anna/IM-server-new
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

支持AES256配置

Browse Source
This commit is contained in:
heavyrian2012
2023-04-24 11:51:13 +08:00
parent 758c5de2c7
commit 145709fd76
6 changed files with 50 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
broker/config/wildfirechat.conf
+3
View File
@@ -65,6 +65,9 @@ token.key testim
##是否拒绝空签名的android客户端， 默认为true。当有旧的客户端需要兼容时改成false，当所有都是新客户端时，改成true。
#connect.reject_empty_signature true
##是否使用AES256加密。默认客户端和服务器都是AES128加密，如果需要开启AES256，需要客户端和IM服务同时开通。
#encrypt.use_aes256 true
##首次登录，是否接收之前的历史消息。
##0 不接收历史消息，只接收${message.compensate_time_limit}毫秒以内的消息，由于服务器没有保存已经收取记录，所以如果有超过${message.compensate_time_limit}毫秒之前未收取的消息也不会收取下拉；
##1接收，会接收 message.max_queue 配置的条数的历史消息
broker/src/main/java/io/moquette/BrokerConstants.java
+2
View File
@@ -29,6 +29,8 @@ public final class BrokerConstants {
public static final String HTTP_SERVER_PORT = "http_port";
public static final String HTTP_LOCAL_PORT = "local_port";
public static final String ENCRYPT_AES256 = "encrypt.use_aes256";
public static final String HTTP_ADMIN_PORT = "http.admin.port";
public static final String DEFAULT_MOQUETTE_STORE_MAP_DB_FILENAME = "moquette_store.mapdb";
public static final String DEFAULT_PERSISTENT_PATH = System.getProperty("user.dir") + File.separator
broker/src/main/java/io/moquette/persistence/MemoryMessagesStore.java
+1 -1
View File
@@ -3492,7 +3492,7 @@ public class MemoryMessagesStore implements IMessagesStore {
}
private String ensureSecretLength(String secret) {
while ( secret.length() < 16) {
while ( secret.length() < AES.keyLen) {
secret += "w";
secret += secret;
}
broker/src/main/java/io/moquette/server/Server.java
+4 -12
View File
@@ -232,18 +232,6 @@ public class Server {
handlers = Collections.emptyList();
}
DBUtil.init(config);
String strKey = "0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x78,0x79,0x7A,0x7B,0x7C,0x7D,0x7E,0x7F";
String[] strs = strKey.split(",");
if(strs.length != 16) {
LOG.error("Key error, it length should be 16");
}
byte[] keys = new byte[16];
for (int i = 0; i < 16; i++) {
keys[i] = (byte)(Integer.parseInt(strs[i].replace("0X", "").replace("0x", ""), 16));
}
AES.init(keys);
LOG.info("Starting Moquette Server. MQTT message interceptors={}", getInterceptorIds(handlers));
@@ -393,9 +381,13 @@ public class Server {
longPort = config.getProperty(BrokerConstants.PORT_PROPERTY_NAME);
shortPort = config.getProperty(BrokerConstants.HTTP_SERVER_PORT);
boolean aes256 = Boolean.parseBoolean(config.getProperty(ENCRYPT_AES256, "false"));
MessageShardingUtil.setNodeId(1);
Tokenor.setKey(config.getProperty(BrokerConstants.TOKEN_SECRET_KEY));
AES.useAes256(aes256);
String expirTimeStr = config.getProperty(TOKEN_EXPIRE_TIME);
if (!StringUtil.isNullOrEmpty(expirTimeStr)) {
try {
common/src/main/java/io/moquette/spi/impl/security/AES.java
+37 -17
View File
@@ -5,6 +5,7 @@ import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.spec.InvalidKeySpecException;
import java.util.Arrays;
import java.util.Base64;
import javax.crypto.BadPaddingException;
@@ -18,38 +19,46 @@ import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
