aes and jwt

install.yaml

@@ -21,12 +21,18 @@ spec:
           ports:
             - containerPort: 8080
           env:
+            - name: URL_PREFIX
+              value: admin
             - name: DB_HOST
               value: 192.168.131.195
             - name: DB_USER
               value: app
             - name: DB_PASS
-              value: ???????
+              value: 1PQlNf9*9Ulo
+            - name: JWT_KEY
+              value: !bd832W0@CG
+            - name: ASE_KEY
+              value: A5es$&!0GeoEast
 ---
 apiVersion: v1
 kind: Service

main.go

@@ -1,20 +1,41 @@
 package main
 
 import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/sha1"
 	"embed"
+	"encoding/base64"
+	"errors"
+	"fmt"
 	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v4"
 	log "github.com/sirupsen/logrus"
 	"io/fs"
 	m "k8s-manager/src"
 	"net/http"
+	"os"
+	"strings"
 )
 
 //go:embed template/* static/*
 var f embed.FS
 
+var jwtKey string
+var aseKey string
+
 func main() {
 	m.InitClient()
 
+	jwtKey = os.Getenv("JWT_KEY")
+	aseKey = os.Getenv("ASE_KEY")
+	if jwtKey == "" {
+		panic("No jwt key")
+	}
+	if aseKey == "" {
+		panic("No ase key")
+	}
+
 	r := gin.Default()
 
 	fp, _ := fs.Sub(f, "static")
@@ -32,6 +53,7 @@ func main() {
 	r.DELETE("/dep", m.JWTAuthMiddleware, m.CreateDeleteDeployment)
 
 	r.GET("/login/:username", Test)
+	r.Any("/test_token", TestToken)
 	r.GET("/username", m.JWTAuthMiddleware, m.GetUsername)
 	err := r.Run(":8000")
 	if err != nil {
@@ -39,8 +61,89 @@ func main() {
 	}
 }
 
+type CGJWTClaim struct {
+	jwt.RegisteredClaims
+	Userid string
+}
+
+func ParseCGToken(token string) (string, error) {
+	token = strings.ReplaceAll(token, "-", "+")
+	token = strings.ReplaceAll(token, "_", "/")
+	token = token + []string{"", "===", "==", "="}[len(token)%4]
+	fmt.Println(token)
+	aesEncrypt, err := base64.StdEncoding.DecodeString(token)
+	if err != nil {
+		log.WithError(err).Error("Parse CG Token 1")
+		return "", err
+	}
+
+	jwtString := AesDecryptECB(aesEncrypt, []byte(aseKey))
+
+	jwtResult, err := jwt.ParseWithClaims(string(jwtString), &CGJWTClaim{}, func(token *jwt.Token) (i interface{}, err error) {
+		return jwtKey, nil
+		// return hmac.New(sha256.New, []byte(jwtKey)), nil
+	})
+	if err != nil {
+		log.WithError(err).Error("Parse CG Token 2")
+		return "", err
+	}
+	if claims, ok := jwtResult.Claims.(*CGJWTClaim); ok && jwtResult.Valid { // 校验token
+		return claims.Userid, nil
+	}
+	return "", errors.New("jwt parse error")
+}
+
+func generateKey(key []byte) (genKey []byte) {
+	genKey = make([]byte, 16)
+	copy(genKey, key)
+	for i := 16; i < len(key); {
+		for j := 0; j < 16 && i < len(key); j, i = j+1, i+1 {
+			genKey[j] ^= key[i]
+		}
+	}
+	return genKey
+}
+func AesDecryptECB(encrypted []byte, key []byte) (decrypted []byte) {
+	cipher, _ := aes.NewCipher(generateKey(key))
+	decrypted = make([]byte, len(encrypted))
+	//
+	for bs, be := 0, cipher.BlockSize(); bs < len(encrypted); bs, be = bs+cipher.BlockSize(), be+cipher.BlockSize() {
+		cipher.Decrypt(decrypted[bs:be], encrypted[bs:be])
+	}
+
+	trim := 0
+	if len(decrypted) > 0 {
+		trim = len(decrypted) - int(decrypted[len(decrypted)-1])
+	}
+
+	return decrypted[:trim]
+}
+
+func AesDecrypt(data []byte, key []byte) ([]byte, error) {
+	sh := sha1.New()
+	sh.Write(key)
+	realKey := sh.Sum(nil)
+
+	fmt.Println(string(realKey))
+	block, err := aes.NewCipher(realKey[:16])
+	if err != nil {
+		log.WithError(err).Error("AesDecrypt 1")
+		return nil, err
+	}
+	blockSize := block.BlockSize()
+	blockMode := cipher.NewCBCDecrypter(block, key[:blockSize])
+	crypted := make([]byte, len(data))
+	blockMode.CryptBlocks(crypted, data)
+	if err != nil {
+		log.WithError(err).Error("AesDecrypt 2")
+		return nil, err
+	}
+	return crypted, nil
+}
+
 func Test(c *gin.Context) {
-	username := c.Param("username")
+	//username := c.Param("username")
+	username, _ := ParseCGToken(c.Request.URL.Query().Get("cgtoken"))
 	if username == "" {
 		c.JSON(http.StatusNotFound, gin.H{
 			"code": http.StatusNotFound,
@@ -56,6 +159,21 @@ func Test(c *gin.Context) {
 		c.SetCookie("Authorization", "Bearer "+token, 0, "", "", false, false)
 		c.Header("Authorization", "Bearer "+token)
 		c.Header("Cache-Control", "no-store")
-		c.Redirect(http.StatusTemporaryRedirect, "../index")
+		redirectUrl := fmt.Sprintf("/%s/index", os.Getenv("URL_PREFIX"))
+		c.Redirect(http.StatusTemporaryRedirect, redirectUrl)
 	}
 }
+
+func TestToken(c *gin.Context) {
+	token := c.Request.URL.Query().Get("cgtoken")
+	if token == "" {
+		c.JSON(http.StatusForbidden, gin.H{"msg": "No token"})
+		return
+	}
+	username, err := ParseCGToken(token)
+	if err != nil {
+		c.JSON(http.StatusForbidden, gin.H{"msg": "token error"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"msg": "ok", "username": username})
+}

