tsai
/
thingsboard
mirror of https://github.com/thingsboard/thingsboard.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Merge pull request #5294 from thingsboard/lwm2m_keys_to_base64 

Lwm2m keys to base64
pull/5314/head
Yevhen Bondarenko 5 years ago
committed by GitHub
parent
bb2efb145b 9186377b97
commit
b5ab7f98ca
No known key found for this signature in database GPG Key ID: 4AEE18F83AFDEB23
14 changed files with 128 additions and 84 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 2
      application/src/test/java/org/thingsboard/server/transport/coap/provision/AbstractCoapProvisionJsonDeviceTest.java
  2. 2
      application/src/test/java/org/thingsboard/server/transport/coap/provision/AbstractCoapProvisionProtoDeviceTest.java
  3. 6
      application/src/test/java/org/thingsboard/server/transport/lwm2m/security/sql/RpkLwM2MIntegrationTest.java
  4. 2
      application/src/test/java/org/thingsboard/server/transport/mqtt/provision/AbstractMqttProvisionJsonDeviceTest.java
  5. 2
      application/src/test/java/org/thingsboard/server/transport/mqtt/provision/AbstractMqttProvisionProtoDeviceTest.java
  6. 19
      common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientSecurityCredentials.java
  7. 4
      common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MServerCredentialsWithKeys.java
  8. 14
      common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/PSKClientCredentials.java
  9. 13
      common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/RPKClientCredentials.java
  10. 13
      common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/X509ClientCredentials.java
  11. 23
      common/message/src/main/java/org/thingsboard/server/common/msg/EncryptionUtil.java
  12. 13
      common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/LwM2mCredentialsSecurityInfoValidator.java
  13. 2
      common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/util/SslUtil.java
  14. 97
      dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java

2
application/src/test/java/org/thingsboard/server/transport/coap/provision/AbstractCoapProvisionJsonDeviceTest.java
View File

@ -146,7 +146,7 @@ public abstract class AbstractCoapProvisionJsonDeviceTest extends AbstractCoapIn
Assert.assertEquals(deviceCredentials.getCredentialsType().name(), response.get("credentialsType").getAsString());
Assert.assertEquals(deviceCredentials.getCredentialsType().name(), "X509_CERTIFICATE");
String cert = EncryptionUtil.trimNewLines(deviceCredentials.getCredentialsValue());
String cert = EncryptionUtil.certTrimNewLines(deviceCredentials.getCredentialsValue());
String sha3Hash = EncryptionUtil.getSha3Hash(cert);
Assert.assertEquals(deviceCredentials.getCredentialsId(), sha3Hash);

2
application/src/test/java/org/thingsboard/server/transport/coap/provision/AbstractCoapProvisionProtoDeviceTest.java
View File

@ -145,7 +145,7 @@ public abstract class AbstractCoapProvisionProtoDeviceTest extends AbstractCoapI
Assert.assertEquals(deviceCredentials.getCredentialsType().name(), response.getCredentialsType().toString());
Assert.assertEquals(deviceCredentials.getCredentialsType(), DeviceCredentialsType.X509_CERTIFICATE);
String cert = EncryptionUtil.trimNewLines(deviceCredentials.getCredentialsValue());
String cert = EncryptionUtil.certTrimNewLines(deviceCredentials.getCredentialsValue());
String sha3Hash = EncryptionUtil.getSha3Hash(cert);
Assert.assertEquals(deviceCredentials.getCredentialsId(), sha3Hash);

6
application/src/test/java/org/thingsboard/server/transport/lwm2m/security/sql/RpkLwM2MIntegrationTest.java
View File

