|
| 1 | +#!/usr/bin/env python |
| 2 | +#-*- encoding:utf-8 -*- |
| 3 | + |
| 4 | +""" 对企业微信发送给企业后台的消息加解密示例代码. |
| 5 | +@copyright: Copyright (c) 1998-2014 Tencent Inc. |
| 6 | +
|
| 7 | +""" |
| 8 | +# ------------------------------------------------------------------------ |
| 9 | + |
| 10 | +import base64 |
| 11 | +import string |
| 12 | +import random |
| 13 | +import hashlib |
| 14 | +import time |
| 15 | +import struct |
| 16 | +from Crypto.Cipher import AES |
| 17 | +import xml.etree.cElementTree as ET |
| 18 | +import sys |
| 19 | +import socket |
| 20 | +reload(sys) |
| 21 | +import ierror |
| 22 | +sys.setdefaultencoding('utf-8') |
| 23 | + |
| 24 | +""" |
| 25 | +关于Crypto.Cipher模块，ImportError: No module named 'Crypto'解决方案 |
| 26 | +请到官方网站 https://www.dlitz.net/software/pycrypto/ 下载pycrypto。 |
| 27 | +下载后，按照README中的“Installation”小节的提示进行pycrypto安装。 |
| 28 | +""" |
| 29 | +class FormatException(Exception): |
| 30 | + pass |
| 31 | + |
| 32 | +def throw_exception(message, exception_class=FormatException): |
| 33 | + """my define raise exception function""" |
| 34 | + raise exception_class(message) |
| 35 | + |
| 36 | +class SHA1: |
| 37 | + """计算企业微信的消息签名接口""" |
| 38 | + |
| 39 | + def getSHA1(self, token, timestamp, nonce, encrypt): |
| 40 | + """用SHA1算法生成安全签名 |
| 41 | + @param token: 票据 |
| 42 | + @param timestamp: 时间戳 |
| 43 | + @param encrypt: 密文 |
| 44 | + @param nonce: 随机字符串 |
| 45 | + @return: 安全签名 |
| 46 | + """ |
| 47 | + try: |
| 48 | + sortlist = [token, timestamp, nonce, encrypt] |
| 49 | + sortlist.sort() |
| 50 | + sha = hashlib.sha1() |
| 51 | + sha.update("".join(sortlist)) |
| 52 | + return ierror.WXBizMsgCrypt_OK, sha.hexdigest() |
| 53 | + except Exception,e: |
| 54 | + print e |
| 55 | + return ierror.WXBizMsgCrypt_ComputeSignature_Error, None |
| 56 | + |
| 57 | + |
| 58 | +class XMLParse: |
| 59 | + """提供提取消息格式中的密文及生成回复消息格式的接口""" |
| 60 | + |
| 61 | + # xml消息模板 |
| 62 | + AES_TEXT_RESPONSE_TEMPLATE = """<xml> |
| 63 | +<Encrypt><![CDATA[%(msg_encrypt)s]]></Encrypt> |
| 64 | +<MsgSignature><![CDATA[%(msg_signaturet)s]]></MsgSignature> |
| 65 | +<TimeStamp>%(timestamp)s</TimeStamp> |
| 66 | +<Nonce><![CDATA[%(nonce)s]]></Nonce> |
| 67 | +</xml>""" |
| 68 | + |
| 69 | + def extract(self, xmltext): |
| 70 | + """提取出xml数据包中的加密消息 |
| 71 | + @param xmltext: 待提取的xml字符串 |
| 72 | + @return: 提取出的加密消息字符串 |
| 73 | + """ |
| 74 | + try: |
| 75 | + xml_tree = ET.fromstring(xmltext) |
| 76 | + encrypt = xml_tree.find("Encrypt") |
| 77 | + touser_name = xml_tree.find("ToUserName") |
| 78 | + return ierror.WXBizMsgCrypt_OK, encrypt.text, touser_name.text |
| 79 | + except Exception,e: |
| 80 | + print e |
| 81 | + return ierror.WXBizMsgCrypt_ParseXml_Error,None,None |
| 82 | + |
| 83 | + def generate(self, encrypt, signature, timestamp, nonce): |
| 84 | + """生成xml消息 |
| 85 | + @param encrypt: 加密后的消息密文 |
| 86 | + @param signature: 安全签名 |
| 87 | + @param timestamp: 时间戳 |
| 88 | + @param nonce: 随机字符串 |
| 89 | + @return: 生成的xml字符串 |
| 90 | + """ |
| 91 | + resp_dict = { |
| 92 | + 'msg_encrypt' : encrypt, |
| 93 | + 'msg_signaturet': signature, |
| 94 | + 'timestamp' : timestamp, |
| 95 | + 'nonce' : nonce, |
| 96 | + } |
| 97 | + resp_xml = self.AES_TEXT_RESPONSE_TEMPLATE % resp_dict |
| 98 | + return resp_xml |
| 99 | + |
| 100 | + |
| 101 | +class PKCS7Encoder(): |
| 102 | + """提供基于PKCS7算法的加解密接口""" |
