Z991239-958 #comment 合并联调之后的KMC改造的代码

Module/mod_Initializer/InitializerConn.cpp

@@ -664,6 +664,15 @@ DWORD CInitializerConn::HandleInitMKRet(const CSmartPointer<IPackage> &pRecvPkg)
 			LogWarn(Severity_Middle, (ErrorCodeEnum)rc, ERR_INITIALIZER_LOAD_KEYS_TO_PINPAD,
 				GetOutPutStr("%s%08X%s%s", "LoadKeysToPinPad", rc, "strRetErrMsg", strRetErrMsg).c_str());
 		}
+		if (rc != Error_Succeed) {
+			Dbg("%s", strRetErrMsg.GetData());
+			//当为国密改造之后的第一次准入，直接认为初始化成功
+			//因为自动初始化时，pinpad有可能没有准备好，但是初始化不能中断，只打日志，不上报错误
+			if (pEntity->m_afterSMIsFirst) {
+				Dbg("国密改造之后的第一次准入");
+				rc = Error_Succeed;
+			}
+		}
 	}
 
 	if (!pEntity->GetOrSetIsFirstSM(1)) {
@@ -750,9 +759,11 @@ DWORD CInitializerConn::HandleGetKMCKey(const CSmartPointer<IPackage>& pRecvPkg)
 			pEntity->m_TMK = ret->TMK;
 			pEntity->m_TPK = ret->TPK;
 			pEntity->m_EDK = ret->EDK;
+			pEntity->m_index = ret->Index;
 			Dbg("TMK=%s", pEntity->m_TMK.c_str());
 			Dbg("TPK=%s", pEntity->m_TPK.c_str());
 			Dbg("EDK=%s", pEntity->m_EDK.c_str());
+			Dbg("Index=%s", pEntity->m_index.c_str());
 		}
 	}
 	

Module/mod_Initializer/InitializerConn.h

@@ -78,6 +78,7 @@ struct KMCKeyRet {
 	char TMK[64];
 	char TPK[64];
 	char EDK[64];
+	char Index[8];
 	char Reserved[256];
 };
 

Module/mod_Initializer/mod_Initializer.cpp

@@ -744,6 +744,7 @@ DWORD CInitializerEntity::LoadKeysToPinPad(bool bSM)
 			req.masterkey = m_TMK.c_str();
 			req.workingkey1 = m_TPK.c_str();
 			req.workingkey2 = m_EDK.c_str();
+			req.reserved3 = m_index.c_str();
 		}
 		else {
 			LogWarn(Severity_Middle, Error_Unexpect, ERR_INITIALIZER_GET_KMC_KEY_NULL,

Module/mod_Initializer/mod_Initializer.h

@@ -188,6 +188,7 @@ public:
 	string m_TMK;
 	string m_TPK;
 	string m_EDK;
+	string m_index;
 	bool m_bGetKMCKey;
 private:
 	bool IsServiceAvailable(const char *pszServiceAddr, int nServerPort);

Module/mod_accessauth/AccessAuthConn.cpp

@@ -6,6 +6,7 @@
 #pragma comment(lib, "crypt32.lib")
 #include <windows.h>
 #include <Wincrypt.h>
+#include "MyBase64.h"
 #define MY_ENCODING_TYPE  (PKCS_7_ASN_ENCODING | X509_ASN_ENCODING)
 
 CAccessAuthConn::CAccessAuthConn(CEntityBase *pEntity, CAccessAuthFSM *pFSM)
@@ -24,8 +25,10 @@ void CAccessAuthConn::OnDisconnect()
 
 void CAccessAuthConn::OnPkgAnswer(const CSmartPointer<IPackage> &pRecvPkg)
 {
+	LOG_FUNCTION();
 	string serviceCode = pRecvPkg->GetServiceCode();
-	if (serviceCode == "UpdateWK")
+	Dbg("serviceCode=%s",serviceCode.c_str());
+	if (serviceCode == "KMCKey")
 	{
 		HandleUpdateWKRet(pRecvPkg);
 	}
@@ -65,6 +68,9 @@ void CAccessAuthConn::OnPkgAnswer(const CSmartPointer<IPackage> &pRecvPkg)
 	{
 		HandleUpdateMD5Ret(pRecvPkg);
 	}
+	else if (serviceCode == "KMCKey") {
+		HandleUpdateWKRet(pRecvPkg);
+	}
 	else
 	{
 		//Dbg("unknown service code: %s", serviceCode.c_str());
@@ -74,16 +80,17 @@ void CAccessAuthConn::OnPkgAnswer(const CSmartPointer<IPackage> &pRecvPkg)
 	}
 }
 
-ErrorCodeEnum CAccessAuthConn::HandleUpdateWKRet(const CSmartPointer<IPackage> &pRecvPkg)
+DWORD CAccessAuthConn::HandleUpdateWKRet(const CSmartPointer<IPackage> &pRecvPkg)
 {
-	ErrorCodeEnum rc = Error_Unexpect;
+	/*
+	LOG_FUNCTION();
+	DWORD rc = Error_Unexpect;
 	DWORD dwSysCode, dwUserCode;
 	string strErrMsg;
 	if (pRecvPkg->GetErrMsg(dwSysCode, dwUserCode, strErrMsg))
 	{
-		rc = (ErrorCodeEnum)dwSysCode;
-		//LogError(Severity_Middle, rc, dwUserCode, strErrMsg.c_str());
-		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_UPDATE_WK, 
+		rc = dwSysCode;
+		LogWarn(Severity_Middle, Error_Unexpect, rc, 
 			GetOutPutStr("%s%08x%s%s","GetErrMsg",rc,"strErrMsg", strErrMsg).c_str());
 	}
 	else
@@ -99,14 +106,14 @@ ErrorCodeEnum CAccessAuthConn::HandleUpdateWKRet(const CSmartPointer<IPackage> &
 			int nArrayNum(0);
 			pRecvPkg->GetStructData("WKU_RET", pBuf, &nRetLen, &nArrayNum);
 
-			// 调用KMC解析返回
+			// 锟斤拷锟斤拷KMC锟斤拷锟斤拷锟斤拷锟斤拷
 			Dbg("parse des key update result");
 			rc = pEntity->ParseWKUpdateResult((char*)pBuf, nRetLen, 1);
 			delete[] pBuf;
 
 			if (rc == Error_Succeed)
 			{
-				// 加载WK到PinPad中
+				// 锟斤拷锟斤拷WK锟斤拷PinPad锟斤拷
 				Dbg("load des key to pinpad");
 				rc = ((CAccessAuthEntity*)m_pEntity)->LoadPinPadWK(false);
 			}
@@ -121,38 +128,83 @@ ErrorCodeEnum CAccessAuthConn::HandleUpdateWKRet(const CSmartPointer<IPackage> &
 			int nArrayNum(0);
 			pRecvPkg->GetStructData("SMWKU_RT", pBuf, &nRetLen, &nArrayNum);
 
-			// 调用KMC解析返回
+			// 锟斤拷锟斤拷KMC锟斤拷锟斤拷锟斤拷锟斤拷
 			Dbg("parse sm key update result");
 			rc = pEntity->ParseWKUpdateResult((char*)pBuf, nRetLen, 2);
 			delete[] pBuf;
 
 			if (rc == Error_Succeed)
 			{
-				// 加载WK到PinPad中
+				// 锟斤拷锟斤拷WK锟斤拷PinPad锟斤拷
 				Dbg("load sm key to pinpad");
 				rc = ((CAccessAuthEntity*)m_pEntity)->LoadPinPadWK(true);
 			}
 		}		
 	}
 
-	m_pFSM->PostEventFIFO(new FSMEvent(rc == Error_Succeed? CAccessAuthFSM::Event_UpdateWKSucc:CAccessAuthFSM::Event_UpdateWKFail));	
+	m_pFSM->PostEventFIFO(new FSMEvent(rc == Error_Succeed? CAccessAuthFSM::Event_UpdateWKSucc:CAccessAuthFSM::Event_UpdateWKFail));
+	*/
+
+	LOG_FUNCTION();
+	DWORD rc = Error_Succeed;
+	DWORD dwSysCode, dwUserCode;
+	string strErrMsg;
+	auto pEntity = (CAccessAuthEntity*)m_pEntity;
+	if (pRecvPkg->GetErrMsg(dwSysCode, dwUserCode, strErrMsg))
+	{
+		rc = dwUserCode;
+		LogWarn(Severity_Middle, (ErrorCodeEnum)dwSysCode, dwUserCode,
+			GetOutPutStr("%s%08X%s%s", "GetErrMsg", rc,"strErrMsg", strErrMsg.c_str()).c_str());
+		
+	}
+	else
+	{
+		int nLen = pRecvPkg->GetStructLen("KMCKeyRet");
+		if (nLen <= 0)
+		{
+			
+			Dbg("KMCKeyRet返回数据为空。");
+			pEntity->m_bGetKMCKey = false;
+			rc = ERR_INITIALIZER_GET_KMC_KEY_NULL;
+		}
+		else
+		{
+			pEntity->m_bGetKMCKey = true;
+			BYTE* pBuf = new BYTE[nLen];
+			memset(pBuf, 0, nLen);
+			int nArrayNum = 0;
+			bool bSuc = pRecvPkg->GetStructData("KMCKeyRet", (BYTE*)pBuf, &nLen, &nArrayNum);
+			assert(bSuc);
+			assert(nLen % sizeof(KMCKeyRet) == 0);
+			KMCKeyRet* ret = (KMCKeyRet*)pBuf;
+			pEntity->m_TMK = ret->TMK;
+			pEntity->m_TPK = ret->TPK;
+			pEntity->m_EDK = ret->EDK;
+			pEntity->m_index = ret->Index;
+			Dbg("TMK=%s", pEntity->m_TMK.c_str());
+			Dbg("TPK=%s", pEntity->m_TPK.c_str());
+			Dbg("EDK=%s", pEntity->m_EDK.c_str());
+			Dbg("Index=%s", pEntity->m_index.c_str());
+			rc = pEntity->LoadPinPadWK(true);
+		}
+	}
+	m_pFSM->PostEventFIFO(new FSMEvent(rc == Error_Succeed ? CAccessAuthFSM::Event_UpdateWKSucc : CAccessAuthFSM::Event_UpdateWKFail));
 	return rc;
 }
 
