1119问题修改

apq-pc-client/pom.xml

@@ -36,9 +36,17 @@
 
     </properties>
     <dependencies>
+        <!-- SpringBoot Web容器 -->
+        <!--web 模块 -->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>
+            <exclusions>
+                <exclusion>
+                    <artifactId>log4j-to-slf4j</artifactId>
+                    <groupId>org.apache.logging.log4j</groupId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.hibernate.validator</groupId>

apq-pc-client/src/main/java/com/priusis/client/service/PersistentFileServiceImpl.java

 package com.priusis.client.service;
 
+import cn.hutool.json.JSONUtil;
 import com.priusis.ApqClientApplication;
 import com.priusis.client.service.conf.PcPersistenceConfiguration;
+import com.priusis.dto.RegisterParamDto;
 import com.sun.jna.Platform;
 import lombok.extern.slf4j.Slf4j;
 
@@ -163,7 +165,8 @@ public class PersistentFileServiceImpl implements PersistentFileService {
     public File flushRpcDataToFile(MqttRpcDataMessage mqttRpcDataMessage) throws IOException {
         ObjectOutputStream outStream = null;
         try {
-            File newFile = new File(storageDir, STORAGE_FILE_PREFIX + mqttRpcDataMessage.getMethod());
+            String method = mqttRpcDataMessage.getMethod();
+            File newFile = new File(storageDir, STORAGE_FILE_PREFIX + method);
             outStream = new ObjectOutputStream(new FileOutputStream(newFile));
             outStream.writeObject(mqttRpcDataMessage);
             return newFile;

apq-pc-client/src/main/java/com/priusis/client/service/core/MqttServiceImpl.java

@@ -360,7 +360,7 @@ public class MqttServiceImpl implements MqttService, MqttHandler, MqttClientCall
             }
             if ("remote_control".equals(mqttRpcDataMessage.getMethod())) {// 远程控制请求
                 log.info("收到远程控制请求!!!");
-                if (vncServerIsRunning()) {
+                if (StrUtil.equals("RUNNING", remoteControlController.vncServerIsRunning())) {
                     log.warn("VNC Server 已在运行中，忽略此次请求");
                     return;
                 }
@@ -374,10 +374,15 @@ public class MqttServiceImpl implements MqttService, MqttHandler, MqttClientCall
             }
             if ("remote_control_accept".equals(mqttRpcDataMessage.getMethod())) {
                 log.info("远程控制请求接受!!! params: {}", mqttRpcDataMessage.getParams());
+                if (StrUtil.equals("RUNNING", remoteControlController.vncServerIsRunning())) {
+                    log.warn("VNC Server 已在运行中，忽略此次请求");
+                    return;
+                } else {
                     Long minutes = Convert.toLong(mqttRpcDataMessage.getParams());
                     remoteControlController.startVncServer(minutes);
                     return;
                 }
+            }
             if ("facility_scan".equals(mqttRpcDataMessage.getMethod())) {
                 log.info("收到平台扫描软件请求");
                 programController.addProgram2Platform();
@@ -391,19 +396,6 @@ public class MqttServiceImpl implements MqttService, MqttHandler, MqttClientCall
         }
     }
 
-    private static boolean vncServerIsRunning() throws IOException {
-        Process process = Runtime.getRuntime().exec("cmd /c sc query uvnc_service");
-        try (BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream(), "GBK"))) {
-            String line;
-            while ((line = reader.readLine()) != null) {
-                line = line.trim();
-                if (line.startsWith("STATE")) return line.endsWith("RUNNING");
-            }
-            process.destroy();
-        }
-        return false;
-    }
-
     private void onGatewayAttributesGet(String message) {
         log.info("Configuration arrived! {}", message);
         JsonNode payload = fromString(message);

apq-pc-client/src/main/java/com/priusis/client/util/ConfigurationTools.java

 package com.priusis.client.util;
 
-import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import lombok.extern.slf4j.Slf4j;
-import org.apache.tomcat.util.codec.binary.Base64;
 
-import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.security.*;
-import java.security.cert.X509Certificate;
 
 /**
  * Created by priusis on 16.01.17.
@@ -19,15 +14,6 @@ public class ConfigurationTools {
 
     private static final ObjectMapper mapper = new ObjectMapper();
 
