From 287657ae861bd136e0733aa394b1d7c032faef71 Mon Sep 17 00:00:00 2001 From: nickAS21 Date: Mon, 27 Sep 2021 17:54:28 +0300 Subject: [PATCH 1/6] Lwm2m credentials base64 validate back --- ...AbstractLwM2MClientCredentialsWithKey.java | 6 +-- ...bstractLwM2MServerCredentialsWithKeys.java | 4 +- .../lwm2m/X509ClientCredentials.java | 14 ++++++ .../device/DeviceCredentialsServiceImpl.java | 46 +++++++++---------- 4 files changed, 40 insertions(+), 30 deletions(-) diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java index 2a3c0ab434..4279694909 100644 --- a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java +++ b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java @@ -19,7 +19,7 @@ import com.fasterxml.jackson.annotation.JsonIgnore; import lombok.Getter; import lombok.Setter; import lombok.SneakyThrows; -import org.apache.commons.codec.binary.Hex; +import org.apache.commons.codec.binary.Base64; public abstract class AbstractLwM2MClientCredentialsWithKey extends AbstractLwM2MClientCredentials { @Getter @@ -30,9 +30,9 @@ public abstract class AbstractLwM2MClientCredentialsWithKey extends AbstractLwM2 @SneakyThrows @JsonIgnore - public byte[] getDecodedKey() { + public byte[] getDecodedKey() throws IllegalArgumentException { if (keyInBytes == null) { - keyInBytes = Hex.decodeHex(key.toLowerCase().toCharArray()); + keyInBytes = Base64.decodeBase64(key.getBytes()); } return keyInBytes; } diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MServerCredentialsWithKeys.java b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MServerCredentialsWithKeys.java index c45fb3891b..c46962fc91 100644 --- a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MServerCredentialsWithKeys.java +++ b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MServerCredentialsWithKeys.java @@ -19,7 +19,7 @@ import com.fasterxml.jackson.annotation.JsonIgnore; import lombok.Getter; import lombok.Setter; import lombok.SneakyThrows; -import org.apache.commons.codec.binary.Hex; +import org.apache.commons.codec.binary.Base64; @Getter @Setter @@ -40,6 +40,6 @@ public abstract class AbstractLwM2MServerCredentialsWithKeys implements LwM2MSer @SneakyThrows private static byte[] getDecoded(String key) { - return Hex.decodeHex(key.toLowerCase().toCharArray()); + return Base64.decodeBase64(key.getBytes()); } } diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/X509ClientCredentials.java b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/X509ClientCredentials.java index 712dcab5eb..d91fbf62ea 100644 --- a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/X509ClientCredentials.java +++ b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/X509ClientCredentials.java @@ -15,16 +15,30 @@ */ package org.thingsboard.server.common.data.device.credentials.lwm2m; +import com.fasterxml.jackson.annotation.JsonIgnore; import lombok.Getter; import lombok.Setter; +import lombok.SneakyThrows; +import org.apache.commons.codec.binary.Base64; @Getter @Setter public class X509ClientCredentials extends AbstractLwM2MClientCredentials { private String cert; + private byte[] certInBytes; + @Override public LwM2MSecurityMode getSecurityConfigClientMode() { return LwM2MSecurityMode.X509; } + + @SneakyThrows + @JsonIgnore + public byte[] getDecodedCert() throws IllegalArgumentException { + if (certInBytes == null) { + certInBytes = Base64.decodeBase64(cert.getBytes()); + } + return certInBytes; + } } diff --git a/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java b/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java index 969745ae31..68370b95e6 100644 --- a/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java +++ b/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java @@ -17,7 +17,6 @@ package org.thingsboard.server.dao.device; import lombok.extern.slf4j.Slf4j; -import org.eclipse.leshan.core.util.Base64; import org.eclipse.leshan.core.util.SecurityUtil; import org.hibernate.exception.ConstraintViolationException; import org.springframework.beans.factory.annotation.Autowired; @@ -231,7 +230,7 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen } private void validateLwM2MClientCredentials(LwM2MClientCredentials clientCredentials) { - if (StringUtils.isEmpty(clientCredentials.getEndpoint())) { + if (StringUtils.isBlank(clientCredentials.getEndpoint())) { throw new DeviceCredentialsValidationException("LwM2M client endpoint should be specified!"); } @@ -240,43 +239,42 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen break; case PSK: PSKClientCredentials pskCredentials = (PSKClientCredentials) clientCredentials; - if (StringUtils.isEmpty(pskCredentials.getIdentity())) { + if (StringUtils.isBlank(pskCredentials.getIdentity())) { throw new DeviceCredentialsValidationException("LwM2M client PSK identity should be specified!"); } String pskKey = pskCredentials.getKey(); - if (StringUtils.isEmpty(pskKey)) { + if (StringUtils.isBlank(pskKey)) { throw new DeviceCredentialsValidationException("LwM2M client PSK key should be specified!"); } if (!pskKey.matches("-?