Viacheslav Klimov
7 months ago
10 changed files with 393 additions and 16 deletions
@ -0,0 +1,272 @@ |
|||
/** |
|||
* Copyright © 2016-2026 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.service.edge.rpc; |
|||
|
|||
import io.grpc.ManagedChannel; |
|||
import io.grpc.Server; |
|||
import io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts; |
|||
import io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder; |
|||
import io.grpc.netty.shaded.io.grpc.netty.NettyServerBuilder; |
|||
import org.bouncycastle.asn1.x500.X500Name; |
|||
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter; |
|||
import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder; |
|||
import org.bouncycastle.jce.provider.BouncyCastleProvider; |
|||
import org.bouncycastle.openssl.jcajce.JcaPEMWriter; |
|||
import org.bouncycastle.openssl.jcajce.JcePEMEncryptorBuilder; |
|||
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder; |
|||
import org.bouncycastle.util.io.pem.PemObject; |
|||
import org.junit.jupiter.api.AfterEach; |
|||
import org.junit.jupiter.params.ParameterizedTest; |
|||
import org.junit.jupiter.params.provider.EnumSource; |
|||
import org.springframework.test.util.ReflectionTestUtils; |
|||
import org.thingsboard.server.controller.AbstractWebTest; |
|||
import org.thingsboard.server.gen.edge.v1.EdgeRpcServiceGrpc; |
|||
|
|||
import java.io.ByteArrayInputStream; |
|||
import java.math.BigInteger; |
|||
import java.nio.charset.StandardCharsets; |
|||
import java.nio.file.Files; |
|||
import java.nio.file.Path; |
|||
import java.security.KeyPair; |
|||
import java.security.KeyPairGenerator; |
|||
import java.security.PrivateKey; |
|||
import java.security.Security; |
|||
import java.security.cert.X509Certificate; |
|||
import java.security.spec.ECGenParameterSpec; |
|||
import java.util.ArrayList; |
|||
import java.util.Date; |
|||
import java.util.List; |
|||
import java.util.concurrent.TimeUnit; |
|||
|
|||
import static org.assertj.core.api.Assertions.assertThat; |
|||
import static org.assertj.core.api.Assertions.assertThatThrownBy; |
|||
import static org.awaitility.Awaitility.await; |
|||
|
|||
/** |
|||
* Tests for Edge gRPC SSL setup using the production {@link EdgeGrpcService#setupSsl} method. |
|||
* <p> |
|||
* Covers: |
|||
* 1. Separate cert and key PEM inputs |
|||
* 2. Combined PEM (cert + key in one file) |
|||
* 3. Encrypted private key with password |
|||
* 4. Missing key in combined PEM → error |
|||
* <p> |
|||
* Each scenario is parameterized across key types: RSA-2048, RSA-4096, EC P-256, EC P-384. |
|||
*/ |
|||
class EdgeGrpcSslTest { |
|||
|
|||
static { |
|||
if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) { |
|||
Security.addProvider(new BouncyCastleProvider()); |
|||
} |
|||
} |
|||
|
|||
enum KeyType { |
|||
RSA_2048("RSA", 2048, null, "SHA256withRSA"), |
|||
RSA_4096("RSA", 4096, null, "SHA256withRSA"), |
|||
EC_P256("EC", 256, "secp256r1", "SHA256withECDSA"), |
|||
EC_P384("EC", 384, "secp384r1", "SHA384withECDSA"); |
|||
|
|||
final String algorithm; |
|||
final int size; |
|||
final String curve; |
|||
final String sigAlg; |
|||
|
|||
KeyType(String algorithm, int size, String curve, String sigAlg) { |
|||
this.algorithm = algorithm; |
|||
this.size = size; |
|||
this.curve = curve; |
|||
this.sigAlg = sigAlg; |
|||
} |
|||
|
|||
KeyPair generateKeyPair() throws Exception { |
|||
KeyPairGenerator kpg = KeyPairGenerator.getInstance(algorithm); |