-ErrorCodeEnum CAccessAuthConn::HandleReqTokenRet(const CSmartPointer<IPackage> &pRecvPkg)
+DWORD CAccessAuthConn::HandleReqTokenRet(const CSmartPointer<IPackage> &pRecvPkg)
 {
 	DWORD dwSysCode, dwUserCode;
 	string strErrMsg;
-	ErrorCodeEnum rc = Error_Succeed;
+	DWORD rc = Error_Succeed;
 	CSmartPointer<IEntityFunction> spFunction = m_pEntity->GetFunction();
 
 	if (pRecvPkg->GetErrMsg(dwSysCode, dwUserCode, strErrMsg))
 	{
-		rc = (ErrorCodeEnum)dwSysCode;
-		//LogError(Severity_Middle, (ErrorCodeEnum)dwSysCode, dwUserCode, strErrMsg.c_str());	
+		rc = dwUserCode;
 		((CAccessAuthEntity*)m_pEntity)->SetAuthErrMsg(strErrMsg.c_str());
 		spFunction->SetSysVar("AuthErrMsg", strErrMsg.c_str(), true);	
-		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_TOKEN,
+		LogWarn(Severity_Middle, Error_Unexpect, rc,
 			GetOutPutStr("%s%s%s%08X", "GetErrMsg", "False", "dwSysCode", rc).c_str());
 	}
 	else
@@ -160,24 +212,38 @@ ErrorCodeEnum CAccessAuthConn::HandleReqTokenRet(const CSmartPointer<IPackage> &
 		int nRetLen = pRecvPkg->GetStructLen("TOKEN_RT");
 		if (nRetLen >0)
 		{
+			((CAccessAuthEntity*)m_pEntity)->GetOrSetIsFirstSM(1);
 			assert(nRetLen == sizeof(RequestTokenRet));
 			RequestTokenRet ret;
 			memset(&ret, 0, sizeof(ret));
+			RequestTokenRet2 ret2;
+			memset(&ret2, 0, sizeof(ret2));
 
 			int nArrayNum(0);
+			int nArrayNum2(0);
 			int nBufLen = sizeof(ret);
+			int nBufLen2 = sizeof(ret2);
 			pRecvPkg->GetStructData("TOKEN_RT", (BYTE*)&ret, &nBufLen, &nArrayNum);
-
+			pRecvPkg->GetStructData("TOKEN_RET2", (BYTE*)&ret2, &nBufLen2, &nArrayNum2);
 			// 生成Hash
-			BYTE md5[16];
+			/*BYTE md5[16];
 			memset(md5, 0, 16);
 			MD5Hash((BYTE*)&ret, 256 + 16, md5);
 			DWORD dwHash = ((DWORD)md5[0]) << 24 | ((DWORD)md5[1]) << 16 | ((DWORD)md5[2]) << 8 | ((DWORD)md5[3]);
-			DWORD dwHash2 = ((DWORD)ret.retHash[0]) << 24 | ((DWORD)ret.retHash[1]) << 16 | ((DWORD)ret.retHash[2]) << 8 | ((DWORD)ret.retHash[3]);
-			if (dwHash != dwHash2)
+			DWORD dwHash2 = ((DWORD)ret.retHash[0]) << 24 | ((DWORD)ret.retHash[1]) << 16 | ((DWORD)ret.retHash[2]) << 8 | ((DWORD)ret.retHash[3]);*/
+			BYTE enToken[512 + 16] = { 0 };
+			memcpy(enToken, ret.enToken, 256);
+			memcpy(enToken + 256, ret2.enToken, 256);
+			memcpy(enToken + 512, ret.sharedSK, 16);
+			BYTE sm3[32] = { 0 };
+			if (!SM3Hash(enToken,512 + 16,sm3)) {
+				Dbg("SM3 Hash error at Token Ret.");
+			}
+			
+			if (memcmp(sm3, ret2.retHash, 32) != 0)
 			{
 				rc = Error_Bug;
-				//LogError(Severity_Low, rc, 0, "返回令牌校验不通过");
+				
 				((CAccessAuthEntity*)m_pEntity)->SetAuthErrMsg("返回令牌校验不通过");
 				spFunction->SetSysVar("AuthErrMsg", "返回令牌校验不通过", true);	
 
@@ -187,9 +253,10 @@ ErrorCodeEnum CAccessAuthConn::HandleReqTokenRet(const CSmartPointer<IPackage> &
 			else
 			{
 				// 保存令牌和共享会话密钥到令牌管理实体
+				//跟良瑜那边确定使用512的长度
 				CBlob token;
-				token.Alloc(256);
-				memcpy(token.m_pData, ret.enToken, 256);
+				token.Alloc(512);
+				memcpy(token.m_pData, enToken, 512);
 
 				CBlob sharedSK;
 				sharedSK.Alloc(16);
@@ -199,8 +266,8 @@ ErrorCodeEnum CAccessAuthConn::HandleReqTokenRet(const CSmartPointer<IPackage> &
 				{
 					((CAccessAuthEntity*)m_pEntity)->SetAuthErrMsg("保存令牌失败");
 					spFunction->SetSysVar("AuthErrMsg", "保存令牌失败", true);
-					//LogError(Severity_Low, rc, 0, "保存令牌失败");
-					LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_TOKEN,
+			
+					LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_SAVE_TOKEN,
 						GetOutPutStr("%s%08X", "SaveTokenAndSharedSK", rc).c_str());
 				}				
 			}
@@ -210,7 +277,6 @@ ErrorCodeEnum CAccessAuthConn::HandleReqTokenRet(const CSmartPointer<IPackage> &
 			rc = Error_Bug;
 			((CAccessAuthEntity*)m_pEntity)->SetAuthErrMsg("返回令牌数据非法");			
 			spFunction->SetSysVar("AuthErrMsg", "返回令牌数据非法", true);
-			//LogError(Severity_Low, rc, 0, "返回令牌数据非法");
 			LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_TOKEN,
 				GetOutPutStr("%s%d", "nRetLen", nRetLen).c_str());
 		}
@@ -220,7 +286,7 @@ ErrorCodeEnum CAccessAuthConn::HandleReqTokenRet(const CSmartPointer<IPackage> &
 	return rc;
 }
 
-ErrorCodeEnum CAccessAuthConn::HandleTermExitRet(const CSmartPointer<IPackage> &pRecvPkg)
+DWORD CAccessAuthConn::HandleTermExitRet(const CSmartPointer<IPackage> &pRecvPkg)
 {
 	DWORD dwSysCode, dwUserCode;
 	string strErrMsg;
@@ -228,7 +294,7 @@ ErrorCodeEnum CAccessAuthConn::HandleTermExitRet(const CSmartPointer<IPackage> &
 	if (pRecvPkg->GetErrMsg(dwSysCode, dwUserCode, strErrMsg))
 	{
 		rc = (ErrorCodeEnum)dwSysCode;
-		//LogError(Severity_Middle, rc, dwUserCode, strErrMsg.c_str());
+
 		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_TERM_EXIT,
 			GetOutPutStr("%s%08X%s%s", "GetErrMsg", dwSysCode, "strErrMsg", strErrMsg.c_str()).c_str());
 		return rc;
@@ -237,7 +303,7 @@ ErrorCodeEnum CAccessAuthConn::HandleTermExitRet(const CSmartPointer<IPackage> &
 	return rc;
 }
 
-ErrorCodeEnum CAccessAuthConn::HandleReportStageRet(const CSmartPointer<IPackage> &pRecvPkg)
+DWORD CAccessAuthConn::HandleReportStageRet(const CSmartPointer<IPackage> &pRecvPkg)
 {
 	DWORD dwSysCode, dwUserCode;
 	string strErrMsg;
@@ -254,16 +320,18 @@ ErrorCodeEnum CAccessAuthConn::HandleReportStageRet(const CSmartPointer<IPackage
 	return rc;
 }
 
-ErrorCodeEnum CAccessAuthConn::SendWKUpdatePackage()
+DWORD CAccessAuthConn::SendWKUpdatePackage()
 {
+	/*
 	assert(IsConnectionOK());
 	auto pEntity = (CAccessAuthEntity*)m_pEntity;
 
 	CSystemStaticInfo si;
 	pEntity->GetFunction()->GetSystemStaticInfo(si);
 
+	
 	CSmartPointer<IPackage> package = CreateNewPackage("UpdateWK");
-
+	
 	// 1:3des only; 2: sm4 only; 3: both 3des and sm4
 	int nCapability = pEntity->GetPinPadCapability();
 	if (nCapability == 1 || nCapability == 3)
@@ -303,16 +371,31 @@ ErrorCodeEnum CAccessAuthConn::SendWKUpdatePackage()
 
 		package->AddStruct("SMWKU_RQ", false, false, (BYTE*)buf, sizeof(SMWKUpdateReq)+nBufLen);
 	}
-
+	
+	return SendPackage(package) != "" ? Error_Succeed : Error_Unexpect;
+	*/
+	LOG_FUNCTION();
+	assert(IsConnectionOK());
+	KMCKeyReq req;
+	memset(req.TerminalNo,0,sizeof(req.TerminalNo));
+	CSystemStaticInfo si;
+	auto pEntity = (CAccessAuthEntity*)m_pEntity;
+	pEntity->GetFunction()->GetSystemStaticInfo(si);
+	strcpy(req.TerminalNo, si.strTerminalID.GetData());
+	//req.TerminalNo = TerminalNo;
+	CSmartPointer<IEntityFunction> pFunc = m_pEntity->GetFunction();
+	CSmartPointer<IPackage> package = CreateNewPackage("KMCKey");
+	package->AddStruct("KMCKeyReq", false, false, (BYTE*)& req, sizeof(req));
 	return SendPackage(package) != "" ? Error_Succeed : Error_Unexpect;
 }
 