-    public static <T> T readConfiguration(JsonNode configurationNode, Class<T> clazz) throws IOException {
-        try {
-            return mapper.treeToValue(configurationNode, clazz);
-        } catch (IOException e) {
-            log.error("Failed to load {} configuration from {}", clazz, configurationNode);
-            throw e;
-        }
-    }
-
     public static <T> T readFileConfiguration(String configurationFile, Class<T> clazz) throws IOException {
         try {
             return mapper.readValue(getFileAsStream(configurationFile), clazz);
@@ -37,35 +23,6 @@ public class ConfigurationTools {
         }
     }
 
-    public static CertificateInfo loadCertificate(KeystoreConfiguration configuration, Boolean isRemote) throws GeneralSecurityException, IOException {
-        try {
-            KeyStore keyStore = KeyStore.getInstance(configuration.getType());
-            if (isRemote) {
-                keyStore.load(getResourceAsStream(configuration.getFileContent()), configuration.getPassword().toCharArray());
-            } else {
-                keyStore.load(getFileAsStream(configuration.getLocation()), configuration.getPassword().toCharArray());
-            }
-
-            Key key = keyStore.getKey(configuration.getAlias(), configuration.getKeyPassword().toCharArray());
-            if (key instanceof PrivateKey) {
-                X509Certificate certificate = (X509Certificate) keyStore.getCertificate(configuration.getAlias());
-                PublicKey publicKey = certificate.getPublicKey();
-                KeyPair keyPair = new KeyPair(publicKey, (PrivateKey) key);
-                return new CertificateInfo(certificate, keyPair);
-            } else {
-                throw new GeneralSecurityException(configuration.getAlias() + " is not a private key!");
-            }
-        } catch (IOException | GeneralSecurityException e) {
-            log.error("Keystore configuration: [{}] is invalid!", configuration, e);
-            throw e;
-        }
-    }
-
-    private static InputStream getResourceAsStream(String fileContent) {
-        byte[] decoded = Base64.decodeBase64(fileContent);
-        return new ByteArrayInputStream(decoded);
-    }
-
     private static InputStream getFileAsStream(String configurationFile) {
         return ConfigurationTools.class.getClassLoader().getResourceAsStream(configurationFile);
     }

apq-pc-client/src/main/java/com/priusis/controller/ProgramController.java

@@ -241,8 +241,14 @@ public class ProgramController {
                 .stream().map(p -> p.get("name")).sorted().collect(Collectors.toList());
         // 扫描进程列表
         Set<String> processNames = new HashSet<>();
-        ///FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "USERNAME ne 暂缺"
-        Process process = Runtime.getRuntime().exec("cmd /c tasklist -fi " + '"' + "USERNAME ne NT AUTHORITY SYSTEM" + '"' + " -fi " + '"' + "USERNAME ne 暂缺" + '"' + " /fo csv");
+        Process process = Runtime.getRuntime().exec("cmd /c tasklist -fi " + '"' + "USERNAME ne NT AUTHORITY\\SYSTEM" + '"'
+                + " -fi " + '"' + "USERNAME ne NT AUTHORITY\\NETWORK SERVICE" + '"'
+                + " -fi " + '"' + "USERNAME ne NT AUTHORITY\\LOCAL SERVICE" + '"'
+                + " -fi " + '"' + "USERNAME ne Window Manager\\UMFD-0" + '"'
+                + " -fi " + '"' + "USERNAME ne Font Driver Host\\UMFD-1" + '"'
+                + " -fi " + '"' + "USERNAME ne Font Driver Host\\DWM-1" + '"'
+                + " -fi " + '"' + "USERNAME ne 暂缺" + '"'
+                + " /fo csv");
         try (BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream(), "GBK"))) {
             reader.readLine();
             String line;

apq-pc-client/src/main/java/com/priusis/controller/RemoteControlController.java

@@ -23,8 +23,10 @@ import org.springframework.web.bind.annotation.RestController;
 import javax.annotation.PostConstruct;
 import javax.annotation.Resource;
 import javax.validation.constraints.NotNull;
+import java.io.BufferedReader;
 import java.io.File;
 import java.io.IOException;
+import java.io.InputStreamReader;
 import java.util.Timer;
 import java.util.TimerTask;
 
@@ -81,11 +83,37 @@ public class RemoteControlController {
             throws IOException, ConfigParser.DuplicateSectionException, ConfigParser.NoSectionException, InterruptedException {
         Boolean hasRequest = Convert.toBool(SysConfigUtil.saveProperty("control.request", "0"), false);
         if (!hasRequest) return R.error("无远程请求");
+
+        if (StrUtil.equals("NO SERVICE", vncServerIsRunning())) {
+            return R.error("没有安装VNC服务，请先安装VNC程序!");
+        }
         return startVncServer(minutes);
     }
 
     private Timer timer = new Timer();
 
