[feature][bootstrap]Add the SM4 algorithm for encrypting sensitive configuration data

8 files changed, 68 insertions, 8 deletions

diff --git a/config/template/grootstream_job_template.yaml b/config/template/grootstream_job_template.yaml
index 7cf50c8..0ca2d68 100644
--- a/config/template/grootstream_job_template.yaml
+++ b/config/template/grootstream_job_template.yaml
@@ -151,7 +151,7 @@ preprocessing_pipelines: # [object] Define Processors for preprocessing pipeline
 # It will be accomplished the common processing for the event by the user-defined functions.
 #
 processing_pipelines: # [object] Define Processors for processing pipelines.
-  projection_processor: # [object] Define projection processor name, must be unique.
+  z: # [object] Define projection processor name, must be unique.
     type: projection  # [string] Processor Type
     remove_fields:
     output_fields:
diff --git a/groot-bootstrap/src/main/java/com/geedgenetworks/bootstrap/command/SM4ConfigShade.java b/groot-bootstrap/src/main/java/com/geedgenetworks/bootstrap/command/SM4ConfigShade.java
new file mode 100644
index 0000000..05d3e52
--- /dev/null
+++ b/groot-bootstrap/src/main/java/com/geedgenetworks/bootstrap/command/SM4ConfigShade.java
@@ -0,0 +1,37 @@
+package com.geedgenetworks.bootstrap.command;
+
+import cn.hutool.crypto.KeyUtil;
+import cn.hutool.crypto.SmUtil;
+import cn.hutool.crypto.symmetric.SM4;
+import com.geedgenetworks.common.config.ConfigShade;
+
+import java.nio.charset.StandardCharsets;
+
+public class SM4ConfigShade implements ConfigShade {
+    private static final String IDENTIFIER = "sm4";
+
+    private static final String[] SENSITIVE_OPTIONS =
+            new String[] {"connection.user", "connection.password", "kafka.sasl.jaas.config","kafka.ssl.keystore.password","kafka.ssl.truststore.password","kafka.ssl.key.password"};
+
+    private static final byte[] SECURITY_KEY = KeyUtil.generateKey(SM4.ALGORITHM_NAME, ".geedgenetworks.".getBytes(StandardCharsets.UTF_8)).getEncoded();
+
+    @Override
+    public String[] sensitiveOptions() {
+        return SENSITIVE_OPTIONS;
+    }
+
+    @Override
+    public String getIdentifier() {
+        return IDENTIFIER;
+    }
+
+    @Override
+    public String encrypt(String content) {
+        return SmUtil.sm4(SECURITY_KEY).encryptHex(content, StandardCharsets.UTF_8);
+    }
+
+    @Override
+    public String decrypt(String content) {
+        return SmUtil.sm4(SECURITY_KEY).decryptStr(content, StandardCharsets.UTF_8);
+    }
+}
diff --git a/groot-bootstrap/src/main/resources/META-INF/services/com.geedgenetworks.common.config.ConfigShade b/groot-bootstrap/src/main/resources/META-INF/services/com.geedgenetworks.common.config.ConfigShade
index 6654db5..f490f28 100644
--- a/groot-bootstrap/src/main/resources/META-INF/services/com.geedgenetworks.common.config.ConfigShade
+++ b/groot-bootstrap/src/main/resources/META-INF/services/com.geedgenetworks.common.config.ConfigShade
@@ -1,2 +1,3 @@
