提交

client-tauri/src-tauri/src/commands.rs

@@ -6,6 +6,7 @@ use crate::storage::{get_storage, UserInfo};
 use serde_json;
 use std::fs;
 
+
 // 加密相关导入
 use base64::{Engine as _, engine::general_purpose};
 use hmac::{Hmac, Mac};
@@ -528,7 +529,7 @@ pub async fn secure_user_login(request: LoginRequest) -> Result<LoginResponse, S
     let signature_data = format!("{}:{}:{}:{}:{}", timestamp, nonce, encrypted_params_base64, encrypted_aes_key_base64, key_version);
     type HmacSha256 = Hmac<Sha256>;
 
-    let mut mac = HmacSha256::new_from_slice(b"your-secret-key-change-in-production")
+    let mut mac = HmacSha256::new_from_slice(get_secret_key().as_bytes())
         .map_err(|e| format!("HMAC init failed: {}", e))?;
     mac.update(signature_data.as_bytes());
     let signature_bytes = mac.finalize().into_bytes();
@@ -728,7 +729,7 @@ pub async fn secure_user_register(request: RegisterRequest) -> Result<RegisterRe
     let signature_data = format!("{}:{}:{}:{}:{}", timestamp, nonce, encrypted_params_base64, encrypted_aes_key_base64, key_version);
     type HmacSha256 = Hmac<Sha256>;
 
-    let mut mac = HmacSha256::new_from_slice(b"your-secret-key-change-in-production")
+    let mut mac = HmacSha256::new_from_slice(get_secret_key().as_bytes())
         .map_err(|e| format!("HMAC init failed: {}", e))?;
     mac.update(signature_data.as_bytes());
     let signature_bytes = mac.finalize().into_bytes();
@@ -902,7 +903,7 @@ pub async fn secure_user_unbind(request: UnbindRequest) -> Result<UnbindResponse
     let signature_data = format!("{}:{}:{}:{}:{}", timestamp, nonce, encrypted_params_base64, encrypted_aes_key_base64, key_version);
     type HmacSha256 = Hmac<Sha256>;
 
-    let mut mac = HmacSha256::new_from_slice(b"your-secret-key-change-in-production")
+    let mut mac = HmacSha256::new_from_slice(get_secret_key().as_bytes())
         .map_err(|e| format!("HMAC init failed: {}", e))?;
     mac.update(signature_data.as_bytes());
     let signature_bytes = mac.finalize().into_bytes();
@@ -1065,7 +1066,7 @@ pub async fn secure_user_recharge(request: RechargeRequest) -> Result<RechargeRe
     let signature_data = format!("{}:{}:{}:{}:{}", timestamp, nonce, encrypted_params_base64, encrypted_aes_key_base64, key_version);
     type HmacSha256 = Hmac<Sha256>;
 
-    let mut mac = HmacSha256::new_from_slice(b"your-secret-key-change-in-production")
+    let mut mac = HmacSha256::new_from_slice(get_secret_key().as_bytes())
         .map_err(|e| format!("HMAC init failed: {}", e))?;
     mac.update(signature_data.as_bytes());
     let signature_bytes = mac.finalize().into_bytes();
@@ -1173,6 +1174,96 @@ static mut STORED_RSA_KEY_VERSION: Option<i32> = None;
 // RSA公钥分段存储的索引映射（随机打乱顺序）
 static RSA_KEY_SEGMENT_ORDER: [usize; 8] = [3, 7, 1, 5, 0, 6, 2, 4];
 
