|
|
@@ -6,6 +6,7 @@ use crate::storage::{get_storage, UserInfo};
|
|
|
use serde_json;
|
|
|
use std::fs;
|
|
|
|
|
|
+
|
|
|
// 加密相关导入
|
|
|
use base64::{Engine as _, engine::general_purpose};
|
|
|
use hmac::{Hmac, Mac};
|
|
|
@@ -528,7 +529,7 @@ pub async fn secure_user_login(request: LoginRequest) -> Result<LoginResponse, S
|
|
|
let signature_data = format!("{}:{}:{}:{}:{}", timestamp, nonce, encrypted_params_base64, encrypted_aes_key_base64, key_version);
|
|
|
type HmacSha256 = Hmac<Sha256>;
|
|
|
|
|
|
- let mut mac = HmacSha256::new_from_slice(b"your-secret-key-change-in-production")
|
|
|
+ let mut mac = HmacSha256::new_from_slice(get_secret_key().as_bytes())
|
|
|
.map_err(|e| format!("HMAC init failed: {}", e))?;
|
|
|
mac.update(signature_data.as_bytes());
|
|
|
let signature_bytes = mac.finalize().into_bytes();
|
|
|
@@ -728,7 +729,7 @@ pub async fn secure_user_register(request: RegisterRequest) -> Result<RegisterRe
|
|
|
let signature_data = format!("{}:{}:{}:{}:{}", timestamp, nonce, encrypted_params_base64, encrypted_aes_key_base64, key_version);
|
|
|
type HmacSha256 = Hmac<Sha256>;
|
|
|
|
|
|
- let mut mac = HmacSha256::new_from_slice(b"your-secret-key-change-in-production")
|
|
|
+ let mut mac = HmacSha256::new_from_slice(get_secret_key().as_bytes())
|
|
|
.map_err(|e| format!("HMAC init failed: {}", e))?;
|
|
|
mac.update(signature_data.as_bytes());
|
|
|
let signature_bytes = mac.finalize().into_bytes();
|
|
|
@@ -902,7 +903,7 @@ pub async fn secure_user_unbind(request: UnbindRequest) -> Result<UnbindResponse
|
|
|
let signature_data = format!("{}:{}:{}:{}:{}", timestamp, nonce, encrypted_params_base64, encrypted_aes_key_base64, key_version);
|
|
|
type HmacSha256 = Hmac<Sha256>;
|
|
|
|
|
|
- let mut mac = HmacSha256::new_from_slice(b"your-secret-key-change-in-production")
|
|
|
+ let mut mac = HmacSha256::new_from_slice(get_secret_key().as_bytes())
|
|
|
.map_err(|e| format!("HMAC init failed: {}", e))?;
|
|
|
mac.update(signature_data.as_bytes());
|
|
|
let signature_bytes = mac.finalize().into_bytes();
|
|
|
@@ -1065,7 +1066,7 @@ pub async fn secure_user_recharge(request: RechargeRequest) -> Result<RechargeRe
|
|
|
let signature_data = format!("{}:{}:{}:{}:{}", timestamp, nonce, encrypted_params_base64, encrypted_aes_key_base64, key_version);
|
|
|
type HmacSha256 = Hmac<Sha256>;
|
|
|
|
|
|
- let mut mac = HmacSha256::new_from_slice(b"your-secret-key-change-in-production")
|
|
|
+ let mut mac = HmacSha256::new_from_slice(get_secret_key().as_bytes())
|
|
|
.map_err(|e| format!("HMAC init failed: {}", e))?;