 com.geedgenetworks.bootstrap.command.Base64ConfigShade
-com.geedgenetworks.bootstrap.command.AESConfigShade
\ No newline at end of file
+com.geedgenetworks.bootstrap.command.AESConfigShade
+com.geedgenetworks.bootstrap.command.SM4ConfigShade
\ No newline at end of file
diff --git a/groot-bootstrap/src/test/java/com/geedgenetworks/bootstrap/utils/ConfigShadeTest.java b/groot-bootstrap/src/test/java/com/geedgenetworks/bootstrap/utils/ConfigShadeTest.java
index c3746a4..17f56ce 100644
--- a/groot-bootstrap/src/test/java/com/geedgenetworks/bootstrap/utils/ConfigShadeTest.java
+++ b/groot-bootstrap/src/test/java/com/geedgenetworks/bootstrap/utils/ConfigShadeTest.java
@@ -65,8 +65,16 @@ public class ConfigShadeTest {
         Assertions.assertEquals("159c7da83d988a9ec041d10a6bfbe221bcbaed6b62d9cc1b04ff51e633ebd105", encryptPassword);
         Assertions.assertEquals(decryptUsername, USERNAME);
         Assertions.assertEquals(decryptPassword, PASSWORD);
-        System.out.println( ConfigShadeUtils.encryptOption("aes", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"admin\" password=\"galaxy2019\";"));
-        System.out.println( ConfigShadeUtils.decryptOption("aes", "454f65ea6eef1256e3067104f82730e737b68959560966b811e7ff364116b03124917eb2b0f3596f14733aa29ebad9352644ce1a5c85991c6f01ba8a5e8f177a7ff0b2d3889a424249967b3870b50993d9644f239f0de82cdb13bdb502959e16afadffa49ef1e1d2b9c9b5113e619817"));
+        encryptUsername = ConfigShadeUtils.encryptOption("sm4", USERNAME);
+        decryptUsername = ConfigShadeUtils.decryptOption("sm4", encryptUsername);
+        Assertions.assertEquals("72ea74367a15cb96b0d1d42104149519", encryptUsername);
+        Assertions.assertEquals(decryptUsername, USERNAME);
+        encryptPassword = ConfigShadeUtils.encryptOption("sm4", PASSWORD);
+        decryptPassword = ConfigShadeUtils.decryptOption("sm4", encryptPassword);
+        Assertions.assertEquals("3876c7088d395bbbfa826e3648b6c9a022e7f80941c132313bde6dc8a7f2351f", encryptPassword);
+        Assertions.assertEquals(decryptPassword, PASSWORD);
+        System.out.println( ConfigShadeUtils.encryptOption("sm4", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"admin\" password=\"galaxy2019\";"));
+        System.out.println( ConfigShadeUtils.decryptOption("sm4", "f76480be84a8ee1b009504c6c56a5bed48239c348a468f94b4029a6a3148f51530b025d6dfa140af93b4c7c6fe0e3dce543773e779d272b5579555fbd3271e7fdbee088673a901b3f3b28e914a25f30a4a859d97594c5ea7d7c1dcefe8c62560baea32b6da0b767232ed8aca17af2dc6"));
         System.out.println( ConfigShadeUtils.encryptOption("aes", "testuser"));
         System.out.println( ConfigShadeUtils.encryptOption("aes", "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"olap\" password=\"galaxy2019\";"));
     }
diff --git a/groot-common/pom.xml b/groot-common/pom.xml
index 10e9ed4..37a4d25 100644
--- a/groot-common/pom.xml
+++ b/groot-common/pom.xml
@@ -41,6 +41,13 @@
             <artifactId>hutool-all</artifactId>
         </dependency>
 
