@tmsfe/tms-core 0.0.157 → 0.0.159

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tmsfe/tms-core",
-  "version": "0.0.157",
+  "version": "0.0.159",
   "description": "tms运行时框架",
   "repository": {
     "type": "git",

package/src/encrypt/encrypt-util.ts

@@ -3,6 +3,7 @@
  * 暴露出来的工具函数封装原则：不可以向外throw错误，返回执行结果统一格式：{ success: boolean, msg: string, res: any }
  * https://iwiki.woa.com/p/4013041987#1.-RSA+AES-%E5%88%87%E6%8D%A2-Curve25519+XSalsa20%EF%BC%9A
  */
+import md5 from '../md5';
 /* eslint-disable @typescript-eslint/no-require-imports */
 const ecc = require('./nacl.min.js');
 const base64Util = require('./nacl-util.min.js');
@@ -106,12 +107,10 @@ const eccUtil = {
           method: 'POST',
           data,
           enableHttp2: true,
-          success: (res) => {
-            const success = eccUtil._updateGlobalPublicKeyInfo(false, res.header);
-            resolve(success);
+          success: () => {
+            resolve(true);
           },
           fail: () => {
-            eccUtil._updateGlobalPublicKeyInfo(true);
             resolve(false);
           },
         });
@@ -135,10 +134,10 @@ const eccUtil = {
     return new baseUtil.BaseRespFac(success);
   },
   _privateKeyInfo: null,
-  getPrivateKeyInfo: (): CryptoKeyInfo => {
+  getPrivateKeyInfo: (forceUpdate = false): CryptoKeyInfo => {
     if (!wx.$_publicKey) return null;
     const serverPubInfo = wx.$_publicKey;
-    if (!eccUtil._privateKeyInfo || eccUtil._privateKeyInfo.serverPubId !== serverPubInfo.pubId) {
+    if (forceUpdate || !eccUtil._privateKeyInfo || eccUtil._privateKeyInfo.serverPubId !== serverPubInfo.pubId) {
       const keyPair = ecc.box.keyPair();  // 生成客户端公钥私钥
       eccUtil._privateKeyInfo = {
         serverPubId: serverPubInfo.pubId,                       // 服务端公钥id
@@ -149,33 +148,91 @@ const eccUtil = {
     return eccUtil._privateKeyInfo;
   },
   // 解析gwCode
+  /* eslint-disable complexity */
   resolveGwCode: async (codeStr: string): Promise<{ retry: boolean, success: boolean }> => {
     if (!codeStr) return { retry: false, success: true };
     const code = parseInt(codeStr, 10);
     switch (code) {
       case 0:
         return { retry: false, success: true };
-      case 11300:  // 解密失败
-        return { retry: false, success: false };
-      case 11305:  // 公钥id无效
+      case 11305:    // 公钥id无效
       case 11306:  { // 公钥过期
-        const genPubSuccess = await eccUtil._refreshPubKeyInfo(true); // 1. 获取公钥
-        if (!genPubSuccess) return { retry: false, success: false };
-        eccUtil.getPrivateKeyInfo();                                  // 2. 生成私钥
+        // 1. 获取公钥
+        eccUtil._refreshPubKeyInfo(true).then((genPubSuccess) => {
+          genPubSuccess && eccUtil.getPrivateKeyInfo();   // 2. 生成私钥
+        });
         return { retry: true, success: false };
       }
-      case 11307:  // 加密未开启
-        return { retry: false, success: false };
+      case 11308:  { // 密钥对有问题
+        eccUtil.getPrivateKeyInfo(true);                   // 重新生成私钥
+        return { retry: true, success: false };
+      }
+      case 11300:  // 解密失败
       case 11301:
       case 11302:
       case 11303:
       case 11304:
-      case 11308:
+      case 11307:  // 加密未开启
+        return { retry: true, success: false };
+      case 11309:
         return { retry: false, success: false };
       default:     // 其他网关错误码
         return { retry: false, success: true };
     }
   },
+  _getSignSharedByte: () => baseUtil.decUrl('mEufQpM1n5J8-OZZoJE7ucYMC2suTjfsHUq_6z5cyh8'),
+  // 计算客户端加密签名
+  getClientCryptoSign: (data = {}, header = {}, sharedByte): string => {
+    const obj = baseUtil.formatHeader(Object.assign({}, data, header));
+    // 1. 生成签名前的字符串
+    const str = Object.keys(obj).filter(item => obj[item])
+      .sort()
+      .reduce((pre, cur) => {