+    public String vncServerIsRunning() throws IOException {
+        Process process = Runtime.getRuntime().exec("cmd /c sc query uvnc_service");
+        try (BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream(), "GBK"))) {
+            String line;
+            while ((line = reader.readLine()) != null) {
+                line = line.trim();
+                if (line.startsWith("STATE")) {
+                    if (line.endsWith("RUNNING")) {
+                        return "RUNNING";
+                    } else {
+                        return "STOPPED";
+                    }
+                }
+                if (line.startsWith("指定的服务未安装")) {
+                    return "NO SERVICE";
+                }
+            }
+            process.destroy();
+        }
+        return "STOPPED";
+    }
+
     public synchronized R<Void> startVncServer(long minutes)
             throws IOException, ConfigParser.DuplicateSectionException, ConfigParser.NoSectionException, InterruptedException {
         // 查询设备的远程ID
@@ -138,7 +166,11 @@ public class RemoteControlController {
     }
 
     @GetMapping(value = "send_request")
-    public R<Void> sendRequest(@RequestParam @NotNull Long minutes) {
+    public R<Void> sendRequest(@RequestParam @NotNull Long minutes) throws IOException {
+        if (StrUtil.equals("NO SERVICE", vncServerIsRunning())) {
+            return R.error("没有安装VNC服务，请先安装VNC程序!");
+        }
+
         JSONObject rsp = JSONUtil.parseObj(HttpUtil.post(gateway + sendControlReqUrl,
                 JSONUtil.createObj().set("controlDate", minutes)
                         .set("macAddress", MacAddrUtil.get())

apq-pc-common/src/main/java/com/priusis/job/ApqRegister4BackListJob.java

+package com.priusis.job;
+
+import cn.hutool.core.util.StrUtil;
+import cn.hutool.json.JSONUtil;
+import com.priusis.dto.RegisterParamDto;
+import com.priusis.utils.WinExecuteUtils;
+import com.priusis.vo.MqttRpcDataMessage;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
+import org.springframework.http.ResponseEntity;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Component;
+import org.springframework.web.client.RestClientException;
+import org.springframework.web.client.RestTemplate;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+@Slf4j
+@Component
+@ConditionalOnExpression("'${apq.job.type:null}'=='all' || '${apq.job.type:null}'=='register'")
+public class ApqRegister4BackListJob {
+
+    // "params":
+    // {
+    //    "type":1
+    //    "programs": [
+    //      {
+    //          "name":"qq"
+    //      }
+    //    ]
+    // }
+    @Autowired
+    private RestTemplate restTemplate;
+
+    @Scheduled(fixedDelay = 30000L)
+    protected void registerProgramTask() {
+        log.info("软件检测上报=================");
+
+/*      try {
+            WinExecuteUtils.killProc("TIM.exe");
+        } catch (IOException e) {
+            log.error("杀进程异常", e);
+        }*/
+
+        // 获取软件检测监控配置 params == data
+        ResponseEntity<MqttRpcDataMessage> forEntity = null;
+        try {
+            forEntity = restTemplate.getForEntity("http://localhost:8765/rpc_cmd/BlackList", MqttRpcDataMessage.class);
+        } catch (RestClientException e) {
+            log.error("软件检测上报异常", e.getMessage());
+        }
+        if (null != forEntity) {
+            MqttRpcDataMessage body = forEntity.getBody();
+            String params = body.getParams();
+
+            if (StrUtil.isNotBlank(params)) {
+                Long sendTime = body.getSendTime();
+                //long current = System.currentTimeMillis();
+                RegisterParamDto registerParamDto = JSONUtil.toBean(params, RegisterParamDto.class);
+
+                // 收到软件检测下发请求
+                log.info("收到软件检测下发请求, sendTime:{}, params:{}", sendTime, params);
+
+                List<RegisterParamDto.RegisterDetailParamDto> programs = registerParamDto.getPrograms();
+                // 上报软件检测监控数据
+                List<String> mapSoftRequest = null;
+                log.info("收到软件检测黑名单");
+                for (RegisterParamDto.RegisterDetailParamDto program : programs) {
+                    String name = program.getName().trim();
+
+                    log.info("软件检测软件: {}", name);
+                    boolean isE = WinExecuteUtils.findProcess(name);
+                    if (isE) {
+                        // 杀进程
+                        log.info("存在黑名单软件， 进行进程查杀: {}", name);
+                        try {
+                            WinExecuteUtils.killProc(name);
+                        } catch (Exception e) {
+                            log.error("杀进程异常", e);
+                        }
+                        // 上报黑名单异常
+                        mapSoftRequest.add(name);
+                    }
+                }
+
+                // 上报黑白名单异常
+                if (null != mapSoftRequest && mapSoftRequest.size() > 0) {
+                    Map eventMapRequest = new HashMap();
+                    Map mapRequest = new HashMap();
+                    eventMapRequest.put("requestId", 2);
+                    //eventMapRequest.put("methodName", type == 1 ? "BlackList" : "WhiteList");  // BlackList  WriteList
+                    eventMapRequest.put("methodName", "BlackList");  // BlackList  WriteList
+                    eventMapRequest.put("params", mapRequest);
+
+                    for (String mapSoftRequestData : mapSoftRequest) {
+                        mapRequest.put("wbl", mapSoftRequestData);
+                        Map map = restTemplate.postForObject("http://localhost:8765/uplink_event/oc-client", eventMapRequest, Map.class);
+                        log.info("存在软件检测接口扫码告警，上报告警事件: mapData:{}, ret:{}", mapRequest, map);
+                    }
+
+                }
+            } else {
+                log.info("未获取到获取软件检测监控配置");
+            }
+        } else {
+            log.info("未获取到获取软件检测监控配置");
+        }
+    }
+
+
+    public static void main(String[] args) {
+        try {
+            WinExecuteUtils.killProc("Xshell.exe");
+        } catch (IOException e) {
+            log.error("杀进程异常", e);
+        }
+    }
+}