| 103 | + |
| 104 | + block_size = 32 |
| 105 | + def encode(self, text): |
| 106 | + """ 对需要加密的明文进行填充补位 |
| 107 | + @param text: 需要进行填充补位操作的明文 |
| 108 | + @return: 补齐明文字符串 |
| 109 | + """ |
| 110 | + text_length = len(text) |
| 111 | + # 计算需要填充的位数 |
| 112 | + amount_to_pad = self.block_size - (text_length % self.block_size) |
| 113 | + if amount_to_pad == 0: |
| 114 | + amount_to_pad = self.block_size |
| 115 | + # 获得补位所用的字符 |
| 116 | + pad = chr(amount_to_pad) |
| 117 | + return text + pad * amount_to_pad |
| 118 | + |
| 119 | + def decode(self, decrypted): |
| 120 | + """删除解密后明文的补位字符 |
| 121 | + @param decrypted: 解密后的明文 |
| 122 | + @return: 删除补位字符后的明文 |
| 123 | + """ |
| 124 | + pad = ord(decrypted[-1]) |
| 125 | + if pad<1 or pad >32: |
| 126 | + pad = 0 |
| 127 | + return decrypted[:-pad] |
| 128 | + |
| 129 | + |
| 130 | +class Prpcrypt(object): |
| 131 | + """提供接收和推送给企业微信消息的加解密接口""" |
| 132 | + |
| 133 | + def __init__(self,key): |
| 134 | + |
| 135 | + #self.key = base64.b64decode(key+"=") |
| 136 | + self.key = key |
| 137 | + # 设置加解密模式为AES的CBC模式 |
| 138 | + self.mode = AES.MODE_CBC |
| 139 | + |
| 140 | + |
| 141 | + def encrypt(self,text,corpid): |
| 142 | + """对明文进行加密 |
| 143 | + @param text: 需要加密的明文 |
| 144 | + @return: 加密得到的字符串 |
| 145 | + """ |
| 146 | + # 16位随机字符串添加到明文开头 |
| 147 | + text = self.get_random_str() + struct.pack("I",socket.htonl(len(text))) + text + corpid |
| 148 | + # 使用自定义的填充方式对明文进行补位填充 |
| 149 | + pkcs7 = PKCS7Encoder() |
| 150 | + text = pkcs7.encode(text) |
| 151 | + # 加密 |
| 152 | + cryptor = AES.new(self.key,self.mode,self.key[:16]) |
| 153 | + try: |
| 154 | + ciphertext = cryptor.encrypt(text) |
| 155 | + # 使用BASE64对加密后的字符串进行编码 |
| 156 | + return ierror.WXBizMsgCrypt_OK, base64.b64encode(ciphertext) |
| 157 | + except Exception,e: |
| 158 | + print e |
| 159 | + return ierror.WXBizMsgCrypt_EncryptAES_Error,None |
| 160 | + |
| 161 | + def decrypt(self,text,corpid): |
| 162 | + """对解密后的明文进行补位删除 |
| 163 | + @param text: 密文 |
| 164 | + @return: 删除填充补位后的明文 |
| 165 | + """ |
| 166 | + try: |
| 167 | + cryptor = AES.new(self.key,self.mode,self.key[:16]) |
| 168 | + # 使用BASE64对密文进行解码，然后AES-CBC解密 |
| 169 | + plain_text = cryptor.decrypt(base64.b64decode(text)) |
| 170 | + except Exception,e: |
| 171 | + print e |
| 172 | + return ierror.WXBizMsgCrypt_DecryptAES_Error,None |
| 173 | + try: |
| 174 | + pad = ord(plain_text[-1]) |
| 175 | + # 去掉补位字符串 |
| 176 | + #pkcs7 = PKCS7Encoder() |
| 177 | + #plain_text = pkcs7.encode(plain_text) |
| 178 | + # 去除16位随机字符串 |
| 179 | + content = plain_text[16:-pad] |
| 180 | + xml_len = socket.ntohl(struct.unpack("I",content[ : 4])[0]) |
| 181 | + xml_content = content[4 : xml_len+4] |
| 182 | + from_corpid = content[xml_len+4:] |
| 183 | + except Exception,e: |
| 184 | + print e |
| 185 | + return ierror.WXBizMsgCrypt_IllegalBuffer,None |
| 186 | + if from_corpid != corpid: |
| 187 | + return ierror.WXBizMsgCrypt_ValidateCorpid_Error,None |
| 188 | + return 0,xml_content |
| 189 | + |
| 190 | + def get_random_str(self): |
| 191 | + """ 随机生成16位字符串 |
| 192 | + @return: 16位字符串 |
| 193 | + """ |
| 194 | + rule = string.letters + string.digits |
| 195 | + str = random.sample(rule, 16) |
| 196 | + return "".join(str) |
| 197 | + |
| 198 | +class WXBizMsgCrypt(object): |
| 199 | + #构造函数 |
| 200 | + #@param sToken: 企业微信后台，开发者设置的Token |
