From 725f1315fd200630cd1345f871378f04142171c1 Mon Sep 17 00:00:00 2001 From: xiaoqidun Date: Wed, 8 Jul 2026 13:28:49 +0800 Subject: [PATCH] =?UTF-8?q?feat(=E7=AD=BE=E5=90=8D=E9=AA=8C=E7=AD=BE):=20?= =?UTF-8?q?=E4=BC=98=E5=8C=96=E7=AD=BE=E5=90=8D=E9=AA=8C=E7=AD=BE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ofdgo_sign_gbt.go | 39 +++++++++++++-------------------------- ofdgo_sign_ses.go | 23 ++--------------------- ofdgo_sign_verify.go | 38 +++++++++++++++++++++----------------- 3 files changed, 36 insertions(+), 64 deletions(-) diff --git a/ofdgo_sign_gbt.go b/ofdgo_sign_gbt.go index 0744993..1ca62f1 100644 --- a/ofdgo_sign_gbt.go +++ b/ofdgo_sign_gbt.go @@ -111,6 +111,9 @@ func verifyRawPublicKeySignature(method, digestMethod string, signedValue, signe if len(options.SignCerts) == 0 { return nil, fmt.Errorf("signature certificate not found") } + if _, err := signatureMethodHash(method, digestMethod); err != nil { + return nil, err + } result := &digitalVerifyResult{DataHashOK: true} for _, cert := range options.SignCerts { ok, err := verifyPublicKeySignature(method, digestMethod, cert, signedData, signedValue) @@ -169,6 +172,7 @@ func verifyGBT35275SignedData(signedValue, signedData []byte, options *signature } cert := sd.findCert(signer.Issuer, signer.Serial) if cert == nil { + result.CertOK = false return result, nil } result.Cert = cert.Raw @@ -177,10 +181,11 @@ func verifyGBT35275SignedData(signedValue, signedData []byte, options *signature if isSM2SignatureMethod(signer.SignatureAlg) { pub, err := parseSM2PublicKeyFromCert(cert.Raw) if err != nil { + result.CertOK = false return result, err } - result.CertOK = true if !sm2VerifySignature(pub, nil, plain, signer.Signature) { + result.CertOK = true return result, nil } continue @@ -190,13 +195,15 @@ func verifyGBT35275SignedData(signedValue, signedData []byte, options *signature } ok, err := verifyPublicKeySignature(signer.SignatureAlg, signer.DigestAlg, cert.Raw, plain, signer.Signature) if err != nil { + result.CertOK = false return result, err } - result.CertOK = true if !ok { + result.CertOK = true return result, nil } } + result.CertOK = true result.SignedOK = true return result, nil } @@ -328,34 +335,14 @@ func parseGBTCertificates(raw asn1.RawValue) ([]gbtCertificate, error) { // 入参: data DER编码证书 // 返回: gbtCertificate 证书索引信息, error 错误信息 func parseGBTCertificate(data []byte) (gbtCertificate, error) { - var cert struct { - TBSCertificate asn1.RawValue - SignatureAlgorithm asn1.RawValue - SignatureValue asn1.BitString - } - rest, err := asn1.Unmarshal(data, &cert) - if err != nil || len(rest) != 0 { - return gbtCertificate{}, fmt.Errorf("invalid certificate") - } - items, ok := asn1Children(cert.TBSCertificate.Bytes) - if !ok { - return gbtCertificate{}, fmt.Errorf("invalid tbs certificate") - } - idx := 0 - if len(items) > 0 && items[0].Class == asn1.ClassContextSpecific && items[0].Tag == 0 { - idx++ - } - if len(items) <= idx+2 { - return gbtCertificate{}, fmt.Errorf("invalid certificate issuer") - } - serial, err := asn1IntegerBig(items[idx]) + cert, err := parseSignatureCertificate(data) if err != nil { return gbtCertificate{}, err } return gbtCertificate{ - Raw: append([]byte(nil), data...), - Issuer: append([]byte(nil), items[idx+2].FullBytes...), - Serial: serial, + Raw: cert.Raw, + Issuer: cert.Issuer, + Serial: cert.Serial, }, nil } diff --git a/ofdgo_sign_ses.go b/ofdgo_sign_ses.go index a14e2c3..399a7d8 100644 --- a/ofdgo_sign_ses.go +++ b/ofdgo_sign_ses.go @@ -425,30 +425,11 @@ func parseSESPicture(raw asn1.RawValue) (string, []byte, error) { // 入参: data DER编码证书 // 返回: sm2PublicKey SM2公钥, error 错误信息 func parseSM2PublicKeyFromCert(data []byte) (sm2PublicKey, error) { - var cert struct { - TBSCertificate asn1.RawValue - SignatureAlgorithm asn1.RawValue - SignatureValue asn1.BitString - } - rest, err := asn1.Unmarshal(data, &cert) + cert, err := parseSignatureCertificate(data) if err != nil { return sm2PublicKey{}, err } - if len(rest) != 0 { - return sm2PublicKey{}, fmt.Errorf("invalid certificate") - } - items, ok := asn1Children(cert.TBSCertificate.Bytes) - if !ok { - return sm2PublicKey{}, fmt.Errorf("invalid