test/test_aes.go

@@ -0,0 +1,151 @@
+package main
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha1"
+	"encoding/base64"
+	"encoding/hex"
+	"io"
+	"log"
+)
+
+func RealKey(key string) []byte {
+	sh := sha1.New()
+	sh.Write([]byte(key))
+	realKey := sh.Sum(nil)
+	return realKey
+}
+
+func main() {
+	origData := []byte("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzY2hvb2xpZCI6Ijk5OSIsImV4cCI6MTY3MDcxMzk3OSwidXNlcm5hbWUiOiLllJDlrociLCJjb3Vyc2VzIjoiLDMyLDQsMzgsMzcsNDIsNDMsOSw0MCw0MSwxMSwxMiwxMyw0NCwxNCwxOSwyNiwyOSIsInNjaG9vbG5hbWUiOiLluIzlhoDlnKjnur8iLCJ1c2VyaWQiOiJjZ190YW5neXUiLCJjb2xsZWdlbmFtZSI6IuWtpuefpeahpSIsImhvbWVwYWdlIjoiaHR0cHM6Ly85OTkuYmQuZWR1Y2cubmV0LyJ9.fB3-L-gEOXVlyjjZqphkORtGCRK4ZWI9RNxO4-FULhw") // 待加密的数据
+	key := RealKey("A5es$&!0GeoEast")
+	log.Println("原文：", string(origData))
+
+	// log.Println("------------------ CBC模式 --------------------")
+	// encrypted := AesEncryptCBC(origData, key)
+	// log.Println("密文(hex)：", hex.EncodeToString(encrypted))
+	// log.Println("密文(base64)：", base64.StdEncoding.EncodeToString(encrypted))
+	// decrypted := AesDecryptCBC(encrypted, key)
+	// log.Println("解密结果：", string(decrypted))
+
+	log.Println("------------------ ECB模式 --------------------")
+	encrypted := AesEncryptECB(origData, key)
+	log.Println("密文(hex)：", hex.EncodeToString(encrypted))
+	log.Println("密文(base64)：", base64.StdEncoding.EncodeToString(encrypted))
+	decrypted := AesDecryptECB(encrypted, key)
+	log.Println("解密结果：", string(decrypted))
+
+	// log.Println("------------------ CFB模式 --------------------")
+	// encrypted = AesEncryptCFB(origData, key)
+	// log.Println("密文(hex)：", hex.EncodeToString(encrypted))
+	// log.Println("密文(base64)：", base64.StdEncoding.EncodeToString(encrypted))
+	// decrypted = AesDecryptCFB(encrypted, key)
+	// log.Println("解密结果：", string(decrypted))
+}
+
+// =================== CBC ======================
+func AesEncryptCBC(origData []byte, key []byte) (encrypted []byte) {
+	// 分组秘钥
+	// NewCipher该函数限制了输入k的长度必须为16, 24或者32
+	block, _ := aes.NewCipher(key)
+	blockSize := block.BlockSize()                              // 获取秘钥块的长度
+	origData = pkcs5Padding(origData, blockSize)                // 补全码
+	blockMode := cipher.NewCBCEncrypter(block, key[:blockSize]) // 加密模式
+	encrypted = make([]byte, len(origData))                     // 创建数组
+	blockMode.CryptBlocks(encrypted, origData)                  // 加密
+	return encrypted
+}
+func AesDecryptCBC(encrypted []byte, key []byte) (decrypted []byte) {
+	block, _ := aes.NewCipher(key)                              // 分组秘钥
+	blockSize := block.BlockSize()                              // 获取秘钥块的长度
+	blockMode := cipher.NewCBCDecrypter(block, key[:blockSize]) // 加密模式
+	decrypted = make([]byte, len(encrypted))                    // 创建数组
+	blockMode.CryptBlocks(decrypted, encrypted)                 // 解密
+	decrypted = pkcs5UnPadding(decrypted)                       // 去除补全码
+	return decrypted
+}
+func pkcs5Padding(ciphertext []byte, blockSize int) []byte {
+	padding := blockSize - len(ciphertext)%blockSize
+	padtext := bytes.Repeat([]byte{byte(padding)}, padding)
+	return append(ciphertext, padtext...)
+}
+func pkcs5UnPadding(origData []byte) []byte {
+	length := len(origData)
+	unpadding := int(origData[length-1])
+	return origData[:(length - unpadding)]
+}
+
+// =================== ECB ======================
+func AesEncryptECB(origData []byte, key []byte) (encrypted []byte) {
+	cipher, _ := aes.NewCipher(generateKey(key))
+	length := (len(origData) + aes.BlockSize) / aes.BlockSize
+	plain := make([]byte, length*aes.BlockSize)
+	copy(plain, origData)
+	pad := byte(len(plain) - len(origData))
+	for i := len(origData); i < len(plain); i++ {
+		plain[i] = pad
+	}
+	encrypted = make([]byte, len(plain))
+	// 分组分块加密
+	for bs, be := 0, cipher.BlockSize(); bs <= len(origData); bs, be = bs+cipher.BlockSize(), be+cipher.BlockSize() {
+		cipher.Encrypt(encrypted[bs:be], plain[bs:be])
+	}
+
+	return encrypted
+}
+func AesDecryptECB(encrypted []byte, key []byte) (decrypted []byte) {
+	cipher, _ := aes.NewCipher(generateKey(key))
+	decrypted = make([]byte, len(encrypted))
+	//
+	for bs, be := 0, cipher.BlockSize(); bs < len(encrypted); bs, be = bs+cipher.BlockSize(), be+cipher.BlockSize() {
+		cipher.Decrypt(decrypted[bs:be], encrypted[bs:be])
+	}
+
+	trim := 0
+	if len(decrypted) > 0 {
+		trim = len(decrypted) - int(decrypted[len(decrypted)-1])
+	}
+
+	return decrypted[:trim]
+}
+func generateKey(key []byte) (genKey []byte) {
+	genKey = make([]byte, 16)
+	copy(genKey, key)
+	for i := 16; i < len(key); {
+		for j := 0; j < 16 && i < len(key); j, i = j+1, i+1 {
+			genKey[j] ^= key[i]
+		}
+	}
+	return genKey
+}
+
+// =================== CFB ======================
+func AesEncryptCFB(origData []byte, key []byte) (encrypted []byte) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		panic(err)
+	}
+	encrypted = make([]byte, aes.BlockSize+len(origData))
+	iv := encrypted[:aes.BlockSize]
+	if _, err := io.ReadFull(rand.Reader, iv); err != nil {
+		panic(err)
+	}
+	stream := cipher.NewCFBEncrypter(block, iv)
+	stream.XORKeyStream(encrypted[aes.BlockSize:], origData)
+	return encrypted
+}
+func AesDecryptCFB(encrypted []byte, key []byte) (decrypted []byte) {
+	block, _ := aes.NewCipher(key)
+	if len(encrypted) < aes.BlockSize {
+		panic("ciphertext too short")
+	}
+	iv := encrypted[:aes.BlockSize]
+	encrypted = encrypted[aes.BlockSize:]
+
+	stream := cipher.NewCFBDecrypter(block, iv)
+	stream.XORKeyStream(encrypted, encrypted)
+	return encrypted
+}