-ErrorCodeEnum CAccessAuthConn::SendGetTokenPackage()
+DWORD CAccessAuthConn::SendGetTokenPackage()
 {
+	LOG_FUNCTION();
 	assert(IsConnectionOK());
 
 	CSmartPointer<IEntityFunction> spFunction = m_pEntity->GetFunction();	
-
+	CSmartPointer<IPackage> package = CreateNewPackage("ReqToken");
 	// 获取外设及PinPadID
 	CSimpleStringA strPinPadID = "", strDeviceID = "";
 	int nRet = ((CAccessAuthEntity*)m_pEntity)->GetPinPadIDAndDeviceID(strPinPadID, strDeviceID);
@@ -327,12 +410,14 @@ ErrorCodeEnum CAccessAuthConn::SendGetTokenPackage()
 	// 生成临时RSA密钥对
 	CBlob pubKey;
 	CBlob priKey;
-	ErrorCodeEnum rc = ((CAccessAuthEntity*)m_pEntity)->CreateRsaKeyPair(pubKey, priKey);
+	char* smVer = GetSMVersion();
+	Dbg("sm vetsion=%s",smVer);
+	DWORD rc = ((CAccessAuthEntity*)m_pEntity)->CreateSM2KeyPair(pubKey, priKey);
 	if (rc != Error_Succeed)
 		return rc;
 
 	// 保存到令牌管理实体中
-	rc = ((CAccessAuthEntity*)m_pEntity)->SaveRsaKeyPair(pubKey, priKey);
+	rc = ((CAccessAuthEntity*)m_pEntity)->SaveSM2KeyPair(pubKey, priKey);
 	if (rc != Error_Succeed)
 		return rc;
 
@@ -349,8 +434,20 @@ ErrorCodeEnum CAccessAuthConn::SendGetTokenPackage()
 	strncpy(&req1.szTerminalNo[0], (const char*)si.strTerminalID, sizeof(req1.szTerminalNo)-1);
 
 	// 拷贝临时公钥
-	memcpy_s(&req1.tpk[0], sizeof(req1.tpk), pubKey.m_pData, pubKey.m_iLength);
-
+	memset(req1.tpk,0,sizeof(req1.tpk));
+	if (pubKey.m_iLength > 70 ) {
+		Dbg("临时公钥长度(%d)大于70。。。", pubKey.m_iLength);
+		return Error_TooSmallBuffer;
+	}
+	memcpy_s(&req1.tpk[0], sizeof(req1.tpk) - 70, pubKey.m_pData, pubKey.m_iLength);
+	//memcpy(req1.tpk, pubKey.m_pData , pubKey.m_iLength);
+	// 拷贝临时私钥
+	if (priKey.m_iLength > 70) {
+		Dbg("临时私钥长度(%d)大于70。。。", priKey.m_iLength);
+		return Error_TooSmallBuffer;
+	}
+	memcpy_s(&req1.tpk[70], sizeof(req1.tpk) - 70 , priKey.m_pData,priKey.m_iLength);
+	//memcpy(req1.tpk + 70, priKey.m_pData, priKey.m_iLength);
 	// 获取设备信息
 	BYTE *pBuf = (BYTE*)&req1.encTerminalInfo;
 
@@ -412,10 +509,9 @@ ErrorCodeEnum CAccessAuthConn::SendGetTokenPackage()
 	rc = m_pEntity->GetFunction()->GetSysVar("TerminalStage", ts);
 	if (rc != Error_Succeed)
 	{
-		//LogError(Severity_Middle, rc, ERROR_ACCESSAUTH_GETSYSVAR, "GetSysVar(\"TerminalStage\") fail");
 		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_GET_SYS_VAR,
 			GetOutPutStr("%s%08X%s%s", "GetSysVar", rc,"TerminalStage",ts).c_str());
-		return rc;
+		return ERR_ACCESSAUTH_GET_SYS_VAR;
 	}
 	assert(ts.GetLength() >=1);
 	pInfo->chTerminalState = ts[0];
@@ -424,10 +520,9 @@ ErrorCodeEnum CAccessAuthConn::SendGetTokenPackage()
 	rc = m_pEntity->GetFunction()->GetSysVar("RunState", rs);
 	if (rc != Error_Succeed)
 	{
-		//LogError(Severity_Middle, rc, ERROR_ACCESSAUTH_GETSYSVAR, "GetSysVar(\"RunState\") fail");
 		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_GET_SYS_VAR,
 			GetOutPutStr("%s%08X%s%s", "GetSysVar", rc,"RunState", rs).c_str());
-		return rc;
+		return ERR_ACCESSAUTH_GET_SYS_VAR;
 	}
 	assert(rs.GetLength() >=1);
 	pInfo->chRunState = rs[0];
@@ -439,11 +534,13 @@ ErrorCodeEnum CAccessAuthConn::SendGetTokenPackage()
 	if (pEntity->GetAuthVersion() == 2)
 	{
 		// 使用会话密钥加密
+		Dbg("使用会话密钥加密。。。");
 		raw.Refer(pBuf, sizeof(RequestTokenInfo)+4);
 		rc = pEntity->EncryptDataWithSessionKey(raw, enc);
 	}
 	else
 	{
+		Dbg("使用密码键盘加密。。。");
 		//add by zl 20190102 简版没有密码键盘单独处理（在终端被注销，DB中公钥被删除时会出现此种情况）
 		if (si.strMachineType.IsStartWith("RVC.IL", true))
 		{
@@ -462,15 +559,14 @@ ErrorCodeEnum CAccessAuthConn::SendGetTokenPackage()
 
 	if (rc != Error_Succeed)
 	{
-		//LogError(Severity_Low, rc, 0, "加密准入请求数据失败");
 		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_ENCRYPT_KEY,
 			GetOutPutStr("%s%08X", "CryptEncrypt", rc).c_str());
-		return rc;
+		return ERR_ACCESSAUTH_ENCRYPT_KEY;
 	}
 
 	memcpy(pBuf, enc.m_pData, enc.m_iLength);
 
-	CSmartPointer<IPackage> package = CreateNewPackage("ReqToken");
+	
 	package->AddStruct("TOKEN_R1", false, false, (BYTE*)&req1, sizeof(RequestTokenReq1));
 
 	// 获取硬件信息
@@ -480,12 +576,11 @@ ErrorCodeEnum CAccessAuthConn::SendGetTokenPackage()
 	{
 		((CAccessAuthEntity*)m_pEntity)->SetAuthErrMsg("从root.ini获取终端设备信息失败");
 		spFunction->SetSysVar("AuthErrMsg", "从root.ini获取终端设备信息失败", true);
-		//LogError(Severity_Middle, rc, ERROR_ACCESSAUTH_GETSYSVAR, "从root.ini获取终端设备信息失败");
 
 		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_READ_WRITE_CONFIG_FILE,
 			GetOutPutStr("%s%08X", "SpGetAllDevices", rc).c_str());
 		
-		return rc;
+		return ERR_ACCESSAUTH_READ_WRITE_CONFIG_FILE;
 	}
 
 	int nDevEntityCount = devNames.GetCount();
@@ -550,47 +645,52 @@ ErrorCodeEnum CAccessAuthConn::SendGetTokenPackage()
 	if (1 == nVerifyCodeSign)
 	{
 		if (GetSpBaseSignCertHash(strHash1))
+		{
 			strncpy(req3.szSignCertHash, strHash1, 40);
+			Dbg("spshell hash value=%s",req3.szSignCertHash);
+		}
+			
 		else
 		{
-			//LogError(Severity_Middle, rc, ERROR_ACCESSAUTH_GETSIGN, "获取spbase.dll签名失败");
-
 			LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_GET_SPSHELL_HASH,
-				GetOutPutStr("%s%s", "GetSpBaseSignCertHash", "False").c_str());
-			
+					GetOutPutStr("%s%s", "GetSpBaseSignCertHash", "False").c_str());
 		}
 	}
 
 	CSimpleStringA strHash2;
 	if (GetUKeyRootCertHash(strHash2))
-		strncpy(req3.szUKeyRootHash, strHash2, 40);
-	/*else
-	{
-	LogError(Severity_Middle, rc, ERROR_ACCESSAUTH_GETSIGN, "获取RootCert.pem签名失败");
-	}*/
+		strncpy(req3.szUKeyRootHash, strHash2, strHash2.GetLength());
 
 	req3.nAuthVersion = pEntity->GetAuthVersion();
 
 	// 上报指纹用于准入校验
-	int nBufLen = sizeof(req3.FingerPrint);
-	if (!pEntity->GetTerminalFingerPrint(req3.FingerPrint, nBufLen))
+	// 更改了指纹大小，16->32,另外16字节通过REQ0上传
+	BYTE fingerPrint[32] = { 0 };
+	int nBufLen = sizeof(fingerPrint);
+	if (!pEntity->GetTerminalFingerPrint(fingerPrint, nBufLen))
 	{
-		//LogError(Severity_Middle, rc, ERROR_INITIALIZER_FINGERPINT, "获取终端指纹失败");
 		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_GET_TERMINAL_FINGERPRINT,
-			GetOutPutStr("%s%s", "GetTerminalFingerPrint", "False").c_str());
-		return Error_Unexpect;
+				GetOutPutStr("%s%s", "GetTerminalFingerPrint", "False").c_str());
+		return ERR_ACCESSAUTH_GET_TERMINAL_FINGERPRINT;
 	}
-
+	memcpy(req3.FingerPrint, fingerPrint, 16);
+
+	//告知服务器终端是否进行过国密改造
+	RequestTokenReq0 req0;
+	memcpy(req0.FingerPrintSM, fingerPrint + 16, 16);
+	req0.isSM = 1;
+	req0.isFirst = ((CAccessAuthEntity*)m_pEntity)->GetOrSetIsFirstSM(0);
+	package->AddStruct("TOKEN_R0", false, false, (BYTE*)& req0, sizeof(RequestTokenReq0));
 	if (req3.nAuthVersion ==1)
 	{
 		// 非自定义密钥准入，需主动上报设备公钥
 		nBufLen = sizeof(req3.PublicKey);
+		memset(req3.PublicKey,0,nBufLen);
 		if (!pEntity->GetTerminalPublicKey(req3.PublicKey, nBufLen))
 		{
-			//LogError(Severity_Middle, rc, ERROR_INITIALIZER_GETPUBKEY, "获取终端公钥失败");
 			LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_GET_TERMINAL_PUBKEY,
 				GetOutPutStr("%s%s", "GetTerminalPublicKey", "False").c_str());
-			return Error_Unexpect;
+			return ERR_ACCESSAUTH_GET_TERMINAL_PUBKEY;
 		}
 	}
 