tbs certificate") - } - idx := 0 - if len(items) > 0 && items[0].Class == asn1.ClassContextSpecific && items[0].Tag == 0 { - idx++ - } - if len(items) <= idx+5 { - return sm2PublicKey{}, fmt.Errorf("invalid public key info") - } - return parseSM2PublicKeyInfo(items[idx+5]) + return parseSM2PublicKeyInfo(cert.PublicKey) } // parseSM2PublicKeyInfo 解析SM2公钥信息 diff --git a/ofdgo_sign_verify.go b/ofdgo_sign_verify.go index d335f0f..a56bee2 100644 --- a/ofdgo_sign_verify.go +++ b/ofdgo_sign_verify.go @@ -103,7 +103,7 @@ type SignatureVerifyOption func(*signatureVerifyOptions) // 返回: SignatureVerifyOption 签名验证选项 func WithSignatureCert(cert []byte) SignatureVerifyOption { return func(o *signatureVerifyOptions) { - o.SignCerts = append(o.SignCerts, parseSignatureCerts(cert)...) + o.SignCerts = appendSignatureCerts(o.SignCerts, cert) } } @@ -112,9 +112,7 @@ func WithSignatureCert(cert []byte) SignatureVerifyOption { // 返回: SignatureVerifyOption 签名验证选项 func WithSignatureCerts(certs ...[]byte) SignatureVerifyOption { return func(o *signatureVerifyOptions) { - for _, cert := range certs { - o.SignCerts = append(o.SignCerts, parseSignatureCerts(cert)...) - } + o.SignCerts = appendSignatureCerts(o.SignCerts, certs...) } } @@ -123,7 +121,7 @@ func WithSignatureCerts(certs ...[]byte) SignatureVerifyOption { // 返回: SignatureVerifyOption 签名验证选项 func WithSignatureTrustCert(cert []byte) SignatureVerifyOption { return func(o *signatureVerifyOptions) { - o.TrustCerts = append(o.TrustCerts, parseSignatureCerts(cert)...) + o.TrustCerts = appendSignatureCerts(o.TrustCerts, cert) } } @@ -132,9 +130,7 @@ func WithSignatureTrustCert(cert []byte) SignatureVerifyOption { // 返回: SignatureVerifyOption 签名验证选项 func WithSignatureTrustCerts(certs ...[]byte) SignatureVerifyOption { return func(o *signatureVerifyOptions) { - for _, cert := range certs { - o.TrustCerts = append(o.TrustCerts, parseSignatureCerts(cert)...) - } + o.TrustCerts = appendSignatureCerts(o.TrustCerts, certs...) } } @@ -147,6 +143,16 @@ func WithSignatureVerifyTime(t time.Time) SignatureVerifyOption { } } +// appendSignatureCerts 追加签名证书 +// 入参: dst 目标证书列表, certs DER或PEM编码证书列表 +// 返回: [][]byte 证书列表 +func appendSignatureCerts(dst [][]byte, certs ...[]byte) [][]byte { + for _, cert := range certs { + dst = append(dst, parseSignatureCerts(cert)...) + } + return dst +} + // VerifySignaturesBytes 验证OFD字节数据签名 // 入参: data OFD字节数据, opts 签名验证选项 // 返回: []SignatureVerifyReport 签名验证报告, error 错误信息 @@ -597,8 +603,12 @@ func (report *SignatureVerifyReport) applySignatureCertificatePolicy(options *si if len(options.TrustCerts) != 0 { report.CertTrustChecked = true report.CertTrustOK = true + pool := append([][]byte{}, options.SignCerts...) + pool = append(pool, extraCerts...) + pool = append(pool, options.TrustCerts...) + pool = compactSignatureCerts(pool) for _, cert := range certs { - if !signatureCertTrusted(cert, options, extraCerts) { + if !signatureCertTrustedBy(cert, pool, options.TrustCerts, make(map[string]bool)) { report.CertTrustOK = false break } @@ -637,14 +647,6 @@ func signatureCertsValidAt(certs [][]byte, t time.Time) bool { return true } -// signatureCertTrusted 判断证书是否受信任 -// 入参: cert 证书, options 验证选项, extraCerts 额外证书池 -// 返回: bool 是否受信任 -func signatureCertTrusted(cert []byte, options *signatureVerifyOptions, extraCerts [][]byte) bool { - pool := compactSignatureCerts(append(append(append([][]byte{}, options.SignCerts...), extraCerts...), options.TrustCerts...)) - return signatureCertTrustedBy(cert, pool, options.TrustCerts, make(map[string]bool)) -} - // signatureCertTrustedBy 判断证书是否可链到信任证书 // 入参: cert 证书, pool 证书池, trusts 信任证书, visited 已访问证书 // 返回: bool 是否受信任 @@ -790,6 +792,7 @@ type signatureCertificate struct { IssuerValue asn1.RawValue Subject []byte SubjectValue asn1.RawValue + PublicKey asn1.RawValue Serial *big.Int NotBefore time.Time NotAfter time.Time @@ -843,6 +846,7 @@ func parseSignatureCertificate(data []byte) (signatureCertificate, error) { IssuerValue: items[idx+2], Subject: append([]byte(nil), items[idx+4].FullBytes...), SubjectValue: items[idx+4], + PublicKey: items[idx+5], Serial: serial, NotBefore: validity[0], NotAfter: validity[1],