public class AES {
private static byte[] aes_key= {0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x78,0x79,0x7A,0x7B,0x7C,0x7D,0x7E,0x7F};
public static void init(byte[] secret) {
if (secret != null && secret.length == 16) {
aes_key = new byte[16];
for (int i = 0; i < 16; i++) {
aes_key[i] = secret[i];
}
} else {
System.out.println("Error int key error, secret incorrect");
}
}
public static int keyLen = 16;
private final static int ivLen = 16;
private static byte[] aes_key= {0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x78,0x79,0x7A,0x7B,0x7C,0x7D,0x7E,0x7F,0x3A,0x1F,0x28,0x39,0x4F,0x52,0x68,0x79,0x71,0x73,0x7A,0x7B,0x7C,0x7D,0x7E,0x7F};
public static byte[] AESEncrypt(String sSrc, String userKey) {
return AESEncrypt(sSrc.getBytes(), userKey);
}
public static void useAes256(boolean aes256) {
if(aes256)
keyLen = 32;
else
keyLen = 16;
}
public static byte[] AESEncrypt(byte[] tobeencrypdata, byte[] aesKey) {
if (aesKey == null) {
System.out.print("Key为空null");
return null;
}
// 判断Key是否为16位
if (aesKey.length != 16) {
if (aesKey.length < keyLen) {
System.out.print("Key长度不是16位");
return null;
}
if(aesKey.length > keyLen) {
aesKey = Arrays.copyOfRange(aesKey, 0, keyLen);
}
byte[] ivKeys;
if(aesKey.length == ivLen) {
ivKeys = aesKey;
} else {
ivKeys = Arrays.copyOfRange(aesKey, 0, ivLen);
}
try {
SecretKeySpec skeySpec = new SecretKeySpec(aesKey, "AES");
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");//"算法/模式/补码方式"
IvParameterSpec iv = new IvParameterSpec(aesKey);//使用CBC模式，需要一个向量iv，可增加加密算法的强度
IvParameterSpec iv = new IvParameterSpec(ivKeys);//使用CBC模式，需要一个向量iv，可增加加密算法的强度
cipher.init(Cipher.ENCRYPT_MODE, skeySpec, iv);
//2018.1.1 0:0:0 以来的小时数
@@ -101,8 +110,8 @@ public class AES {
}
private static byte[] convertUserKey(String userKey) {
byte[] key = new byte[16];
for (int i = 0; i < 16; i++) {
byte[] key = new byte[keyLen];
for (int i = 0; i < keyLen; i++) {
key[i] = (byte) (userKey.charAt(i) & 0xFF);
}
return key;
@@ -128,14 +137,25 @@ public class AES {
aesKey = aes_key;
}
// 判断Key是否为16位
if (aesKey.length != 16) {
if (aesKey.length < keyLen) {
System.out.print("Key长度不是16位");
return null;
}
if(aesKey.length > keyLen) {
aesKey = Arrays.copyOfRange(aesKey, 0, keyLen);
}
byte[] ivKeys;
if(aesKey.length == ivLen) {
ivKeys = aesKey;
} else {
ivKeys = Arrays.copyOfRange(aesKey, 0, ivLen);
}
SecretKeySpec skeySpec = new SecretKeySpec(aesKey, "AES");
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
IvParameterSpec iv = new IvParameterSpec(aesKey);
IvParameterSpec iv = new IvParameterSpec(ivKeys);
cipher.init(Cipher.DECRYPT_MODE, skeySpec, iv);
try {
byte[] original = cipher.doFinal(sSrc);
distribution/src/main/resources/wildfirechat.conf
+3
View File
@@ -63,6 +63,9 @@ token.key testim
##是否拒绝空签名的android客户端， 默认为true。当有旧的客户端需要兼容时改成false，当所有都是新客户端时，改成true。
#connect.reject_empty_signature true
##是否使用AES256加密。默认客户端和服务器都是AES128加密，如果需要开启AES256，需要客户端和IM服务同时开通。
#encrypt.use_aes256 true
##首次登录，是否接收之前的历史消息。
##0 不接收历史消息，只接收${message.compensate_time_limit}毫秒以内的消息，由于服务器没有保存已经收取记录，所以如果有超过${message.compensate_time_limit}毫秒之前未收取的消息也不会收取下拉；
##1接收，会接收 message.max_queue 配置的条数的历史消息