@ -16,11 +16,12 @@
package org.thingsboard.server.transport.lwm2m.security.sql;
import org.eclipse.leshan.client.object.Security;
import org.eclipse.leshan.core.util.Hex;
import org.junit.Test;
import org.thingsboard.server.common.data.device.credentials.lwm2m.RPKClientCredentials;
import org.thingsboard.server.transport.lwm2m.security.AbstractSecurityLwM2MIntegrationTest;
import org.apache.commons.codec.binary.Base64;;
import static org.eclipse.leshan.client.object.Security.rpk;
import static org.thingsboard.server.transport.lwm2m.Lwm2mTestHelper.SECURE_COAP_CONFIG;
import static org.thingsboard.server.transport.lwm2m.Lwm2mTestHelper.SECURE_URI;
@ -32,7 +33,7 @@ public class RpkLwM2MIntegrationTest extends AbstractSecurityLwM2MIntegrationTes
public void testConnectWithRPKAndObserveTelemetry() throws Exception {
RPKClientCredentials rpkClientCredentials = new RPKClientCredentials();
rpkClientCredentials.setEndpoint(ENDPOINT);
rpkClientCredentials.setKey(Hex.encodeHexString(clientPublicKey.getEncoded()));
rpkClientCredentials.setKey(new String(Base64.encodeBase64(clientPublicKey.getEncoded())));
Security security = rpk(SECURE_URI,
SHORT_SERVER_ID,
clientPublicKey.getEncoded(),
@ -40,5 +41,4 @@ public class RpkLwM2MIntegrationTest extends AbstractSecurityLwM2MIntegrationTes
serverX509Cert.getPublicKey().getEncoded());
super.basicTestConnectionObserveTelemetry(security, rpkClientCredentials, SECURE_COAP_CONFIG, ENDPOINT);
}
}

2
application/src/test/java/org/thingsboard/server/transport/mqtt/provision/AbstractMqttProvisionJsonDeviceTest.java
View File

@ -152,7 +152,7 @@ public abstract class AbstractMqttProvisionJsonDeviceTest extends AbstractMqttIn
Assert.assertEquals(deviceCredentials.getCredentialsType().name(), response.get("credentialsType").getAsString());
Assert.assertEquals(deviceCredentials.getCredentialsType().name(), "X509_CERTIFICATE");
String cert = EncryptionUtil.trimNewLines(deviceCredentials.getCredentialsValue());
String cert = EncryptionUtil.certTrimNewLines(deviceCredentials.getCredentialsValue());
String sha3Hash = EncryptionUtil.getSha3Hash(cert);
Assert.assertEquals(deviceCredentials.getCredentialsId(), sha3Hash);

2
application/src/test/java/org/thingsboard/server/transport/mqtt/provision/AbstractMqttProvisionProtoDeviceTest.java
View File

@ -154,7 +154,7 @@ public abstract class AbstractMqttProvisionProtoDeviceTest extends AbstractMqttI
Assert.assertEquals(deviceCredentials.getCredentialsType().name(), response.getCredentialsType().toString());
Assert.assertEquals(deviceCredentials.getCredentialsType(), DeviceCredentialsType.X509_CERTIFICATE);
String cert = EncryptionUtil.trimNewLines(deviceCredentials.getCredentialsValue());
String cert = EncryptionUtil.certTrimNewLines(deviceCredentials.getCredentialsValue());
String sha3Hash = EncryptionUtil.getSha3Hash(cert);
Assert.assertEquals(deviceCredentials.getCredentialsId(), sha3Hash);

19
common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java → common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientSecurityCredentials.java
View File

@ -15,25 +15,16 @@
*/
package org.thingsboard.server.common.data.device.credentials.lwm2m;
import com.fasterxml.jackson.annotation.JsonIgnore;
import lombok.Getter;
import lombok.Setter;
import lombok.SneakyThrows;
import org.apache.commons.codec.binary.Hex;
import org.apache.commons.codec.DecoderException;
public abstract class AbstractLwM2MClientCredentialsWithKey extends AbstractLwM2MClientCredentials {
public abstract class AbstractLwM2MClientSecurityCredentials extends AbstractLwM2MClientCredentials {
@Getter
@Setter
private String key;
protected String key;
private byte[] keyInBytes;
protected byte[] securityInBytes;
@SneakyThrows
@JsonIgnore
public byte[] getDecodedKey() {
if (keyInBytes == null) {
keyInBytes = Hex.decodeHex(key.toLowerCase().toCharArray());
}
return keyInBytes;
}
public abstract byte[] getDecoded() throws IllegalArgumentException, DecoderException;
}