[0-9a-fA-F]+")) { - throw new DeviceCredentialsValidationException("LwM2M client PSK key should be HexDecimal format!"); + throw new DeviceCredentialsValidationException("LwM2M client PSK key should be random sequence in hex encoding!"); } - if (pskKey.length() % 32 != 0 || pskKey.length() > 128) { - throw new DeviceCredentialsValidationException("LwM2M client PSK key must be 32, 64, 128 characters!"); + if (pskKey.length()% 32 != 0 || pskKey.length() > 128) { + throw new DeviceCredentialsValidationException("LwM2M client PSK key length = " + pskKey.length() + ". Key should be HexDec format: 32, 64, 128 characters!"); } break; case RPK: RPKClientCredentials rpkCredentials = (RPKClientCredentials) clientCredentials; - - if (StringUtils.isEmpty(rpkCredentials.getKey())) { + if (StringUtils.isBlank(rpkCredentials.getKey())) { throw new DeviceCredentialsValidationException("LwM2M client RPK key should be specified!"); } try { SecurityUtil.publicKey.decode(rpkCredentials.getDecodedKey()); } catch (Exception e) { - throw new DeviceCredentialsValidationException("LwM2M client RPK key should be in RFC7250 standard!"); + throw new DeviceCredentialsValidationException("LwM2M client RPK key should be in RFC7250 standard and support only EC algorithm and encoded to Bas64 format!"); } break; case X509: X509ClientCredentials x509CCredentials = (X509ClientCredentials) clientCredentials; if (StringUtils.isNotBlank(x509CCredentials.getCert())) { try { - SecurityUtil.certificate.decode(Base64.decodeBase64(x509CCredentials.getCert())); + SecurityUtil.certificate.decode(x509CCredentials.getDecodedCert()); } catch (Exception e) { - throw new DeviceCredentialsValidationException("LwM2M client X509 certificate should be in DER-encoded X.509 format!"); + throw new DeviceCredentialsValidationException("LwM2M client X509 certificate should be in DER-encoded X509v3 format and support only EC algorithm and encoded to Bas64 format!"); } } break; @@ -289,34 +287,32 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen break; case PSK: PSKServerCredentials pskCredentials = (PSKServerCredentials) serverCredentials; - if (StringUtils.isEmpty(pskCredentials.getClientPublicKeyOrId())) { + if (StringUtils.isBlank(pskCredentials.getClientPublicKeyOrId())) { throw new DeviceCredentialsValidationException(server + " client PSK public key or id should be specified!"); } String pskKey = pskCredentials.getClientSecretKey(); - if (StringUtils.isEmpty(pskKey)) { + if (StringUtils.isBlank(pskKey)) { throw new DeviceCredentialsValidationException(server + " client PSK key should be specified!"); } if (!pskKey.matches("-?[0-9a-fA-F]+")) { - throw new DeviceCredentialsValidationException(server + " client PSK key should be HexDecimal format!"); + throw new DeviceCredentialsValidationException(server + " client PSK key should be random sequence in hex encoding!"); } - if (pskKey.length() % 32 != 0 || pskKey.length() > 128) { - throw new DeviceCredentialsValidationException(server + " client PSK key must be 32, 64, 128 characters!"); + if (pskKey.length()% 32 != 0 || pskKey.length() > 128) { + throw new DeviceCredentialsValidationException(server + " client PSK key length = " + pskKey.length() + ". Key should be HexDec format: 32, 64, 128 characters!"); } break; case RPK: RPKServerCredentials rpkCredentials = (RPKServerCredentials) serverCredentials; - if (StringUtils.isEmpty(rpkCredentials.getClientPublicKeyOrId())) { throw new DeviceCredentialsValidationException(server + " client RPK public key or id should be specified!"); } - try { SecurityUtil.publicKey.decode(rpkCredentials.getDecodedClientPublicKeyOrId()); } catch (Exception e) { - throw new DeviceCredentialsValidationException(server + " client RPK public key or id should be in RFC7250 standard!"); + throw new DeviceCredentialsValidationException(server + " client RPK public key or id should be in RFC7250 standard and encoded to Bas64 format!"); } if (StringUtils.isEmpty(rpkCredentials.getClientSecretKey())) { @@ -326,28 +322,28 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen try { SecurityUtil.privateKey.decode(rpkCredentials.getDecodedClientSecretKey()); } catch (Exception e) { - throw new DeviceCredentialsValidationException(server + " client RPK secret key should be in RFC5958 standard!"); + throw new DeviceCredentialsValidationException(server + " client RPK secret key should be in PKCS#8 format (DER encoding, RFC5958 standard) and encoded to Bas64 format!"); } break; case X509: X509ServerCredentials x509CCredentials = (X509ServerCredentials) serverCredentials; - if (StringUtils.isEmpty(x509CCredentials.getClientPublicKeyOrId())) { + if (StringUtils.isBlank(x509CCredentials.getClientPublicKeyOrId())) { throw new DeviceCredentialsValidationException(server + " client X509 public key or id should be specified!"); } try { SecurityUtil.certificate.decode(x509CCredentials.getDecodedClientPublicKeyOrId()); } catch (Exception e) { - throw new DeviceCredentialsValidationException(server + " client X509 public key or id should be in DER-encoded X.509 format!"); + throw new DeviceCredentialsValidationException(server + " client X509 public key or id should be in DER-encoded X509v3 format and support only EC algorithm and encoded to Bas64 format!"); } - if (StringUtils.isEmpty(x509CCredentials.getClientSecretKey())) { + if (StringUtils.isBlank(x509CCredentials.getClientSecretKey())) { throw new DeviceCredentialsValidationException(server + " client X509 secret key should be specified!"); } try { SecurityUtil.privateKey.decode(x509CCredentials.getDecodedClientSecretKey()); } catch (Exception e) { - throw new DeviceCredentialsValidationException(server + " client X509 secret key should be in RFC5958 standard!"); + throw new DeviceCredentialsValidationException(server + " client X509 secret key should be in PKCS#8 format (DER encoding, RFC5958 standard) and encoded to Bas64 format!"); } break; } From d403afb0e6815bd28da12e8f5e70b5f6fe629341 Mon Sep 17 00:00:00 2001 From: nickAS21 Date: Tue, 28 Sep 2021 14:11:32 +0300 Subject: [PATCH 2/6] Lwm2m credentials base64 validate (with /n and "...BEGIN...") back --- .../AbstractCoapProvisionJsonDeviceTest.java | 2 +- .../AbstractCoapProvisionProtoDeviceTest.java | 2 +- .../AbstractMqttProvisionJsonDeviceTest.java | 2 +- .../AbstractMqttProvisionProtoDeviceTest.java | 2 +- .../server/common/msg/EncryptionUtil.java | 23 ++++++-- .../server/common/transport/util/SslUtil.java | 2 +- .../device/DeviceCredentialsServiceImpl.java | 53 +++++++++++-------- 7 files changed, 56 insertions(+), 30 deletions(-) diff --git a/application/src/test/java/org/thingsboard/server/transport/coap/provision/AbstractCoapProvisionJsonDeviceTest.java b/application/src/test/java/org/thingsboard/server/transport/coap/provision/AbstractCoapProvisionJsonDeviceTest.java index eccba64ddc..091900488b 100644 --- a/application/src/test/java/org/thingsboard/server/transport/coap/provision/AbstractCoapProvisionJsonDeviceTest.java +++ b/application/src/test/java/org/thingsboard/server/transport/coap/provision/AbstractCoapProvisionJsonDeviceTest.java @@ -146,7 +146,7 @@ public abstract class AbstractCoapProvisionJsonDeviceTest extends AbstractCoapIn Assert.assertEquals(deviceCredentials.getCredentialsType().name(), response.get("credentialsType").getAsString()); Assert.assertEquals(deviceCredentials.getCredentialsType().name(), "X509_CERTIFICATE"); - String cert = EncryptionUtil.trimNewLines(deviceCredentials.getCredentialsValue()); + String cert = EncryptionUtil.certTrimNewLines(deviceCredentials.getCredentialsValue()); String sha3Hash = EncryptionUtil.getSha3Hash(cert); Assert.assertEquals(deviceCredentials.getCredentialsId(), sha3Hash); diff --git a/application/src/test/java/org/thingsboard/server/transport/coap/provision/AbstractCoapProvisionProtoDeviceTest.java b/application/src/test/java/org/thingsboard/server/transport/coap/provision/AbstractCoapProvisionProtoDeviceTest.java index 14d72297a4..671741c7d0 100644 --- a/application/src/test/java/org/thingsboard/server/transport/coap/provision/AbstractCoapProvisionProtoDeviceTest.java +++ b/application/src/test/java/org/thingsboard/server/transport/coap/provision/AbstractCoapProvisionProtoDeviceTest.java @@ -145,7 +145,7 @@ public abstract class AbstractCoapProvisionProtoDeviceTest extends AbstractCoapI Assert.assertEquals(deviceCredentials.getCredentialsType().name(), response.getCredentialsType().toString()); Assert.assertEquals(deviceCredentials.getCredentialsType(), DeviceCredentialsType.X509_CERTIFICATE); - String cert = EncryptionUtil.trimNewLines(deviceCredentials.getCredentialsValue()); + String cert = EncryptionUtil.certTrimNewLines(deviceCredentials.getCredentialsValue()); String sha3Hash = EncryptionUtil.getSha3Hash(cert); Assert.assertEquals(deviceCredentials.getCredentialsId(), sha3Hash); diff --git a/application/src/test/java/org/thingsboard/server/transport/mqtt/provision/AbstractMqttProvisionJsonDeviceTest.java b/application/src/test/java/org/thingsboard/server/transport/mqtt/provision/AbstractMqttProvisionJsonDeviceTest.java index 870b62b195..e1b0269138 100644 --- a/application/src/test/java/org/thingsboard/server/transport/mqtt/provision/AbstractMqttProvisionJsonDeviceTest.java +++ b/application/src/test/java/org/thingsboard/server/transport/mqtt/provision/AbstractMqttProvisionJsonDeviceTest.java @@ -152,7 +152,7 @@ public abstract class AbstractMqttProvisionJsonDeviceTest extends AbstractMqttIn Assert.assertEquals(deviceCredentials.getCredentialsType().name(), response.get("credentialsType").getAsString()); Assert.assertEquals(deviceCredentials.getCredentialsType().name(), "X509_CERTIFICATE"); - String cert = EncryptionUtil.trimNewLines(deviceCredentials.getCredentialsValue()); + String cert = EncryptionUtil.certTrimNewLines(deviceCredentials.getCredentialsValue()); String sha3Hash = EncryptionUtil.getSha3Hash(cert); Assert.assertEquals(deviceCredentials.getCredentialsId(), sha3Hash); diff --git a/application/src/test/java/org/thingsboard/server/transport/mqtt/provision/AbstractMqttProvisionProtoDeviceTest.java b/application/src/test/java/org/thingsboard/server/transport/mqtt/provision/AbstractMqttProvisionProtoDeviceTest.java index 97ebbfe4a7..7816db5de0 100644 --- a/application/src/test/java/org/thingsboard/server/transport/mqtt/provision/AbstractMqttProvisionProtoDeviceTest.java +++ b/application/src/test/java/org/thingsboard/server/transport/mqtt/provision/AbstractMqttProvisionProtoDeviceTest.java @@ -154,7 +154,7 @@ public abstract class AbstractMqttProvisionProtoDeviceTest extends AbstractMqttI Assert.assertEquals(deviceCredentials.getCredentialsType().name(), response.getCredentialsType().toString()); Assert.assertEquals(deviceCredentials.getCredentialsType(), DeviceCredentialsType.X509_CERTIFICATE); - String cert = EncryptionUtil.trimNewLines(deviceCredentials.getCredentialsValue()); + String cert = EncryptionUtil.certTrimNewLines(deviceCredentials.getCredentialsValue()); String sha3Hash = EncryptionUtil.getSha3Hash(cert); Assert.assertEquals(deviceCredentials.getCredentialsId(), sha3Hash); diff --git a/common/message/src/main/java/org/thingsboard/server/common/msg/EncryptionUtil.java b/common/message/src/main/java/org/thingsboard/server/common/msg/EncryptionUtil.java index d8fbbad543..1421d4c64e 100644 --- a/common/message/src/main/java/org/thingsboard/server/common/msg/EncryptionUtil.java +++ b/common/message/src/main/java/org/thingsboard/server/common/msg/EncryptionUtil.java @@ -28,15 +28,30 @@ public class EncryptionUtil { private EncryptionUtil() { } - public static String trimNewLines(String input) { + public static String certTrimNewLines(String input) { return input.replaceAll("-----BEGIN CERTIFICATE-----", "") - .replaceAll("-----END CERTIFICATE-----", "") .replaceAll("\n", "") - .replaceAll("\r", ""); + .replaceAll("\r", "") + .replaceAll("-----END CERTIFICATE-----", ""); } + public static String pubkTrimNewLines(String input) { + return input.replaceAll("-----BEGIN PUBLIC