test/test_jwt.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"github.com/golang-jwt/jwt/v4"
+	log "github.com/sirupsen/logrus"
+)
+
+var data = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzY2hvb2xpZCI6Ijk5OSIsImV4cCI6MTY3MDcxMzk3OSwidXNlcm5hbWUiOiLllJDlrociLCJjb3Vyc2VzIjoiLDMyLDQsMzgsMzcsNDIsNDMsOSw0MCw0MSwxMSwxMiwxMyw0NCwxNCwxOSwyNiwyOSIsInNjaG9vbG5hbWUiOiLluIzlhoDlnKjnur8iLCJ1c2VyaWQiOiJjZ190YW5neXUiLCJjb2xsZWdlbmFtZSI6IuWtpuefpeahpSIsImhvbWVwYWdlIjoiaHR0cHM6Ly85OTkuYmQuZWR1Y2cubmV0LyJ9.fB3-L-gEOXVlyjjZqphkORtGCRK4ZWI9RNxO4-FULhw"
+var key = "!bd832W0@CG"
+
+type CGJWTClaim struct {
+	jwt.RegisteredClaims
+	Userid string
+}
+
+func main() {
+	jwtResult, err := jwt.ParseWithClaims(data, &CGJWTClaim{}, func(token *jwt.Token) (i interface{}, err error) {
+		return []byte(key), nil
+	})
+	if err != nil {
+		log.WithError(err).Error("err1")
+	}
+	if claims, ok := jwtResult.Claims.(*CGJWTClaim); ok && jwtResult.Valid { // 校验token
+		log.Println("user id", claims.Userid)
+	} else {
+		log.Error("err 2")
+	}
+}