4
common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MServerCredentialsWithKeys.java
View File

@ -19,7 +19,7 @@ import com.fasterxml.jackson.annotation.JsonIgnore;
import lombok.Getter;
import lombok.Setter;
import lombok.SneakyThrows;
import org.apache.commons.codec.binary.Hex;
import org.apache.commons.codec.binary.Base64;
@Getter
@Setter
@ -40,6 +40,6 @@ public abstract class AbstractLwM2MServerCredentialsWithKeys implements LwM2MSer
@SneakyThrows
private static byte[] getDecoded(String key) {
return Hex.decodeHex(key.toLowerCase().toCharArray());
return Base64.decodeBase64(key.getBytes());
}
}

14
common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/PSKClientCredentials.java
View File

@ -17,14 +17,24 @@ package org.thingsboard.server.common.data.device.credentials.lwm2m;
import lombok.Getter;
import lombok.Setter;
import org.apache.commons.codec.DecoderException;
import org.apache.commons.codec.binary.Hex;
@Getter
@Setter
public class PSKClientCredentials extends AbstractLwM2MClientCredentialsWithKey {
public class PSKClientCredentials extends AbstractLwM2MClientSecurityCredentials {
private String identity;
@Override
public LwM2MSecurityMode getSecurityConfigClientMode() {
return LwM2MSecurityMode.PSK;
}
}
@Override
public byte[] getDecoded() throws IllegalArgumentException, DecoderException {
if (securityInBytes == null) {
securityInBytes = Hex.decodeHex(key.toLowerCase().toCharArray());
}
return securityInBytes;
}
}

13
common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/RPKClientCredentials.java
View File

@ -15,10 +15,21 @@
*/
package org.thingsboard.server.common.data.device.credentials.lwm2m;
public class RPKClientCredentials extends AbstractLwM2MClientCredentialsWithKey {
import org.apache.commons.codec.DecoderException;
import org.apache.commons.codec.binary.Base64;
public class RPKClientCredentials extends AbstractLwM2MClientSecurityCredentials {
@Override
public LwM2MSecurityMode getSecurityConfigClientMode() {
return LwM2MSecurityMode.RPK;
}
@Override
public byte[] getDecoded() throws IllegalArgumentException, DecoderException {
if (securityInBytes == null) {
securityInBytes = Base64.decodeBase64(key.getBytes());
}
return securityInBytes;
}
}

13
common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/X509ClientCredentials.java
View File

@ -17,14 +17,25 @@ package org.thingsboard.server.common.data.device.credentials.lwm2m;
import lombok.Getter;
import lombok.Setter;
import org.apache.commons.codec.DecoderException;
import org.apache.commons.codec.binary.Base64;
@Getter
@Setter
public class X509ClientCredentials extends AbstractLwM2MClientCredentials {
public class X509ClientCredentials extends AbstractLwM2MClientSecurityCredentials {
private String cert;
@Override
public LwM2MSecurityMode getSecurityConfigClientMode() {
return LwM2MSecurityMode.X509;
}
@Override
public byte[] getDecoded() throws IllegalArgumentException, DecoderException {
if (securityInBytes == null && cert != null) {
securityInBytes = Base64.decodeBase64(cert.getBytes());
}
return securityInBytes;
}
}

23
common/message/src/main/java/org/thingsboard/server/common/msg/EncryptionUtil.java
View File

