Examples with AsyncResumptionVerifier org.eclipse.californium.scandium.dtls.resumption.AsyncResumptionVerifier used on opensource projects

Example 1 with AsyncResumptionVerifier

use of org.eclipse.californium.scandium.dtls.resumption.AsyncResumptionVerifier in project californium by eclipse.

the class AbstractTestServer method addEndpoints.

/**
 * Add endpoints.
 *
 * @param selectAddress  list of regular expression to filter the endpoints by
 *                       {@link InetAddress#getHostAddress()}. May be
 *                       {@code null} or {@code empty}, if endpoints should not
 *                       be filtered by their host address.
 * @param interfaceTypes list of type to filter the endpoints. Maybe
 *                       {@code null} or empty, if endpoints should not be
 *                       filtered by type.
 * @param protocols      list of protocols to create endpoints for.
 * @param cliConfig      client cli-config.
 */
public void addEndpoints(List<String> selectAddress, List<InterfaceType> interfaceTypes, List<Protocol> protocols, BaseConfig cliConfig) {
    int coapPort = config.get(CoapConfig.COAP_PORT);
    int coapsPort = config.get(CoapConfig.COAP_SECURE_PORT);
    if (protocols.contains(Protocol.DTLS) || protocols.contains(Protocol.TLS)) {
        initCredentials();
        serverSslContext = getServerSslContext(cliConfig.trustall, SslContextUtil.DEFAULT_SSL_PROTOCOL);
        if (serverSslContext == null && protocols.contains(Protocol.TLS)) {
            throw new IllegalArgumentException("TLS not supported, credentials missing!");
        }
    }
    List<InetAddress> used = new ArrayList<>();
    for (InetAddress addr : NetworkInterfacesUtil.getNetworkInterfaces()) {
        if (used.contains(addr)) {
            continue;
        }
        if (interfaceTypes != null && !interfaceTypes.isEmpty()) {
            if (addr.isLoopbackAddress() || addr.isLinkLocalAddress()) {
                if (!interfaceTypes.contains(InterfaceType.LOCAL)) {
                    String scope = "???";
                    if (addr.isLoopbackAddress()) {
                        scope = "lo";
                    } else if (addr.isLinkLocalAddress()) {
                        scope = "link";
                    }
                    LOGGER.info("{}skip local {} ({})", getTag(), addr, scope);
                    continue;
                }
            } else {
                if (!interfaceTypes.contains(InterfaceType.EXTERNAL)) {
                    LOGGER.info("{}skip external {}", getTag(), addr);
                    continue;
                }
            }
            if (addr instanceof Inet4Address) {
                if (!interfaceTypes.contains(InterfaceType.IPV4)) {
                    LOGGER.info("{}skip ipv4 {}", getTag(), addr);
                    continue;
                }
            } else if (addr instanceof Inet6Address) {
                if (!interfaceTypes.contains(InterfaceType.IPV6)) {
                    LOGGER.info("{}skip ipv6 {}", getTag(), addr);
                    continue;
                }
            }
        }
        if (selectAddress != null && !selectAddress.isEmpty()) {
            boolean found = false;
            String name = addr.getHostAddress();
            for (String filter : selectAddress) {
                if (name.matches(filter)) {
                    found = true;
                    break;
                }
            }
            if (!found && addr instanceof Inet6Address) {
                Matcher matcher = IPV6_SCOPE.matcher(name);
                if (matcher.matches()) {
                    // apply filter also on interface name
                    name = matcher.group(1) + "%" + ((Inet6Address) addr).getScopedInterface().getName();
                    for (String filter : selectAddress) {
                        if (name.matches(filter)) {
                            found = true;
                            break;
                        }
                    }
                }
            }
            if (!found) {
                continue;
            }
        }
        used.add(addr);
        InterfaceType interfaceType = addr.isLoopbackAddress() ? InterfaceType.LOCAL : InterfaceType.EXTERNAL;
        if (protocols.contains(Protocol.UDP) || protocols.contains(Protocol.TCP)) {
            InetSocketAddress bindToAddress = new InetSocketAddress(addr, coapPort);
            if (protocols.contains(Protocol.UDP)) {
                Configuration udpConfig = getConfig(Protocol.UDP, interfaceType);
                CoapEndpoint.Builder builder = new CoapEndpoint.Builder();
                builder.setInetSocketAddress(bindToAddress);
                builder.setConfiguration(udpConfig);
                CoapEndpoint endpoint = builder.build();
                addEndpoint(endpoint);
                print(endpoint, interfaceType);
            }
            if (protocols.contains(Protocol.TCP)) {
                Configuration tcpConfig = getConfig(Protocol.TCP, interfaceType);
                TcpServerConnector connector = new TcpServerConnector(bindToAddress, tcpConfig);
                CoapEndpoint.Builder builder = new CoapEndpoint.Builder();
                builder.setConnector(connector);
                builder.setConfiguration(tcpConfig);
                CoapEndpoint endpoint = builder.build();
                addEndpoint(endpoint);
                print(endpoint, interfaceType);
            }
        }
        if (protocols.contains(Protocol.DTLS) || protocols.contains(Protocol.TLS)) {
            InetSocketAddress bindToAddress = new InetSocketAddress(addr, coapsPort);