KEY-----", "") + .replaceAll("\n", "") + .replaceAll("\r", "") + .replaceAll("-----END PUBLIC KEY-----", ""); + } + + public static String prikTrimNewLines(String input) { + return input.replaceAll("-----BEGIN EC PRIVATE KEY-----", "") + .replaceAll("\n", "") + .replaceAll("\r", "") + .replaceAll("-----END EC PRIVATE KEY-----", ""); + } + + public static String getSha3Hash(String data) { - String trimmedData = trimNewLines(data); + String trimmedData = certTrimNewLines(data); byte[] dataBytes = trimmedData.getBytes(); SHA3Digest md = new SHA3Digest(256); md.reset(); diff --git a/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/util/SslUtil.java b/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/util/SslUtil.java index 77e4045655..2a17a4791d 100644 --- a/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/util/SslUtil.java +++ b/common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/util/SslUtil.java @@ -33,6 +33,6 @@ public class SslUtil { public static String getCertificateString(Certificate cert) throws CertificateEncodingException { - return EncryptionUtil.trimNewLines(Base64Utils.encodeToString(cert.getEncoded())); + return EncryptionUtil.certTrimNewLines(Base64Utils.encodeToString(cert.getEncoded())); } } diff --git a/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java b/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java index 68370b95e6..84db68f4fc 100644 --- a/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java +++ b/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java @@ -154,7 +154,7 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen } private void formatCertData(DeviceCredentials deviceCredentials) { - String cert = EncryptionUtil.trimNewLines(deviceCredentials.getCredentialsValue()); + String cert = EncryptionUtil.certTrimNewLines(deviceCredentials.getCredentialsValue()); String sha3Hash = EncryptionUtil.getSha3Hash(cert); deviceCredentials.setCredentialsId(sha3Hash); deviceCredentials.setCredentialsValue(cert); @@ -171,26 +171,25 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen String credentialsId = null; LwM2MClientCredentials clientCredentials = lwM2MCredentials.getClient(); - + LwM2MServerCredentials bootstrapServer = lwM2MCredentials.getBootstrap().getBootstrapServer(); + LwM2MServerCredentials lwm2mServer = lwM2MCredentials.getBootstrap().getLwm2mServer(); switch (clientCredentials.getSecurityConfigClientMode()) { case NO_SEC: case RPK: + deviceCredentials.setCredentialsValue(JacksonUtil.toString(lwM2MCredentials)); credentialsId = clientCredentials.getEndpoint(); break; case PSK: credentialsId = ((PSKClientCredentials) clientCredentials).getIdentity(); break; case X509: - X509ClientCredentials x509Config = (X509ClientCredentials) clientCredentials; - if ((StringUtils.isNotBlank(x509Config.getCert()))) { - String cert = EncryptionUtil.trimNewLines(x509Config.getCert()); - String sha3Hash = EncryptionUtil.getSha3Hash(cert); - x509Config.setCert(cert); - ((X509ClientCredentials) clientCredentials).setCert(cert); - deviceCredentials.setCredentialsValue(JacksonUtil.toString(lwM2MCredentials)); + deviceCredentials.setCredentialsValue(JacksonUtil.toString(lwM2MCredentials)); + X509ClientCredentials x509ClientConfig = (X509ClientCredentials) clientCredentials; + if ((StringUtils.isNotBlank(x509ClientConfig.getCert()))) { + String sha3Hash = EncryptionUtil.getSha3Hash(x509ClientConfig.getCert()); credentialsId = sha3Hash; } else { - credentialsId = x509Config.getEndpoint(); + credentialsId = x509ClientConfig.getEndpoint(); } break; } @@ -263,6 +262,8 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen } try { + String pubkClient = EncryptionUtil.pubkTrimNewLines(rpkCredentials.getKey()); + rpkCredentials.setKey(pubkClient); SecurityUtil.publicKey.decode(rpkCredentials.getDecodedKey()); } catch (Exception e) { throw new DeviceCredentialsValidationException("LwM2M client RPK key should be in RFC7250 standard and support only EC algorithm and encoded to Bas64 format!"); @@ -272,6 +273,8 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen X509ClientCredentials x509CCredentials = (X509ClientCredentials) clientCredentials; if (StringUtils.isNotBlank(x509CCredentials.getCert())) { try { + String certClient = EncryptionUtil.certTrimNewLines(x509CCredentials.getCert()); + x509CCredentials.setCert(certClient); SecurityUtil.certificate.decode(x509CCredentials.getDecodedCert()); } catch (Exception e) { throw new DeviceCredentialsValidationException("LwM2M client X509 certificate should be in DER-encoded X509v3 format and support only EC algorithm and encoded to Bas64 format!"); @@ -300,48 +303,56 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen throw new DeviceCredentialsValidationException(server + " client PSK key should be random sequence in hex encoding!"); } - if (pskKey.length()% 32 != 0 || pskKey.length() > 128) { + if (pskKey.length() % 32 != 0 || pskKey.length() > 128) { throw new DeviceCredentialsValidationException(server + " client PSK key length = " + pskKey.length() + ". Key should be HexDec format: 32, 64, 128 characters!"); } break; case RPK: - RPKServerCredentials rpkCredentials = (RPKServerCredentials) serverCredentials; - if (StringUtils.isEmpty(rpkCredentials.getClientPublicKeyOrId())) { + RPKServerCredentials rpkServerCredentials = (RPKServerCredentials) serverCredentials; + if (StringUtils.isEmpty(rpkServerCredentials.getClientPublicKeyOrId())) { throw new DeviceCredentialsValidationException(server + " client RPK public key or id should be specified!"); } try { - SecurityUtil.publicKey.decode(rpkCredentials.getDecodedClientPublicKeyOrId()); + String pubkRpkSever = EncryptionUtil.pubkTrimNewLines(rpkServerCredentials.getClientPublicKeyOrId()); + rpkServerCredentials.setClientPublicKeyOrId(pubkRpkSever); + SecurityUtil.publicKey.decode(rpkServerCredentials.getDecodedClientPublicKeyOrId()); } catch (Exception e) { throw new DeviceCredentialsValidationException(server + " client RPK public key or id should be in RFC7250 standard and encoded to Bas64 format!"); } - if (StringUtils.isEmpty(rpkCredentials.getClientSecretKey())) { + if (StringUtils.isEmpty(rpkServerCredentials.getClientSecretKey())) { throw new DeviceCredentialsValidationException(server + " client RPK secret key should be specified!"); } try { - SecurityUtil.privateKey.decode(rpkCredentials.getDecodedClientSecretKey()); + String prikRpkSever = EncryptionUtil.prikTrimNewLines(rpkServerCredentials.getClientSecretKey()); + rpkServerCredentials.setClientSecretKey(prikRpkSever); + SecurityUtil.privateKey.decode(rpkServerCredentials.getDecodedClientSecretKey()); } catch (Exception e) { throw new DeviceCredentialsValidationException(server + " client RPK secret key should be in PKCS#8 format (DER encoding, RFC5958 standard) and encoded to Bas64 format!"); } break; case X509: - X509ServerCredentials x509CCredentials = (X509ServerCredentials) serverCredentials; - if (StringUtils.isBlank(x509CCredentials.getClientPublicKeyOrId())) { + X509ServerCredentials x509ServerCredentials = (X509ServerCredentials) serverCredentials; + if (StringUtils.isBlank(x509ServerCredentials.getClientPublicKeyOrId())) { throw new DeviceCredentialsValidationException(server + " client X509 public key or id should be specified!"); } try { - SecurityUtil.certificate.decode(x509CCredentials.getDecodedClientPublicKeyOrId()); + String certServer = EncryptionUtil.certTrimNewLines(x509ServerCredentials.getClientPublicKeyOrId()); + x509ServerCredentials.setClientPublicKeyOrId(certServer); + SecurityUtil.certificate.decode(x509ServerCredentials.getDecodedClientPublicKeyOrId()); } catch (Exception e) { throw new DeviceCredentialsValidationException(server + " client X509 public key or id should be in DER-encoded X509v3 format and support only EC algorithm and encoded to Bas64 format!"); } - if (StringUtils.isBlank(x509CCredentials.getClientSecretKey())) { + if (StringUtils.isBlank(x509ServerCredentials.getClientSecretKey())) { throw new DeviceCredentialsValidationException(server + " client X509 secret key should be specified!"); } try { - SecurityUtil.privateKey.decode(x509CCredentials.getDecodedClientSecretKey()); + String prikX509Sever = EncryptionUtil.prikTrimNewLines(x509ServerCredentials.getClientSecretKey()); + x509ServerCredentials.setClientSecretKey(prikX509Sever); + SecurityUtil.privateKey.decode(x509ServerCredentials.getDecodedClientSecretKey()); } catch (Exception e) { throw new DeviceCredentialsValidationException(server + " client X509 secret key should be in PKCS#8 format (DER encoding, RFC5958 standard) and encoded to Bas64 format!"); } From dba087e949ec04085339710e4fbf253605c450c8 Mon Sep 17 00:00:00 2001 From: nickAS21 Date: Tue, 28 Sep 2021 16:48:34 +0300 Subject: [PATCH 3/6] Lwm2m credentials base64 fix bug PSK (hexDec) --- .../lwm2m/AbstractLwM2MClientCredentialsWithKey.java | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java index 4279694909..26cc55faa6 100644 --- a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java +++ b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java @@ -20,6 +20,7 @@ import lombok.Getter; import lombok.Setter; import lombok.SneakyThrows; import org.apache.commons.codec.binary.Base64; +import org.apache.commons.codec.binary.Hex; public abstract class AbstractLwM2MClientCredentialsWithKey extends AbstractLwM2MClientCredentials { @Getter @@ -32,7 +33,12 @@ public abstract class AbstractLwM2MClientCredentialsWithKey extends AbstractLwM2 @JsonIgnore public byte[] getDecodedKey() throws IllegalArgumentException { if (keyInBytes == null) { - keyInBytes = Base64.decodeBase64(key.getBytes()); + if (this.getSecurityConfigClientMode() == LwM2MSecurityMode.PSK) { + keyInBytes = Hex.decodeHex(key.toLowerCase().toCharArray()); + } + else { + keyInBytes = Base64.decodeBase64(key.getBytes()); + } } return keyInBytes; } From 81ec387c86e28eee7771a21c2ba4882f5ef1aa39 Mon Sep 17 00:00:00 2001 From: nickAS21 Date: Tue, 28 Sep 2021 17:21:15 +0300 Subject: [PATCH 4/6] Lwm2m credentials base64 fix bug PSK test --- .../lwm2m/security/sql/RpkLwM2MIntegrationTest.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/application/src/test/java/org/thingsboard/server/transport/lwm2m/security/sql/RpkLwM2MIntegrationTest.java b/application/src/test/java/org/thingsboard/server/transport/lwm2m/security/sql/RpkLwM2MIntegrationTest.java index fdfa56957c..68479f6fb9 100644 --- a/application/src/test/java/org/thingsboard/server/transport/lwm2m/security/sql/RpkLwM2MIntegrationTest.java +++ b/application/src/test/java/org/thingsboard/server/transport/lwm2m/security/sql/RpkLwM2MIntegrationTest.java @@ -16,11 +16,12 @@ package org.thingsboard.server.transport.lwm2m.security.sql; import org.eclipse.leshan.client.object.Security; -import org.eclipse.leshan.core.util.Hex; import org.junit.Test; import org.thingsboard.server.common.data.device.credentials.lwm2m.RPKClientCredentials; import org.thingsboard.server.transport.lwm2m.security.AbstractSecurityLwM2MIntegrationTest; +import org.apache.commons.codec.binary.Base64;; + import static org.eclipse.leshan.client.object.Security.rpk; import static org.thingsboard.server.transport.lwm2m.Lwm2mTestHelper.SECURE_COAP_CONFIG; import static org.thingsboard.server.transport.lwm2m.Lwm2mTestHelper.SECURE_URI; @@ -32,7 +33,7 @@ public class RpkLwM2MIntegrationTest extends AbstractSecurityLwM2MIntegrationTes