Merge pull request #4032 from liuliaozhong-canway/master_issue_3996

fix: 密码明文传输问题 #3996

Author: jsonwan

op-tools/README.md

@@ -91,3 +91,23 @@ pip install pymysql pandas openpyxl
 cd biz_statistics
 python generate_business_statictics_excel.py
 ```
+
+### 5.生成SM2加解密所需的秘钥对
+
+#### 代码位置
+sm2_keypair
+
+#### 功能简介
+
+用于生成SM2加解密所需的秘钥对，生成的原始秘钥可以直接用于后端SM2Util工具，生成的PEM秘钥可以直接用于前端vue。
+
+> python环境: python3.6
+
+#### 执行
+
+```shell
+# 安装依赖
+pip install bk-crypto-python-sdk
+# 生成秘钥对
+python generate_sm2_keypair.py
+```

op-tools/sm2_keypair/generate_sm2_keypair.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+生成SM2加密算法的公私钥对
+依赖：
+- bk-crypto-python-sdk
+"""
+
+from bkcrypto.contrib.basic.ciphers import get_asymmetric_cipher
+from bkcrypto import constants
+from bkcrypto.asymmetric.ciphers import BaseAsymmetricCipher
+from bkcrypto.asymmetric.options import SM2AsymmetricOptions
+from base64 import b64encode
+from tongsuopy.crypto import serialization
+
+
+def generate_sm2_keypair():
+    """
+    生成一套SM2密钥对：
+    1. Job后端（SM2Utils）使用的原始公私钥
+    2. 前端（cryptoJsSdk）使用的PEM公钥
+    """
+
+    # 1 生成SM2 Cipher对象，None表示随机生成密钥
+    sm2_cipher: BaseAsymmetricCipher = get_asymmetric_cipher(
+        cipher_type=constants.AsymmetricCipherType.SM2.value,
+        cipher_options={
+            constants.AsymmetricCipherType.SM2.value: SM2AsymmetricOptions(
+                private_key_string=None
+            )
+        }
+    )
+
+    private_key_obj = sm2_cipher.config.private_key
+    public_key_obj = sm2_cipher.config.public_key
+
+    print('1.生成原始公私钥，可直接用于后端Java SM2Utils使用')
+
+    # 2.生成原始公私钥
+    # 原始公钥 (uncompressed, 65 bytes)
+    # 公钥点的 x,y 拼接，加上前缀 0x04
+    numbers = public_key_obj.public_numbers()
+    x_bytes = numbers.x.to_bytes(32, byteorder="big")
+    y_bytes = numbers.y.to_bytes(32, byteorder="big")
+    raw_public_bytes = b"\x04" + x_bytes + y_bytes
+    raw_public_base64 = b64encode(raw_public_bytes).decode("utf-8")
+
+    # 原始私钥 (32 bytes)
+    raw_private_bytes = private_key_obj.private_numbers().private_value.to_bytes(32, byteorder="big")
+    raw_private_base64 = b64encode(raw_private_bytes).decode("utf-8")
+
+    print("原始公钥:")
+    print(raw_public_base64)
+    print("原始私钥:")
+    print(raw_private_base64)
+
+    # 3. 生成PEM公私钥
+    print('2.生成PEM公私钥，可直接用于前端cryptoJsSdk使用')
+
+    public_pem = public_key_obj.public_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PublicFormat.SubjectPublicKeyInfo
+    ).decode("utf-8")
+
+    private_pem = private_key_obj.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.TraditionalOpenSSL,
+        encryption_algorithm=serialization.NoEncryption()
+    ).decode("utf-8")
+
+    print("PEM公钥：")
+    print(public_pem)
+    print("PEM私钥：")
+    print(private_pem)
+
+
+if __name__ == "__main__":
+    generate_sm2_keypair()

src/backend/commons/common-crypto/build.gradle

@@ -26,6 +26,7 @@ dependencies {
     api project(':commons:common')
     api project(':commons:common-utils')
     api 'com.tencent.bk.sdk:crypto-java-sdk'
+    implementation 'org.bouncycastle:bcprov-jdk18on'
     testImplementation 'org.junit.jupiter:junit-jupiter'
     testImplementation 'org.springframework.boot:spring-boot-starter-test'
 }

src/backend/commons/common-crypto/src/main/java/com/tencent/bk/job/common/crypto/ASymmetricCryptoService.java

@@ -0,0 +1,81 @@
+/*
+ * Tencent is pleased to support the open source community by making BK-JOB蓝鲸智云作业平台 available.