@ -28,15 +28,30 @@ public class EncryptionUtil {
private EncryptionUtil() {
}
public static String trimNewLines(String input) {
public static String certTrimNewLines(String input) {
return input.replaceAll("-----BEGIN CERTIFICATE-----", "")
.replaceAll("-----END CERTIFICATE-----", "")
.replaceAll("\n", "")
.replaceAll("\r", "");
.replaceAll("\r", "")
.replaceAll("-----END CERTIFICATE-----", "");
}
public static String pubkTrimNewLines(String input) {
return input.replaceAll("-----BEGIN PUBLIC KEY-----", "")
.replaceAll("\n", "")
.replaceAll("\r", "")
.replaceAll("-----END PUBLIC KEY-----", "");
}
public static String prikTrimNewLines(String input) {
return input.replaceAll("-----BEGIN EC PRIVATE KEY-----", "")
.replaceAll("\n", "")
.replaceAll("\r", "")
.replaceAll("-----END EC PRIVATE KEY-----", "");
}
public static String getSha3Hash(String data) {
String trimmedData = trimNewLines(data);
String trimmedData = certTrimNewLines(data);
byte[] dataBytes = trimmedData.getBytes();
SHA3Digest md = new SHA3Digest(256);
md.reset();

13
common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/LwM2mCredentialsSecurityInfoValidator.java
View File

@ -17,6 +17,7 @@ package org.thingsboard.server.transport.lwm2m.secure;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.codec.DecoderException;
import org.eclipse.leshan.core.util.SecurityUtil;
import org.eclipse.leshan.server.security.SecurityInfo;
import org.springframework.stereotype.Component;
@ -146,14 +147,14 @@ public class LwM2mCredentialsSecurityInfoValidator {
PSKClientCredentials pskConfig = (PSKClientCredentials) clientCredentialsConfig;
if (StringUtils.isNotEmpty(pskConfig.getIdentity())) {
try {
if (pskConfig.getDecodedKey() != null && pskConfig.getDecodedKey().length > 0) {
if (pskConfig.getDecoded() != null && pskConfig.getDecoded().length > 0) {
endpoint = StringUtils.isNotEmpty(pskConfig.getEndpoint()) ? pskConfig.getEndpoint() : endpoint;
if (endpoint != null && !endpoint.isEmpty()) {
result.setSecurityInfo(SecurityInfo.newPreSharedKeyInfo(endpoint, pskConfig.getIdentity(), pskConfig.getDecodedKey()));
result.setSecurityInfo(SecurityInfo.newPreSharedKeyInfo(endpoint, pskConfig.getIdentity(), pskConfig.getDecoded()));
result.setSecurityMode(PSK);
}
}
} catch (IllegalArgumentException e) {
} catch (IllegalArgumentException | DecoderException e) {
log.error("Missing PSK key: " + e.getMessage());
}
} else {
@ -164,14 +165,14 @@ public class LwM2mCredentialsSecurityInfoValidator {
private void createClientSecurityInfoRPK(TbLwM2MSecurityInfo result, String endpoint, LwM2MClientCredentials clientCredentialsConfig) {
RPKClientCredentials rpkConfig = (RPKClientCredentials) clientCredentialsConfig;
try {
if (rpkConfig.getDecodedKey() != null) {
PublicKey key = SecurityUtil.publicKey.decode(rpkConfig.getDecodedKey());
if (rpkConfig.getDecoded() != null) {
PublicKey key = SecurityUtil.publicKey.decode(rpkConfig.getDecoded());
result.setSecurityInfo(SecurityInfo.newRawPublicKeyInfo(endpoint, key));
result.setSecurityMode(RPK);
} else {
log.error("Missing RPK key");
}
} catch (IllegalArgumentException | IOException | GeneralSecurityException e) {
} catch (IllegalArgumentException | IOException | GeneralSecurityException | DecoderException e) {
log.error("RPK: Invalid security info content: " + e.getMessage());
}
}

2
common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/util/SslUtil.java
View File

@ -33,6 +33,6 @@ public class SslUtil {
public static String getCertificateString(Certificate cert)
throws CertificateEncodingException {
return EncryptionUtil.trimNewLines(Base64Utils.encodeToString(cert.getEncoded()));
return EncryptionUtil.certTrimNewLines(Base64Utils.encodeToString(cert.getEncoded()));
}
}

