data []byte, blockSize int) []byte {
|
||
padding := blockSize - len(data)%blockSize
|
||
padText := bytes.Repeat([]byte{byte(padding)}, padding)
|
||
return append(data, padText...)
|
||
}
|
||
|
||
// pkcs7Unpad 去除PKCS7填充
|
||
func pkcs7Unpad(data []byte, blockSize int) ([]byte, error) {
|
||
if len(data) == 0 {
|
||
return nil, errors.New("data is empty")
|
||
}
|
||
padding := int(data[len(data)-1])
|
||
if padding > blockSize || padding == 0 {
|
||
return nil, errors.New("invalid padding")
|
||
}
|
||
for i := len(data) - padding; i < len(data); i++ {
|
||
if int(data[i]) != padding {
|
||
return nil, errors.New("invalid padding")
|
||
}
|
||
}
|
||
return data[:len(data)-padding], nil
|
||
}
|
||
|
||
// Signer 签名工具
|
||
type Signer struct {
|
||
privateKey *rsa.PrivateKey
|
||
}
|
||
|
||
// NewSigner 创建签名工具
|
||
func NewSigner(privateKeyPEM string) (*Signer, error) {
|
||
block, _ := pem.Decode([]byte(privateKeyPEM))
|
||
if block == nil {
|
||
return nil, errors.New("failed to decode private key PEM")
|
||
}
|
||
key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
|
||
if err != nil {
|
||
// 尝试PKCS1
|
||
key, err = x509.ParsePKCS1PrivateKey(block.Bytes)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("failed to parse private key: %w", err)
|
||
}
|
||
}
|
||
rsaKey, ok := key.(*rsa.PrivateKey)
|
||
if !ok {
|
||
return nil, errors.New("private key is not RSA")
|
||
}
|
||
return &Signer{privateKey: rsaKey}, nil
|
||
}
|
||
|
||
// Sign 对数据进行签名，返回base64编码的签名
|
||
func (s *Signer) Sign(data string) (string, error) {
|
||
hash := sha256.Sum256([]byte(data))
|
||
signature, err := rsa.SignPKCS1v15(rand.Reader, s.privateKey, crypto.SHA256, hash[:])
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
return base64.StdEncoding.EncodeToString(signature), nil
|
||
}
|
||
|
||
// Verifier 验签工具
|
||
type Verifier struct {
|
||
publicKey *rsa.PublicKey
|
||
}
|
||
|
||
// NewVerifier 创建验签工具
|
||
func NewVerifier(publicKeyPEM string) (*Verifier, error) {
|
||
block, _ := pem.Decode([]byte(publicKeyPEM))
|
||
if block == nil {
|
||
return nil, errors.New("failed to decode public key PEM")
|
||
}
|
||
key, err := x509.ParsePKIXPublicKey(block.Bytes)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("failed to parse public key: %w", err)
|
||
}
|
||
rsaKey, ok := key.(*rsa.PublicKey)
|
||
if !ok {
|
||
return nil, errors.New("public key is not RSA")
|
||
}
|
||
return &Verifier{publicKey: rsaKey}, nil
|
||
}
|
||
|
||
// Verify 验证签名
|
||
func (v *Verifier) Verify(data, signatureBase64 string) error {
|
||
sig, err := base64.StdEncoding.DecodeString(signatureBase64)
|
||
if err != nil {
|
||
return fmt.Errorf("base64 decode signature failed: %w", err)
|
||
}
|
||
hash := sha256.Sum256([]byte(data))
|
||
return rsa.VerifyPKCS1v15(v.publicKey, crypto.SHA256, hash[:], sig)
|
||
}
|
||
|
||
// BuildPlaintext 构建待加密/签名的明文：将结构体转为JSON，去掉零值字段，按key排序
|
||
func BuildPlaintext(v interface{}) (string, error) {
|
||
val := reflect.ValueOf(v)
|
||
if val.Kind() == reflect.Ptr {
|
||
val = val.Elem()
|
||
}
|
||
if val.Kind() != reflect.Struct {
|
||
return "", errors.New("input must be a struct or pointer to struct")
|
||
}
|
||
// 转换为map[string]interface{}，过滤零值
|
||
m := make(map[string]interface{})
|
||
typ := val.Type()
|
||
for i := 0; i < val.NumField(); i++ {
|
||
field := typ.Field(i)
|
||
jsonTag := field.Tag.Get("json")
|
||
if jsonTag == "" || jsonTag == "-" {
|
||
continue
|
||
}
|
||
// 处理json tag，可能包含omitempty
|
||
name := strings.Split(jsonTag, ",")[0]
|
||
fieldVal := val.Field(i)
|
||
if isZeroValue(fieldVal) {
|
||
continue
|
||
}
|
||
m[name] = fieldVal.Interface()
|
||
}
|
||
// 按key排序
|
||
keys := make([]string, 0, len(m))
|
||
for k := range m {
|
||
keys = append(keys, k)
|
||
}
|
||
sort.Strings(keys)
|
||
// 构建有序JSON
|
||
var buf bytes.Buffer
|
||
buf.WriteByte('{')
|
||
for idx, k := range keys {
|
||
if idx > 0 {
|
||
buf.WriteByte(',')
|
||
}
|
||
buf.WriteString(fmt.Sprintf(`"%s":`, k))
|
||
// 将值转为JSON
|
||
valBytes, err := json.Marshal(m[k])
|
||
if err != nil {
|
||
return "", err
|
||
}
|
||
buf.Write(valBytes)
|
||
}
|
||
buf.WriteByte('}')
|
||
return buf.String(), nil
|
||
}
|
||
|
||
// isZeroValue 判断反射值是否为零值
|
||
func isZeroValue(v reflect.Value) bool {
|
||
switch v.Kind() {
|
||
case reflect.String:
|
||
return v.String() == ""
|
||
case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
|
||
return v.Int() == 0
|
||
case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
|
||
return v.Uint() == 0
|
||
case reflect.Float32, reflect.Float64:
|
||
return v.Float() == 0
|
||
case reflect.Bool:
|
||
return !v.Bool()
|
||
case reflect.Slice, reflect.Map, reflect.Ptr, reflect.Interface:
|
||
return v.IsNil()
|
||
default:
|
||
return false
|
||
}
|
||
}
|
||
``` |