@@ -623,7 +723,7 @@ ErrorCodeEnum CAccessAuthConn::SendGetTokenPackage()
 	return Error_Succeed;
 }
 
-ErrorCodeEnum CAccessAuthConn::SendExitNoticePackage(int nReason, int nWay)
+DWORD CAccessAuthConn::SendExitNoticePackage(int nReason, int nWay)
 {
 	assert(IsConnectionOK());
 
@@ -650,7 +750,7 @@ ErrorCodeEnum CAccessAuthConn::SendExitNoticePackage(int nReason, int nWay)
 	return Error_Succeed;
 }
 
-ErrorCodeEnum CAccessAuthConn::SendTerminalStagePackage(char cNewStage, CSmallDateTime dtNewStageTime, 
+DWORD CAccessAuthConn::SendTerminalStagePackage(char cNewStage, CSmallDateTime dtNewStageTime,
 												   char cOldStage, CSmallDateTime dtOldStageTime)
 {
 	assert(IsConnectionOK());
@@ -829,19 +929,25 @@ bool CAccessAuthConn::GetUKeyRootCertHash(CSimpleStringA &strHash)
 			long nRetLen = 2048;
 			base64_decode((BYTE*)pCert, nLen, buf, nRetLen);
 			
-			BYTE hash[20] = {};
-			if (Sha1Hash(buf, nRetLen, hash))
+			BYTE hash[32] = {0};
+			//if (Sha1Hash(buf, nRetLen, hash))
+			if(SM3Hash(buf,nRetLen,hash))
 			{
-				char szBuf[64] = {};
-				for (int i = 0; i < 20; i++)
-					sprintf(szBuf, "%s%02x", szBuf, hash[i]);
+				char* szBuf;
+				
+				szBuf = MyBase64::Str2Hex((char *)hash,32);
+				//for (int i = 0; i < 32; i++)
+					//sprintf(szBuf, "%s%02x", szBuf, hash[i]);
 
 				strHash = szBuf;
+				delete[] szBuf;
+				Dbg("Ex RootCert.pem hash=%s",strHash.GetData());
 				bRet = true;
+
 			}
 			else
 			{
-				//LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_GETSH1HASH, "get RootCert.pem sha1 value fail");
+			
 				LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_GET_HASH,
 					GetOutPutStr("%s%s", "Sha1Hash", "False").c_str());
 			}
@@ -853,9 +959,9 @@ bool CAccessAuthConn::GetUKeyRootCertHash(CSimpleStringA &strHash)
 	return bRet;
 }
 
-bool CAccessAuthConn::Sha1Hash(BYTE *pData, int nDataLen, BYTE hash[20])
+bool CAccessAuthConn::Sha1Hash(BYTE *pData, int nDataLen, BYTE hash[])
 {
-	bool bRet = false;
+	/*bool bRet = false;
 	HCRYPTPROV hCryptProv;
 	if (CryptAcquireContextA(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT | CRYPT_MACHINE_KEYSET)) {
 		HCRYPTHASH hHash;
@@ -863,9 +969,7 @@ bool CAccessAuthConn::Sha1Hash(BYTE *pData, int nDataLen, BYTE hash[20])
 		{
 			if (!CryptHashData(hHash, pData, nDataLen, 0))
 			{
-				//LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_GETSH1HASH, CSimpleStringA::Format("CryptHashData fail: %d", GetLastError()));
-				LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_SHA1_HASH,
-					GetOutPutStr("%s%s%s%d", "CryptHashData", "False","GetLastError", GetLastError()).c_str());
+				LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_GETSH1HASH, CSimpleStringA::Format("CryptHashData fail: %d", GetLastError()));
 			}				
 			else
 			{
@@ -874,9 +978,7 @@ bool CAccessAuthConn::Sha1Hash(BYTE *pData, int nDataLen, BYTE hash[20])
 					bRet = true;
 				else
 				{
-					//LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_GETSH1HASH, CSimpleStringA::Format("CryptGetHashParam fail: %d", GetLastError()));
-					LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_SHA1_HASH,
-						GetOutPutStr("%s%s%s%d", "CryptGetHashParam", "False", "GetLastError", GetLastError()).c_str());
+					LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_GETSH1HASH, CSimpleStringA::Format("CryptGetHashParam fail: %d", GetLastError()));
 				}
 					
 			}
@@ -884,24 +986,26 @@ bool CAccessAuthConn::Sha1Hash(BYTE *pData, int nDataLen, BYTE hash[20])
 		}
 		else 
 		{
-			//LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_GETSH1HASH, CSimpleStringA::Format("CryptCreateHash fail: %d", GetLastError()));
-			LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_SHA1_HASH,
-				GetOutPutStr("%s%s%s%d", "CryptCreateHash", "False", "GetLastError", GetLastError()).c_str());
+			LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_GETSH1HASH, CSimpleStringA::Format("CryptCreateHash fail: %d", GetLastError()));
 		}
 
 		CryptReleaseContext(hCryptProv, 0);
 	}
 	else 
 	{
-		//LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_GETSH1HASH, CSimpleStringA::Format("CryptAcquireContextA fail: %d", GetLastError()));
-		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_SHA1_HASH,
-			GetOutPutStr("%s%s%s%d", "CryptAcquireContextA", "False", "GetLastError", GetLastError()).c_str());
+		LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_GETSH1HASH, CSimpleStringA::Format("CryptAcquireContextA fail: %d", GetLastError()));
 	}
+	return bRet;*/
 
-	return bRet;
+	/*if (!SM3Hash(pData, nDataLen, hash)) {
+		LogWarn(Severity_Middle,Error_Unexpect, ERROR_ACCESSAUTH_GETSH1HASH,"Sha1hash failed.");
+		return false;
+	}*/
+	return true;
 }
 
-ErrorCodeEnum CAccessAuthConn::SendSyncTimePackage()
+//同步时间
+DWORD CAccessAuthConn::SendSyncTimePackage()
 {
 	assert(IsConnectionOK());
 
@@ -916,21 +1020,26 @@ ErrorCodeEnum CAccessAuthConn::SendSyncTimePackage()
 
 	// 终端时间
 	req.dwCurTime = (DWORD)CSmallDateTime::GetNow();
+
+	SyncTimeReq2 req2;
+	req2.isSm = 1;
 		
 	CSmartPointer<IPackage> package = CreateNewPackage("SyncTime");
 	package->AddStruct("SYNC_R1", false, false, (BYTE*)&req, sizeof(req));
+	package->AddStruct("SYNC_R2", false, false, (BYTE*)&req2, sizeof(req2));
 	Dbg("send sync time package");
 	return SendPackage(package) == "" ? Error_Unexpect : Error_Succeed;
 }
 
-ErrorCodeEnum CAccessAuthConn::SendSyncTimePackageNew()
+
+DWORD CAccessAuthConn::SendSyncTimePackageNew()
 {
 	Dbg("SendSyncTimePackageNew");
 
 	assert(IsConnectionOK());
 	DWORD dwSysCode, dwUserCode;
 	string strErrMsg;
-	ErrorCodeEnum rc = Error_Succeed;
+	DWORD rc = Error_Succeed;
 	SyncTimeReq req;
 	memset(&req, 0, sizeof(req));
 
@@ -963,10 +1072,10 @@ ErrorCodeEnum CAccessAuthConn::SendSyncTimePackageNew()
 
 	if (pRecvPkg->GetErrMsg(dwSysCode, dwUserCode, strErrMsg))
 	{
-		rc = (ErrorCodeEnum)dwSysCode;
+		rc = dwUserCode;
 		//LogError(Severity_Middle, (ErrorCodeEnum)dwSysCode, dwUserCode, strErrMsg.c_str());
 		//Dbg("GetErrMsg error at SendSyncTimePackageNew,dwSysCode=%08X,strErrMsg=%s",dwUserCode, strErrMsg.c_str());
-		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_SYNC_TIME,
+		LogWarn(Severity_Middle, Error_Unexpect, rc,
 			GetOutPutStr("%s%08X%s%s", "GetErrMsg", rc, "strErrMsg", strErrMsg.c_str()).c_str());
 	}
 	else
@@ -995,10 +1104,9 @@ ErrorCodeEnum CAccessAuthConn::SendSyncTimePackageNew()
 					Dbg("sync time with server succeed, server time: [%s]", (const char*)dtServerTime.ToTimeString());
 				else
 				{
-					//LogError(Severity_Middle, Error_Unexpect, 0, CSimpleStringA::Format("SetLocalTime(%s),sync time with server fail: %d", dtServerTime.ToTimeString(), GetLastError()));
 					LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_SET_LOCALE_TIME,
 						GetOutPutStr("%s%s", "stServerTime", dtServerTime.ToTimeString()).c_str());
-					rc = Error_Unexpect;
+					rc = ERR_ACCESSAUTH_SET_LOCALE_TIME;
 				}
 			}
 			else
@@ -1008,29 +1116,29 @@ ErrorCodeEnum CAccessAuthConn::SendSyncTimePackageNew()
 		}
 		else
 		{
-			//LogError(Severity_Middle, Error_Unexpect, 0, "GetStructLen [SYNC_A1] fail!");
+			
 			LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_SYNC_TIME,
 				GetOutPutStr("%s%d", "GetStructLen", nRetLen).c_str());
-			rc = Error_Bug;
+			rc = ERR_ACCESSAUTH_SYNC_TIME;
 		}
 	}
 