97
dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java
View File

@ -17,7 +17,6 @@ package org.thingsboard.server.dao.device;
import lombok.extern.slf4j.Slf4j;
import org.eclipse.leshan.core.util.Base64;
import org.eclipse.leshan.core.util.SecurityUtil;
import org.hibernate.exception.ConstraintViolationException;
import org.springframework.beans.factory.annotation.Autowired;
@ -118,7 +117,7 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen
formatSimpleMqttCredentials(deviceCredentials);
break;
case LWM2M_CREDENTIALS:
formatSimpleLwm2mCredentials(deviceCredentials);
formatAndValidateSimpleLwm2mCredentials(deviceCredentials);
break;
}
}
@ -155,13 +154,13 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen
}
private void formatCertData(DeviceCredentials deviceCredentials) {
String cert = EncryptionUtil.trimNewLines(deviceCredentials.getCredentialsValue());
String cert = EncryptionUtil.certTrimNewLines(deviceCredentials.getCredentialsValue());
String sha3Hash = EncryptionUtil.getSha3Hash(cert);
deviceCredentials.setCredentialsId(sha3Hash);
deviceCredentials.setCredentialsValue(cert);
}
private void formatSimpleLwm2mCredentials(DeviceCredentials deviceCredentials) {
private void formatAndValidateSimpleLwm2mCredentials(DeviceCredentials deviceCredentials) {
LwM2MDeviceCredentials lwM2MCredentials;
try {
lwM2MCredentials = JacksonUtil.fromString(deviceCredentials.getCredentialsValue(), LwM2MDeviceCredentials.class);
@ -172,26 +171,23 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen
String credentialsId = null;
LwM2MClientCredentials clientCredentials = lwM2MCredentials.getClient();
switch (clientCredentials.getSecurityConfigClientMode()) {
case NO_SEC:
case RPK:
deviceCredentials.setCredentialsValue(JacksonUtil.toString(lwM2MCredentials));
credentialsId = clientCredentials.getEndpoint();
break;
case PSK:
credentialsId = ((PSKClientCredentials) clientCredentials).getIdentity();
break;
case X509:
X509ClientCredentials x509Config = (X509ClientCredentials) clientCredentials;
if ((StringUtils.isNotBlank(x509Config.getCert()))) {
String cert = EncryptionUtil.trimNewLines(x509Config.getCert());
String sha3Hash = EncryptionUtil.getSha3Hash(cert);
x509Config.setCert(cert);
((X509ClientCredentials) clientCredentials).setCert(cert);
deviceCredentials.setCredentialsValue(JacksonUtil.toString(lwM2MCredentials));
deviceCredentials.setCredentialsValue(JacksonUtil.toString(lwM2MCredentials));
X509ClientCredentials x509ClientConfig = (X509ClientCredentials) clientCredentials;
if ((StringUtils.isNotBlank(x509ClientConfig.getCert()))) {
String sha3Hash = EncryptionUtil.getSha3Hash(x509ClientConfig.getCert());
credentialsId = sha3Hash;
} else {
credentialsId = x509Config.getEndpoint();
credentialsId = x509ClientConfig.getEndpoint();
}
break;
}
@ -231,7 +227,7 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen
}
private void validateLwM2MClientCredentials(LwM2MClientCredentials clientCredentials) {
if (StringUtils.isEmpty(clientCredentials.getEndpoint())) {
if (StringUtils.isBlank(clientCredentials.getEndpoint())) {
throw new DeviceCredentialsValidationException("LwM2M client endpoint should be specified!");
}
@ -240,43 +236,46 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen
break;
case PSK:
PSKClientCredentials pskCredentials = (PSKClientCredentials) clientCredentials;
if (StringUtils.isEmpty(pskCredentials.getIdentity())) {
if (StringUtils.isBlank(pskCredentials.getIdentity())) {
throw new DeviceCredentialsValidationException("LwM2M client PSK identity should be specified!");
}
String pskKey = pskCredentials.getKey();
if (StringUtils.isEmpty(pskKey)) {
if (StringUtils.isBlank(pskKey)) {
throw new DeviceCredentialsValidationException("LwM2M client PSK key should be specified!");
}
