From 7ab2fadecb95ac1d0538db4672d67085b3f95260 Mon Sep 17 00:00:00 2001 From: vincent Date: Thu, 5 Nov 2026 14:04:53 +0800 Subject: [PATCH] =?UTF-8?q?=E6=89=8B=E6=9C=BA=E5=8F=B7=E7=A0=81=E4=BC=98?= =?UTF-8?q?=E5=8C=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../web/supervision/CommonController.java | 19 ++++++++++++++++++ .../service/ICryptoSensitiveHsmService.java | 4 +++- .../impl/CryptoSensitiveHsmServiceImpl.java | 20 ++++++++++++------- 3 files changed, 35 insertions(+), 8 deletions(-) diff --git a/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/web/supervision/CommonController.java b/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/web/supervision/CommonController.java index b4fd03fb..60537df4 100644 --- a/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/web/supervision/CommonController.java +++ b/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/web/supervision/CommonController.java @@ -106,5 +106,24 @@ public class CommonController extends BaseController { return R.ok("同步用户密评成功", stats); } + /** + * 数据完整性校验 + * @param loginName + * @return + */ + @GetMapping("/hmac") + public R> hmac(@RequestParam(value = "loginName", required = false) String loginName) { + String[] tables = {"sys_user", "sys_oper_log"}; + for (String table : tables) { + log.info("数据完整性校验表开始 {}", table); + // 修复: 使用返回值输出处理量, 校验结果异常由 verifyIntegrityHash 内部 error 日志告警 + int processed = cryptoSensitiveHsmService.verifyIntegrityHash(table); + log.info("数据完整性校验表结束 {}, 处理记录数: {}", table, processed); + } + return R.ok("同步用户密评成功"); + } + + + } diff --git a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/ICryptoSensitiveHsmService.java b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/ICryptoSensitiveHsmService.java index 319e2fd1..8bf9f83f 100644 --- a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/ICryptoSensitiveHsmService.java +++ b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/ICryptoSensitiveHsmService.java @@ -180,7 +180,9 @@ public interface ICryptoSensitiveHsmService { *

* 查询 crypto_integrity_data 中 table_name 匹配且 generate_time 早于今天的基准摘要记录， * 根据 table_name 与 biz_id 回查业务表当前数据重新计算摘要并比对： - * 一致则标记 verify_result=1（通过），不一致或业务数据缺失则标记 verify_result=2（篡改）， + * 一致则标记 verify_result=1（通过），不一致则标记 verify_result=2（篡改）， + * 校验过程异常标记 verify_result=4（校验异常, 非篡改），业务数据缺失标记 verify_result=3（跳过）， + * 同时刷新 last_verify_time。 * * @param tableName 业务表名，当前支持 sys_user、sys_oper_log diff --git a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/impl/CryptoSensitiveHsmServiceImpl.java b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/impl/CryptoSensitiveHsmServiceImpl.java index 04f3fc24..ea2e6f7f 100644 --- a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/impl/CryptoSensitiveHsmServiceImpl.java +++ b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/service/impl/CryptoSensitiveHsmServiceImpl.java @@ -363,6 +363,7 @@ public class CryptoSensitiveHsmServiceImpl implements ICryptoSensitiveHsmService int passed = 0; int tampered = 0; int skipped = 0; + int errored = 0; long pageSize = 500L; Page page = new Page<>(1, pageSize); LambdaQueryWrapper lqw = new LambdaQueryWrapper() @@ -395,13 +396,14 @@ public class CryptoSensitiveHsmServiceImpl implements ICryptoSensitiveHsmService cryptoIntegrityDataMapper.updateById(record); processed++; } catch (Exception e) { - // 修复: 校验异常(如 bizId 非数字/不支持字段)不再静默滞留, 标记失败态脱离"永不校验"盲区 - log.error("完整性校验异常, 标记为校验失败, tableName={}, bizId={}", + // 修复: 校验异常(如 bizId 非数字/不支持字段)标记独立状态 4, 与"确认篡改"(2)区分, + // 避免程序缺陷被误统计为篡改告警噪音; 数据状态未知, 代码修复后允许重建基线 + log.error("完整性校验异常, 标记为校验异常(非篡改), tableName={}, bizId={}", record.getTableName(), record.getBizId(), e); - record.setVerifyResult(2); + record.setVerifyResult(4); record.setLastVerifyTime(new Date()); cryptoIntegrityDataMapper.updateById(record); - tampered++; + errored++; processed++; } } @@ -412,11 +414,15 @@ public class CryptoSensitiveHsmServiceImpl implements ICryptoSensitiveHsmService } // 修复: 发现异常记录时升级为 error 告警, 不再仅 info 汇总 if (tampered > 0) { - log.error("完整性校验发现异常记录, tableName={}, 异常数={}（含篡改与校验失败, 须人工核查）", tableName, tampered); + log.error("完整性校验发现疑似篡改记录, tableName={}, 篡改数={}（须人工核查, 基线已锁定拒绝自动覆盖）", tableName, tampered); } - log.info("完整性校验完成, tableName={}, 处理={}, 通过={}, 篡改/异常={}, 跳过(数据不存在)={}", - tableName, processed, passed, tampered, skipped); + if (errored > 0) { + log.warn("完整性校验存在校验异常记录, tableName={}, 异常数={}（程序缺陷或脏数据, 须排查代码, 非篡改）", tableName, errored); + } + log.info("完整性校验完成, tableName={}, 处理={}, 通过={}, 篡改={}, 校验异常={}, 跳过(数据不存在)={}", + tableName, processed, passed, tampered, errored, skipped); return processed; + }catch (Exception e){ log.error("数据完整性校验失败, tableName={}", tableName, e); }