public void testConnectWithRPKAndObserveTelemetry() throws Exception { RPKClientCredentials rpkClientCredentials = new RPKClientCredentials(); rpkClientCredentials.setEndpoint(ENDPOINT); - rpkClientCredentials.setKey(Hex.encodeHexString(clientPublicKey.getEncoded())); + rpkClientCredentials.setKey(new String(Base64.encodeBase64(clientPublicKey.getEncoded()))); Security security = rpk(SECURE_URI, SHORT_SERVER_ID, clientPublicKey.getEncoded(), @@ -40,5 +41,4 @@ public class RpkLwM2MIntegrationTest extends AbstractSecurityLwM2MIntegrationTes serverX509Cert.getPublicKey().getEncoded()); super.basicTestConnectionObserveTelemetry(security, rpkClientCredentials, SECURE_COAP_CONFIG, ENDPOINT); } - } From e8444f8bdc7cf7d96b8b32eccd18797e39d8869d Mon Sep 17 00:00:00 2001 From: nickAS21 Date: Wed, 29 Sep 2021 19:32:19 +0300 Subject: [PATCH 5/6] Lwm2m base64 back fix bug "bas64" and x509 empty --- .../dao/device/DeviceCredentialsServiceImpl.java | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java b/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java index 84db68f4fc..4c6031d8bf 100644 --- a/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java +++ b/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java @@ -266,18 +266,18 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen rpkCredentials.setKey(pubkClient); SecurityUtil.publicKey.decode(rpkCredentials.getDecodedKey()); } catch (Exception e) { - throw new DeviceCredentialsValidationException("LwM2M client RPK key should be in RFC7250 standard and support only EC algorithm and encoded to Bas64 format!"); + throw new DeviceCredentialsValidationException("LwM2M client RPK key should be in RFC7250 standard and support only EC algorithm and encoded to Base64 format!"); } break; case X509: X509ClientCredentials x509CCredentials = (X509ClientCredentials) clientCredentials; - if (StringUtils.isNotBlank(x509CCredentials.getCert())) { + if (StringUtils.isNotEmpty(x509CCredentials.getCert())) { try { String certClient = EncryptionUtil.certTrimNewLines(x509CCredentials.getCert()); x509CCredentials.setCert(certClient); SecurityUtil.certificate.decode(x509CCredentials.getDecodedCert()); } catch (Exception e) { - throw new DeviceCredentialsValidationException("LwM2M client X509 certificate should be in DER-encoded X509v3 format and support only EC algorithm and encoded to Bas64 format!"); + throw new DeviceCredentialsValidationException("LwM2M client X509 certificate should be in DER-encoded X509v3 format and support only EC algorithm and encoded to Base64 format!"); } } break; @@ -317,7 +317,7 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen rpkServerCredentials.setClientPublicKeyOrId(pubkRpkSever); SecurityUtil.publicKey.decode(rpkServerCredentials.getDecodedClientPublicKeyOrId()); } catch (Exception e) { - throw new DeviceCredentialsValidationException(server + " client RPK public key or id should be in RFC7250 standard and encoded to Bas64 format!"); + throw new DeviceCredentialsValidationException(server + " client RPK public key or id should be in RFC7250 standard and encoded to Base64 format!"); } if (StringUtils.isEmpty(rpkServerCredentials.getClientSecretKey())) { @@ -329,7 +329,7 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen rpkServerCredentials.setClientSecretKey(prikRpkSever); SecurityUtil.privateKey.decode(rpkServerCredentials.getDecodedClientSecretKey()); } catch (Exception e) { - throw new DeviceCredentialsValidationException(server + " client RPK secret key should be in PKCS#8 format (DER encoding, RFC5958 standard) and encoded to Bas64 format!"); + throw new DeviceCredentialsValidationException(server + " client RPK secret key should be in PKCS#8 format (DER encoding, RFC5958 standard) and encoded to Base64 format!"); } break; case X509: @@ -343,7 +343,7 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen x509ServerCredentials.setClientPublicKeyOrId(certServer); SecurityUtil.certificate.decode(x509ServerCredentials.getDecodedClientPublicKeyOrId()); } catch (Exception e) { - throw new DeviceCredentialsValidationException(server + " client X509 public key or id should be in DER-encoded X509v3 format and support only EC algorithm and encoded to Bas64 format!"); + throw new DeviceCredentialsValidationException(server + " client X509 public key or id should be in DER-encoded X509v3 format and support only EC algorithm and encoded to Base64 format!"); } if (StringUtils.isBlank(x509ServerCredentials.getClientSecretKey())) { throw new DeviceCredentialsValidationException(server + " client X509 secret key should be specified!"); @@ -354,7 +354,7 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen x509ServerCredentials.setClientSecretKey(prikX509Sever); SecurityUtil.privateKey.decode(x509ServerCredentials.getDecodedClientSecretKey()); } catch (Exception e) { - throw new DeviceCredentialsValidationException(server + " client X509 secret key should be in PKCS#8 format (DER encoding, RFC5958 standard) and encoded to Bas64 format!"); + throw new DeviceCredentialsValidationException(server + " client X509 secret key should be in PKCS#8 format (DER encoding, RFC5958 standard) and encoded to Base64 format!"); } break; } From 9186377b974fec8809cfb84963a27ca2174823fd Mon Sep 17 00:00:00 2001 From: nickAS21 Date: Thu, 30 Sep 2021 12:24:29 +0300 Subject: [PATCH 6/6] Lwm2m base64 back fix bug "bas64" on review --- ...AbstractLwM2MClientCredentialsWithKey.java | 45 ------------------- ...bstractLwM2MClientSecurityCredentials.java | 30 +++++++++++++ .../lwm2m/PSKClientCredentials.java | 14 +++++- .../lwm2m/RPKClientCredentials.java | 13 +++++- .../lwm2m/X509ClientCredentials.java | 19 ++++---- ...LwM2mCredentialsSecurityInfoValidator.java | 13 +++--- .../device/DeviceCredentialsServiceImpl.java | 10 ++--- 7 files changed, 73 insertions(+), 71 deletions(-) delete mode 100644 common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java create mode 100644 common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientSecurityCredentials.java diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java deleted file mode 100644 index 26cc55faa6..0000000000 --- a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientCredentialsWithKey.java +++ /dev/null @@ -1,45 +0,0 @@ -/** - * Copyright © 2016-2021 The Thingsboard Authors - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package org.thingsboard.server.common.data.device.credentials.lwm2m; - -import com.fasterxml.jackson.annotation.JsonIgnore; -import lombok.Getter; -import lombok.Setter; -import lombok.SneakyThrows; -import org.apache.commons.codec.binary.Base64; -import org.apache.commons.codec.binary.Hex; - -public abstract class AbstractLwM2MClientCredentialsWithKey extends AbstractLwM2MClientCredentials { - @Getter - @Setter - private String key; - - private byte[] keyInBytes; - - @SneakyThrows - @JsonIgnore - public byte[] getDecodedKey() throws IllegalArgumentException { - if (keyInBytes == null) { - if (this.getSecurityConfigClientMode() == LwM2MSecurityMode.PSK) { - keyInBytes = Hex.decodeHex(key.toLowerCase().toCharArray()); - } - else { - keyInBytes = Base64.decodeBase64(key.getBytes()); - } - } - return keyInBytes; - } -} diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientSecurityCredentials.java b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientSecurityCredentials.java new file mode 100644 index 0000000000..e5e3271c7a --- /dev/null +++ b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/AbstractLwM2MClientSecurityCredentials.java @@ -0,0 +1,30 @@ +/** + * Copyright © 2016-2021 The Thingsboard Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.thingsboard.server.common.data.device.credentials.lwm2m; + +import lombok.Getter; +import lombok.Setter; +import org.apache.commons.codec.DecoderException; + +public abstract class AbstractLwM2MClientSecurityCredentials extends AbstractLwM2MClientCredentials { + @Getter + @Setter + protected String key; + + protected byte[] securityInBytes; + + public abstract byte[] getDecoded() throws IllegalArgumentException, DecoderException; +} diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/PSKClientCredentials.java b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/PSKClientCredentials.java index f90e85ff4a..03d2ab328c 100644 --- a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/PSKClientCredentials.java +++ b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/PSKClientCredentials.java @@ -17,14 +17,24 @@ package org.thingsboard.server.common.data.device.credentials.lwm2m; import lombok.Getter; import lombok.Setter; +import org.apache.commons.codec.DecoderException; +import org.apache.commons.codec.binary.Hex; @Getter @Setter -public class PSKClientCredentials extends AbstractLwM2MClientCredentialsWithKey { +public class PSKClientCredentials extends AbstractLwM2MClientSecurityCredentials { private String identity; @Override public LwM2MSecurityMode getSecurityConfigClientMode() { return LwM2MSecurityMode.PSK; } -} + + @Override + public byte[] getDecoded() throws IllegalArgumentException, DecoderException { + if (securityInBytes == null) { + securityInBytes = Hex.decodeHex(key.toLowerCase().toCharArray()); + } + return securityInBytes; + } +} \ No newline at end of file diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/RPKClientCredentials.java b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/RPKClientCredentials.java index 4ebe2de71a..a05bb438c6 100644 --- a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/RPKClientCredentials.java +++ b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/RPKClientCredentials.java @@ -15,10 +15,21 @@ */ package org.thingsboard.server.common.data.device.credentials.lwm2m; -public class RPKClientCredentials extends AbstractLwM2MClientCredentialsWithKey { +import org.apache.commons.codec.DecoderException; +import org.apache.commons.codec.binary.Base64; + +public class RPKClientCredentials extends AbstractLwM2MClientSecurityCredentials { @Override public LwM2MSecurityMode getSecurityConfigClientMode() { return LwM2MSecurityMode.RPK; } + + @Override + public byte[] getDecoded() throws IllegalArgumentException, DecoderException { + if (securityInBytes == null) { + securityInBytes = Base64.decodeBase64(key.getBytes()); + } + return securityInBytes; + } } diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/X509ClientCredentials.java b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/X509ClientCredentials.java index d91fbf62ea..dfef57e18e 100644 --- a/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/X509ClientCredentials.java +++ b/common/data/src/main/java/org/thingsboard/server/common/data/device/credentials/lwm2m/X509ClientCredentials.java @@ -15,30 +15,27 @@ */ package org.thingsboard.server.common.data.device.credentials.lwm2m; -import com.fasterxml.jackson.annotation.JsonIgnore; import lombok.Getter; import lombok.Setter; -import lombok.SneakyThrows; +import org.apache.commons.codec.DecoderException; import org.apache.commons.codec.binary.Base64; @Getter @Setter -public class X509ClientCredentials extends AbstractLwM2MClientCredentials { - private String cert; +public class X509ClientCredentials extends AbstractLwM2MClientSecurityCredentials { - private byte[] certInBytes; + private String cert; @Override public LwM2MSecurityMode getSecurityConfigClientMode() { return