if (!pskKey.matches("-?[0-9a-fA-F]+")) {
throw new DeviceCredentialsValidationException("LwM2M client PSK key should be HexDecimal format!");
throw new DeviceCredentialsValidationException("LwM2M client PSK key should be random sequence in hex encoding!");
}
if (pskKey.length() % 32 != 0 || pskKey.length() > 128) {
throw new DeviceCredentialsValidationException("LwM2M client PSK key must be 32, 64, 128 characters!");
if (pskKey.length()% 32 != 0 || pskKey.length() > 128) {
throw new DeviceCredentialsValidationException("LwM2M client PSK key length = " + pskKey.length() + ". Key should be HexDec format: 32, 64, 128 characters!");
}
break;
case RPK:
RPKClientCredentials rpkCredentials = (RPKClientCredentials) clientCredentials;
if (StringUtils.isEmpty(rpkCredentials.getKey())) {
if (StringUtils.isBlank(rpkCredentials.getKey())) {
throw new DeviceCredentialsValidationException("LwM2M client RPK key should be specified!");
}
try {
SecurityUtil.publicKey.decode(rpkCredentials.getDecodedKey());
String pubkClient = EncryptionUtil.pubkTrimNewLines(rpkCredentials.getKey());
rpkCredentials.setKey(pubkClient);
SecurityUtil.publicKey.decode(rpkCredentials.getDecoded());
} catch (Exception e) {
throw new DeviceCredentialsValidationException("LwM2M client RPK key should be in RFC7250 standard!");
throw new DeviceCredentialsValidationException("LwM2M client RPK key should be in RFC7250 standard and support only EC algorithm and encoded to Base64 format!");
}
break;
case X509:
X509ClientCredentials x509CCredentials = (X509ClientCredentials) clientCredentials;
if (StringUtils.isNotBlank(x509CCredentials.getCert())) {
if (StringUtils.isNotEmpty(x509CCredentials.getCert())) {
try {
SecurityUtil.certificate.decode(Base64.decodeBase64(x509CCredentials.getCert()));
String certClient = EncryptionUtil.certTrimNewLines(x509CCredentials.getCert());
x509CCredentials.setCert(certClient);
SecurityUtil.certificate.decode(x509CCredentials.getDecoded());
} catch (Exception e) {
throw new DeviceCredentialsValidationException("LwM2M client X509 certificate should be in DER-encoded X.509 format!");
throw new DeviceCredentialsValidationException("LwM2M client X509 certificate should be in DER-encoded X509v3 format and support only EC algorithm and encoded to Base64 format!");
}
}
break;
@ -289,65 +288,71 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen
break;
case PSK:
PSKServerCredentials pskCredentials = (PSKServerCredentials) serverCredentials;
if (StringUtils.isEmpty(pskCredentials.getClientPublicKeyOrId())) {
if (StringUtils.isBlank(pskCredentials.getClientPublicKeyOrId())) {
throw new DeviceCredentialsValidationException(server + " client PSK public key or id should be specified!");
}
String pskKey = pskCredentials.getClientSecretKey();
if (StringUtils.isEmpty(pskKey)) {
if (StringUtils.isBlank(pskKey)) {
throw new DeviceCredentialsValidationException(server + " client PSK key should be specified!");
}
if (!pskKey.matches("-?[0-9a-fA-F]+")) {
throw new DeviceCredentialsValidationException(server + " client PSK key should be HexDecimal format!");
throw new DeviceCredentialsValidationException(server + " client PSK key should be random sequence in hex encoding!");
}
if (pskKey.length() % 32 != 0 || pskKey.length() > 128) {
throw new DeviceCredentialsValidationException(server + " client PSK key must be 32, 64, 128 characters!");
throw new DeviceCredentialsValidationException(server + " client PSK key length = " + pskKey.length() + ". Key should be HexDec format: 32, 64, 128 characters!");
}
break;
case RPK:
RPKServerCredentials rpkCredentials = (RPKServerCredentials) serverCredentials;
if (StringUtils.isEmpty(rpkCredentials.getClientPublicKeyOrId())) {
RPKServerCredentials rpkServerCredentials = (RPKServerCredentials) serverCredentials;