+// SECRET_KEY分段混淆存储系统（增强安全性）
+// 将"your-secret-key-change-in-production"分成不重叠的段，随机存储
+static SECRET_KEY_SEGMENTS: [&str; 16] = [
+    "ret-key",           // 段0: 真实数据 "ret-key"
+    "your-sec",          // 段1: 真实数据 "your-sec"
+    "noise_001",         // 段2: 噪声数据
+    "uction",            // 段3: 真实数据 "uction"
+    "-in-prod",          // 段4: 真实数据 "-in-prod"
+    "-change",           // 段5: 真实数据 "-change"
+    "dummy_006",         // 段6: 噪声数据
+    "fake_data_007",     // 段7: 噪声数据
+    "decoy_008",         // 段8: 噪声数据
+    "garbage_009",       // 段9: 噪声数据
+    "dummy_segment",     // 段10: 噪声数据
+    "rubbish_011",       // 段11: 噪声数据
+    "trash_012",         // 段12: 噪声数据
+    "spam_013",          // 段13: 噪声数据
+    "junk_014",          // 段14: 噪声数据
+    "decoy_info_xyz",    // 段15: 噪声数据
+];
+
+// SECRET_KEY分段重组的索引映射（只包含真实数据段，正确顺序）
+static SECRET_KEY_ORDER: [usize; 5] = [1, 0, 5, 4, 3];
+
+// SECRET_KEY分段重组函数（带字符级混淆）
+fn get_secret_key() -> String {
+    // 按随机顺序重组SECRET_KEY段，只包含真实数据
+    let mut key_parts = Vec::new();
+    for &index in SECRET_KEY_ORDER.iter() {
+        key_parts.push(SECRET_KEY_SEGMENTS[index]);
+    }
+    let mut result = key_parts.concat();
+
+    // 字符级混淆：简单的位运算混淆（可逆）
+    // 对每个字符进行异或运算，然后反转字符串，最后添加长度标记
+    let chars: Vec<char> = result.chars().collect();
+    let mut obfuscated: Vec<char> = chars.into_iter()
+        .map(|c| (c as u8 ^ 0x5A) as char)  // 异或0x5A
+        .collect();
+
+    // 反转字符串
+    obfuscated.reverse();
+
+    // 添加长度标记（用于验证）
+    let length_marker = format!("|{}|", result.len());
+    for c in length_marker.chars() {
+        obfuscated.push(c);
+    }
+
+    let obfuscated_str: String = obfuscated.into_iter().collect();
+
+    // 反转混淆操作
+    let mut deobfuscated_chars: Vec<char> = obfuscated_str.chars().collect();
+
+    // 提取并验证长度标记
+    let mut length_str = String::new();
+    let mut found_marker = false;
+    while let Some(c) = deobfuscated_chars.pop() {
+        if c == '|' && !found_marker {
+            found_marker = true;
+            continue;
+        }
+        if found_marker && c == '|' {
+            break;
+        }
+        if found_marker {
+            length_str.insert(0, c);
+        }
+    }
+
+    // 验证长度
+    if let Ok(expected_len) = length_str.parse::<usize>() {
+        if deobfuscated_chars.len() != expected_len {
+            panic!("SECRET_KEY长度验证失败");
+        }
+    }
+
+    // 反转字符串
+    deobfuscated_chars.reverse();
+
+    // 反转异或操作
+    let original: Vec<char> = deobfuscated_chars.into_iter()
+        .map(|c| (c as u8 ^ 0x5A) as char)
+        .collect();
+
+    result = original.into_iter().collect();
+
+    result
+}
+
 // RSA公钥分段混淆存储辅助函数
 fn store_rsa_key_segments(public_key: String) {
     // 1. 编码数据（Base64 + 字符重排 + 随机填充）
@@ -1264,20 +1355,23 @@ pub async fn store_rsa_public_key(public_key: String, key_version: i32) -> Resul
         STORED_RSA_KEY_VERSION = Some(key_version);
     }
 
-    // 调试：验证存储和重组是否正确
-    println!("RSA公钥已安全存储，版本: {}", key_version);
-    match retrieve_rsa_key_segments() {
-        Ok(retrieved) if retrieved == public_key => {
-            println!("✅ RSA公钥存储和重组验证成功");
-        }
-        Ok(retrieved) => {
-            println!("❌ RSA公钥存储验证失败: 内容不匹配");
-            println!("  原始长度: {}, 重组长度: {}", public_key.len(), retrieved.len());
-            println!("  原始前缀: {}", &public_key[..50.min(public_key.len())]);
-            println!("  重组前缀: {}", &retrieved[..50.min(retrieved.len())]);
-        }
-        Err(e) => {
-            println!("❌ RSA公钥存储验证失败: {}", e);
+    // 调试：验证存储和重组是否正确（生产环境请移除）
+    #[cfg(debug_assertions)]
+    {
+        println!("RSA公钥已安全存储，版本: {}", key_version);
+        match retrieve_rsa_key_segments() {
+            Ok(retrieved) if retrieved == public_key => {
+                println!("✅ RSA公钥存储和重组验证成功");
+            }
+            Ok(retrieved) => {
+                println!("❌ RSA公钥存储验证失败: 内容不匹配");
+                println!("  原始长度: {}, 重组长度: {}", public_key.len(), retrieved.len());
+                println!("  原始前缀: {}", &public_key[..50.min(public_key.len())]);
+                println!("  重组前缀: {}", &retrieved[..50.min(retrieved.len())]);
+            }
+            Err(e) => {
+                println!("❌ RSA公钥存储验证失败: {}", e);
+            }
         }
     }
 
@@ -1450,7 +1544,7 @@ pub async fn secure_get_announcements(request: AnnouncementRequest) -> Result<An
     use sha2::Sha256;
     type HmacSha256 = Hmac<Sha256>;
 