+        pre.push(`${cur}=${obj[cur]}`);
+        return pre;
+      }, [])
+      .join('&');
+    // 2. md5
+    const md5Str = md5(str, '', 'unit8array');
+    const nonce = ecc.randomBytes(ecc.box.nonceLength);
+    const encrypted = ecc.box.after(md5Str, nonce, sharedByte);
+    const combined = new Uint8Array(nonce.length + encrypted.length);
+    combined.set(nonce);
+    combined.set(encrypted, nonce.length);
+    return baseUtil.encUrl(combined);
+  },
+  // 验证服务端加密签名
+  verifyServerCryptoSign: (traceId: string, resHeader = {}): boolean => {
+    const formatHeader = baseUtil.formatHeader(resHeader);
+    const signStr = formatHeader['x-crypto-sign'];
+    const obj = {
+      'x-encrypt-key': formatHeader['x-encrypt-key'],
+      'x-encrypt-response': formatHeader['x-encrypt-response'],
+      'x-response-header-name': formatHeader['x-response-header-name'],
+      'x-encrypted-headers': formatHeader['x-encrypted-headers'],
+      'x-crypto-enable': formatHeader['x-crypto-enable'],
+      'content-type': formatHeader['content-type'],
+      'x-gateway-code': formatHeader['x-gateway-code'],
+      'x-crypto-pub-id': formatHeader['x-crypto-pub-id'],
+      'x-crypto-pub-key': formatHeader['x-crypto-pub-key'],
+      'x-crypto-pub-exp': formatHeader['x-crypto-pub-exp'],
+      'x-crypto-path': formatHeader['x-crypto-path'],
+      'x-trace-id': traceId,
+    };
+    const msg = baseUtil.decUrl(signStr);
+    const decrypted = ecc.sign.open(msg, eccUtil._getSignSharedByte());
+    const str = Object.keys(obj).filter(item => obj[item])
+      .sort()
+      .reduce((pre, cur) => {
+        pre.push(`${cur}=${obj[cur]}`);
+        return pre;
+      }, [])
+      .join('&');
+    const preHashArr = md5(str, '', 'unit8array');
+    const verified = preHashArr.length === decrypted.length && preHashArr.every((v, i) => v === decrypted[i]);
+    return verified;
+  },
+  /* eslint-enable complexity */
   execEncrypt: (input: string, ignoreNull = false): BaseResp<{
     cryptoKeyInfo: CryptoKeyInfo,
     encryptedContent: any } | null> => {
@@ -355,23 +412,30 @@ const reqEncrypt = (method: string, data: any, header: {
   if (!success) {
     return new baseUtil.BaseRespFac(null, false, `请求Header加密失败: ${msg}`);
   }
+  const cryptoHeader = {
+    'X-Crypto-Mode': '2',  // ecc加密模式
+    'X-Encrypted-Headers': res.encryptedContent,
+    'X-Encrypt-Pub': res.cryptoKeyInfo.serverPubId,
+    'X-Encrypt-Key': res.cryptoKeyInfo.clientPublicKey,
+    'X-Encrypt-Response': '3',                 // 加密，二进制
+    'X-Response-Header-Name': encryptedResponseHeaderName,
+    'Content-Type': 'text/plain',
+  };
+  const cryptoSign = eccUtil.getClientCryptoSign(baseUtil._isObject(finalData) ? finalData : {
+    body: finalData,
+  }, cryptoHeader, res.cryptoKeyInfo.sharedByte);
   return new baseUtil.BaseRespFac({
     cryptoKeyInfo: res.cryptoKeyInfo,
     data: finalData,
     header: {
-      'Content-Type': 'text/plain',
-      'X-Crypto-Mode': '2',                       // ecc加密模式
-      'X-Encrypted-Headers': res.encryptedContent,
-      'X-Encrypt-Pub': res.cryptoKeyInfo.serverPubId,
-      'X-Encrypt-Key': res.cryptoKeyInfo.clientPublicKey,
-      'X-Encrypt-Response': '3',                 // 加密，二进制
-      'X-Response-Header-Name': encryptedResponseHeaderName,
+      ...cryptoHeader,
+      'X-Crypto-Sign': cryptoSign,
     },
   });
 };
 // 解密请求结果
-const resDecrypt = async (header, data, cryptoKeyInfo: CryptoKeyInfo): Promise<BaseResp<{
-  retry: boolean,
+const resDecrypt = async (requestTraceId: string, header, data, cryptoKeyInfo: CryptoKeyInfo): Promise<BaseResp<{
+  retry: boolean,  // 是否需要明文重试
   header: any,
   data: any,
 }>> => {
@@ -386,17 +450,28 @@ const resDecrypt = async (header, data, cryptoKeyInfo: CryptoKeyInfo): Promise<B