|
|
|
mac.update(signature_data.as_bytes());
|
|
|
let signature_bytes = mac.finalize().into_bytes();
|
|
|
@@ -1173,6 +1174,96 @@ static mut STORED_RSA_KEY_VERSION: Option<i32> = None;
|
|
|
// RSA公钥分段存储的索引映射（随机打乱顺序）
|
|
|
static RSA_KEY_SEGMENT_ORDER: [usize; 8] = [3, 7, 1, 5, 0, 6, 2, 4];
|
|
|
|
|
|
+// SECRET_KEY分段混淆存储系统（增强安全性）
|
|
|
+// 将"your-secret-key-change-in-production"分成不重叠的段，随机存储
|
|
|
+static SECRET_KEY_SEGMENTS: [&str; 16] = [
|
|
|
+ "ret-key", // 段0: 真实数据 "ret-key"
|
|
|
+ "your-sec", // 段1: 真实数据 "your-sec"
|
|
|
+ "noise_001", // 段2: 噪声数据
|
|
|
+ "uction", // 段3: 真实数据 "uction"
|
|
|
+ "-in-prod", // 段4: 真实数据 "-in-prod"
|
|
|
+ "-change", // 段5: 真实数据 "-change"
|
|
|
+ "dummy_006", // 段6: 噪声数据
|
|
|
+ "fake_data_007", // 段7: 噪声数据
|
|
|
+ "decoy_008", // 段8: 噪声数据
|
|
|
+ "garbage_009", // 段9: 噪声数据
|
|
|
+ "dummy_segment", // 段10: 噪声数据
|
|
|
+ "rubbish_011", // 段11: 噪声数据
|
|
|
+ "trash_012", // 段12: 噪声数据
|
|
|
+ "spam_013", // 段13: 噪声数据
|
|
|
+ "junk_014", // 段14: 噪声数据
|
|
|
+ "decoy_info_xyz", // 段15: 噪声数据
|
|
|
+];
|
|
|
+
|
|
|
+// SECRET_KEY分段重组的索引映射（只包含真实数据段，正确顺序）
|
|
|
+static SECRET_KEY_ORDER: [usize; 5] = [1, 0, 5, 4, 3];
|
|
|
+
|
|
|
+// SECRET_KEY分段重组函数（带字符级混淆）
|
|
|
+fn get_secret_key() -> String {
|
|
|
+ // 按随机顺序重组SECRET_KEY段，只包含真实数据
|
|
|
+ let mut key_parts = Vec::new();
|
|
|
+ for &index in SECRET_KEY_ORDER.iter() {
|
|
|
+ key_parts.push(SECRET_KEY_SEGMENTS[index]);
|
|
|
+ }
|
|
|
+ let mut result = key_parts.concat();
|
|
|
+
|
|
|
+ // 字符级混淆：简单的位运算混淆（可逆）
|
|
|
+ // 对每个字符进行异或运算，然后反转字符串，最后添加长度标记
|
|
|
+ let chars: Vec<char> = result.chars().collect();
|
|
|
+ let mut obfuscated: Vec<char> = chars.into_iter()
|
|
|
+ .map(|c| (c as u8 ^ 0x5A) as char) // 异或0x5A
|
|
|
+ .collect();
|
|
|
+
|
|
|
+ // 反转字符串
|
|
|
+ obfuscated.reverse();
|
|
|
+
|
|
|
+ // 添加长度标记（用于验证）
|
|
|
+ let length_marker = format!("|{}|", result.len());
|
|
|
+ for c in length_marker.chars() {
|
|
|
+ obfuscated.push(c);
|
|
|
+ }
|
|
|
+
|
|
|
+ let obfuscated_str: String = obfuscated.into_iter().collect();
|
|
|
+
|
|
|
+ // 反转混淆操作
|
|
|
+ let mut deobfuscated_chars: Vec<char> = obfuscated_str.chars().collect();
|
|
|
+
|
|
|
+ // 提取并验证长度标记
|
|
|
+ let mut length_str = String::new();
|
|
|
+ let mut found_marker = false;
|
|
|
+ while let Some(c) = deobfuscated_chars.pop() {
|
|
|
+ if c == '|' && !found_marker {
|
|
|
+ found_marker = true;
|
|
|
+ continue;
|
|
|
+ }
|
|
|
+ if found_marker && c == '|' {
|
|
|
+ break;
|
|
|
+ }
|
|
|
+ if found_marker {
|
|
|
+ length_str.insert(0, c);
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ // 验证长度