apq-pc-common/src/main/java/com/priusis/job/ApqRegisterJob.java → apq-pc-common/src/main/java/com/priusis/job/ApqRegister4WhiteListJob.java

 package com.priusis.job;
 
+import cn.hutool.core.collection.ListUtil;
 import cn.hutool.core.util.StrUtil;
 import cn.hutool.json.JSONUtil;
 import com.priusis.dto.RegisterParamDto;
@@ -22,7 +23,7 @@ import java.util.*;
 @Slf4j
 @Component
 @ConditionalOnExpression("'${apq.job.type:null}'=='all' || '${apq.job.type:null}'=='register'")
-public class ApqRegisterJob {
+public class ApqRegister4WhiteListJob {
 
     // "params":
     // {
@@ -34,6 +35,38 @@ public class ApqRegisterJob {
     //    ]
     // }
 
+    private List<String> excludePrograms = ListUtil.of("svchost.exe", "explorer.exe", "dwm.exe"
+            , "apq-client.exe"
+            , "alg.exe"
+            , "csrss.exe"
+            , "ctfmon.exe"
+            , "lsass.exe"
+            , "nvvsvc.exe"
+            , "services.exe"
+            , "smss.exe"
+            , "winlogon.exe"
+            , "mstask.exe"
+            , "winmgmt.exe"
+            , "conhost.exe"
+            , "sihost.exe"
+            , "dllhost.exe"
+            , "smartscreen.exe"
+            , "SearchUI.exe"
+            , "igfxEM.exe"
+            , "Taskmgr.exe"
+            , "fontdrvhost.exe"
+            , "wscript.exe"
+            , "taskhostw.exe"
+            , "StartMenuExperienceHost.exe"
+            , "ShellExperienceHost.exe"
+            , "SettingSyncHost.exe"
+            , "RuntimeBroker.exe"
+            , "igfxext.exe"
+            , "ApplicationFrameHost.exe"
+            , "LockApp.exe"
+            , "Microsoft.Photos.exe"
+    );
+
     @Autowired
     private RestTemplate restTemplate;
 