       'content-type': contentType,                            // 响应内容类型
     } = formatHeader;
     if (!encryptResponseMode || encryptResponseMode === '0') { // 不需要解密，直接返回
-      return new baseUtil.BaseRespFac({ header, data, retry: false });
+      const dataStr = base64Util.encodeUTF8(new Uint8Array(data));
+      return new baseUtil.BaseRespFac({
+        header,
+        data: JSON.parse(dataStr),
+        retry: false,
+      });
     }
     const { retry, success: gwSuccess } = await eccUtil.resolveGwCode(gatewayCode);
     if (!gwSuccess) {
+      // 网关加密流程出现问题，需要验证网关签名
+      const verified = eccUtil.verifyServerCryptoSign(requestTraceId, header);
+      if (!verified) {
+        // 验证失败，表示请求被篡改
+        return new baseUtil.BaseRespFac({ header: null, data: null, retry: false }, false, '响应被篡改');
+      }
       return new baseUtil.BaseRespFac({ header: null, data: null, retry }, false, `网关返回错误码: ${gatewayCode}`);
     }
     let decryptedHeaders = {};
     if (encryptedResponseHeaderName) {                         // 解密响应Header
       const { success, msg, res } = eccUtil.execDecrypt(baseUtil.decUrl(encryptedHeaders), cryptoKeyInfo);
       if (!success) {
-        return new baseUtil.BaseRespFac({ header: null, data: null, retry: false }, false, `解密响应Header失败: ${msg}`);
+        return new baseUtil.BaseRespFac({ header: null, data: null, retry: true }, false, `解密响应Header失败: ${msg}`);
       }
       decryptedHeaders = JSON.parse(res);
     }
@@ -404,7 +479,7 @@ const resDecrypt = async (header, data, cryptoKeyInfo: CryptoKeyInfo): Promise<B
     const cipher = needDecode ? baseUtil.decUrl(data) : new Uint8Array(data);
     const { success, msg, res } = eccUtil.execDecrypt(cipher, cryptoKeyInfo);
     if (!success) {
-      return new baseUtil.BaseRespFac({ header: null, data: null, retry: false }, false, `解密响应Body失败: ${msg}`);
+      return new baseUtil.BaseRespFac({ header: null, data: null, retry: true }, false, `解密响应Body失败: ${msg}`);
     }
     const decryptedBody = JSON.parse(res); // 解密响应Body
     return new baseUtil.BaseRespFac({
@@ -417,24 +492,40 @@ const resDecrypt = async (header, data, cryptoKeyInfo: CryptoKeyInfo): Promise<B
     });
   } catch (e) {
     // 因为上面的逻辑有parse, 所以这里再加一个catch
-    return new baseUtil.BaseRespFac({ header: null, data: null, retry: false }, false, `解密响应Body失败: ${JSON.stringify(e)}`);
+    return new baseUtil.BaseRespFac({ header: null, data: null, retry: true }, false, `解密响应Body失败: ${JSON.stringify(e)}`);
   }
 };
 // 处理接下来的请求开关
 let dealEncryptionSwitching = false;
-const dealEncryptionSwitch = async (path: string, resHeader): Promise<void> => {
+const dealEncryptionSwitch = async (path: string, traceId: string, resHeader): Promise<boolean> => {
   if ((!resHeader || dealEncryptionSwitching)) {
     return;
   }
   dealEncryptionSwitching = true;
   const formatHeader = baseUtil.formatHeader(resHeader);
   if (formatHeader['x-crypto-enable'] === '0') {
-    eccUtil.closeCrypto();
+    // 网关加密验签，验签通过才能执行关闭
+    const verified = eccUtil.verifyServerCryptoSign(traceId, formatHeader);
+    if (verified) {
+      eccUtil.closeCrypto();
+    }
   } else if (formatHeader['x-crypto-enable'] === '1') {
-    `${baseUtil.getSinanHost()}/user/login` === path && eccUtil._updateGlobalPublicKeyInfo(false, formatHeader);
+    if ([
+      `${baseUtil.getSinanHost()}/user/login`,
+      `${baseUtil.getSinanHost()}/basic/crypto/lastkey`,
+    ].indexOf(path) > -1) {
+      const verified = eccUtil.verifyServerCryptoSign(traceId, formatHeader);
+      if (!verified) {
+        // 验签失败，表示请求被篡改
+        dealEncryptionSwitching = false;
+        return false;
+      }
+      eccUtil._updateGlobalPublicKeyInfo(false, formatHeader);
+    }
     await eccUtil.openCrypto();
   } // 0是关闭，1是开启, 2是保持
   dealEncryptionSwitching = false;
+  return true;
 };
 
