分享甲方项目一个涉及密钥,使用秘钥基于HMC-SHA1算法进行请求内容的加密和解密脚本开发过程(2)

论坛 期权论坛 编程之家     
选择匿名的用户   2021-6-2 20:20   2836   0

脚本开发工具:idea64(压测工具为甲方采购的第三方压测工具,脚本基本idea64编辑器调试,基于sacla语言开发)

具体接口文档和加密方案可见上文,以下为基于sacla语言开发的脚本以及相关注释:


/*
* 导入需要的包
* */
package scripts

import scala.concurrent.duration._
import io.gatling.app.Script
import io.gatling.core.Predef._
import io.gatling.http.Predef._

import java.text.SimpleDateFormat
import java.util.Date

import java.util.UUID

import javax.crypto.Mac
import javax.crypto.spec.SecretKeySpec
import java.security.MessageDigest


class 百望_认证抵扣申请 extends Script {

val httpConfig = http
.baseURL("http://****:31004")
.acceptHeader("text/html,application/xhtml+xml,application/xmlq=0.9,image/webp,image/apng,*/*q=0.8")
.acceptEncodingHeader("gzip, deflate")
.acceptLanguageHeader("zh-CN,zhq=0.9")
.upgradeInsecureRequestsHeader("1")
.userAgentHeader("Mozilla/5.0 (Windows NT 6.1 Win64 x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36")

val headers_0 = Map(
"accept"->"*/*",
"Cache-Control" -> "no-cache",
"Content-Type" -> "application/json;charset=UTF-8"
)

/*
* MD5加密,基于HMC-SHA1算法加密要调用MD5加密方法来实现
* */
var hexDigits = Array('0','1','2','3','4','5','6','7','8','9','A','B','C','D','E','F')
def getMD5Encode(key:Array[Byte]): String={
val md5 = MessageDigest.getInstance("MD5")//获取MD5实例
val result:Array[Byte] = md5.digest(key)//此处得到的是md5加密后的byte类型值

val sb = new StringBuffer(32)
var i = 0
// while 循环执行
while (i< result.length){
// 一个字节对应两个字符
val x:Byte = result(i)
// 取得高位
val h = 0x0f & (x >>> 4)
// 取得低位
val l = 0x0f & x
sb.append(hexDigits(h)).append(hexDigits(l))

i+=1
}
return sb.toString()
}

/*
* AccessKeySecret基于HMC-SHA1算法加密
* */
def getSignature(data:String,key:String):String={
val signingKey = new SecretKeySpec(key.getBytes(), "HmacSHA1")
val mac = Mac.getInstance("HmacSHA1")//应付漏洞检查
mac.init(signingKey)
val rawHmac = mac.doFinal(data.getBytes())
return getMD5Encode(rawHmac)
}

val init = exec()

val action = group("百望")(
exec(session=>{
val uuid = UUID.randomUUID().toString().replaceAll("-", "")//获取uuid函数值

val date=new Date()
val dateTimeFormat: SimpleDateFormat =
new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'Z'")
val TimeStamp = dateTimeFormat.format(date)

val rawStr = "AccessKeyID=inter&SignatureNonce="+uuid+ "&TimeStamp="+TimeStamp //拼接需要加密的报文
val pass="123456"

val sign = getSignature(rawStr,pass)//调用HMC-SHA1算法加密方法,获取值返回给sign字段

/*
*对各入参函数重新赋值
* */
session
.set("SignatureNonce",uuid) //是否已被占用,被占用则提示:004
.set("TimeStamp",TimeStamp) //不能和本系统时间差异不能超过5分钟,否则提示错误:003
.set("Signature",sign)
})

/*
*接口调用action主体
* */
.group("认证抵扣申请接口")(
exec(
http("request_0")
.get("/scm/rest/api/nocheckDeductible?AccessKeyID=inter&SignatureNonce=${SignatureNonce}&TimeStamp=${TimeStamp}&Signature=${Signature}")
.headers(headers_0)
.body(StringBody("""{"TaxNo":"91310000766940223R","Version":"1.0","AccessKeyID":"inter","Period":"201811","InvoiceList":[{"CertificationType":"1","InvoiceCode":"1100182130","InvoiceNumber":"41362168","PurchaserTaxNo":"91310000766940223R"}]}"""))
.check(substring(""""Message":"执行成功"""").exists)
)
)
)

setUp(
scenario("百望_认证抵扣申请")
.exec(
exitBlockOnFail(init).exitHereIfFailed,
exitBlockOnFail(action)
)
.inject(atOnceUsers(1))
.protocols(httpConfig)
).maxDuration(1 minutes)
}

分享到 :
0 人收藏
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

积分:3875789
帖子:775174
精华:0
期权论坛 期权论坛
发布
内容

下载期权论坛手机APP