@@ -50,7 +83,7 @@ public class ApqRegisterJob {
         // 获取软件检测监控配置 params == data
         ResponseEntity<MqttRpcDataMessage> forEntity = null;
         try {
-            forEntity = restTemplate.getForEntity("http://localhost:8765/rpc_cmd/register", MqttRpcDataMessage.class);
+            forEntity = restTemplate.getForEntity("http://localhost:8765/rpc_cmd/WhiteList", MqttRpcDataMessage.class);
         } catch (RestClientException e) {
             log.error("软件检测上报异常", e.getMessage());
         }
@@ -70,33 +103,20 @@ public class ApqRegisterJob {
                 List<RegisterParamDto.RegisterDetailParamDto> programs = registerParamDto.getPrograms();
                 // 上报软件检测监控数据
                 List<String> mapSoftRequest = null;
-                if (type == 1) {
-                    log.info("收到软件检测黑名单");
-                    for (RegisterParamDto.RegisterDetailParamDto program : programs) {
-                        String name = program.getName().trim();
-
-                        log.info("软件检测软件: {}", name);
-                        boolean isE = WinExecuteUtils.findProcess(name);
-                        if (isE) {
-                            // 杀进程
-                            log.info("存在黑名单软件， 进行进程查杀: {}", name);
-                            try {
-                                WinExecuteUtils.killProc(name);
-                            } catch (Exception e) {
-                                log.error("杀进程异常", e);
-                            }
-                            // 上报黑名单异常
-                            mapSoftRequest.add(name);
-                        }
-                    }
-                } else {
                 log.info("收到软件检测白名单");
                 try {
                     // 扫描进程列表
                     Set<String> processNames = new HashSet<>();
                     Set<String> killProcessNames = new HashSet<>();
                     ///FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "USERNAME ne 暂缺"
-                        Process process = Runtime.getRuntime().exec("cmd /c tasklist -fi " + '"' + "USERNAME ne NT AUTHORITY\\SYSTEM" + '"' + " -fi " + '"' + "USERNAME ne 暂缺" + '"' + " /fo csv");
+                    Process process = Runtime.getRuntime().exec("cmd /c tasklist -fi " + '"' + "USERNAME ne NT AUTHORITY\\SYSTEM" + '"'
+                            + " -fi " + '"' + "USERNAME ne NT AUTHORITY\\NETWORK SERVICE" + '"'
+                            + " -fi " + '"' + "USERNAME ne NT AUTHORITY\\LOCAL SERVICE" + '"'
+                            + " -fi " + '"' + "USERNAME ne Window Manager\\UMFD-0" + '"'
+                            + " -fi " + '"' + "USERNAME ne Font Driver Host\\UMFD-1" + '"'
+                            + " -fi " + '"' + "USERNAME ne Font Driver Host\\DWM-1" + '"'
+                            + " -fi " + '"' + "USERNAME ne 暂缺" + '"'
+                            + " /fo csv");
                     try (BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream(), "GBK"))) {
                         reader.readLine();
                         String line;
@@ -106,16 +126,18 @@ public class ApqRegisterJob {
                     }
 
                     for (String processName : processNames) {
+                        if (excludePrograms.contains(processName)) {
+                            continue;
+                        }
                         boolean isContains = false;
                         for (RegisterParamDto.RegisterDetailParamDto program : programs) {
                             String name = program.getName().trim();
-                                if (processNames.contains(name)) {
+                            if (StrUtil.equals(processName, name)) {
                                 isContains = true;
                                 break;
                             }
                         }
                         if (!isContains) {
-                                // 上报白名单异常
                             killProcessNames.add(processName);
                         }
                     }
@@ -126,7 +148,7 @@ public class ApqRegisterJob {
                             boolean isE = WinExecuteUtils.findProcess(name);
                             if (isE) {
                                 // 杀进程
-                                    log.info("存在黑名单软件， 进行进程查杀: {}", name);
+                                log.info("存在白名单软件， 进行进程查杀: {}", name);
                                 try {
                                     WinExecuteUtils.killProc(name);
                                 } catch (Exception e) {
@@ -141,14 +163,13 @@ public class ApqRegisterJob {
                 } catch (IOException e) {
                     log.error("软件检测上报异常", e.getMessage());
                 }
-                }
 
                 // 上报黑白名单异常
-                if (mapSoftRequest.size() > 0) {
+                if (null != mapSoftRequest && mapSoftRequest.size() > 0) {
                     Map eventMapRequest = new HashMap();
                     Map mapRequest = new HashMap();
-                    eventMapRequest.put("requestId", 2);
-                    eventMapRequest.put("methodName", type == 1 ? "BlackList" : "WhiteList");  // BlackList  WriteList
+                    eventMapRequest.put("requestId", 22);
+                    eventMapRequest.put("methodName", "WhiteList");  // BlackList  WriteList
                     eventMapRequest.put("params", mapRequest);
 
                     for (String mapSoftRequestData : mapSoftRequest) {
@@ -166,12 +187,4 @@ public class ApqRegisterJob {
         }
     }
 
-
-    public static void main(String[] args) {
-        try {
-            WinExecuteUtils.killProc("Xshell.exe");
-        } catch (IOException e) {
-            log.error("杀进程异常", e);
-        }
-    }
 }

tools/install-package/client/x32/client-soft/LICENSE.electron.txt

-Copyright (c) Electron contributors
-Copyright (c) 2013-2020 GitHub Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.