|||
if (curve != null) { |
|||
kpg.initialize(new ECGenParameterSpec(curve)); |
|||
} else { |
|||
kpg.initialize(size); |
|||
} |
|||
return kpg.generateKeyPair(); |
|||
} |
|||
} |
|||
|
|||
private final List<Path> tempFiles = new ArrayList<>(); |
|||
private Server server; |
|||
private ManagedChannel channel; |
|||
|
|||
@AfterEach |
|||
void cleanup() throws Exception { |
|||
if (channel != null) { |
|||
channel.shutdownNow().awaitTermination(2, TimeUnit.SECONDS); |
|||
} |
|||
if (server != null) { |
|||
server.shutdownNow().awaitTermination(2, TimeUnit.SECONDS); |
|||
} |
|||
for (Path p : tempFiles) { |
|||
Files.deleteIfExists(p); |
|||
} |
|||
} |
|||
|
|||
@ParameterizedTest(name = "separateCertAndKey_{0}") |
|||
@EnumSource(KeyType.class) |
|||
void separateCertAndKey(KeyType keyType) throws Exception { |
|||
KeyPair kp = keyType.generateKeyPair(); |
|||
X509Certificate cert = generateSelfSignedCert(kp, keyType.sigAlg); |
|||
|
|||
Path certFile = writeTempPem("cert", cert); |
|||
Path keyFile = writeTempPem("key", kp.getPrivate()); |
|||
|
|||
server = startServer(certFile.toString(), keyFile.toString(), null); |
|||
assertTlsConnectivity(cert); |
|||
} |
|||
|
|||
@ParameterizedTest(name = "combinedPemWithCertAndKey_{0}") |
|||
@EnumSource(KeyType.class) |
|||
void combinedPemWithCertAndKey(KeyType keyType) throws Exception { |
|||
KeyPair kp = keyType.generateKeyPair(); |
|||
X509Certificate cert = generateSelfSignedCert(kp, keyType.sigAlg); |
|||
|
|||
Path combinedFile = writeTempPem("combined", cert, kp.getPrivate()); |
|||
|
|||
server = startServer(combinedFile.toString(), "", null); |
|||
assertTlsConnectivity(cert); |
|||
} |
|||
|
|||
// RSA-only: BouncyCastle writes encrypted EC keys in traditional PEM format (BEGIN EC PRIVATE KEY),
|
|||
// which after decryption produces a PEMKeyPair without public key info — causing PemSslCredentials
|
|||
// to fail with "Cannot invoke SubjectPublicKeyInfo.getEncoded() because getPublicKeyInfo() is null".
|
|||
@ParameterizedTest(name = "encryptedPrivateKey_{0}") |
|||
@EnumSource(value = KeyType.class, names = {"RSA_2048", "RSA_4096"}) |
|||
void encryptedPrivateKey(KeyType keyType) throws Exception { |
|||
KeyPair kp = keyType.generateKeyPair(); |
|||
X509Certificate cert = generateSelfSignedCert(kp, keyType.sigAlg); |
|||
String password = "test-password"; |
|||
|
|||
Path combinedFile = writeTempPemEncrypted("enc-combined", password, cert, kp.getPrivate()); |
|||
|
|||
server = startServer(combinedFile.toString(), "", password); |
|||
assertTlsConnectivity(cert); |
|||
} |
|||
|
|||
@ParameterizedTest(name = "combinedPemWithCertOnly_throwsException_{0}") |
|||
@EnumSource(KeyType.class) |
|||
void combinedPemWithCertOnly_throwsException(KeyType keyType) throws Exception { |
|||
KeyPair kp = keyType.generateKeyPair(); |
|||
X509Certificate cert = generateSelfSignedCert(kp, keyType.sigAlg); |
|||
|
|||
Path certOnlyFile = writeTempPem("cert-only", cert); |
|||
|
|||
assertThatThrownBy(() -> startServer(certOnlyFile.toString(), "", null)) |
|||
.isInstanceOf(IllegalArgumentException.class); |
|||
} |
|||
|
|||
// --- Server startup using production EdgeGrpcService.setupSsl() ---
|
|||
|
|||
private Server startServer(String certFileResource, String privateKeyResource, String keyPassword) throws Exception { |
|||
EdgeGrpcService edgeGrpcService = new EdgeGrpcService(); |
|||