 	return rc;
 }
 
-ErrorCodeEnum CAccessAuthConn::HandleSyncTimeRet(const CSmartPointer<IPackage> &pRecvPkg)
+DWORD CAccessAuthConn::HandleSyncTimeRet(const CSmartPointer<IPackage> &pRecvPkg)
 {
+	LOG_FUNCTION();
 	DWORD dwSysCode, dwUserCode;
 	string strErrMsg;
-	ErrorCodeEnum rc = Error_Succeed;
+	DWORD rc = Error_Succeed;
 	int nAuthVersion = 1;		// 默认使用KMC准入
 	BYTE *pSessionKey = NULL;
 
 	if (pRecvPkg->GetErrMsg(dwSysCode, dwUserCode, strErrMsg))
 	{
-		rc = (ErrorCodeEnum)dwSysCode;
-		//LogError(Severity_Middle, (ErrorCodeEnum)dwSysCode, dwUserCode, strErrMsg.c_str());
-		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_SYNC_TIME,
+		rc = dwUserCode;
+		LogWarn(Severity_Middle, Error_Unexpect, rc,
 			GetOutPutStr("%s%08X%s%s", "GetErrMsg", rc,"strErrMsg", strErrMsg.c_str()).c_str());
 	}
 	else
@@ -1059,9 +1167,9 @@ ErrorCodeEnum CAccessAuthConn::HandleSyncTimeRet(const CSmartPointer<IPackage> &
 					Dbg("sync time with server succeed, server time: [%s]", (const char*)dtServerTime.ToTimeString());
 				else
 				{
-					//LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_SYNCTIME, CSimpleStringA::Format("SetLocalTime(%s),sync time with server fail: %d", dtServerTime.ToTimeString(), GetLastError()));
 					LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_SET_LOCALE_TIME,
 						GetOutPutStr("%s%s", "stServerTime", dtServerTime.ToTimeString()).c_str());
+					rc = ERR_ACCESSAUTH_SET_LOCALE_TIME;
 				}
 			}
 			else
@@ -1070,24 +1178,30 @@ ErrorCodeEnum CAccessAuthConn::HandleSyncTimeRet(const CSmartPointer<IPackage> &
 			}
 
 			// 检查准入请求版本 //会话密钥缓存
-			Dbg("auth version: %d", ret.nAuthVersion);			
-			((CAccessAuthEntity*)m_pEntity)->SaveAuthVerAndKey(ret.nAuthVersion, ret.SessionKey);
+			Dbg("auth version: %d", ret.nAuthVersion);
+			if (ret.nAuthVersion == 1) {
+				rc = ERR_ACCESSAUTH_AUTH_VERSION;
+				auto pEntity = (CAccessAuthEntity*)m_pEntity;
+				pEntity->GetFunction()->ShowFatalError("时间同步时，获取准入加密版本错误，请先进行密钥初始化");
+			}
+			else {
+				((CAccessAuthEntity*)m_pEntity)->SaveAuthVerAndKey(ret.nAuthVersion, ret.SessionKey);
+			}
 		}
 		else
 		{
-			//LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_GETSTRUCTLEN, "GetStructLen [SYNC_A1] fail!");
 			LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_SYNC_TIME,
 				GetOutPutStr("%s%d", "GetStructLen", nRetLen).c_str());
-			rc = Error_Bug;
+			rc = ERR_ACCESSAUTH_SYNC_TIME;
 		}
 	}
-
-	auto pEvent = new FSMEvent(CAccessAuthFSM::Event_EndSyncTime);
+	
+	auto pEvent = new FSMEvent(rc == Error_Succeed?CAccessAuthFSM::Event_EndSyncTime: CAccessAuthFSM::Event_SyncTimeFailed);
 	m_pFSM->PostEventFIFO(pEvent);
 	return rc;
 }
 
-ErrorCodeEnum CAccessAuthConn::SendInitDevicePackage(SpReqAnsContext<AccessAuthService_InitDev_Req, AccessAuthService_InitDev_Ans>::Pointer &ctx)
+DWORD CAccessAuthConn::SendInitDevicePackage(SpReqAnsContext<AccessAuthService_InitDev_Req, AccessAuthService_InitDev_Ans>::Pointer &ctx)
 {
 	assert(IsConnectionOK());
 
@@ -1104,22 +1218,20 @@ ErrorCodeEnum CAccessAuthConn::SendInitDevicePackage(SpReqAnsContext<AccessAuthS
 	package->AddStruct("InitDevR", false, false, (BYTE*)&req, sizeof(req));
 	if (SendPackage(package) == "")
 	{
-		//LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_SENDPACK, "SendPackage failed, send init device req fail");
-		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_INIT_DEV,
+		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_INIT_DEV_SEND_PKG,
 			GetOutPutStr("%s%s", "SendInitDevicePackage", "").c_str());
-		return Error_Unexpect;
+		return ERR_ACCESSAUTH_INIT_DEV_SEND_PKG;
 	}
 	else
 	{
 		//Dbg("send init device req succ, CR1:%s, R2:%s, CR3:%s, CDevPubKey:%s",  (const char*)ctx->Req.EncR1, 
 		//	(const char*)ctx->Req.R2, (const char*)ctx->Req.EncR3, (const char*)ctx->Req.EncDevPubKey);
-
 		m_ctxInitDev = ctx;
 		return Error_Succeed;
 	}
 }
 
-ErrorCodeEnum CAccessAuthConn::HandleInitDeviceRet(const CSmartPointer<IPackage> &pRecvPkg)
+DWORD CAccessAuthConn::HandleInitDeviceRet(const CSmartPointer<IPackage> &pRecvPkg)
 {
 	DWORD dwSysCode, dwUserCode;
 	string strErrMsg;
@@ -1128,7 +1240,7 @@ ErrorCodeEnum CAccessAuthConn::HandleInitDeviceRet(const CSmartPointer<IPackage>
 	if (pRecvPkg->GetErrMsg(dwSysCode, dwUserCode, strErrMsg))
 	{
 		rc = (ErrorCodeEnum)dwSysCode;
-		//LogError(Severity_Middle, (ErrorCodeEnum)dwSysCode, dwUserCode, strErrMsg.c_str());
+
 		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_INIT_DEV,
 			GetOutPutStr("%s%08X%s%s", "GetErrMsg", rc,"strErrMsg", strErrMsg.c_str()).c_str());
 	}
@@ -1175,7 +1287,8 @@ ErrorCodeEnum CAccessAuthConn::HandleInitDeviceRet(const CSmartPointer<IPackage>
 	return rc;
 }
 
-ErrorCodeEnum CAccessAuthConn::SendReportStatePackage(const char*pszEventType, DWORD dwErrCode, const char *pszErrMsg)
+//上报状态
+DWORD CAccessAuthConn::SendReportStatePackage(const char*pszEventType, DWORD dwErrCode, const char *pszErrMsg)
 {
 	auto pFunc = m_pEntity->GetFunction();
 
@@ -1195,36 +1308,35 @@ ErrorCodeEnum CAccessAuthConn::SendReportStatePackage(const char*pszEventType, D
 	return SendPackage(package) != "" ? Error_Succeed : Error_Unexpect;
 }
 
-ErrorCodeEnum CAccessAuthConn::HandleReportStateRet(const CSmartPointer<IPackage> &pRecvPkg)
+DWORD CAccessAuthConn::HandleReportStateRet(const CSmartPointer<IPackage> &pRecvPkg)
 {
-	ErrorCodeEnum rc = Error_Succeed;
+	DWORD rc = Error_Succeed;
 	DWORD dwSysCode, dwUserCode;
 	string strErrMsg;
 
 	if (pRecvPkg->GetErrMsg(dwSysCode, dwUserCode, strErrMsg))
 	{
-		rc = (ErrorCodeEnum)dwSysCode;
-		//LogError(Severity_Middle, rc, ERROR_ACCESSAUTH_SERVERRETURN, CSimpleStringA::Format("HandleReportStateRet,report state fail, %s", strErrMsg.c_str()));
-		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_REPORT_STATE,
+		rc = dwUserCode;
+		LogWarn(Severity_Middle, Error_Unexpect, rc,
 			GetOutPutStr("%s%08X%s%s", "GetErrMsg", dwSysCode,"strErrMsg", strErrMsg.c_str()).c_str());
 	}
 
 	return rc;
 }
 
-ErrorCodeEnum CAccessAuthConn::SendLockStatePackage()
+//同步锁定状态
+DWORD CAccessAuthConn::SendLockStatePackage()
 {
 	LockStateReq req = {0};
 
 	auto pFunc = m_pEntity->GetFunction();
 	CSystemStaticInfo info;
-	auto rc = pFunc->GetSystemStaticInfo(info);
+	DWORD rc = pFunc->GetSystemStaticInfo(info);
 	if (rc != Error_Succeed)
 	{
-		//LogError(Severity_Middle, rc, ERROR_ACCESSAUTH_GETSTATICINFO, "SendLockStatePackage()=>GetSystemStaticInfo() fail");
 		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_GET_SYSTEM_STATIC_INFO,
 			GetOutPutStr("%s%08X", "GetSystemStaticInfo", rc).c_str());
-		return rc;
+		return ERR_ACCESSAUTH_GET_SYSTEM_STATIC_INFO;
 	}
 	strncpy(req.TerminalNo, (const char*)info.strTerminalID, sizeof(req.TerminalNo)-1);
 
@@ -1232,10 +1344,9 @@ ErrorCodeEnum CAccessAuthConn::SendLockStatePackage()
 	pkt->AddStruct("LockStateReq", false, false, (LPBYTE)&req, sizeof(LockStateReq));
 	if (SendPackage(pkt) == "")
 	{
-		//LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_SENDPACK, "SendPackage failed, send Lock State req fail");
-		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_LOCK_STATE,
+		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_LOCK_SEND_PKG,
 			GetOutPutStr("%s%08X", "SendLockStatePackage", Error_Unexpect).c_str());
-		return Error_Unexpect;
+		return ERR_ACCESSAUTH_LOCK_SEND_PKG;
 	}
 	else
 	{
@@ -1245,22 +1356,21 @@ ErrorCodeEnum CAccessAuthConn::SendLockStatePackage()
 	return Error_Succeed;
 }
 
