From 71f936f68740026589ac7ae919d17cb7483f8a92 Mon Sep 17 00:00:00 2001
From: Andrii Landiak <andriylandiak@gmail.com>
Date: Wed, 12 Apr 2023 11:03:59 +0300
Subject: [PATCH] Add yaml config for java cacerts path and password to be able
 to configure

---
 .../src/main/resources/thingsboard.yml        |  3 ++
 .../validator/DeviceProfileDataValidator.java | 29 ++++++++++---------
 2 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/application/src/main/resources/thingsboard.yml b/application/src/main/resources/thingsboard.yml
index f745e03ffc..7f29ecfb8c 100644
--- a/application/src/main/resources/thingsboard.yml
+++ b/application/src/main/resources/thingsboard.yml
@@ -130,6 +130,9 @@ security:
     loginProcessingUrl: "${SECURITY_OAUTH2_LOGIN_PROCESSING_URL:/login/oauth2/code/}"
     githubMapper:
       emailUrl: "${SECURITY_OAUTH2_GITHUB_MAPPER_EMAIL_URL_KEY:https://api.github.com/user/emails}"
+  java_cacerts:
+    path: "${SECURITY_JAVA_CACERTS_PATH:${java.home}${file.separator}lib${file.separator}security${file.separator}cacerts}"
+    password: "${SECURITY_JAVA_CACERTS_PASSWORD:changeit}"
 
 # Usage statistics parameters
 usage:
diff --git a/dao/src/main/java/org/thingsboard/server/dao/service/validator/DeviceProfileDataValidator.java b/dao/src/main/java/org/thingsboard/server/dao/service/validator/DeviceProfileDataValidator.java
index 073b685167..7b142d08e3 100644
--- a/dao/src/main/java/org/thingsboard/server/dao/service/validator/DeviceProfileDataValidator.java
+++ b/dao/src/main/java/org/thingsboard/server/dao/service/validator/DeviceProfileDataValidator.java
@@ -19,6 +19,7 @@ import com.google.protobuf.Descriptors;
 import com.google.protobuf.DynamicMessage;
 import org.eclipse.leshan.core.util.SecurityUtil;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Lazy;
 import org.springframework.stereotype.Component;
 import org.springframework.util.Base64Utils;
@@ -56,14 +57,12 @@ import org.thingsboard.server.dao.queue.QueueService;
 import org.thingsboard.server.dao.rule.RuleChainService;
 import org.thingsboard.server.dao.tenant.TenantService;
 
-import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
-import java.security.cert.Certificate;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
 import java.security.cert.PKIXParameters;
@@ -99,6 +98,12 @@ public class DeviceProfileDataValidator extends AbstractHasOtaPackageValidator<D
     @Autowired
     private DashboardService dashboardService;
 
+    @Value("${security.java_cacerts.path}")
+    private String javaCacertsPath;
+
+    @Value("${security.java_cacerts.password}")
+    private String javaCacertsPassword;
+
     @Override
     protected void validateDataImpl(TenantId tenantId, DeviceProfile deviceProfile) {
         if (StringUtils.isEmpty(deviceProfile.getName())) {
@@ -132,8 +137,8 @@ public class DeviceProfileDataValidator extends AbstractHasOtaPackageValidator<D
         if (deviceProfile.getProvisionType() == null) {
             deviceProfile.setProvisionType(DeviceProfileProvisionType.DISABLED);
         }
-        if (deviceProfile.getProvisionDeviceKey() != null) {
-            if (getRootCAFromJavaCacerts(deviceProfile.getProvisionDeviceKey())) {
+        if (deviceProfile.getProvisionDeviceKey() != null && DeviceProfileProvisionType.X509_CERTIFICATE_CHAIN.equals(deviceProfile.getProvisionType())) {
+            if (isDeviceProfileCertificateInJavaCacerts(deviceProfile.getProfileData().getProvisionConfiguration().getProvisionDeviceSecret())) {
                 throw new DataValidationException("Device profile certificate cannot be well known root CA!");
             }
         }
@@ -230,8 +235,8 @@ public class DeviceProfileDataValidator extends AbstractHasOtaPackageValidator<D
                 throw new DataValidationException(message);
             }
         }
-        if (deviceProfile.getProvisionDeviceKey() != null) {
-            if (getRootCAFromJavaCacerts(deviceProfile.getProvisionDeviceKey())) {
+        if (deviceProfile.getProvisionDeviceKey() != null && DeviceProfileProvisionType.X509_CERTIFICATE_CHAIN.equals(deviceProfile.getProvisionType())) {
+            if (isDeviceProfileCertificateInJavaCacerts(deviceProfile.getProvisionDeviceKey())) {
                 throw new DataValidationException("Device profile certificate cannot be well known root CA!");
             }
         }
@@ -388,18 +393,16 @@ public class DeviceProfileDataValidator extends AbstractHasOtaPackageValidator<D
         }
     }
 
-    boolean getRootCAFromJavaCacerts(String deviceProfileHash) {
+    private boolean isDeviceProfileCertificateInJavaCacerts(String deviceProfileX509Secret) {
         try {
-            String filename = System.getProperty("java.home") + "/lib/security/cacerts".replace('/', File.separatorChar);
-            FileInputStream is = new FileInputStream(filename);
+            FileInputStream is = new FileInputStream(javaCacertsPath);
             KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
-            String password = "changeit";
-            keystore.load(is, password.toCharArray());
+            keystore.load(is, javaCacertsPassword.toCharArray());
 
             PKIXParameters params = new PKIXParameters(keystore);
             for (TrustAnchor ta : params.getTrustAnchors()) {
                 X509Certificate cert = ta.getTrustedCert();
-                if (EncryptionUtil.getSha3Hash(getCertificateString(cert)).equals(deviceProfileHash)) {
+                if (getCertificateString(cert).equals(deviceProfileX509Secret)) {
                     return true;
                 }
             }
@@ -409,7 +412,7 @@ public class DeviceProfileDataValidator extends AbstractHasOtaPackageValidator<D
         return false;
     }
 
-    private String getCertificateString(Certificate cert) throws CertificateEncodingException {
+    private String getCertificateString(X509Certificate cert) throws CertificateEncodingException {
         return EncryptionUtil.certTrimNewLines(Base64Utils.encodeToString(cert.getEncoded()));
     }
 }