Browse Source
[3.3.3] Fix corner case when access token matches user name in credentialspull/5627/head
Andrew Shvayka
5 years ago
committed by
GitHub
GitHub
5 changed files with 306 additions and 37 deletions
@ -0,0 +1,18 @@ |
|||
/** |
|||
* Copyright © 2016-2021 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.transport; |
|||
|
|||
enum BasicCredentialsValidationResult {HASH_MISMATCH, PASSWORD_MISMATCH, VALID} |
|||
@ -0,0 +1,226 @@ |
|||
/** |
|||
* Copyright © 2016-2021 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.transport.mqtt.credentials.sql; |
|||
|
|||
import com.fasterxml.jackson.core.type.TypeReference; |
|||
import org.apache.commons.lang3.RandomStringUtils; |
|||
import org.eclipse.paho.client.mqttv3.MqttAsyncClient; |
|||
import org.eclipse.paho.client.mqttv3.MqttConnectOptions; |
|||
import org.eclipse.paho.client.mqttv3.MqttException; |
|||
import org.eclipse.paho.client.mqttv3.MqttSecurityException; |
|||
import org.eclipse.paho.client.mqttv3.persist.MemoryPersistence; |
|||
import org.junit.After; |
|||
import org.junit.Assert; |
|||
import org.junit.Before; |
|||
import org.junit.Test; |
|||
import org.thingsboard.common.util.JacksonUtil; |
|||
import org.thingsboard.server.common.data.Device; |
|||
import org.thingsboard.server.common.data.StringUtils; |
|||
import org.thingsboard.server.common.data.Tenant; |
|||
import org.thingsboard.server.common.data.User; |
|||
import org.thingsboard.server.common.data.device.credentials.BasicMqttCredentials; |
|||
import org.thingsboard.server.common.data.device.profile.MqttTopics; |
|||
import org.thingsboard.server.common.data.security.Authority; |
|||
import org.thingsboard.server.common.data.security.DeviceCredentials; |
|||
import org.thingsboard.server.common.data.security.DeviceCredentialsType; |
|||
import org.thingsboard.server.dao.service.DaoSqlTest; |
|||
import org.thingsboard.server.transport.mqtt.AbstractMqttIntegrationTest; |
|||
|
|||
import java.util.Arrays; |
|||
import java.util.HashSet; |
|||
import java.util.List; |
|||
import java.util.Set; |
|||
|
|||
import static org.junit.Assert.assertEquals; |
|||
import static org.junit.Assert.assertNotNull; |
|||
import static org.junit.Assert.assertNull; |
|||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; |
|||
|
|||
@DaoSqlTest |
|||
public class BasicMqttCredentialsTest extends AbstractMqttIntegrationTest { |
|||
|
|||
public static final String CLIENT_ID = "ClientId"; |
|||
public static final String USER_NAME1 = "UserName1"; |
|||
public static final String USER_NAME2 = "UserName2"; |
|||
public static final String USER_NAME3 = "UserName3"; |
|||
public static final String PASSWORD = "secret"; |
|||
|
|||
private Device clientIdDevice; |
|||
private Device clientIdAndUserNameDevice1; |
|||
private Device clientIdAndUserNameAndPasswordDevice2; |
|||
private Device clientIdAndUserNameAndPasswordDevice3; |
|||
private Device accessTokenDevice; |
|||
private Device accessToken2Device; |
|||
|
|||
|
|||
@Before |
|||
public void before() throws Exception { |
|||
loginSysAdmin(); |
|||
|
|||
Tenant tenant = new Tenant(); |
|||
tenant.setTitle("My tenant"); |
|||
savedTenant = doPost("/api/tenant", tenant, Tenant.class); |
|||
Assert.assertNotNull(savedTenant); |
