361 lines
10 KiB
Go
361 lines
10 KiB
Go
package cryptx
|
||
|
||
import (
|
||
"bytes"
|
||
"crypto/aes"
|
||
"crypto/cipher"
|
||
"crypto/sha1"
|
||
"encoding/base64"
|
||
"encoding/binary"
|
||
"encoding/xml"
|
||
"errors"
|
||
"fmt"
|
||
"math/rand"
|
||
"sort"
|
||
"strings"
|
||
"time"
|
||
)
|
||
|
||
const (
|
||
LETTERDIGITS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
|
||
LD_COUNT = 62
|
||
)
|
||
|
||
const (
|
||
WXBizMsgCrypt_OK = 0
|
||
WXBizMsgCrypt_ValidateSignature_Error = -40001
|
||
WXBizMsgCrypt_ParseXml_Error = -40002
|
||
WXBizMsgCrypt_ComputeSignature_Error = -40003
|
||
WXBizMsgCrypt_IllegalAesKey = -40004
|
||
WXBizMsgCrypt_ValidateAppid_Error = -40005
|
||
WXBizMsgCrypt_EncryptAES_Error = -40006
|
||
WXBizMsgCrypt_DecryptAES_Error = -40007
|
||
WXBizMsgCrypt_IllegalBuffer = -40008
|
||
WXBizMsgCrypt_EncodeBase64_Error = -40009
|
||
WXBizMsgCrypt_DecodeBase64_Error = -40010
|
||
WXBizMsgCrypt_GenReturnXml_Error = -40011
|
||
)
|
||
|
||
var (
|
||
letterDigitArr = []byte(LETTERDIGITS)
|
||
)
|
||
|
||
type (
|
||
XMLParse struct {
|
||
XMLtmpl string
|
||
}
|
||
|
||
WXBizMsgCrypt interface {
|
||
EncryptMsg(sReplyMsg string, sNonce string, timestamp int64) (int, string)
|
||
DecryptMsg(sPostData, sMsgSignature string, sTimeStamp int64, sNonce string) (int, string)
|
||
}
|
||
|
||
wxBizMsgCrypt struct {
|
||
key string
|
||
token string
|
||
appid string
|
||
}
|
||
)
|
||
|
||
// sToken: 公众平台上，开发者设置的Token
|
||
// sEncodingAESKey: 公众平台上，开发者设置的EncodingAESKey
|
||
// sAppId: 企业号的AppId
|
||
func NewWXBizMsgCrypt(sToken, sEncodingAESKey, sAppId string) (WXBizMsgCrypt, error) {
|
||
decodeBytes, err := base64.StdEncoding.DecodeString(sEncodingAESKey + "=")
|
||
if err != nil {
|
||
return nil, errors.New("EncodingAESKey err")
|
||
}
|
||
//assert len(key) == 32
|
||
if len(decodeBytes) != 32 {
|
||
return nil, errors.New("EncodingAESKey length err")
|
||
}
|
||
c := &wxBizMsgCrypt{
|
||
key: string(decodeBytes),
|
||
token: sToken,
|
||
appid: sAppId,
|
||
}
|
||
return c, nil
|
||
}
|
||
|
||
// 将公众号回复用户的消息加密打包
|
||
// sReplyMsg: 企业号待回复用户的消息，xml格式的字符串
|
||
// sTimeStamp: 时间戳，可以自己生成，也可以用URL参数的timestamp,如为None则自动用当前时间
|
||
// sNonce: 随机串，可以自己生成，也可以用URL参数的nonce
|
||
// sEncryptMsg: 加密后的可以直接回复用户的密文，包括msg_signature, timestamp, nonce, encrypt的xml格式的字符串,
|
||
// return：成功0，sEncryptMsg,失败返回对应的错误码None
|
||
func (c *wxBizMsgCrypt) EncryptMsg(sReplyMsg string, sNonce string, timestamp int64) (int, string) {
|
||
pc := NewPrpcrypt(c.key)
|
||
ret, encryptBytes := pc.encrypt([]byte(sReplyMsg), c.appid)
|
||
if ret != WXBizMsgCrypt_OK {
|
||
return ret, ""
|
||
}
|
||
if timestamp <= 0 {
|
||
timestamp = time.Now().Unix()
|
||
}
|
||