+ *
+ * Copyright (C) 2021 Tencent.  All rights reserved.
+ *
+ * BK-JOB蓝鲸智云作业平台 is licensed under the MIT License.
+ *
+ * License for BK-JOB蓝鲸智云作业平台:
+ * --------------------------------------------------------------------
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
+ * documentation files (the "Software"), to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and
+ * to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all copies or substantial portions of
+ * the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO
+ * THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
+ * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ */
+
+package com.tencent.bk.job.common.crypto;
+
+import com.tencent.bk.sdk.crypto.cryptor.ASymmetricCryptor;
+import com.tencent.bk.sdk.crypto.cryptor.ASymmetricCryptorFactory;
+import lombok.extern.slf4j.Slf4j;
+
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * 非对称加解密服务
+ */
+@SuppressWarnings("unused")
+@Slf4j
+public class ASymmetricCryptoService {
+
+    private final CryptoConfigService cryptoConfigService;
+    private final Map<String, ASymmetricCryptor> cryptorMap = new ConcurrentHashMap<>();
+
+    public ASymmetricCryptoService(CryptoConfigService cryptoConfigService) {
+        this.cryptoConfigService = cryptoConfigService;
+    }
+
+    /**
+     * 对明文信息非对称加密，返回Base64编码后的密文信息
+     *
+     * @param publicKey 公钥
+     * @param message 要加密的明文信息，不可为空
+     * @param cryptoScenarioEnum 加密场景
+     * @return Base64编码的加密后的密文信息
+     */
+    public String encrypt(PublicKey publicKey,
+                          String message,
+                          CryptoScenarioEnum cryptoScenarioEnum) {
+        String algorithm = cryptoConfigService.getSymmetricAlgorithmByScenario(cryptoScenarioEnum);
+        ASymmetricCryptor cryptor = cryptorMap.computeIfAbsent(algorithm, ASymmetricCryptorFactory::getCryptor);
+        return cryptor.encrypt(publicKey, message);
+    }
+
+    /**
+     * 对Base64编码的加密后的密文信息解密，返回解密后的明文
+     *
+     * @param privateKey 私钥
+     * @param base64EncryptedMessage Base64编码的加密后的密文信息，不可为空
+     * @param cryptoScenarioEnum 解密场景
+     * @return 解密后的明文信息
+     */
+    public String decrypt(PrivateKey privateKey,
+                          String base64EncryptedMessage,
+                          CryptoScenarioEnum cryptoScenarioEnum) {
+        String algorithm = cryptoConfigService.getSymmetricAlgorithmByScenario(cryptoScenarioEnum);
+        ASymmetricCryptor cryptor = cryptorMap.computeIfAbsent(algorithm, ASymmetricCryptorFactory::getCryptor);
+        return cryptor.decrypt(privateKey, base64EncryptedMessage);
+    }
+}

src/backend/commons/common-crypto/src/main/java/com/tencent/bk/job/common/crypto/CryptoConfigService.java

@@ -26,6 +26,7 @@
 
 import com.tencent.bk.sdk.crypto.cryptor.consts.CryptorNames;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
 
 import java.util.HashMap;
 import java.util.Map;
@@ -75,6 +76,21 @@ public String getSymmetricPassword() {
         return encryptConfig.getPassword();
     }
 
+    /**
+     * 获取SM2私钥字符串
+     */
+    public String getSm2PrivateKey() {
+        return encryptConfig.getSm2PrivateKey();
+    }
+
+    /**
+     * 获取SM2公钥
+     * @return
+     */
+    public String getSm2PublicKey() {
+        return encryptConfig.getSm2PublicKey();
+    }
+
     /**
      * 根据加密场景获取需要使用的加密算法
      *
@@ -88,6 +104,9 @@ public String getSymmetricAlgorithmByScenario(CryptoScenarioEnum cryptoScenarioE
         if (scenarioAlgorithms != null && scenarioAlgorithms.containsKey(cryptoScenarioEnum.getValue())) {
             return scenarioAlgorithms.get(cryptoScenarioEnum.getValue());
         }
+        if (StringUtils.isNotEmpty(cryptoScenarioEnum.getAlgorithm())) {
+            return cryptoScenarioEnum.getAlgorithm();
+        }
         return getDefaultSymmetricAlgorithm();
     }
 

src/backend/commons/common-crypto/src/main/java/com/tencent/bk/job/common/crypto/CryptoScenarioEnum.java