|||
|
|||
tenantAdmin = new User(); |
|||
tenantAdmin.setAuthority(Authority.TENANT_ADMIN); |
|||
tenantAdmin.setTenantId(savedTenant.getId()); |
|||
tenantAdmin.setEmail("tenant" + atomicInteger.getAndIncrement() + "@thingsboard.org"); |
|||
tenantAdmin.setFirstName("Joe"); |
|||
tenantAdmin.setLastName("Downs"); |
|||
|
|||
tenantAdmin = createUserAndLogin(tenantAdmin, "testPassword1"); |
|||
|
|||
BasicMqttCredentials credValue = new BasicMqttCredentials(); |
|||
credValue.setClientId(CLIENT_ID); |
|||
clientIdDevice = createDevice("clientIdDevice", credValue); |
|||
|
|||
credValue = new BasicMqttCredentials(); |
|||
credValue.setClientId(CLIENT_ID); |
|||
credValue.setUserName(USER_NAME1); |
|||
clientIdAndUserNameDevice1 = createDevice("clientIdAndUserNameDevice", credValue); |
|||
|
|||
credValue = new BasicMqttCredentials(); |
|||
credValue.setClientId(CLIENT_ID); |
|||
credValue.setUserName(USER_NAME2); |
|||
credValue.setPassword(PASSWORD); |
|||
clientIdAndUserNameAndPasswordDevice2 = createDevice("clientIdAndUserNameAndPasswordDevice", credValue); |
|||
|
|||
credValue = new BasicMqttCredentials(); |
|||
credValue.setClientId(CLIENT_ID); |
|||
credValue.setUserName(USER_NAME3); |
|||
credValue.setPassword(PASSWORD); |
|||
clientIdAndUserNameAndPasswordDevice3 = createDevice("clientIdAndUserNameAndPasswordDevice2", credValue); |
|||
|
|||
accessTokenDevice = createDevice("accessTokenDevice", USER_NAME1); |
|||
accessToken2Device = createDevice("accessToken2Device", USER_NAME2); |
|||
} |
|||
|
|||
@Test |
|||
public void testCorrectCredentials() throws Exception { |
|||
// Check that correct devices receive telemetry
|
|||
testTelemetryIsDelivered(accessTokenDevice, getMqttAsyncClient(null, USER_NAME1, null)); |
|||
testTelemetryIsDelivered(clientIdDevice, getMqttAsyncClient(CLIENT_ID, null, null)); |
|||
testTelemetryIsDelivered(clientIdAndUserNameDevice1, getMqttAsyncClient(CLIENT_ID, USER_NAME1, null)); |
|||
testTelemetryIsDelivered(clientIdAndUserNameAndPasswordDevice2, getMqttAsyncClient(CLIENT_ID, USER_NAME2, PASSWORD)); |
|||
|
|||
// Also correct. Random clientId and password, but matches access token
|
|||
testTelemetryIsDelivered(accessToken2Device, getMqttAsyncClient(RandomStringUtils.randomAlphanumeric(10), USER_NAME2, RandomStringUtils.randomAlphanumeric(10))); |
|||
} |
|||
|
|||
@Test(expected = MqttSecurityException.class) |
|||
public void testCorrectClientIdAndUserNameButWrongPassword() throws Exception { |
|||
// Not correct. Correct clientId and username, but wrong password
|
|||
testTelemetryIsNotDelivered(clientIdAndUserNameAndPasswordDevice3, getMqttAsyncClient(CLIENT_ID, USER_NAME3, "WRONG PASSWORD")); |
|||
} |
|||
|
|||
private void testTelemetryIsDelivered(Device device, MqttAsyncClient client) throws Exception { |
|||
testTelemetryIsDelivered(device, client, true); |
|||
} |
|||
|
|||
private void testTelemetryIsNotDelivered(Device device, MqttAsyncClient client) throws Exception { |
|||
testTelemetryIsDelivered(device, client, false); |
|||
} |
|||
|
|||
private void testTelemetryIsDelivered(Device device, MqttAsyncClient client, boolean ok) throws Exception { |
|||
String randomKey = RandomStringUtils.randomAlphanumeric(10); |
|||