encrypt_text := string(encryptBytes)
|
||
timestampStr := fmt.Sprintf("%d", timestamp)
|
||
// 生成安全签名
|
||
ret, signature := getSHA1(c.token, timestampStr, sNonce, encrypt_text)
|
||
if ret != WXBizMsgCrypt_OK {
|
||
return ret, ""
|
||
}
|
||
xmlParse := NewXMLParse()
|
||
resp_xml := xmlParse.generate(encrypt_text, signature, timestampStr, sNonce)
|
||
return ret, resp_xml
|
||
}
|
||
|
||
// 检验消息的真实性，并且获取解密后的明文
|
||
// sMsgSignature: 签名串，对应URL参数的msg_signature
|
||
// sTimeStamp: 时间戳，对应URL参数的timestamp
|
||
// sNonce: 随机串，对应URL参数的nonce
|
||
// sPostData: 密文，对应POST请求的数据
|
||
// xml_content: 解密后的原文，当return返回0时有效
|
||
// return: 成功0，失败返回对应的错误码
|
||
// 验证安全签名
|
||
func (c *wxBizMsgCrypt) DecryptMsg(sPostData, sMsgSignature string, sTimeStamp int64, sNonce string) (int, string) {
|
||
// 验证安全签名
|
||
xmlParse := NewXMLParse()
|
||
ret, encrypt, _ := xmlParse.extract(sPostData)
|
||
if ret != WXBizMsgCrypt_OK {
|
||
return ret, ""
|
||
}
|
||
timestampStr := fmt.Sprintf("%d", sTimeStamp)
|
||
ret, signature := getSHA1(c.token, timestampStr, sNonce, encrypt)
|
||
if ret != WXBizMsgCrypt_OK {
|
||
return ret, ""
|
||
}
|
||
if signature != sMsgSignature {
|
||
return WXBizMsgCrypt_ValidateSignature_Error, ""
|
||
}
|
||
pc := NewPrpcrypt(c.key)
|
||
ret, xml_content := pc.decrypt([]byte(encrypt), c.appid)
|
||
return ret, string(xml_content)
|
||
}
|
||
|
||
// 提供提取消息格式中的密文及生成回复消息格式的接口
|
||
func NewXMLParse() *XMLParse {
|
||
xp := &XMLParse{
|
||
// xml消息模板
|
||
XMLtmpl: `<xml>
|
||
<Encrypt><![CDATA[%(msg_encrypt)s]]></Encrypt>
|
||
<MsgSignature><![CDATA[%(msg_signaturet)s]]></MsgSignature>
|
||
<TimeStamp>%(timestamp)s</TimeStamp>
|
||
<Nonce><![CDATA[%(nonce)s]]></Nonce>
|
||
</xml>`,
|
||
}
|
||
return xp
|
||
}
|
||
|
||
type XmlResources struct {
|
||
XMLName xml.Name `xml:"xml"`
|
||
Encrypt string `xml:"Encrypt"`
|
||
ToUserName string `xml:"ToUserName"`
|
||
}
|
||
|
||
// 提取出xml数据包中的加密消息
|
||
// xmltext: 待提取的xml字符串
|
||
// return: 提取出的加密消息字符串
|
||
//
|
||
func (xp *XMLParse) extract(xmltext string) (int, string, string) {
|
||
var result XmlResources
|
||
err := xml.Unmarshal([]byte(xmltext), &result)
|
||
if err != nil {
|
||
fmt.Println(err)
|
||
return WXBizMsgCrypt_ParseXml_Error, "", ""
|
||
}
|
||
return WXBizMsgCrypt_OK, result.Encrypt, result.ToUserName
|
||
}
|
||
|
||
// 生成xml消息
|
||
// encrypt: 加密后的消息密文
|
||
// signature: 安全签名
|
||
// timestamp: 时间戳
|
||
// nonce: 随机字符串
|
||
// return: 生成的xml字符串
|
||
//
|
||
func (xp *XMLParse) generate(encrypt, signature, timestampStr, nonce string) string {
|
||
resp_xml := strings.Replace(xp.XMLtmpl, "%(msg_encrypt)s", encrypt, 1)
|
||
resp_xml = strings.Replace(resp_xml, "%(msg_signaturet)s", signature, 1)
|
||