| 201 | + # @param sEncodingAESKey: 企业微信后台，开发者设置的EncodingAESKey |
| 202 | + # @param sCorpId: 企业号的CorpId |
| 203 | + def __init__(self,sToken,sEncodingAESKey,sCorpId): |
| 204 | + try: |
| 205 | + self.key = base64.b64decode(sEncodingAESKey+"=") |
| 206 | + assert len(self.key) == 32 |
| 207 | + except: |
| 208 | + throw_exception("[error]: EncodingAESKey unvalid !", FormatException) |
| 209 | + # return ierror.WXBizMsgCrypt_IllegalAesKey,None |
| 210 | + self.m_sToken = sToken |
| 211 | + self.m_sCorpid = sCorpId |
| 212 | + |
| 213 | + #验证URL |
| 214 | + #@param sMsgSignature: 签名串，对应URL参数的msg_signature |
| 215 | + #@param sTimeStamp: 时间戳，对应URL参数的timestamp |
| 216 | + #@param sNonce: 随机串，对应URL参数的nonce |
| 217 | + #@param sEchoStr: 随机串，对应URL参数的echostr |
| 218 | + #@param sReplyEchoStr: 解密之后的echostr，当return返回0时有效 |
| 219 | + #@return：成功0，失败返回对应的错误码 |
| 220 | + |
| 221 | + def VerifyURL(self, sMsgSignature, sTimeStamp, sNonce, sEchoStr): |
| 222 | + sha1 = SHA1() |
| 223 | + ret,signature = sha1.getSHA1(self.m_sToken, sTimeStamp, sNonce, sEchoStr) |
| 224 | + if ret != 0: |
| 225 | + return ret, None |
| 226 | + if not signature == sMsgSignature: |
| 227 | + return ierror.WXBizMsgCrypt_ValidateSignature_Error, None |
| 228 | + pc = Prpcrypt(self.key) |
| 229 | + ret,sReplyEchoStr = pc.decrypt(sEchoStr,self.m_sCorpid) |
| 230 | + return ret,sReplyEchoStr |
| 231 | + |
| 232 | + def EncryptMsg(self, sReplyMsg, sNonce, timestamp = None): |
| 233 | + #将企业回复用户的消息加密打包 |
| 234 | + #@param sReplyMsg: 企业号待回复用户的消息，xml格式的字符串 |
| 235 | + #@param sTimeStamp: 时间戳，可以自己生成，也可以用URL参数的timestamp,如为None则自动用当前时间 |
| 236 | + #@param sNonce: 随机串，可以自己生成，也可以用URL参数的nonce |
| 237 | + #sEncryptMsg: 加密后的可以直接回复用户的密文，包括msg_signature, timestamp, nonce, encrypt的xml格式的字符串, |
| 238 | + #return：成功0，sEncryptMsg,失败返回对应的错误码None |
| 239 | + pc = Prpcrypt(self.key) |
| 240 | + ret,encrypt = pc.encrypt(sReplyMsg, self.m_sCorpid) |
| 241 | + if ret != 0: |
| 242 | + return ret,None |
| 243 | + if timestamp is None: |
| 244 | + timestamp = str(int(time.time())) |
| 245 | + # 生成安全签名 |
| 246 | + sha1 = SHA1() |
| 247 | + ret,signature = sha1.getSHA1(self.m_sToken, timestamp, sNonce, encrypt) |
| 248 | + if ret != 0: |
| 249 | + return ret,None |
| 250 | + xmlParse = XMLParse() |
| 251 | + return ret,xmlParse.generate(encrypt, signature, timestamp, sNonce) |
| 252 | + |
| 253 | + def DecryptMsg(self, sPostData, sMsgSignature, sTimeStamp, sNonce): |
| 254 | + # 检验消息的真实性，并且获取解密后的明文 |
| 255 | + # @param sMsgSignature: 签名串，对应URL参数的msg_signature |
| 256 | + # @param sTimeStamp: 时间戳，对应URL参数的timestamp |
| 257 | + # @param sNonce: 随机串，对应URL参数的nonce |
| 258 | + # @param sPostData: 密文，对应POST请求的数据 |
| 259 | + # xml_content: 解密后的原文，当return返回0时有效 |
| 260 | + # @return: 成功0，失败返回对应的错误码 |
| 261 | + # 验证安全签名 |
| 262 | + xmlParse = XMLParse() |
| 263 | + ret,encrypt,touser_name = xmlParse.extract(sPostData) |
| 264 | + if ret != 0: |
| 265 | + return ret, None |
| 266 | + sha1 = SHA1() |
| 267 | + ret,signature = sha1.getSHA1(self.m_sToken, sTimeStamp, sNonce, encrypt) |
| 268 | + if ret != 0: |
| 269 | + return ret, None |
| 270 | + if not signature == sMsgSignature: |
| 271 | + return ierror.WXBizMsgCrypt_ValidateSignature_Error, None |
| 272 | + pc = Prpcrypt(self.key) |
| 273 | + ret,xml_content = pc.decrypt(encrypt,self.m_sCorpid) |
| 274 | + return ret,xml_content |
| 275 | + |
| 276 | + |
0 commit comments