|
|
|
+ if let Ok(expected_len) = length_str.parse::<usize>() {
|
|
|
+ if deobfuscated_chars.len() != expected_len {
|
|
|
+ panic!("SECRET_KEY长度验证失败");
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ // 反转字符串
|
|
|
+ deobfuscated_chars.reverse();
|
|
|
+
|
|
|
+ // 反转异或操作
|
|
|
+ let original: Vec<char> = deobfuscated_chars.into_iter()
|
|
|
+ .map(|c| (c as u8 ^ 0x5A) as char)
|
|
|
+ .collect();
|
|
|
+
|
|
|
+ result = original.into_iter().collect();
|
|
|
+
|
|
|
+ result
|
|
|
+}
|
|
|
+
|
|
|
// RSA公钥分段混淆存储辅助函数
|
|
|
fn store_rsa_key_segments(public_key: String) {
|
|
|
// 1. 编码数据（Base64 + 字符重排 + 随机填充）
|
|
|
@@ -1264,20 +1355,23 @@ pub async fn store_rsa_public_key(public_key: String, key_version: i32) -> Resul
|
|
|
STORED_RSA_KEY_VERSION = Some(key_version);
|
|
|
}
|
|
|
|
|
|
- // 调试：验证存储和重组是否正确
|
|
|
- println!("RSA公钥已安全存储，版本: {}", key_version);
|
|
|
- match retrieve_rsa_key_segments() {
|
|
|
- Ok(retrieved) if retrieved == public_key => {
|
|
|
- println!("✅ RSA公钥存储和重组验证成功");
|
|
|
- }
|
|
|
- Ok(retrieved) => {
|
|
|
- println!("❌ RSA公钥存储验证失败: 内容不匹配");
|
|
|
- println!(" 原始长度: {}, 重组长度: {}", public_key.len(), retrieved.len());
|
|
|
- println!(" 原始前缀: {}", &public_key[..50.min(public_key.len())]);
|
|
|
- println!(" 重组前缀: {}", &retrieved[..50.min(retrieved.len())]);
|
|
|
- }
|
|
|
- Err(e) => {
|
|
|
- println!("❌ RSA公钥存储验证失败: {}", e);
|
|
|
+ // 调试：验证存储和重组是否正确（生产环境请移除）
|
|
|
+ #[cfg(debug_assertions)]
|
|
|
+ {
|
|
|
+ println!("RSA公钥已安全存储，版本: {}", key_version);
|
|
|
+ match retrieve_rsa_key_segments() {
|
|
|
+ Ok(retrieved) if retrieved == public_key => {
|
|
|
+ println!("✅ RSA公钥存储和重组验证成功");
|
|
|
+ }
|
|
|
+ Ok(retrieved) => {
|
|
|
+ println!("❌ RSA公钥存储验证失败: 内容不匹配");
|
|
|
+ println!(" 原始长度: {}, 重组长度: {}", public_key.len(), retrieved.len());
|
|
|
+ println!(" 原始前缀: {}", &public_key[..50.min(public_key.len())]);
|
|
|
+ println!(" 重组前缀: {}", &retrieved[..50.min(retrieved.len())]);
|
|
|
+ }
|
|
|
+ Err(e) => {
|
|
|
+ println!("❌ RSA公钥存储验证失败: {}", e);
|
|
|
+ }
|
|
|
}
|
|
|
}
|
|
|
|
|
|
@@ -1450,7 +1544,7 @@ pub async fn secure_get_announcements(request: AnnouncementRequest) -> Result<An
|
|
|
use sha2::Sha256;
|
|
|
type HmacSha256 = Hmac<Sha256>;
|
|
|
|
|
|
- let mut mac = HmacSha256::new_from_slice(b"your-secret-key-change-in-production")
|
|
|
+ let mut mac = HmacSha256::new_from_slice(get_secret_key().as_bytes())
|
|
|
.map_err(|e| format!("HMAC init failed: {}", e))?;
|
|
|
mac.update(signature_data.as_bytes());
|
|
|
let signature_bytes = mac.finalize().into_bytes();
|