resp_xml = strings.Replace(resp_xml, "%(timestamp)s", timestampStr, 1)
|
||
resp_xml = strings.Replace(resp_xml, "%(nonce)s", nonce, 1)
|
||
return resp_xml
|
||
}
|
||
|
||
// 计算公众平台的消息签名接口
|
||
// 用SHA1算法生成安全签名
|
||
// token: 票据
|
||
// timestamp: 时间戳
|
||
// encrypt: 密文
|
||
// nonce: 随机字符串
|
||
// return: 安全签名
|
||
func getSHA1(token string, timestampStr, nonce, encrypt string) (int, string) {
|
||
sortlist := []string{token, timestampStr, nonce, encrypt}
|
||
sort.Strings(sortlist)
|
||
hashBytes := sha1.Sum([]byte(strings.Join(sortlist, "")))
|
||
hashString := fmt.Sprintf("%x", hashBytes)
|
||
return WXBizMsgCrypt_OK, hashString
|
||
}
|
||
|
||
type Prpcrypt struct {
|
||
key string
|
||
mode string
|
||
}
|
||
|
||
// 提供接收和推送给公众平台消息的加解密接口
|
||
func NewPrpcrypt(key string) *Prpcrypt {
|
||
// 设置加解密模式为AES的CBC模式
|
||
pc := &Prpcrypt{
|
||
key: key,
|
||
mode: "AES.CBC",
|
||
}
|
||
return pc
|
||
}
|
||
|
||
// s对明文进行加密
|
||
// textBytes: 需要加密的明文
|
||
// return: 加密得到的字符串
|
||
//
|
||
func (pc *Prpcrypt) encrypt(textBytes []byte, appid string) (int, []byte) {
|
||
//# 16位随机字符串添加到明文开头
|
||
rand_bytes := pc.get_random_bytes()
|
||
len1 := len(rand_bytes)
|
||
len3 := len(textBytes)
|
||
len_bytes := htonl(len3)
|
||
len2 := len(len_bytes)
|
||
appid_bytes := []byte(appid)
|
||
len4 := len(appid_bytes)
|
||
toBytes := make([]byte, len1+len2+len3+len4)
|
||
copy(toBytes[0:len1], rand_bytes)
|
||
copy(toBytes[len1:(len1+len2)], len_bytes)
|
||
copy(toBytes[(len1+len2):(len1+len2+len3)], textBytes)
|
||
copy(toBytes[(len1+len2+len3):(len1+len2+len3+len4)], appid_bytes)
|
||
// 使用自定义的填充方式对明文进行补位填充
|
||
pkcs7 := NewPKCS7Encoder()
|
||
plantBytes := pkcs7.encode(toBytes)
|
||
// 加密
|
||
keyBytes := []byte(pc.key)
|
||
block, err := aes.NewCipher(keyBytes) //选择加密算法
|
||
if err != nil {
|
||
fmt.Println(err)
|
||
return WXBizMsgCrypt_EncryptAES_Error, []byte{}
|
||
}
|
||
blockModel := cipher.NewCBCEncrypter(block, keyBytes[0:16])
|
||
cipherBytes := make([]byte, len(plantBytes))
|
||
blockModel.CryptBlocks(cipherBytes, plantBytes)
|
||
// 使用BASE64对加密后的字符串进行编码
|
||
dstBytes := make([]byte, base64.StdEncoding.EncodedLen(len(cipherBytes)))
|
||
base64.StdEncoding.Encode(dstBytes, cipherBytes)
|
||
return WXBizMsgCrypt_OK, dstBytes
|
||
}
|
||
|
||
// 对解密后的明文进行补位删除
|
||
// cipherBytes: 密文
|
||
// return: 删除填充补位后的明文
|
||
//
|
||
func (pc *Prpcrypt) decrypt(cipherBytes []byte, appid string) (int, []byte) {
|
||
_dstBytes := make([]byte, base64.StdEncoding.DecodedLen(len(cipherBytes)))
|
||
n, err := base64.StdEncoding.Decode(_dstBytes, cipherBytes)
|
||
if err != nil {
|
||
fmt.Println(err)
|
||
return WXBizMsgCrypt_DecodeBase64_Error, []byte{}
|
||
}
|
||
dstBytes := _dstBytes[0:n]
