diff --git a/src/main/java/com/nis/web/controller/configuration/proxy/PxyObjKeyringController.java b/src/main/java/com/nis/web/controller/configuration/proxy/PxyObjKeyringController.java index f4373b6b8..dc0db66ff 100644 --- a/src/main/java/com/nis/web/controller/configuration/proxy/PxyObjKeyringController.java +++ b/src/main/java/com/nis/web/controller/configuration/proxy/PxyObjKeyringController.java @@ -13,6 +13,7 @@ import java.text.SimpleDateFormat; import java.util.ArrayList; import java.util.Date; import java.util.HashMap; +import java.util.Iterator; import java.util.List; import java.util.Map; import java.util.Properties; @@ -34,6 +35,7 @@ import org.springframework.ui.Model; import org.springframework.util.FileCopyUtils; import org.springframework.web.bind.annotation.ModelAttribute; import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.ResponseBody; import org.springframework.web.multipart.MultipartFile; import org.springframework.web.servlet.mvc.support.RedirectAttributes; @@ -370,6 +372,19 @@ public class PxyObjKeyringController extends BaseController { // 查询时left join policyGroup Page page = pxyObjKeyringService.findPage(new Page(request, response, "r"), entity); + + //查询是否存在内置配置 + PxyObjKeyring searchEntity=new PxyObjKeyring(); + searchEntity.setCompileId(0); + Page searchPage=new Page(); + Page builtInPage = pxyObjKeyringService.findPage(searchPage, + searchEntity); + if(builtInPage != null && !StringUtil.isEmpty(builtInPage.getList())) { + model.addAttribute("hasBuiltIn", true); + }else { + model.addAttribute("hasBuiltIn", false); + } + model.addAttribute("page", page); initPageCondition(model, entity); return "/cfg/intercept/strateagy/list"; @@ -608,8 +623,9 @@ public class PxyObjKeyringController extends BaseController { searchBuiltIn.setBuiltIn(1); searchBuiltIn.setIsValid(1); searchBuiltIn.setIsAudit(1); + Page searchPage =new Page(); Page builtInReslt = pxyObjKeyringService - .findTrustedCertPage(new Page(request, response, "r"), searchBuiltIn); + .findTrustedCertPage(searchPage, searchBuiltIn); if(builtInReslt != null && !StringUtil.isEmpty(builtInReslt.getList())) { model.addAttribute("hasBuiltIn", true); }else { @@ -858,6 +874,17 @@ public class PxyObjKeyringController extends BaseController { return "redirect:" + adminPath + "/proxy/intercept/strateagy/trustedCertList?functionId=" + cfg.getFunctionId(); } + + /** + * 内置可信证书导入 + * @param model + * @param request + * @param response + * @param cfg + * @param crlFileI + * @param redirectAttributes + * @return + */ @RequestMapping(value = { "/addBuiltInCert" }) public String trustedCertBuiltIn(Model model, HttpServletRequest request, HttpServletResponse response, @ModelAttribute("cfg") PxyObjTrustedCaCert cfg, MultipartFile crlFileI, @@ -1039,6 +1066,220 @@ public class PxyObjKeyringController extends BaseController { return "redirect:" + adminPath + "/proxy/intercept/strateagy/trustedCertList?functionId=" + cfg.getFunctionId(); } + + /** + * 内置Keyring 导入功能 + * @param model + * @param request + * @param response + * @param cfg + * @param certFileI + * @param redirectAttributes + * @return + */ + @RequestMapping(value = { "/addKeyRingBuiltInCert" }) + public String addKeyRingBuiltInCert(Model model, HttpServletRequest request, HttpServletResponse response, + @ModelAttribute("cfg") PxyObjKeyring cfg, @RequestParam("certFileI")MultipartFile[] certFileI, + RedirectAttributes redirectAttributes) { + + logger.info("keyring内置证书开始校验"); + boolean validFlag = true; + //每个证书文件的内容 + Map fileCertMap=new HashMap<>(); + try { + if(certFileI != null && certFileI.length > 0) { + for (MultipartFile multipartFile : certFileI) { + //校验证书格式 + boolean certFileflag = validCertFileContent(multipartFile,null, "-incert"); + logger.info("证书列表校验结果"+certFileflag); + if (!certFileflag) { + addMessage(redirectAttributes, "error", "save_failed"); + logger.error(multipartFile.getOriginalFilename() + " file non crl file format "); + throw new MultiPartNewException(this.getMsgProp().getProperty("cert_file_error")); + }else { + if(!certInfoMap.isEmpty()) { + String issuer = StringUtil.isEmpty(certInfoMap.get("ca issuer")) ? "" + : certInfoMap.get("ca issuer").toString();// 颁发者 + String fingerprint = StringUtil.isEmpty(certInfoMap.get("ca fingerprint")) ? "" + : certInfoMap.get("ca fingerprint").toString();// 指纹 + if(!StringUtil.isEmpty(issuer) && !StringUtil.isEmpty(fingerprint)) { + if(Constants.KEYRING_BUILT_IN_ISSER.contains("||"+issuer+"||") + && Constants.KEYRING_BUILT_IN_FINGERPRINT.contains("||"+fingerprint+"||")) { + fileCertMap.put(multipartFile.getOriginalFilename(), certInfoMap); + }else { + validFlag=false; + break; + } + }else { + validFlag=false; + break; + } + }else { + validFlag=false; + break; + } + } + } + }else { + addMessage(redirectAttributes, "error", "save_failed"); + logger.error(" keyring is null "); + throw new Exception(); + } + } catch (Exception e) { + validFlag = false; + logger.error("证书文件校验失败", e); + if (e instanceof MaatConvertException) { + addMessage(redirectAttributes, "error", "request_service_failed"); + LogUtils.saveLog(request, null, e, null); + } else if (e instanceof MultiPartNewException) { + addMessage(redirectAttributes, "error", e.getMessage()); + LogUtils.saveLog(request, null, e, null); + } else { + addMessage(redirectAttributes, "error", "save_failed"); + LogUtils.saveLog(request, null, e, null); + } + } + List keyringList=new ArrayList(); + //是keyring内置证书,且验证通过,进行证书文件上传 + try { + if(validFlag) { + File file=null; + for (MultipartFile certFile :certFileI) { + PxyObjKeyring keyring=new PxyObjKeyring(); + BeanUtils.copyProperties(cfg, keyring); + /**************************证书信息获取*************************************/ + String issuer = StringUtil.isEmpty(fileCertMap.get(certFile.getOriginalFilename()).get("ca issuer")) ? "" + : fileCertMap.get(certFile.getOriginalFilename()).get("ca issuer").toString();// 颁发者 + String subject = StringUtil.isEmpty(fileCertMap.get(certFile.getOriginalFilename()).get("ca subjectname")) ? "" + : fileCertMap.get(certFile.getOriginalFilename()).get("ca subjectname").toString();// 颁发给 + String notBeforeStr = ""; + if (!StringUtil.isEmpty(fileCertMap.get(certFile.getOriginalFilename()).get("ca notbefore"))) { + Date notBeforeTime = new Date(fileCertMap.get(certFile.getOriginalFilename()).get("ca notbefore").toString());// 开始时间 + notBeforeStr = sdf.format(notBeforeTime); + } + String notAfterStr = ""; + if (!StringUtil.isEmpty(fileCertMap.get(certFile.getOriginalFilename()).get("ca notafter"))) { + Date notAfterTime = new Date(fileCertMap.get(certFile.getOriginalFilename()).get("ca notafter").toString());// 结束时间 + notAfterStr = sdf.format(notAfterTime); + } + String cn = "";// CN + // CN精确信息获取 + if (!StringUtil.isEmpty(subject)) { + for (String cnStr : subject.split(",")) { + cnStr = StringUtil.isEmpty(cnStr) ? "" : cnStr.trim(); + if (cnStr.split("=").length > 1) { + cn = cnStr.split("=")[1]; + cn = StringUtil.isEmpty(cn) ? "" : cn.trim(); + } + } + } + String altName = StringUtil.isEmpty(fileCertMap.get(certFile.getOriginalFilename()).get("ca altname")) ? "" + : fileCertMap.get(certFile.getOriginalFilename()).get("ca altname").toString();// SAN + + keyring.setIssuer(issuer); + keyring.setSubject(subject); + keyring.setCn(cn); + keyring.setAltName(altName); + keyring.setNotBeforeTime(notBeforeStr); + keyring.setNotAfterTime(notAfterStr); + keyring.setKeyringType("root"); + keyring.setExpireAfter(30); + keyring.setCrl(""); + keyring.setPublicKeyAlgo(""); + /**************************公私钥文件上传*************************************/ + if (certFile != null) { + String filename = certFile.getOriginalFilename(); + String prefix = FileUtils.getPrefix(filename, false); + keyring.setKeyringName(prefix); + keyring.setCfgDesc(prefix); + String suffix = FileUtils.getSuffix(filename, false); + file = File.createTempFile("file_" + prefix, FileUtils.getSuffix(filename, true)); + certFile.transferTo(file);// 复制文件 + String md5 = FileUtils.getFileMD5(file); + Map srcMap = Maps.newHashMap(); + srcMap.put("filetype", suffix); + srcMap.put("datatype", "dbSystem");// 源文件存入数据中心 + srcMap.put("createTime", new Date()); + srcMap.put("key", prefix); + srcMap.put("fileName", filename); + srcMap.put("checksum", md5); + ToMaatResult result = ConfigServiceUtil.postFileCfg(null, file, JsonMapper.toJsonString(srcMap)); + logger.info("proxy 证书文件策略公钥 文件上传响应信息:" + JsonMapper.toJsonString(result)); + String publicKeyFileAccessUrl = null; + if (!StringUtil.isEmpty(result)) { + ResponseData data = result.getData(); + publicKeyFileAccessUrl = data.getAccessUrl(); + keyring.setPublicKeyFile(publicKeyFileAccessUrl); + } + } + if (certFile != null) { + String filename = certFile.getOriginalFilename(); + String prefix = FileUtils.getPrefix(filename, false); + String suffix = FileUtils.getSuffix(filename, false); + file = File.createTempFile("file_" + prefix, FileUtils.getSuffix(filename, true)); + certFile.transferTo(file);// 复制文件 + String md5 = FileUtils.getFileMD5(file); + Map srcMap = Maps.newHashMap(); + srcMap.put("filetype", suffix); + srcMap.put("datatype", "dbSystem");// 源文件存入数据中心 + srcMap.put("createTime", new Date()); + srcMap.put("key", prefix); + srcMap.put("fileName", filename); + srcMap.put("checksum", md5); + ToMaatResult result = ConfigServiceUtil.postFileCfg(null, file, JsonMapper.toJsonString(srcMap)); + logger.info("proxy 证书文件策略私钥 上传响应信息:" + JsonMapper.toJsonString(result)); + String privateKeyFileAccessUrl = null; + if (!StringUtil.isEmpty(result)) { + ResponseData data = result.getData(); + privateKeyFileAccessUrl = data.getAccessUrl(); + keyring.setPrivateKeyFile(privateKeyFileAccessUrl); + ; + } + } + logger.info(keyring.getPublicKeyFile()); + logger.info(keyring.getPrivateKeyFile()); + keyringList.add(keyring); + } + } + } catch (MultiPartNewException e) { + logger.error("证书文件上传失败:",e); + addMessage(redirectAttributes, "error", "request_service_failed"); + LogUtils.saveLog(request, null, e, null); + } catch (MaatConvertException e) { + logger.error("策略配置下发失败:",e); + addMessage(redirectAttributes, "error", "request_service_failed"); + LogUtils.saveLog(request, null, e, null); + } catch (Exception e) { + logger.error("策略配置保存失败:",e); + addMessage(redirectAttributes, "error", "save_failed"); + LogUtils.saveLog(request, null, e, null); + } + + + try { + if(!StringUtil.isEmpty(keyringList)) { + + pxyObjKeyringService.saveAndAuditKeyring(keyringList); + //配置仅保存 + if(StringUtil.isEmpty(cfg.getIsValid()) || cfg.getIsValid()!=1) { + addMessage(redirectAttributes, "success", "save_success"); + }else { + //配置直接生效 + addMessage(redirectAttributes, "success", "audit_success"); + } + } + } catch (MaatConvertException e) { + logger.error("策略配置下发失败:",e); + addMessage(redirectAttributes, "error", "request_service_failed"); + LogUtils.saveLog(request, null, e, null); + } catch (Exception e) { + logger.error("策略配置保存失败:",e); + addMessage(redirectAttributes, "error", "save_failed"); + LogUtils.saveLog(request, null, e, null); + } + + return "redirect:" + adminPath + "/proxy/intercept/strateagy/list?functionId=" + cfg.getFunctionId(); + } /** * 调用shell脚本 返回运行结果 diff --git a/src/main/java/com/nis/web/dao/configuration/PxyObjKeyringDao.xml b/src/main/java/com/nis/web/dao/configuration/PxyObjKeyringDao.xml