+
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk18on</artifactId>
+        </dependency>
+
+
         <dependency>
             <groupId>org.apache.avro</groupId>
             <artifactId>avro</artifactId>
diff --git a/groot-examples/end-to-end-example/src/main/java/com/geedgenetworks/example/GrootStreamExample.java b/groot-examples/end-to-end-example/src/main/java/com/geedgenetworks/example/GrootStreamExample.java
index 0eba408..f435f59 100644
--- a/groot-examples/end-to-end-example/src/main/java/com/geedgenetworks/example/GrootStreamExample.java
+++ b/groot-examples/end-to-end-example/src/main/java/com/geedgenetworks/example/GrootStreamExample.java
@@ -13,7 +13,7 @@ import java.nio.file.Paths;
 
 public class GrootStreamExample {
     public static void main(String[] args) throws FileNotFoundException, URISyntaxException {
-        String configPath = args.length > 0 ? args[0] : "/examples/inline_to_print_with_aggregation.yaml";
+        String configPath = args.length > 0 ? args[0] : "/examples/inline_to_kafka.yaml";
         String configFile = getTestConfigFile(configPath);
         ExecuteCommandArgs executeCommandArgs = new ExecuteCommandArgs();
         executeCommandArgs.setConfigFile(configFile);
diff --git a/groot-examples/end-to-end-example/src/main/resources/examples/inline_to_kafka.yaml b/groot-examples/end-to-end-example/src/main/resources/examples/inline_to_kafka.yaml
index 517d29b..63159c5 100644
--- a/groot-examples/end-to-end-example/src/main/resources/examples/inline_to_kafka.yaml
+++ b/groot-examples/end-to-end-example/src/main/resources/examples/inline_to_kafka.yaml
@@ -46,7 +46,7 @@ sinks:
       kafka.compression.type: snappy
       kafka.security.protocol: SASL_PLAINTEXT
       kafka.sasl.mechanism: PLAIN
-      kafka.sasl.jaas.config: 454f65ea6eef1256e3067104f82730e737b68959560966b811e7ff364116b03124917eb2b0f3596f14733aa29ebad9352644ce1a5c85991c6f01ba8a5e8f177a80bea937958aaa485c2acc2b475603495a23eb59f055e037c0b186acb22886bd0275ca91f1633441d9943e7962942252
+      kafka.sasl.jaas.config: f76480be84a8ee1b009504c6c56a5bed48239c348a468f94b4029a6a3148f51530b025d6dfa140af93b4c7c6fe0e3dce543773e779d272b5579555fbd3271e7fdbee088673a901b3f3b28e914a25f30a4a859d97594c5ea7d7c1dcefe8c62560baea32b6da0b767232ed8aca17af2dc6
       format: json
       log.failures.only: true
 
@@ -64,7 +64,7 @@ sinks:
       kafka.compression.type: snappy
       kafka.security.protocol: SASL_PLAINTEXT
       kafka.sasl.mechanism: PLAIN
-      kafka.sasl.jaas.config: 454f65ea6eef1256e3067104f82730e737b68959560966b811e7ff364116b03124917eb2b0f3596f14733aa29ebad9352644ce1a5c85991c6f01ba8a5e8f177a7ff0b2d3889a424249967b3870b50993d9644f239f0de82cdb13bdb502959e16afadffa49ef1e1d2b9c9b5113e619817
+      kafka.sasl.jaas.config: f76480be84a8ee1b009504c6c56a5bed48239c348a468f94b4029a6a3148f51530b025d6dfa140af93b4c7c6fe0e3dce543773e779d272b5579555fbd3271e7fdbee088673a901b3f3b28e914a25f30a4a859d97594c5ea7d7c1dcefe8c62560baea32b6da0b767232ed8aca17af2dc6
       format: json
       log.failures.only: true
 
@@ -72,7 +72,7 @@ application:  # [object] Define job configuration
   env:
     name: example-inline-to-kafka
     parallelism: 3
-    shade.identifier: aes
+    shade.identifier: sm4
     pipeline:
       object-reuse: true
   topology:
diff --git a/pom.xml b/pom.xml
index 53bcf1f..73d45b8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -55,6 +55,7 @@
         <jsonpath.version>2.4.0</jsonpath.version>
         <fastjson2.version>2.0.32</fastjson2.version>
         <hutool.version>5.8.22</hutool.version>
+        <bouncycastle.version>1.78.1</bouncycastle.version>
         <galaxy.version>2.0.2</galaxy.version>
         <guava-retrying.version>2.0.0</guava-retrying.version>
         <ipaddress.version>5.3.3</ipaddress.version>
@@ -392,6 +393,12 @@
             </dependency>
 
             <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcprov-jdk18on</artifactId>
+                <version>${bouncycastle.version}</version>
+            </dependency>
+
+            <dependency>
                 <groupId>com.github.seancfoley</groupId>
                 <artifactId>ipaddress</artifactId>
                 <version>${ipaddress.version}</version>