-ErrorCodeEnum CAccessAuthConn::HandleLockStateRet(const CSmartPointer<IPackage> &pRecvPkg)
+DWORD CAccessAuthConn::HandleLockStateRet(const CSmartPointer<IPackage> &pRecvPkg)
 {
-	ErrorCodeEnum rc = Error_Succeed;
+	DWORD rc = Error_Succeed;
 	DWORD dwSysCode, dwUserCode;
 	string strErrMsg;
 
 	if (pRecvPkg->GetErrMsg(dwSysCode, dwUserCode, strErrMsg))
 	{
-		rc = (ErrorCodeEnum)dwSysCode;
-		//LogError(Severity_Middle, (ErrorCodeEnum)dwSysCode, dwUserCode, strErrMsg.c_str());
+		rc = dwUserCode;
 		((CAccessAuthEntity*)m_pEntity)->SetAuthErrMsg(strErrMsg.c_str());
 		CSmartPointer<IEntityFunction> spFunction = m_pEntity->GetFunction();
 		spFunction->SetSysVar("AuthErrMsg", strErrMsg.c_str(), true);
 
-		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_LOCK_STATE,
-			GetOutPutStr("%s%08X%s%s", "GetErrMsg", dwSysCode,"AuthErrMsg", strErrMsg.c_str()).c_str());
+		LogWarn(Severity_Middle, Error_Unexpect, rc,
+			GetOutPutStr("%s%08X%s%s", "GetErrMsg", rc,"AuthErrMsg", strErrMsg.c_str()).c_str());
 
 		return rc;
 	}
@@ -1293,25 +1403,23 @@ ErrorCodeEnum CAccessAuthConn::HandleLockStateRet(const CSmartPointer<IPackage>
 		} 
 		else 
 		{
-			//LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_GETSTRUCTDATA, "GetStructData LockStateAns fail!");
 			LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_LOCK_STATE,
 				GetOutPutStr("%s%s", "GetStructLen", "False").c_str());
-			return Error_Param;
+			return ERR_ACCESSAUTH_LOCK_STATE;
 		}
 		delete pBuf;
 	}
 	else
 	{
-		//LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_GETSTRUCTLEN, "GetStructLen LockStateAns fail!");
 		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_LOCK_STATE,
 			GetOutPutStr("%s%s%s%d", "GetStructData", "False","nLen", nLen).c_str());
-		return Error_Param;
+		return ERR_ACCESSAUTH_LOCK_STATE;
 	}
 
 	return rc;
 }
 
-ErrorCodeEnum CAccessAuthConn::SendCheckMD5Package(const char* pMD5Value)
+DWORD CAccessAuthConn::SendCheckMD5Package(const char* pMD5Value)
 {
 	assert(IsConnectionOK());
 	CheckMD5Req req;
@@ -1333,7 +1441,7 @@ ErrorCodeEnum CAccessAuthConn::SendCheckMD5Package(const char* pMD5Value)
 	return SendPackage(pkt) != "" ? Error_Succeed : Error_Unexpect;			
 }
 
-ErrorCodeEnum CAccessAuthConn::SendUpdateMD5Package(const char* pMD5Value)
+DWORD CAccessAuthConn::SendUpdateMD5Package(const char* pMD5Value)
 {
 	assert(IsConnectionOK());
 	CheckMD5Req req;
@@ -1355,7 +1463,7 @@ ErrorCodeEnum CAccessAuthConn::SendUpdateMD5Package(const char* pMD5Value)
 	return SendPackage(pkt) != "" ? Error_Succeed : Error_Unexpect;			
 }
 
-ErrorCodeEnum CAccessAuthConn::HandleCheckMD5Ret(const CSmartPointer<IPackage> &pRecvPkg)
+DWORD CAccessAuthConn::HandleCheckMD5Ret(const CSmartPointer<IPackage> &pRecvPkg)
 {
 	ErrorCodeEnum rc = Error_Succeed;
 	DWORD dwSysCode, dwUserCode;
@@ -1375,7 +1483,7 @@ ErrorCodeEnum CAccessAuthConn::HandleCheckMD5Ret(const CSmartPointer<IPackage> &
 	return rc;
 }
 
-ErrorCodeEnum CAccessAuthConn::HandleUpdateMD5Ret(const CSmartPointer<IPackage> &pRecvPkg)
+DWORD CAccessAuthConn::HandleUpdateMD5Ret(const CSmartPointer<IPackage> &pRecvPkg)
 {
 	ErrorCodeEnum rc = Error_Succeed;
 	DWORD dwSysCode, dwUserCode;

Module/mod_accessauth/AccessAuthConn.h

@@ -35,6 +35,19 @@ struct SMWKUpdateRet
 	BYTE kmcData[0];        // 变长1到300
 };
 
+//获取KMC密钥
+struct KMCKeyReq {
+	char TerminalNo[16];
+};
+
+struct KMCKeyRet {
+	char TMK[64];
+	char TPK[64];
+	char EDK[64];
+	char Index[8];
+	char Reserved[256];
+};
+
 // 请求TOKEN时附带设备信息(未加密) 102 byte
 struct RequestTokenInfo
 {
@@ -49,7 +62,13 @@ struct RequestTokenInfo
     char chTerminalState;		//	终端生命阶段状态	char	1
     char chRunState;			//	系统状态	char	1
 };
-
+//判断是否进行了国密改造
+struct RequestTokenReq0
+{
+	int isSM; 
+	int isFirst;//是否国密改造之后的第一次准入
+	BYTE FingerPrintSM[16];
+};
 // 请求Token设备信息加密后结构(使用密码键盘加密)
 // [StructName("TOKEN_R1")]
 struct RequestTokenReq1
@@ -104,7 +123,12 @@ struct RequestTokenRet
 	BYTE sharedSK[16];		// 共享会话密钥
 	BYTE retHash[4];		// 返回结构Hash
 };
-
+//国密
+struct RequestTokenRet2
+{
+	BYTE enToken[256];      // 使用准入服务签名后的TOKEN
+	BYTE retHash[32];		// 返回结构Hash
+};
 // 退出准入上报
 // [StructName("EXIT_REQ")]
 struct TerminalExitReq
@@ -139,7 +163,11 @@ struct SyncTimeReq
 	DWORD dwCurTime;		// 终端当前时间
 	BYTE byReserved[64];		// 保留字段
 };
-
+//是否进行国密改造
+struct SyncTimeReq2
+{
+	int isSm;
+};
 // [StructName("SYNC_A1")]
 struct SyncTimeAns
 {
@@ -206,33 +234,39 @@ class CAccessAuthConn : public SpSecureClient
 public:
 	CAccessAuthConn(CEntityBase *pEntity, CAccessAuthFSM *pFSM);
 
-	ErrorCodeEnum SendWKUpdatePackage();
-	ErrorCodeEnum SendGetTokenPackage();
-	ErrorCodeEnum SendExitNoticePackage(int nReason, int nWay);
-	ErrorCodeEnum SendTerminalStagePackage(char cNewStage, CSmallDateTime dtNewStageTime, char cOldStage, CSmallDateTime dtOldStageTime);
-	ErrorCodeEnum SendSyncTimePackage();
-	ErrorCodeEnum SendSyncTimePackageNew();
-	ErrorCodeEnum SendInitDevicePackage(SpReqAnsContext<AccessAuthService_InitDev_Req, AccessAuthService_InitDev_Ans>::Pointer &ctx);
-	ErrorCodeEnum SendReportStatePackage(const char*pszEventType, DWORD dwErrCode, const char *pszErrMsg);
-	ErrorCodeEnum SendLockStatePackage();
-	ErrorCodeEnum SendCheckMD5Package(const char* pMD5Value);
-	ErrorCodeEnum SendUpdateMD5Package(const char* pMD5Value);
+	DWORD SendSyncTimePackage();
+	DWORD SendSyncTimePackageNew();
+	DWORD SendLockStatePackage();
+	DWORD SendWKUpdatePackage();
+
+	DWORD SendGetTokenPackage();
+	DWORD SendExitNoticePackage(int nReason, int nWay);
+	DWORD SendTerminalStagePackage(char cNewStage, CSmallDateTime dtNewStageTime, char cOldStage, CSmallDateTime dtOldStageTime);
+	DWORD SendInitDevicePackage(SpReqAnsContext<AccessAuthService_InitDev_Req, AccessAuthService_InitDev_Ans>::Pointer &ctx);
+	DWORD SendReportStatePackage(const char*pszEventType, DWORD dwErrCode, const char *pszErrMsg);
+
+	DWORD SendCheckMD5Package(const char* pMD5Value);
+	DWORD SendUpdateMD5Package(const char* pMD5Value);
 
 private:
 	~CAccessAuthConn();
 	void OnDisconnect();
 	void OnPkgAnswer(const CSmartPointer<IPackage> &pRecvPkg);
 
-	ErrorCodeEnum HandleUpdateWKRet(const CSmartPointer<IPackage> &pRecvPkg);
-	ErrorCodeEnum HandleReqTokenRet(const CSmartPointer<IPackage> &pRecvPkg);
-	ErrorCodeEnum HandleTermExitRet(const CSmartPointer<IPackage> &pRecvPkg);
-	ErrorCodeEnum HandleReportStageRet(const CSmartPointer<IPackage> &pRecvPkg);
-	ErrorCodeEnum HandleSyncTimeRet(const CSmartPointer<IPackage> &pRecvPkg);
-	ErrorCodeEnum HandleInitDeviceRet(const CSmartPointer<IPackage> &pRecvPkg);
-	ErrorCodeEnum HandleReportStateRet(const CSmartPointer<IPackage> &pRecvPkg);
-	ErrorCodeEnum HandleLockStateRet(const CSmartPointer<IPackage> &pRecvPkg);
-	ErrorCodeEnum HandleCheckMD5Ret(const CSmartPointer<IPackage> &pRecvPkg);
-	ErrorCodeEnum HandleUpdateMD5Ret(const CSmartPointer<IPackage> &pRecvPkg);
+	DWORD HandleSyncTimeRet(const CSmartPointer<IPackage>& pRecvPkg);
+	DWORD HandleLockStateRet(const CSmartPointer<IPackage>& pRecvPkg);
+	DWORD HandleUpdateWKRet(const CSmartPointer<IPackage> &pRecvPkg);
+	DWORD HandleReqTokenRet(const CSmartPointer<IPackage> &pRecvPkg);
+	DWORD HandleTermExitRet(const CSmartPointer<IPackage> &pRecvPkg);
+
+	DWORD HandleReportStageRet(const CSmartPointer<IPackage> &pRecvPkg);
+
+	DWORD HandleInitDeviceRet(const CSmartPointer<IPackage> &pRecvPkg);
+
+	DWORD HandleReportStateRet(const CSmartPointer<IPackage>& pRecvPkg);
+
+	DWORD HandleCheckMD5Ret(const CSmartPointer<IPackage> &pRecvPkg);
+	DWORD HandleUpdateMD5Ret(const CSmartPointer<IPackage> &pRecvPkg);
 	
 	bool GetSpBaseSignCertHash(CSimpleStringA &strHash);
 	bool GetUKeyRootCertHash(CSimpleStringA &strHash);