index 920a96762..d17546146 100644 --- a/src/main/java/com/nis/web/dao/configuration/PxyObjKeyringDao.xml +++ b/src/main/java/com/nis/web/dao/configuration/PxyObjKeyringDao.xml @@ -467,8 +467,8 @@ #{cfgId,jdbcType=VARCHAR}, #{cfgDesc,jdbcType=VARCHAR}, #{action,jdbcType=INTEGER}, - 0, - 0, + #{isValid,jdbcType=INTEGER}, + #{isAudit,jdbcType=INTEGER}, #{creatorId,jdbcType=INTEGER}, #{createTime,jdbcType=TIMESTAMP}, #{editorId,jdbcType=INTEGER}, diff --git a/src/main/java/com/nis/web/service/configuration/PxyObjKeyringService.java b/src/main/java/com/nis/web/service/configuration/PxyObjKeyringService.java index 4532acdb9..a446e330e 100644 --- a/src/main/java/com/nis/web/service/configuration/PxyObjKeyringService.java +++ b/src/main/java/com/nis/web/service/configuration/PxyObjKeyringService.java @@ -533,6 +533,48 @@ public class PxyObjKeyringService extends BaseService{ throw e; } } + + @Transactional(readOnly=false,rollbackFor=RuntimeException.class) + public void saveAndAuditKeyring(List cfgList){ + + Date date=new Date(); + for (PxyObjKeyring cfg : cfgList) { + //0为不可信证书,1可信证书 + if(cfg.getIssuer().indexOf("UNTRUST") > -1) { + cfg.setCompileId(0); + }else { + cfg.setCompileId(1); + } + cfg.setCreateTime(date); + cfg.setCreatorId(UserUtils.getUser().getId()); + cfg.setAuditTime(date); + cfg.setAuditorId(UserUtils.getUser().getId()); + logger.info(cfg.getPublicKeyFile()); + logger.info(cfg.getPrivateKeyFile()); + pxyObjKeyringDao.insert(cfg); + } + + String json=""; + List keyRingList=new ArrayList(); + //可信证书cert回调配置转换 + for (PxyObjKeyring cfg : cfgList) { + keyRingList.add(convertCallBackProxyObjKeyring(cfg)); + } + //调用服务接口下发配置数据 + json=gsonToJson(keyRingList); + logger.info("keyring内置证书下发配置参数:"+json); + //调用服务接口下发配置 + try { + ToMaatResult result = ConfigServiceUtil.postCallbackCfg(json); + if(result!=null){ + logger.info("keyring内置证书下发响应信息:"+result.getMsg()); + } + } catch (Exception e) { + logger.error("keyring内置证书下发失败",e); + throw e; + } + + } } \ No newline at end of file diff --git a/src/main/webapp/WEB-INF/views/cfg/intercept/strateagy/keyRingCertForm.jsp b/src/main/webapp/WEB-INF/views/cfg/intercept/strateagy/keyRingCertForm.jsp new file mode 100644 index 000000000..2f6f27420 --- /dev/null +++ b/src/main/webapp/WEB-INF/views/cfg/intercept/strateagy/keyRingCertForm.jsp @@ -0,0 +1,140 @@ +<%@ page contentType="text/html;charset=UTF-8"%> +<%@ include file="/WEB-INF/include/taglib.jsp"%> +< + \ No newline at end of file diff --git a/src/main/webapp/WEB-INF/views/cfg/intercept/strateagy/list.jsp b/src/main/webapp/WEB-INF/views/cfg/intercept/strateagy/list.jsp index a77df6a8b..aae4162aa 100644 --- a/src/main/webapp/WEB-INF/views/cfg/intercept/strateagy/list.jsp +++ b/src/main/webapp/WEB-INF/views/cfg/intercept/strateagy/list.jsp @@ -38,6 +38,17 @@ } } }); + + var addCertFile=function(obj){ + if($(obj).attr("attribute") != null && $(obj).attr("attribute") != ''){ + attribute=$(obj).attr("attribute"); + } + $("#add_cert_modal").modal({ + backdrop:"static", + keyboard:false, + show:true + }); + } @@ -51,6 +62,12 @@ + + +

@@ -460,6 +477,7 @@ - + +<%@include file="/WEB-INF/views/cfg/intercept/strateagy/keyRingCertForm.jsp" %> \ No newline at end of file diff --git a/src/main/webapp/WEB-INF/views/cfg/intercept/strateagy/trustedCertList.jsp b/src/main/webapp/WEB-INF/views/cfg/intercept/strateagy/trustedCertList.jsp index 288cece5a..9f7b4a5d0 100644 --- a/src/main/webapp/WEB-INF/views/cfg/intercept/strateagy/trustedCertList.jsp +++ b/src/main/webapp/WEB-INF/views/cfg/intercept/strateagy/trustedCertList.jsp @@ -540,7 +540,7 @@ - + <%@include file="/WEB-INF/views/cfg/intercept/strateagy/certForm.jsp" %> <%-- <%@include file="/WEB-INF/views/cfg/intercept/strateagy/crlForm.jsp" %> --%>