|
||
keyBytes := []byte(pc.key)
|
||
block, err := aes.NewCipher(keyBytes) //选择加密算法
|
||
if err != nil {
|
||
fmt.Println(err)
|
||
return WXBizMsgCrypt_IllegalBuffer, []byte{}
|
||
}
|
||
blockModel := cipher.NewCBCDecrypter(block, keyBytes[0:16])
|
||
plantBytes := make([]byte, len(dstBytes))
|
||
blockModel.CryptBlocks(plantBytes, dstBytes)
|
||
//
|
||
length := len(plantBytes)
|
||
pad := int(uint8(plantBytes[length-1]))
|
||
// 去除16位随机字符串
|
||
content := plantBytes[16:(length - pad)]
|
||
xml_len := ntohl(content[0:4])
|
||
xml_content := content[4:(xml_len + 4)]
|
||
from_appid := content[(xml_len + 4):len(content)]
|
||
if string(from_appid) != appid {
|
||
return WXBizMsgCrypt_ValidateAppid_Error, []byte{}
|
||
}
|
||
return WXBizMsgCrypt_OK, xml_content
|
||
|
||
}
|
||
|
||
// 随机生成16位字符串
|
||
// return: 16位字符串
|
||
//
|
||
func (pc *Prpcrypt) get_random_bytes() []byte {
|
||
rander := rand.New(rand.NewSource(time.Now().UnixNano()))
|
||
length := 16
|
||
result := make([]byte, length)
|
||
for i, _ := range result {
|
||
result[i] = letterDigitArr[rander.Intn(LD_COUNT)]
|
||
//result[i] = letterDigitArr[52+((i+1)%10)]
|
||
}
|
||
return result
|
||
}
|
||
|
||
// 提供基于PKCS7算法的加解密接口
|
||
type PKCS7Encoder struct {
|
||
block_size int
|
||
}
|
||
|
||
func NewPKCS7Encoder() *PKCS7Encoder {
|
||
p := &PKCS7Encoder{
|
||
block_size: 32,
|
||
}
|
||
return p
|
||
}
|
||
|
||
// 对需要加密的明文进行填充补位
|
||
// text: 需要进行填充补位操作的明文
|
||
// return: 补齐明文字符串
|
||
func (p *PKCS7Encoder) encode(textBytes []byte) []byte {
|
||
length := len(textBytes)
|
||
if length == 0 {
|
||
return []byte{}
|
||
}
|
||
// 计算需要填充的位数
|
||
amount_to_pad := p.block_size - (length % p.block_size)
|
||
if amount_to_pad == 0 {
|
||
amount_to_pad = p.block_size
|
||
}
|
||
// 获得补位所用的字符
|
||
padArr := bytes.Repeat([]byte{byte(amount_to_pad)}, amount_to_pad)
|
||
encTextBytes := make([]byte, length+amount_to_pad)
|
||
copy(encTextBytes, textBytes)
|
||
copy(encTextBytes[length:(length+amount_to_pad)], padArr)
|
||
return encTextBytes
|
||
}
|
||
|
||
// 删除解密后明文的补位字符
|
||
// decrypted: 解密后的明文
|
||
// return: 删除补位字符后的明文
|
||
func (p *PKCS7Encoder) decode(decrypted []byte) []byte {
|
||
length := len(decrypted)
|
||
if length == 0 {
|
||
return []byte{}
|
||
}
|
||
pad := int(uint8(decrypted[length-1]))
|
||
if pad < 1 || pad > 32 {
|
||
pad = 0
|
||
}
|
||
if pad >= length {
|
||
return []byte{}
|
||
}
|
||
return decrypted[0:(length - pad)]
|
||
}
|
||
|
||
func htonl(n int) []byte {
|
||
data := make([]byte, 4)
|
||
binary.BigEndian.PutUint32(data, uint32(n))
|
||
return data
|
||
}
|
||
|
||
func ntohl(data []byte) int {
|
||
n := binary.BigEndian.Uint32(data[0:4])
|
||
return int(n)
|
||
} |