Module/mod_accessauth/AccessAuthFSM.cpp

@@ -25,6 +25,7 @@ void CAccessAuthFSM::OnStateTrans(int iSrcState, int iDstState)
 // 初始化PinPad及KMC
 ErrorCodeEnum CAccessAuthFSM::OnInit()
 {
+	LOG_FUNCTION();
 	AddStateHooker(this);
 	m_finishAccess = 0;
 	//设置初始锁定状态，0
@@ -57,6 +58,7 @@ void CAccessAuthFSM::s1_on_exit()
 
 unsigned int CAccessAuthFSM::s1_on_event(FSMEvent* pEvent)
 {
+	LOG_FUNCTION();
 	Dbg("s1_on_event: %d", pEvent->iEvt);
 	if (pEvent->iEvt == Event_ReportStage)
 	{
@@ -117,6 +119,7 @@ struct TimeOutTask : public ITaskSp {
 };
 void CAccessAuthFSM::s2_on_entry()
 {
+	LOG_FUNCTION();
 	//  [6/16/2020 9:51 @Gifur]
 	//ScheduleTimer(2, 120 * 1000);		// 设定30秒准入超时
 	m_finishAccess = 0;
@@ -125,6 +128,7 @@ void CAccessAuthFSM::s2_on_entry()
 	Dbg("启动了准入超时定时器2分钟[%d]",m_finishAccess);
 
 	auto pEntity = (CAccessAuthEntity*)m_pEntity;
+	
 	auto rc = pEntity->InitKMC();
 	if (rc != Error_Succeed)
 	{
@@ -134,13 +138,12 @@ void CAccessAuthFSM::s2_on_entry()
 			GetOutPutStr("%s%08X", "InitKMC", rc).c_str());
 		return;
 	}
-
+	
 	SetSysVar("C");
 
 	if ((rc = SecureClientConnect()) != Error_Succeed)
 	{
 		// 启动定时器尝试重试
-		//LogError(Severity_Low, rc, ERROR_ACCESSAUTH_CONNECTSERVER, "connect AccessAuthorization fail, start timer(8s) to retry");
 		LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_CONNECT_SERVER,
 			GetOutPutStr("%s%08X", "SecureClientConnect", rc).c_str());
 		ScheduleTimer(1, 8000);
@@ -173,13 +176,12 @@ unsigned int CAccessAuthFSM::s2_on_event(FSMEvent* pEvent)
 			Dbg("access authorize timeout");
 			PostEventFIFO(new FSMEvent(Event_ReqTokenCancel));
 		}
-		else if (pEvent->param1 == 1)	 // reconnect
+		else if (pEvent->param1 == 1 || pEvent->param1 == 3)	 // reconnect
 		{
 			auto rc = SecureClientConnect();
 			if (rc != Error_Succeed)
 			{
 				// 启动定时器尝试重试
-				// LogError(Severity_Low, rc, ERROR_ACCESSAUTH_CONNECTSERVER, "connect to AccessAuthorization service fail, retry 8's later");
 				LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_CONNECT_SERVER,
 					GetOutPutStr("%s%08X","SecureClientConnect",rc).c_str());
 				ScheduleTimer(1, 8000);
@@ -192,56 +194,23 @@ unsigned int CAccessAuthFSM::s2_on_event(FSMEvent* pEvent)
 	}
 	else if (pEvent->iEvt == Event_ConnectionOK)
 	{
-		//暂时默认不校验MD5，需要校验配置CheckMD5=1
-		if (0 == m_nCheckMD5)
-		{			
-			FSMEvent *pEvent = new FSMEvent(Event_CheckMD5Succ);
-			PostEventFIFO(pEvent);		
+		auto pEntity = ((CAccessAuthEntity*)m_pEntity);
+		int isFirstAccessAfterSM = pEntity->GetOrSetIsFirstSM(0);
+		if (isFirstAccessAfterSM != 1) {
+			FSMEvent* pEvent = new FSMEvent(Event_CheckMD5Succ);
+			PostEventFIFO(pEvent);
+			return 0;
 		}
-		else
-		{
-			//校验MD5列表的MD5值
-			//获取MD5列表路径
-			TCHAR szPath[MAX_PATH] = {0};
-			CSimpleStringA strMD5ListPath;
-			CSimpleStringA strSysDir;
-			GetModuleFileNameA(NULL, szPath, MAX_PATH);
-			*strrchr(szPath, '\\') = 0;
-			strSysDir = szPath;
-			strMD5ListPath = strSysDir.SubString(0,1);			
-			strMD5ListPath += ":\\RVC\\MD5\\MD5.txt";
-
-			//判断本地MD5列表是否存在
-			auto pEntity = (CAccessAuthEntity*)m_pEntity;
-			if(-1 == (_access(strMD5ListPath.GetData(), 0)))
-			{
-				pEntity->SetAuthErrMsg("MD5列表不存在");
-				CSmartPointer<IEntityFunction> spFunction = m_pEntity->GetFunction();
-				spFunction->SetSysVar("AuthErrMsg", "MD5列表不存在", true);
-				LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_MD5FILE_NOTEXIST,"\\RVC\\MD5\\MD5.txt not exist");
-				PostEventFIFO(new FSMEvent(CAccessAuthFSM::Event_CheckMD5Fail));
-				return 1;
-			}
-
-			//计算本地MD5值
-			char* pMd5 = MD5_file((char*)strMD5ListPath.GetData(), 16);
-			if (NULL == pMd5)
-			{
-				pEntity->SetAuthErrMsg("计算MD5列表的MD5值失败");
-				CSmartPointer<IEntityFunction> spFunction = m_pEntity->GetFunction();
-				spFunction->SetSysVar("AuthErrMsg", "计算MD5列表的MD5值失败", true);
-				LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_MD5FILE,"calculate \\RVC\\MD5\\MD5.txt md5 value fail");
-				PostEventFIFO(new FSMEvent(CAccessAuthFSM::Event_CheckMD5Fail));
-				return 1;
-			}
 
-			//发送MD5值校验请求
-			auto rc = m_pConnection->SendCheckMD5Package(pMd5);
-			if (rc != Error_Succeed)
-			{
-				LogError(Severity_Middle, Error_Unexpect, ERROR_ACCESSAUTH_SENDPACK,"SendCheckMD5Package fail");
-				PostEventFIFO(new FSMEvent(CAccessAuthFSM::Event_CheckMD5Fail));
-			}
+		CSimpleStringA strInitState;
+		pEntity->GetFunction()->GetSysVar("InitState", strInitState);
+		if (strInitState == "1") {
+			//2020/5/29 删除了各个文件MD5检验的代码		
+			FSMEvent* pEvent = new FSMEvent(Event_CheckMD5Succ);
+			PostEventFIFO(pEvent);
+		}
+		else {
+			ScheduleTimer(3, 1500);
 		}
 	}
 	else if (pEvent->iEvt == Event_CheckMD5Fail)
@@ -253,10 +222,9 @@ unsigned int CAccessAuthFSM::s2_on_event(FSMEvent* pEvent)
 	else if (pEvent->iEvt == Event_CheckMD5Succ)
 	{
 		// 同步服务器时间
-		ErrorCodeEnum rc = m_pConnection->SendSyncTimePackage();
+		DWORD rc = m_pConnection->SendSyncTimePackage();
 		if (rc != Error_Succeed)
 		{
-			//LogError(Severity_Low, rc, ERROR_ACCESSAUTH_SENDPACK, "SendSyncTimePackage fail!");
 			FSMEvent *pEvent = new FSMEvent(Event_EndSyncTime);
 			PostEventFIFO(pEvent);
 			LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_SYNC_TIME,
@@ -267,8 +235,7 @@ unsigned int CAccessAuthFSM::s2_on_event(FSMEvent* pEvent)
 		rc = m_pConnection->SendLockStatePackage();
 		if (rc != Error_Succeed)
 		{
-			//LogError(Severity_Low, rc, ERROR_ACCESSAUTH_SENDPACK, "SendLockStatePackage fail!");
-			LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_LOCK_STATE,
+			LogWarn(Severity_Middle, Error_Unexpect, rc,
 				GetOutPutStr("%s%08X", "SendLockStatePackage", rc).c_str());
 		}		
 	}
@@ -322,10 +289,9 @@ unsigned int CAccessAuthFSM::s2_on_event(FSMEvent* pEvent)
 			Dbg("begin update WK now");
 		
 			// 请求WK
-			ErrorCodeEnum rc = m_pConnection->SendWKUpdatePackage();
+			DWORD rc = m_pConnection->SendWKUpdatePackage();
 			if (rc != Error_Succeed)
 			{
-				LogError(Severity_Low, rc, ERROR_ACCESSAUTH_SENDPACK, "SendWKUpdatePackage fail!");
 				LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_UPDATE_WK,
 					GetOutPutStr("%s%08X", "SendWKUpdatePackage", rc).c_str());
 				FSMEvent *pEvent = new FSMEvent(Event_UpdateWKFail);
@@ -344,7 +310,7 @@ unsigned int CAccessAuthFSM::s2_on_event(FSMEvent* pEvent)
 		//CSmartPointer<IConfigInfo> pConfig;
 		//m_pEntity->GetFunction()->OpenConfig(Config_Software, pConfig);
 
