From bbde3b4b45d4b649dd502f81880d87dd189568e5 Mon Sep 17 00:00:00 2001
From: Andrii Landiak <andriylandiak@gmail.com>
Date: Wed, 12 Apr 2023 18:49:40 +0300
Subject: [PATCH] Add trace logging fpr parsing CN and refactor extractByRegex
 to throw ProvisionFailedException

---
 .../service/device/DeviceProvisionServiceImpl.java  | 13 +++++--------
 application/src/main/resources/thingsboard.yml      |  8 ++++----
 2 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/application/src/main/java/org/thingsboard/server/service/device/DeviceProvisionServiceImpl.java b/application/src/main/java/org/thingsboard/server/service/device/DeviceProvisionServiceImpl.java
index 6d1156986d..beecebe2ba 100644
--- a/application/src/main/java/org/thingsboard/server/service/device/DeviceProvisionServiceImpl.java
+++ b/application/src/main/java/org/thingsboard/server/service/device/DeviceProvisionServiceImpl.java
@@ -110,12 +110,8 @@ public class DeviceProvisionServiceImpl implements DeviceProvisionService {
         X509CertificateChainProvisionConfiguration configuration = (X509CertificateChainProvisionConfiguration) targetProfile.getProfileData().getProvisionConfiguration();
         String certificateValue = provisionRequest.getCredentialsData().getX509CertHash();
         String certificateRegEx = configuration.getCertificateRegExPattern();
-        String commonName = getCNFromX509Certificate(certificateValue);
+        String commonName = getCNFromX509Certificate(targetProfile, certificateValue);
         String deviceName = extractDeviceNameFromCNByRegEx(targetProfile, commonName, certificateRegEx);
-        if (StringUtils.isBlank(deviceName)) {
-            log.warn("[{}][{}] Failed to extract device name using [{}] and certificate: [{}]", targetProfile.getTenantId(), targetProfile.getId(), certificateRegEx, certificateValue);
-            throw new ProvisionFailedException(ProvisionResponseStatus.FAILURE.name());
-        }
         provisionRequest.setDeviceName(deviceName);
         Device targetDevice = deviceService.findDeviceByTenantIdAndName(targetProfile.getTenantId(), provisionRequest.getDeviceName());
         X509CertificateChainProvisionConfiguration x509Configuration = (X509CertificateChainProvisionConfiguration) targetProfile.getProfileData().getProvisionConfiguration();
@@ -296,15 +292,16 @@ public class DeviceProvisionServiceImpl implements DeviceProvisionService {
         auditLogService.logEntityAction(tenantId, customerId, new UserId(UserId.NULL_UUID), device.getName(), device.getId(), device, actionType, null, provisionRequest);
     }
 
-    private String getCNFromX509Certificate(String x509Value) {
+    private String getCNFromX509Certificate(DeviceProfile profile, String x509Value) {
         try {
             return SslUtil.parseCommonName(SslUtil.readCertFile(x509Value));
         } catch (Exception e) {
+            log.trace("[{}][{}] Failed to parse CN from X509 certificate {}", profile.getTenantId(), profile.getId(), x509Value);
             return null;
         }
     }
 
-    public String extractDeviceNameFromCNByRegEx(DeviceProfile profile, String commonName, String regex) {
+    public String extractDeviceNameFromCNByRegEx(DeviceProfile profile, String commonName, String regex) throws ProvisionFailedException {
         try {
             log.trace("Extract device name from CN [{}] by regex pattern [{}]", commonName, regex);
             Pattern pattern = Pattern.compile(regex);
@@ -314,7 +311,7 @@ public class DeviceProvisionServiceImpl implements DeviceProvisionService {
             }
         } catch (Exception ignored) {}
         log.trace("[{}][{}] Failed to match device name using [{}] from CN: [{}]", profile.getTenantId(), profile.getId(), regex, commonName);
-        return null;
+        throw new ProvisionFailedException(ProvisionResponseStatus.FAILURE.name());
     }
 
 }
diff --git a/application/src/main/resources/thingsboard.yml b/application/src/main/resources/thingsboard.yml
index 9f90b3457a..ee64e389b0 100644
--- a/application/src/main/resources/thingsboard.yml
+++ b/application/src/main/resources/thingsboard.yml
@@ -746,7 +746,7 @@ transport:
     # MQTT SSL configuration
     ssl:
       # Enable/disable SSL support
-      enabled: "${MQTT_SSL_ENABLED:false}"
+      enabled: "${MQTT_SSL_ENABLED:true}"
       # MQTT SSL bind address
       bind_address: "${MQTT_SSL_BIND_ADDRESS:0.0.0.0}"
       # MQTT SSL bind port
@@ -760,11 +760,11 @@ transport:
         # PEM server credentials
         pem:
           # Path to the server certificate file (holds server certificate or certificate chain, may include server private key)
-          cert_file: "${MQTT_SSL_PEM_CERT:mqttserver.pem}"
+          cert_file: "${MQTT_SSL_PEM_CERT:/home/developer/x509/server.pem}"
           # Path to the server certificate private key file. Optional by default. Required if the private key is not present in server certificate file;
-          key_file: "${MQTT_SSL_PEM_KEY:mqttserver_key.pem}"
+          key_file: "${MQTT_SSL_PEM_KEY:/home/developer/x509/server_key.pem}"
           # Server certificate private key password (optional)
-          key_password: "${MQTT_SSL_PEM_KEY_PASSWORD:server_key_password}"
+          key_password: "${MQTT_SSL_PEM_KEY_PASSWORD:}"
         # Keystore server credentials
         keystore:
           # Type of the key store (JKS or PKCS12)