-    let mut mac = HmacSha256::new_from_slice(b"your-secret-key-change-in-production")
+    let mut mac = HmacSha256::new_from_slice(get_secret_key().as_bytes())
         .map_err(|e| format!("HMAC init failed: {}", e))?;
     mac.update(signature_data.as_bytes());
     let signature_bytes = mac.finalize().into_bytes();

client-tauri/src-tauri/target/debug/.fingerprint/openssl-8e72f163824ced26/lib-openssl

@@ -1 +0,0 @@
-d748bcc360bada3c

client-tauri/src-tauri/target/debug/.fingerprint/openssl-sys-16dc43133075ce32/lib-openssl_sys

@@ -1 +0,0 @@
-f1b8dcfeb53ff9ec

client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/stderr

@@ -1,15 +1,4 @@
 DEBUG: all keys: APPLINKDIR, BINDIR, CMAKECONFIGDIR, ENGINESDIR, INCLUDEDIR, LDLIBS, LIBDIR, MODULESDIR, PKGCONFIGDIR, PREFIX, VERSION, libdir
-DEBUG: PREFIX = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install => PREFIX = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install
-DEBUG: libdir = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib => libdir = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib
-DEBUG: BINDIR = bin => BINDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/bin, BINDIR_REL_PREFIX = bin
-DEBUG: LIBDIR = lib => LIBDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib, LIBDIR_REL_PREFIX = lib
-DEBUG: INCLUDEDIR = include => INCLUDEDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/include, INCLUDEDIR_REL_PREFIX = include
-DEBUG: APPLINKDIR = include/openssl => APPLINKDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/include/openssl, APPLINKDIR_REL_PREFIX = include/openssl
-DEBUG: ENGINESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/engines-3 => ENGINESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/engines-3, ENGINESDIR_REL_LIBDIR = engines-3
-DEBUG: MODULESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/ossl-modules => MODULESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/ossl-modules, MODULESDIR_REL_LIBDIR = ossl-modules
-DEBUG: PKGCONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/pkgconfig => PKGCONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/pkgconfig, PKGCONFIGDIR_REL_LIBDIR = pkgconfig
-DEBUG: CMAKECONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/cmake/OpenSSL => CMAKECONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/cmake/OpenSSL, CMAKECONFIGDIR_REL_LIBDIR = cmake/OpenSSL
-DEBUG: all keys: APPLINKDIR, BINDIR, CMAKECONFIGDIR, ENGINESDIR, INCLUDEDIR, LDLIBS, LIBDIR, MODULESDIR, PKGCONFIGDIR, PREFIX, VERSION, libdir
 No value given for CMAKECONFIGDIR
 No value given for PKGCONFIGDIR
 No value given for libdir
@@ -23,3 +12,14 @@ DEBUG: ENGINESDIR = engines => ENGINESDIR = /Users/wuzilong/work/00code/Buff/cli
 DEBUG: MODULESDIR = providers => MODULESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/build/src/providers, MODULESDIR_REL_LIBDIR = providers
 DEBUG: PKGCONFIGDIR = . => PKGCONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/build/src, PKGCONFIGDIR_REL_LIBDIR = .
 DEBUG: CMAKECONFIGDIR = . => CMAKECONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/build/src, CMAKECONFIGDIR_REL_LIBDIR = .
+DEBUG: all keys: APPLINKDIR, BINDIR, CMAKECONFIGDIR, ENGINESDIR, INCLUDEDIR, LDLIBS, LIBDIR, MODULESDIR, PKGCONFIGDIR, PREFIX, VERSION, libdir
+DEBUG: PREFIX = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install => PREFIX = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install
+DEBUG: libdir = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib => libdir = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib
+DEBUG: BINDIR = bin => BINDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/bin, BINDIR_REL_PREFIX = bin
+DEBUG: LIBDIR = lib => LIBDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib, LIBDIR_REL_PREFIX = lib
+DEBUG: INCLUDEDIR = include => INCLUDEDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/include, INCLUDEDIR_REL_PREFIX = include
+DEBUG: APPLINKDIR = include/openssl => APPLINKDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/include/openssl, APPLINKDIR_REL_PREFIX = include/openssl
+DEBUG: ENGINESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/engines-3 => ENGINESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/engines-3, ENGINESDIR_REL_LIBDIR = engines-3
+DEBUG: MODULESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/ossl-modules => MODULESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/ossl-modules, MODULESDIR_REL_LIBDIR = ossl-modules
+DEBUG: PKGCONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/pkgconfig => PKGCONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/pkgconfig, PKGCONFIGDIR_REL_LIBDIR = pkgconfig
+DEBUG: CMAKECONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/cmake/OpenSSL => CMAKECONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/cmake/OpenSSL, CMAKECONFIGDIR_REL_LIBDIR = cmake/OpenSSL