@@ -24,31 +24,38 @@
 
 package com.tencent.bk.job.common.crypto;
 
+import com.tencent.bk.sdk.crypto.cryptor.consts.CryptorNames;
+
 /**
  * 加密场景枚举值
  */
 public enum CryptoScenarioEnum {
     // 脚本敏感参数
-    SCRIPT_SENSITIVE_PARAM((byte) 0, "scriptSensitiveParam"),
+    SCRIPT_SENSITIVE_PARAM((byte) 0, "scriptSensitiveParam", null),
     // 密文变量
-    CIPHER_VARIABLE((byte) 0, "cipherVariable"),
+    CIPHER_VARIABLE((byte) 0, "cipherVariable", null),
     // DB账号的密码
-    DATABASE_PASSWORD((byte) 0, "databasePassword"),
+    DATABASE_PASSWORD((byte) 0, "databasePassword", null),
     // 凭证信息
-    CREDENTIAL((byte) 0, "credential"),
+    CREDENTIAL((byte) 0, "credential", null),
     // 导出作业的密码
-    EXPORT_JOB_PASSWORD((byte) 0, "exportJobPassword"),
+    EXPORT_JOB_PASSWORD((byte) 0, "exportJobPassword", null),
     // 导出作业的备份文件
-    BACKUP_FILE((byte) 0, "backupFile");
+    BACKUP_FILE((byte) 0, "backupFile", null),
+    // 前端给后端提交账号的密码
+    SUBMIT_ACCOUNT_PASSWORD((byte) 1, "submitAccountPassword", CryptorNames.SM2);
 
     // 加密类型：0为对称加密，1为非对称加密
     private final byte type;
     // 场景标识
     private final String value;
+    // 场景默认加密算法
+    private final String algorithm;
 
-    CryptoScenarioEnum(byte type, String value) {
+    CryptoScenarioEnum(byte type, String value, String algorithm) {
         this.type = type;
         this.value = value;
+        this.algorithm = algorithm;
     }
 
     public String getValue() {
@@ -58,4 +65,8 @@ public String getValue() {
     public byte getType() {
         return type;
     }
+
+    public String getAlgorithm() {
+        return algorithm;
+    }
 }

src/backend/commons/common-crypto/src/main/java/com/tencent/bk/job/common/crypto/EncryptConfig.java

@@ -25,13 +25,13 @@
 package com.tencent.bk.job.common.crypto;
 
 import com.tencent.bk.job.common.util.json.JsonUtils;
+import jakarta.annotation.PostConstruct;
 import lombok.Getter;
 import lombok.Setter;
 import lombok.ToString;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 
-import jakarta.annotation.PostConstruct;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -49,6 +49,10 @@ public class EncryptConfig {
 
     private String password;
 
+    private String sm2PrivateKey;
+
+    private String sm2PublicKey;
+
     /**
      * 各个场景下使用的加密算法，不配置则使用默认算法
      */

src/backend/commons/common-crypto/src/main/java/com/tencent/bk/job/common/crypto/config/CryptoAutoConfiguration.java

@@ -24,11 +24,13 @@
 
 package com.tencent.bk.job.common.crypto.config;
 
+import com.tencent.bk.job.common.crypto.ASymmetricCryptoService;
 import com.tencent.bk.job.common.crypto.CryptoConfigService;
 import com.tencent.bk.job.common.crypto.EncryptConfig;
 import com.tencent.bk.job.common.crypto.SymmetricCryptoService;
 import com.tencent.bk.job.common.crypto.scenario.CipherVariableCryptoService;
 import com.tencent.bk.job.common.crypto.scenario.DbPasswordCryptoService;
+import com.tencent.bk.job.common.crypto.scenario.SubmitAccountPasswordCryptoService;
 import com.tencent.bk.job.common.crypto.scenario.SensitiveParamCryptoService;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.context.annotation.Bean;
@@ -62,4 +64,16 @@ DbPasswordCryptoService dbPasswordCryptoService(SymmetricCryptoService symmetric
     SensitiveParamCryptoService sensitiveParamCryptoService(SymmetricCryptoService symmetricCryptoService) {
         return new SensitiveParamCryptoService(symmetricCryptoService);
     }
+
+    @Bean
+    ASymmetricCryptoService aSymmetricCryptoService(CryptoConfigService cryptoConfigService) {
+        return new ASymmetricCryptoService(cryptoConfigService);
+    }
+
+    @Bean
+    SubmitAccountPasswordCryptoService submitAccountPasswordCryptoService(
+        ASymmetricCryptoService aSymmetricCryptoService,
+        CryptoConfigService cryptoConfigService) {
+        return new SubmitAccountPasswordCryptoService(aSymmetricCryptoService, cryptoConfigService);
+    }
 }