if (StringUtils.isEmpty(rpkServerCredentials.getClientPublicKeyOrId())) {
throw new DeviceCredentialsValidationException(server + " client RPK public key or id should be specified!");
}
try {
SecurityUtil.publicKey.decode(rpkCredentials.getDecodedClientPublicKeyOrId());
String pubkRpkSever = EncryptionUtil.pubkTrimNewLines(rpkServerCredentials.getClientPublicKeyOrId());
rpkServerCredentials.setClientPublicKeyOrId(pubkRpkSever);
SecurityUtil.publicKey.decode(rpkServerCredentials.getDecodedClientPublicKeyOrId());
} catch (Exception e) {
throw new DeviceCredentialsValidationException(server + " client RPK public key or id should be in RFC7250 standard!");
throw new DeviceCredentialsValidationException(server + " client RPK public key or id should be in RFC7250 standard and encoded to Base64 format!");
}
if (StringUtils.isEmpty(rpkCredentials.getClientSecretKey())) {
if (StringUtils.isEmpty(rpkServerCredentials.getClientSecretKey())) {
throw new DeviceCredentialsValidationException(server + " client RPK secret key should be specified!");
}
try {
SecurityUtil.privateKey.decode(rpkCredentials.getDecodedClientSecretKey());
String prikRpkSever = EncryptionUtil.prikTrimNewLines(rpkServerCredentials.getClientSecretKey());
rpkServerCredentials.setClientSecretKey(prikRpkSever);
SecurityUtil.privateKey.decode(rpkServerCredentials.getDecodedClientSecretKey());
} catch (Exception e) {
throw new DeviceCredentialsValidationException(server + " client RPK secret key should be in RFC5958 standard!");
throw new DeviceCredentialsValidationException(server + " client RPK secret key should be in PKCS#8 format (DER encoding, RFC5958 standard) and encoded to Base64 format!");
}
break;
case X509:
X509ServerCredentials x509CCredentials = (X509ServerCredentials) serverCredentials;
if (StringUtils.isEmpty(x509CCredentials.getClientPublicKeyOrId())) {
X509ServerCredentials x509ServerCredentials = (X509ServerCredentials) serverCredentials;
if (StringUtils.isBlank(x509ServerCredentials.getClientPublicKeyOrId())) {
throw new DeviceCredentialsValidationException(server + " client X509 public key or id should be specified!");
}
try {
SecurityUtil.certificate.decode(x509CCredentials.getDecodedClientPublicKeyOrId());
String certServer = EncryptionUtil.certTrimNewLines(x509ServerCredentials.getClientPublicKeyOrId());
x509ServerCredentials.setClientPublicKeyOrId(certServer);
SecurityUtil.certificate.decode(x509ServerCredentials.getDecodedClientPublicKeyOrId());
} catch (Exception e) {
throw new DeviceCredentialsValidationException(server + " client X509 public key or id should be in DER-encoded X.509 format!");
throw new DeviceCredentialsValidationException(server + " client X509 public key or id should be in DER-encoded X509v3 format and support only EC algorithm and encoded to Base64 format!");
}
if (StringUtils.isEmpty(x509CCredentials.getClientSecretKey())) {
if (StringUtils.isBlank(x509ServerCredentials.getClientSecretKey())) {
throw new DeviceCredentialsValidationException(server + " client X509 secret key should be specified!");
}
try {
SecurityUtil.privateKey.decode(x509CCredentials.getDecodedClientSecretKey());
String prikX509Sever = EncryptionUtil.prikTrimNewLines(x509ServerCredentials.getClientSecretKey());
x509ServerCredentials.setClientSecretKey(prikX509Sever);
SecurityUtil.privateKey.decode(x509ServerCredentials.getDecodedClientSecretKey());
} catch (Exception e) {
throw new DeviceCredentialsValidationException(server + " client X509 secret key should be in RFC5958 standard!");
throw new DeviceCredentialsValidationException(server + " client X509 secret key should be in PKCS#8 format (DER encoding, RFC5958 standard) and encoded to Base64 format!");
}
break;
}

Write Preview
Loading…
Cancel
Save