List<String> expectedKeys = Arrays.asList(randomKey); |
|||
publishMqttMsg(client, JacksonUtil.toString(JacksonUtil.newObjectNode().put(randomKey, true)).getBytes(), MqttTopics.DEVICE_TELEMETRY_TOPIC); |
|||
|
|||
String deviceId = device.getId().getId().toString(); |
|||
|
|||
long start = System.currentTimeMillis(); |
|||
long end = System.currentTimeMillis() + 5000; |
|||
|
|||
List<String> actualKeys = null; |
|||
while (start <= end) { |
|||
actualKeys = doGetAsyncTyped("/api/plugins/telemetry/DEVICE/" + deviceId + "/keys/timeseries", new TypeReference<>() { |
|||
}); |
|||
if (actualKeys.size() == expectedKeys.size()) { |
|||
break; |
|||
} |
|||
Thread.sleep(100); |
|||
start += 100; |
|||
} |
|||
if (ok) { |
|||
assertNotNull(actualKeys); |
|||
|
|||
Set<String> actualKeySet = new HashSet<>(actualKeys); |
|||
Set<String> expectedKeySet = new HashSet<>(expectedKeys); |
|||
|
|||
assertEquals(expectedKeySet, actualKeySet); |
|||
} else { |
|||
assertNull(actualKeys); |
|||
} |
|||
client.disconnect().waitForCompletion(); |
|||
} |
|||
|
|||
@After |
|||
public void after() throws Exception { |
|||
processAfterTest(); |
|||
} |
|||
|
|||
protected MqttAsyncClient getMqttAsyncClient(String clientId, String username, String password) throws MqttException { |
|||
if (StringUtils.isEmpty(clientId)) { |
|||
clientId = MqttAsyncClient.generateClientId(); |
|||
} |
|||
MqttAsyncClient client = new MqttAsyncClient(MQTT_URL, clientId, new MemoryPersistence()); |
|||
|
|||
MqttConnectOptions options = new MqttConnectOptions(); |
|||
if (StringUtils.isNotEmpty(username)) { |
|||
options.setUserName(username); |
|||
} |
|||
if (StringUtils.isNotEmpty(password)) { |
|||
options.setPassword(password.toCharArray()); |
|||
} |
|||
client.connect(options).waitForCompletion(); |
|||
return client; |
|||
} |
|||
|
|||
private Device createDevice(String deviceName, BasicMqttCredentials clientIdCredValue) throws Exception { |
|||
Device device = new Device(); |
|||
device.setName(deviceName); |
|||
device.setType("default"); |
|||
|
|||
device = doPost("/api/device", device, Device.class); |
|||
|
|||
DeviceCredentials clientIdCred = |
|||
doGet("/api/device/" + device.getId().getId().toString() + "/credentials", DeviceCredentials.class); |
|||
|
|||
clientIdCred.setCredentialsType(DeviceCredentialsType.MQTT_BASIC); |
|||
|
|||
|
|||
clientIdCred.setCredentialsValue(JacksonUtil.toString(clientIdCredValue)); |
|||
doPost("/api/device/credentials", clientIdCred).andExpect(status().isOk()); |
|||
return device; |
|||
} |
|||
|
|||
private Device createDevice(String deviceName, String accessToken) throws Exception { |
|||
Device device = new Device(); |
|||
device.setName(deviceName); |
|||
device.setType("default"); |
|||
|
|||
device = doPost("/api/device", device, Device.class); |
|||
|
|||
DeviceCredentials clientIdCred = |
|||
doGet("/api/device/" + device.getId().getId().toString() + "/credentials", DeviceCredentials.class); |
|||
|
|||
clientIdCred.setCredentialsType(DeviceCredentialsType.ACCESS_TOKEN); |
|||
clientIdCred.setCredentialsId(accessToken); |
|||
doPost("/api/device/credentials", clientIdCred).andExpect(status().isOk()); |
|||
return device; |
|||
} |
|||
} |
|||
Loading…
Reference in new issue