ReflectionTestUtils.setField(edgeGrpcService, "certFileResource", certFileResource); |
|||
ReflectionTestUtils.setField(edgeGrpcService, "privateKeyResource", privateKeyResource); |
|||
ReflectionTestUtils.setField(edgeGrpcService, "keyPassword", keyPassword != null ? keyPassword : ""); |
|||
|
|||
NettyServerBuilder builder = NettyServerBuilder.forPort(0) |
|||
.addService(new EdgeRpcServiceGrpc.EdgeRpcServiceImplBase() {}); |
|||
|
|||
edgeGrpcService.setupSsl(builder); |
|||
|
|||
return builder.build().start(); |
|||
} |
|||
|
|||
private void assertTlsConnectivity(X509Certificate trustedCert) throws Exception { |
|||
String certPem = toPem(trustedCert); |
|||
var clientSsl = GrpcSslContexts.forClient() |
|||
.trustManager(new ByteArrayInputStream(certPem.getBytes(StandardCharsets.UTF_8))) |
|||
.build(); |
|||
|
|||
channel = NettyChannelBuilder.forAddress("localhost", server.getPort()) |
|||
.sslContext(clientSsl) |
|||
.build(); |
|||
|
|||
channel.getState(true); // trigger connection attempt
|
|||
await().atMost(AbstractWebTest.TIMEOUT, TimeUnit.SECONDS) |
|||
.pollInterval(50, TimeUnit.MILLISECONDS) |
|||
.untilAsserted(() -> { |
|||
var state = channel.getState(false); |
|||
if (state == io.grpc.ConnectivityState.TRANSIENT_FAILURE) { |
|||
throw new AssertionError("TLS handshake failed: channel in TRANSIENT_FAILURE"); |
|||
} |
|||
assertThat(state).isEqualTo(io.grpc.ConnectivityState.READY); |
|||
}); |
|||
} |
|||
|
|||
// --- Cert/key generation ---
|
|||
|
|||
private X509Certificate generateSelfSignedCert(KeyPair kp, String sigAlg) throws Exception { |
|||
X500Name subject = new X500Name("CN=localhost"); |
|||
Date now = new Date(); |
|||
return new JcaX509CertificateConverter().getCertificate( |
|||
new JcaX509v3CertificateBuilder( |
|||
subject, BigInteger.ONE, now, |
|||
new Date(now.getTime() + TimeUnit.DAYS.toMillis(1)), |
|||
subject, kp.getPublic()) |
|||
.build(new JcaContentSignerBuilder(sigAlg).build(kp.getPrivate()))); |
|||
} |
|||
|
|||
// --- PEM file helpers ---
|
|||
|
|||
private String toPem(Object obj) throws Exception { |
|||
java.io.StringWriter sw = new java.io.StringWriter(); |
|||
try (JcaPEMWriter w = new JcaPEMWriter(sw)) { |
|||
w.writeObject(obj); |
|||
} |
|||
return sw.toString(); |
|||
} |
|||
|
|||
private Path writeTempPem(String prefix, Object... objects) throws Exception { |
|||
Path p = Files.createTempFile(prefix + "-", ".pem"); |
|||
tempFiles.add(p); |
|||
try (JcaPEMWriter w = new JcaPEMWriter(Files.newBufferedWriter(p))) { |
|||
for (Object o : objects) { |
|||
w.writeObject(toPkcs8IfKey(o)); |
|||
} |
|||
} |
|||
return p; |
|||
} |
|||
|
|||
private Path writeTempPemEncrypted(String prefix, String password, Object... objects) throws Exception { |
|||
Path p = Files.createTempFile(prefix + "-", ".pem"); |
|||
tempFiles.add(p); |
|||
var encryptor = new JcePEMEncryptorBuilder("AES-256-CBC") |
|||
.setProvider(BouncyCastleProvider.PROVIDER_NAME) |
|||
.build(password.toCharArray()); |
|||
try (JcaPEMWriter w = new JcaPEMWriter(Files.newBufferedWriter(p))) { |
|||
for (Object o : objects) { |
|||
if (o instanceof PrivateKey) { |
|||
w.writeObject(o, encryptor); |
|||
} else { |
|||
w.writeObject(o); |
|||
} |
|||
} |
|||
} |
|||
return p; |
|||
} |
|||
|
|||
private Object toPkcs8IfKey(Object o) { |
|||
if (o instanceof PrivateKey pk) { |
|||
return new PemObject("PRIVATE KEY", pk.getEncoded()); |
|||
} |
|||
return o; |
|||
} |
|||
} |
|||
Loading…
Reference in new issue