#!/bin/bash

set -eo pipefail

# 配置路径

SM2_PRIVATE_KEY="/etc/rsyslog.d/sm2-private.pem"

OUTPUT_LOG="/var/log/sm-sign.log"

ERROR_LOG="/var/log/syslog-sign-error.log"

# 检查私钥文件

if [ ! -f "$SM2_PRIVATE_KEY" ]; then

    echo "$(date) ERROR: SM2 私钥不存在 $SM2_PRIVATE_KEY" >> "$ERROR_LOG"

    exit 1

fi

# 检查 openssl 可执行

if [ ! -x /usr/bin/openssl ]; then

    echo "$(date) ERROR: openssl 不可用" >> "$ERROR_LOG"

    exit 1

fi

# 核心：稳定读取 rsyslog 日志流（解决断行、丢行）

while IFS= read -r log_line || [ -n "$log_line" ]; do

    # 跳过空行

    [ -z "$log_line" ] && continue

    # 计算 SM3 哈希（无换行、无格式干扰）

    sm3_hash=$(printf "%s" "$log_line" | openssl dgst -sm3 -binary | base64 -w 0 2>>"$ERROR_LOG")

    # 计算 SM2 国密签名（无换行、二进制→base64）

    sm2_sig=$(printf "%s" "$log_line" | openssl dgst -sm3 \

        -sign "$SM2_PRIVATE_KEY" \

        -keyform PEM \

        -binary 2>>"$ERROR_LOG" | base64 -w 0)

    # 输出：严格单行，不添加任何多余换行符

    printf "%s |SM3:%s |SM2:%s\n" "$log_line" "$sm3_hash" "$sm2_sig"

done >> "$OUTPUT_LOG" 2>>"$ERROR_LOG"

# 1. 加载外部命令模块

module(load="omprog")

# 2. 定义日志模板：严格单行，无多余换行

template(name="SecureLogTemplate" type="string" string="%TIMESTAMP:::date-rfc3339% %HOSTNAME% %PROGRAMNAME% %MSG%\n")

# 3. 匹配进程和安全级别的日志，调用签名脚本

if $programname == 'kylin_kms_daemon' or $syslogfacility-text == 'authpriv' or $syslogfacility-text == 'local6' then action(

    type="omprog"

    binary="/usr/local/bin/syslog-sm-sign.sh"

    template="SecureLogTemplate"

)

# 4. 处理完成后停止，不进入其他规则

*.* stop

#!/bin/bash

# 国密验签脚本

SM2_PUBLIC_CRT="/etc/rsyslog.d/sm2-public.pem"

LOG_FILE="/var/log/sm-sign.log"

#LOG_FILE=$1

[ ! -f "$LOG_FILE" ] && echo "Log file not exist!" && exit 1

[ ! -f "$SM2_PUBLIC_CRT" ] && echo "SM2公钥证书文件不存在: $SM2_PUBLIC_CRT" && exit 1

while read -r line; do

    # 跳过空行

    [ -z "$line" ] && continue

    # 使用空格作为分隔符解析日志行：日志内容 |SM3:哈希值 |SM2:签名值

    log_content=$(echo "$line" | sed 's/ |SM3:.*//')

    sm3_field=$(echo "$line" | grep -o '|SM3:[^ |]*')

    sm2_field=$(echo "$line" | grep -o '|SM2:[^ |]*')

    # 检查是否包含完整的签名信息

    if [ -z "$sm3_field" ] || [ -z "$sm2_field" ]; then

        echo "跳过不完整的日志行: $line"

        continue

    fi

    # 提取哈希和签名值

    sm3_hash=${sm3_field#|SM3:}

    sm2_sig=${sm2_field#|SM2:}

    # 检查签名值是否为空

    if [ -z "$sm2_sig" ]; then

        echo "SM2签名值为空，跳过: $log_content"

        continue

    fi

    echo "content=[$log_content]"

    # 1. 验证 SM3 哈希一致性

    calc_sm3=$(echo -n "$log_content" | openssl dgst -sm3 -binary | base64)

    if [ "$calc_sm3" != "$sm3_hash" ]; then

        echo " SM3 校验失败: $log_content"

        exit 1

    fi

    # 2. 验证 SM2 签名有效性

    # 先检查base64解码是否成功

    if ! echo "$sm2_sig" | base64 -d > /dev/null 2>&1; then

        echo "SM2签名Base64格式错误: $log_content"

        exit 1

    fi

    echo -n "$log_content" | openssl dgst -sm3 -verify "$SM2_PUBLIC_CRT" -signature <(echo "$sm2_sig" | base64 -d)

    if [ $? -ne 0 ]; then

        echo " SM2 验签失败: $log_content"

        exit 1

    fi

    echo "验签成功"

done < "$LOG_FILE"

echo "所有日志验签成功!"

#!/bin/bash

# 国密实时验签脚本

SM2_PUBLIC_CRT="/etc/rsyslog.d/sm2-public.pem"

LOG_FILE="/var/log/sm-sign.log"

#LOG_FILE=$1

[ ! -f "$LOG_FILE" ] && echo "Log file not exist!" && exit 1

[ ! -f "$SM2_PUBLIC_CRT" ] && echo "SM2公钥证书文件不存在: $SM2_PUBLIC_CRT" && exit 1

echo "实时验签已启动，监听日志：$LOG_FILE"

echo "========================================"

# 核心：实时跟踪日志（tail -f 持续读）

tail -n 0 -F "$LOG_FILE" | while read -r line; do

    # 跳过空行

    [ -z "$line" ] && continue

    # 拆分日志内容、SM3、SM2

    log_content=$(echo "$line" | sed 's/ |SM3:.*//')

    sm3_field=$(echo "$line" | grep -o '|SM3:[^ |]*')

    sm2_field=$(echo "$line" | grep -o '|SM2:[^ |]*')

    if [ -z "$sm3_field" ] || [ -z "$sm2_field" ]; then

        echo "跳过不完整的日志行: $line"

        continue

    fi

    sm3_hash=${sm3_field#|SM3:}

    sm2_sig=${sm2_field#|SM2:}

    # 1. 验证 SM3 哈希一致性

    calc_sm3=$(printf "%s" "$log_content" | openssl dgst -sm3 -binary | base64 -w 0)

    if [ "$calc_sm3" != "$sm3_hash" ]; then

        echo "SM3 校验失败: $log_content"

        continue

    fi

    # 2. 验证 SM2 签名有效性

    if ! echo "$sm2_sig" | base64 -d > /dev/null 2>&1; then

        echo " SM2签名Base64格式错误: $log_content"

        continue

    fi

    if ! printf "%s" "$log_content" | openssl dgst -sm3 \

        -verify "$SM2_PUBLIC_CRT" \

        -signature <(echo "$sm2_sig" | base64 -d); then

        echo " SM2 验签失败: $log_content"

        continue

    fi

    # 验签通过

    echo "验签成功: $log_content"

done