-		auto rc = m_pEntity->GetFunction()->SetSysVar("WKSyncSuccTime", (const char*) CSimpleStringA::Format("0x%08X", (DWORD)CSmallDateTime::GetNow()), true);
+		DWORD rc = m_pEntity->GetFunction()->SetSysVar("WKSyncSuccTime", (const char*) CSimpleStringA::Format("0x%08X", (DWORD)CSmallDateTime::GetNow()), true);
 		assert(rc == Error_Succeed);
 		/*pConfig->WriteConfigValue("Main", "WKSyncSuccTime", 
 			(const char*) CSimpleStringA::Format("0x%08X", (DWORD)CSmallDateTime::GetNow()));*/
@@ -372,7 +338,7 @@ unsigned int CAccessAuthFSM::s2_on_event(FSMEvent* pEvent)
 	{
 		// 忽略同步WK，直接准入
 		Dbg("ignore update wk, get token now");
-		auto rc = SecureClientConnect();
+		DWORD rc = SecureClientConnect();
 		if (rc == Error_Succeed)
 			rc = m_pConnection->SendGetTokenPackage();
 	
@@ -501,9 +467,8 @@ void CAccessAuthFSM::s4_on_entry()
 	SetSysVar("A");
 
 	// 发送准入超时事件
-	//LogError(Severity_Middle, Error_Unexpect, EVENT_ACCESSAUTH_TIMEOUT, "准入超时");
 	LogWarn(Severity_Middle, Error_Unexpect, ERR_ACCESSAUTH_TIMEOUT,
-		GetOutPutStr("%s%s", "准入", "超时").c_str());
+		    GetOutPutStr("%s%s", "准入", "超时").c_str());
 	// 切换到s1
 	PostEventFIFO(new FSMEvent(Event_StateTimeout));
 }
@@ -587,7 +552,7 @@ unsigned int CAccessAuthFSM::s6_on_event(FSMEvent* pEvent)
 	else if (pEvent->iEvt == Event_ConnectionOK)
 	{
 		// 请求退出
-		ErrorCodeEnum rc = m_pConnection->SendExitNoticePackage(m_nExitReason, m_nExitWay);
+		DWORD rc = m_pConnection->SendExitNoticePackage(m_nExitReason, m_nExitWay);
 
 		// 切换到s1
 		PostEventFIFO(new FSMEvent(Event_StateTimeout));
@@ -619,9 +584,9 @@ ErrorCodeEnum CAccessAuthFSM::SetSysVar(const CSimpleStringA &newVal)
 	return spFunction->SetSysVar("EntryPermit", (const char*)newVal);
 }
 
-ErrorCodeEnum CAccessAuthFSM::InitDevice(SpReqAnsContext<AccessAuthService_InitDev_Req, AccessAuthService_InitDev_Ans>::Pointer &ctx)
+DWORD CAccessAuthFSM::InitDevice(SpReqAnsContext<AccessAuthService_InitDev_Req, AccessAuthService_InitDev_Ans>::Pointer &ctx)
 {
-	auto rc = SecureClientConnect();
+	DWORD rc = SecureClientConnect();
 
 	if (rc == Error_Succeed)
 		rc = m_pConnection->SendInitDevicePackage(ctx);
@@ -630,14 +595,14 @@ ErrorCodeEnum CAccessAuthFSM::InitDevice(SpReqAnsContext<AccessAuthService_InitD
 
 	if (rc != Error_Succeed)
 	{
-		ctx->Answer(rc);
+		ctx->Answer(rc? Error_Unexpect: Error_Succeed);
 		return rc;
 	}	
 
 	return Error_Succeed;
 }
 
-ErrorCodeEnum CAccessAuthFSM::SyncTime()
+DWORD CAccessAuthFSM::SyncTime()
 {
 	auto rc = SecureClientConnect();
 	if (rc == Error_Succeed)

Module/mod_accessauth/AccessAuthFSM.h

@@ -48,7 +48,9 @@ public:
 		Event_StateTimeout,		// 临时状态超时
 		Event_ReportStage,
 		Event_CheckMD5Succ,
-		Event_CheckMD5Fail
+		Event_CheckMD5Fail,
+		Event_InitFinishOK,
+		Event_SyncTimeFailed  //同步时间失败
 	};
 
 	BEGIN_FSM_STATE(CAccessAuthFSM)
@@ -68,6 +70,7 @@ public:
 		FSM_RULE_ENTRY_ANY(s2, s3, Event_CheckMD5Fail)		
 		FSM_RULE_ENTRY_ANY(s2, s4, Event_ReqTokenCancel)
 		FSM_RULE_ENTRY_ANY(s2, s5, Event_ReqTokenSucc)
+		FSM_RULE_ENTRY_ANY(s2, s3, Event_SyncTimeFailed)
 		FSM_RULE_ENTRY_ANY(s3, s2, Event_StartRegist)
 		FSM_RULE_ENTRY_ANY(s4, s1, Event_StateTimeout)
 		FSM_RULE_ENTRY_ANY(s5, s6, Event_StartUnregist)			
@@ -107,8 +110,8 @@ public:
 	unsigned int s7_on_event(FSMEvent* event);
 
 public:
-	ErrorCodeEnum InitDevice(SpReqAnsContext<AccessAuthService_InitDev_Req, AccessAuthService_InitDev_Ans>::Pointer &ctx);
-	ErrorCodeEnum SyncTime();
+	DWORD InitDevice(SpReqAnsContext<AccessAuthService_InitDev_Req, AccessAuthService_InitDev_Ans>::Pointer &ctx);
+	DWORD SyncTime();
 	int m_finishAccess;
 
 private:

Module/mod_accessauth/mod_AccessAuth.h

@@ -34,7 +34,7 @@ private:
 class CAccessAuthEntity : public CEntityBase, public ISysVarListener
 {
 public:
-	CAccessAuthEntity() :m_nAuthVersion(1) {}
+	CAccessAuthEntity() :m_nAuthVersion(1), m_bGetKMCKey(false){}
 	virtual ~CAccessAuthEntity() 
 	{
 		/*if (NULL != m_pkeys)
@@ -68,13 +68,13 @@ public:
 	ErrorCodeEnum Unregist(int nReason, int nWay);
 
 	// 时间同步
-	ErrorCodeEnum SyncTime();
+	DWORD SyncTime();
 
 	// 状态上报
 	ErrorCodeEnum PushTerminalStage(char cNewStage, DWORD dwNewStageTime, char cOldStage, DWORD dwOldStageTime);
 
 	// KMC初始化
-	ErrorCodeEnum InitKMC();
+	DWORD InitKMC();
 		
 	// 获取WK更新请求包
 	// @nAlgFlag:  1:3des only; 2: sm4 only; 3: both 3des and sm4
@@ -82,7 +82,7 @@ public:
 
 	// 解析WK
 	// @nAlgFlag:  1:3des only; 2: sm4 only; 3: both 3des and sm4
-	ErrorCodeEnum ParseWKUpdateResult(char *pBuf, int nLen, int  nAlgFlag);
+	DWORD ParseWKUpdateResult(char *pBuf, int nLen, int  nAlgFlag);
 
 	// 获取KMC错误
 	CSimpleStringA GetKMCLastErrMsg();
@@ -93,19 +93,19 @@ public:
 	//ErrorCodeEnum PrintAllKeys(bool bSM);
 
 	// 加载新WK
-	ErrorCodeEnum LoadPinPadWK(bool bSM);
+	DWORD LoadPinPadWK(bool bSM);
 	
 	bool HexStrToByteArray(const char* pHex, BYTE *pBuf, int *pBufLen);
 	string ByteArrayToHexStr(BYTE *pBuf, int nBufLen);
 
 	// 调用PinPad加密(只支持DES加密，不支持SM)
-	ErrorCodeEnum EncryptDataWithPinPad(const CBlob &raw, CBlob &enc);
+	DWORD EncryptDataWithPinPad(const CBlob &raw, CBlob &enc);
 
-	// 生成RSA密钥对
-	ErrorCodeEnum CreateRsaKeyPair(CBlob &pubKey, CBlob &priKey);
+	// 生成SM2密钥对
+	DWORD CreateSM2KeyPair(CBlob &pubKey, CBlob &priKey);
 
 	// 保存密钥对到令牌实体
-	ErrorCodeEnum SaveRsaKeyPair(const CBlob &pubKey, const CBlob &priKey);
+	DWORD SaveSM2KeyPair(const CBlob &pubKey, const CBlob &priKey);
 
 	// 保存Token和共享会话密钥到令牌实体
 	ErrorCodeEnum SaveTokenAndSharedSK(const CBlob &token, const CBlob &sharedSK);
@@ -127,7 +127,7 @@ public:
 	bool GetTerminalPublicKey(BYTE *pBuf, int &nBufLen);
 	bool GetMD5Hash(const char *pStr, BYTE md5[16]);
 	
-	ErrorCodeEnum InitDevice(SpReqAnsContext<AccessAuthService_InitDev_Req, AccessAuthService_InitDev_Ans>::Pointer &ctx);
+	DWORD InitDevice(SpReqAnsContext<AccessAuthService_InitDev_Req, AccessAuthService_InitDev_Ans>::Pointer &ctx);
 
 	void SetAuthErrMsg(const char *pszErrMsg) { m_strAuthErrMsg = pszErrMsg; }
 	const char *GetAuthErrMsg() { return m_strAuthErrMsg; }
@@ -143,7 +143,15 @@ public:
 	wstring ANSIToUnicode(const string& str);
 	BOOL SetLocalTimeZoneByKeyName(const TCHAR* szTimeZoneKeyName, BOOL isDaylightSavingTime);
 
+	int ConvertStr2Byte(string input, BYTE* output, int outputLen);
+	void printPasswdError();
+	int CAccessAuthEntity::GetOrSetIsFirstSM(int type);
 
+	string m_TMK;
+	string m_TPK;
+	string m_EDK;
+	string m_index;
+	bool m_bGetKMCKey;
 protected:
 	CAccessAuthFSM m_FSM;