LwM2MSecurityMode.X509; } - @SneakyThrows - @JsonIgnore - public byte[] getDecodedCert() throws IllegalArgumentException { - if (certInBytes == null) { - certInBytes = Base64.decodeBase64(cert.getBytes()); + @Override + public byte[] getDecoded() throws IllegalArgumentException, DecoderException { + if (securityInBytes == null && cert != null) { + securityInBytes = Base64.decodeBase64(cert.getBytes()); } - return certInBytes; + return securityInBytes; } } diff --git a/common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/LwM2mCredentialsSecurityInfoValidator.java b/common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/LwM2mCredentialsSecurityInfoValidator.java index bf30723ce0..6b7b3a9877 100644 --- a/common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/LwM2mCredentialsSecurityInfoValidator.java +++ b/common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/LwM2mCredentialsSecurityInfoValidator.java @@ -17,6 +17,7 @@ package org.thingsboard.server.transport.lwm2m.secure; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; +import org.apache.commons.codec.DecoderException; import org.eclipse.leshan.core.util.SecurityUtil; import org.eclipse.leshan.server.security.SecurityInfo; import org.springframework.stereotype.Component; @@ -146,14 +147,14 @@ public class LwM2mCredentialsSecurityInfoValidator { PSKClientCredentials pskConfig = (PSKClientCredentials) clientCredentialsConfig; if (StringUtils.isNotEmpty(pskConfig.getIdentity())) { try { - if (pskConfig.getDecodedKey() != null && pskConfig.getDecodedKey().length > 0) { + if (pskConfig.getDecoded() != null && pskConfig.getDecoded().length > 0) { endpoint = StringUtils.isNotEmpty(pskConfig.getEndpoint()) ? pskConfig.getEndpoint() : endpoint; if (endpoint != null && !endpoint.isEmpty()) { - result.setSecurityInfo(SecurityInfo.newPreSharedKeyInfo(endpoint, pskConfig.getIdentity(), pskConfig.getDecodedKey())); + result.setSecurityInfo(SecurityInfo.newPreSharedKeyInfo(endpoint, pskConfig.getIdentity(), pskConfig.getDecoded())); result.setSecurityMode(PSK); } } - } catch (IllegalArgumentException e) { + } catch (IllegalArgumentException | DecoderException e) { log.error("Missing PSK key: " + e.getMessage()); } } else { @@ -164,14 +165,14 @@ public class LwM2mCredentialsSecurityInfoValidator { private void createClientSecurityInfoRPK(TbLwM2MSecurityInfo result, String endpoint, LwM2MClientCredentials clientCredentialsConfig) { RPKClientCredentials rpkConfig = (RPKClientCredentials) clientCredentialsConfig; try { - if (rpkConfig.getDecodedKey() != null) { - PublicKey key = SecurityUtil.publicKey.decode(rpkConfig.getDecodedKey()); + if (rpkConfig.getDecoded() != null) { + PublicKey key = SecurityUtil.publicKey.decode(rpkConfig.getDecoded()); result.setSecurityInfo(SecurityInfo.newRawPublicKeyInfo(endpoint, key)); result.setSecurityMode(RPK); } else { log.error("Missing RPK key"); } - } catch (IllegalArgumentException | IOException | GeneralSecurityException e) { + } catch (IllegalArgumentException | IOException | GeneralSecurityException | DecoderException e) { log.error("RPK: Invalid security info content: " + e.getMessage()); } } diff --git a/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java b/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java index 4c6031d8bf..a5ed9e1e29 100644 --- a/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java +++ b/dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java @@ -117,7 +117,7 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen formatSimpleMqttCredentials(deviceCredentials); break; case LWM2M_CREDENTIALS: - formatSimpleLwm2mCredentials(deviceCredentials); + formatAndValidateSimpleLwm2mCredentials(deviceCredentials); break; } } @@ -160,7 +160,7 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen deviceCredentials.setCredentialsValue(cert); } - private void formatSimpleLwm2mCredentials(DeviceCredentials deviceCredentials) { + private void formatAndValidateSimpleLwm2mCredentials(DeviceCredentials deviceCredentials) { LwM2MDeviceCredentials lwM2MCredentials; try { lwM2MCredentials = JacksonUtil.fromString(deviceCredentials.getCredentialsValue(), LwM2MDeviceCredentials.class); @@ -171,8 +171,6 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen String credentialsId = null; LwM2MClientCredentials clientCredentials = lwM2MCredentials.getClient(); - LwM2MServerCredentials bootstrapServer = lwM2MCredentials.getBootstrap().getBootstrapServer(); - LwM2MServerCredentials lwm2mServer = lwM2MCredentials.getBootstrap().getLwm2mServer(); switch (clientCredentials.getSecurityConfigClientMode()) { case NO_SEC: case RPK: @@ -264,7 +262,7 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen try { String pubkClient = EncryptionUtil.pubkTrimNewLines(rpkCredentials.getKey()); rpkCredentials.setKey(pubkClient); - SecurityUtil.publicKey.decode(rpkCredentials.getDecodedKey()); + SecurityUtil.publicKey.decode(rpkCredentials.getDecoded()); } catch (Exception e) { throw new DeviceCredentialsValidationException("LwM2M client RPK key should be in RFC7250 standard and support only EC algorithm and encoded to Base64 format!"); } @@ -275,7 +273,7 @@ public class DeviceCredentialsServiceImpl extends AbstractEntityService implemen try { String certClient = EncryptionUtil.certTrimNewLines(x509CCredentials.getCert()); x509CCredentials.setCert(certClient); - SecurityUtil.certificate.decode(x509CCredentials.getDecodedCert()); + SecurityUtil.certificate.decode(x509CCredentials.getDecoded()); } catch (Exception e) { throw new DeviceCredentialsValidationException("LwM2M client X509 certificate should be in DER-encoded X509v3 format and support only EC algorithm and encoded to Base64 format!"); }