 const encryptUtil = {

package/src/encrypt/index.ts

@@ -71,6 +71,7 @@ function proxyWxRequest(): void {
     value(options: any) {
       const { url, method, data, header = {}, success, fail, complete, dataType, responseType } = options;
       const traceparent = genTraceparent();
+      const traceId = traceparent.split('-')[1];
       const originalOptions = { ...options };
 
       // 如果用户自定义了dataType或者responseType，则不做处理
@@ -79,7 +80,7 @@ function proxyWxRequest(): void {
         originalRequestApi.call(this, {
           ...originalOptions,
           success: (res) => {
-            encryptUtil.dealEncryptionSwitch(url, res.header);
+            encryptUtil.dealEncryptionSwitch(url, traceId, res.header);
             success?.call(this, res);
           },
           header: { ...header, Traceparent: traceparent },
@@ -94,9 +95,14 @@ function proxyWxRequest(): void {
         util.logInfo(url, traceparent, msg);
         originalRequestApi.call(this, {
           ...originalOptions,
-          success: (res) => {
-            encryptUtil.dealEncryptionSwitch(url, res.header);
-            success?.call(this, res);
+          success: async (res) => {
+            const dealSuccess = await encryptUtil.dealEncryptionSwitch(url, traceId, res.header);
+            if (dealSuccess) {
+              success?.call(this, res);
+            } else {
+              util.reportFunc(url, traceparent, `加密验签不通过: ${JSON.stringify(res)}`);
+              fail?.call(this, new Error('加密验签不通过'));
+            }
           },
           header: { ...header, Traceparent: traceparent },
         });
@@ -115,25 +121,34 @@ function proxyWxRequest(): void {
         responseType: 'arraybuffer',
         success: async (result) => {
           const { header: resHeader, data: resData } = result;
-          const { success: resSuccess, msg, res } = await encryptUtil.resDecrypt(resHeader, resData, cryptoKeyInfo);
-          if (resSuccess) {
-            util.logInfo(url, traceparent, '解密成功');
-            success?.call(this, res);
-            const completeRes: any = await completePromp;
-            completeRes.header = resHeader;
-            completeRes.data = resData;
-            complete?.call(this, completeRes);
-          } else {
+          const { success: decSuccess, msg, res } = await encryptUtil
+            .resDecrypt(traceId, resHeader, resData, cryptoKeyInfo);
+          if (res.retry) { // 解密出现问题，需要明文重试
             util.reportFunc(url, traceparent, `解密失败：${msg}`);
+            const newTraceparent = genTraceparent();
+            const traceId = newTraceparent.split('-')[1];
             originalRequestApi.call(this, {
               ...originalOptions,
               success: (res) => {
-                encryptUtil.dealEncryptionSwitch(url, res.header);
+                encryptUtil.dealEncryptionSwitch(url, traceId, res.header);
                 success?.call(this, res);
               },
-              header: { ...header, Traceparent: genTraceparent() },
+              header: { ...header, Traceparent: newTraceparent },
             });
+            return;
+          }
+          if (decSuccess) {
+            util.logInfo(url, traceparent, '解密成功');
+            encryptUtil.dealEncryptionSwitch(url, traceId, resHeader);
+            success?.call(this, res);
+          } else { // 不支持明文重试，且解密失败
+            util.reportFunc(url, traceparent, `解密失败：${msg}`);
+            fail?.call(this, new Error(msg));
           }
+          const completeRes: any = await completePromp;
+          completeRes.header = resHeader;
+          completeRes.data = resData;
+          complete?.call(this, completeRes);
         },
         fail: async (err) => {
           fail?.call(this, err);

package/src/md5.js

@@ -349,6 +349,20 @@ function hexHMACMD5(k, d) {
   return rstr2hex(rawHMACMD5(k, d));
 }
 
+/**
+ * 将原始二进制字符串转换为 Uint8Array
+ *
+ * @param {string} input 原始的 MD5 二进制字符串
+ * @returns {Uint8Array} Uint8Array 格式的 MD5 哈希值
+ */
+function rstr2uint8array(input) {
+  const output = new Uint8Array(input.length);
+  for (let i = 0; i < input.length; i++) {
+    output[i] = input.charCodeAt(i);
+  }
+  return output;
+}
+
 /**
  * Calculates MD5 value for a given string.
  * If a key is provided, calculates the HMAC-MD5 value.
@@ -356,7 +370,7 @@ function hexHMACMD5(k, d) {
  *
  * @param {string} string Input string
  * @param {string} [key] HMAC key
- * @param {boolean} [raw] Raw output switch
+ * @param {string} [raw] Raw output switch
  * @returns {string} MD5 output
  */
 function md5(string, key, raw) {
@@ -364,11 +378,17 @@ function md5(string, key, raw) {
     if (!raw) {
       return hexMD5(string);
     }
+    if (raw === 'unit8array') {
+      return rstr2uint8array(rawMD5(string));
+    }
     return rawMD5(string);
   }
   if (!raw) {
     return hexHMACMD5(key, string);
   }
+  if (raw === 'unit8array') {
+    return rstr2uint8array(rawHMACMD5(key, string));
+  }
   return rawHMACMD5(key, string);
 }