            if (protocols.contains(Protocol.DTLS)) {
                Configuration dtlsConfig = getConfig(Protocol.DTLS, interfaceType);
                int handshakeResultDelayMillis = dtlsConfig.getTimeAsInt(DTLS_HANDSHAKE_RESULT_DELAY, TimeUnit.MILLISECONDS);
                DtlsConnectorConfig.Builder dtlsConfigBuilder = DtlsConnectorConfig.builder(dtlsConfig);
                if (cliConfig.clientAuth != null) {
                    dtlsConfigBuilder.set(DtlsConfig.DTLS_CLIENT_AUTHENTICATION_MODE, cliConfig.clientAuth);
                }
                String tag = "dtls:" + StringUtil.toString(bindToAddress);
                dtlsConfigBuilder.setLoggingTag(tag);
                AsyncAdvancedPskStore asyncPskStore = new AsyncAdvancedPskStore(new PlugPskStore());
                asyncPskStore.setDelay(handshakeResultDelayMillis);
                dtlsConfigBuilder.setAdvancedPskStore(asyncPskStore);
                dtlsConfigBuilder.setAddress(bindToAddress);
                X509KeyManager keyManager = SslContextUtil.getX509KeyManager(serverCredentials);
                AsyncKeyManagerCertificateProvider certificateProvider = new AsyncKeyManagerCertificateProvider(keyManager, CertificateType.RAW_PUBLIC_KEY, CertificateType.X_509);
                certificateProvider.setDelay(handshakeResultDelayMillis);
                dtlsConfigBuilder.setCertificateIdentityProvider(certificateProvider);
                AsyncNewAdvancedCertificateVerifier.Builder verifierBuilder = AsyncNewAdvancedCertificateVerifier.builder();
                if (cliConfig.trustall) {
                    verifierBuilder.setTrustAllCertificates();
                } else {
                    verifierBuilder.setTrustedCertificates(trustedCertificates);
                }
                verifierBuilder.setTrustAllRPKs();
                AsyncNewAdvancedCertificateVerifier verifier = verifierBuilder.build();
                verifier.setDelay(handshakeResultDelayMillis);
                dtlsConfigBuilder.setAdvancedCertificateVerifier(verifier);
                AsyncResumptionVerifier resumptionVerifier = new AsyncResumptionVerifier();
                resumptionVerifier.setDelay(handshakeResultDelayMillis);
                dtlsConfigBuilder.setResumptionVerifier(resumptionVerifier);
                dtlsConfigBuilder.setConnectionListener(new MdcConnectionListener());
                if (dtlsConfig.get(SystemConfig.HEALTH_STATUS_INTERVAL, TimeUnit.MILLISECONDS) > 0) {
                    DtlsHealthLogger health = new DtlsHealthLogger(tag);
                    dtlsConfigBuilder.setHealthHandler(health);
                    add(health);
                    // reset to prevent active logger
                    dtlsConfigBuilder.set(SystemConfig.HEALTH_STATUS_INTERVAL, 0, TimeUnit.MILLISECONDS);
                }
                DTLSConnector connector = new DTLSConnector(dtlsConfigBuilder.build());
                CoapEndpoint.Builder builder = new CoapEndpoint.Builder();
                builder.setConnector(connector);
                if (MatcherMode.PRINCIPAL == dtlsConfig.get(CoapConfig.RESPONSE_MATCHING)) {
                    builder.setEndpointContextMatcher(new PrincipalEndpointContextMatcher(true));
                }
                builder.setConfiguration(dtlsConfig);
                CoapEndpoint endpoint = builder.build();
                addEndpoint(endpoint);
                print(endpoint, interfaceType);
            }
            if (protocols.contains(Protocol.TLS) && serverSslContext != null) {
                Configuration tlsConfig = getConfig(Protocol.TLS, interfaceType);
                if (cliConfig.clientAuth != null) {
                    tlsConfig.set(TcpConfig.TLS_CLIENT_AUTHENTICATION_MODE, cliConfig.clientAuth);
                }
                int maxPeers = tlsConfig.get(CoapConfig.MAX_ACTIVE_PEERS);
                int sessionTimeout = tlsConfig.getTimeAsInt(TcpConfig.TLS_SESSION_TIMEOUT, TimeUnit.SECONDS);
                SSLSessionContext serverSessionContext = serverSslContext.getServerSessionContext();
                if (serverSessionContext != null) {
                    serverSessionContext.setSessionTimeout(sessionTimeout);
                    serverSessionContext.setSessionCacheSize(maxPeers);
                }
                TlsServerConnector connector = new TlsServerConnector(serverSslContext, bindToAddress, tlsConfig);
                CoapEndpoint.Builder builder = new CoapEndpoint.Builder();
                builder.setConnector(connector);
                builder.setConfiguration(tlsConfig);
                CoapEndpoint endpoint = builder.build();
                addEndpoint(endpoint);
                print(endpoint, interfaceType);
            }
        }
    }
}

Example 2 with AsyncResumptionVerifier

use of org.eclipse.californium.scandium.dtls.resumption.AsyncResumptionVerifier in project californium by eclipse.

the class DTLSConnectorResumeTest method startServer.

/**
 * Starts the server side DTLS connector.
 *
 * @throws Exception if the connector cannot be started.
 */
@BeforeClass
public static void startServer() throws Exception {
    ApplicationLevelInfoSupplier supplier = new ApplicationLevelInfoSupplier() {

        @Override
        public AdditionalInfo getInfo(Principal clientIdentity, Object customArgument) {
            return applicationInfo.get();
        }
    };
    AdvancedMultiPskStore pskStore = new AdvancedMultiPskStore();
    pskStore.setKey(CLIENT_IDENTITY, CLIENT_IDENTITY_SECRET.getBytes());
    pskStore.setKey(SCOPED_CLIENT_IDENTITY, SCOPED_CLIENT_IDENTITY_SECRET.getBytes(), SERVERNAME);
    pskStore.setKey(SCOPED_CLIENT_IDENTITY, SCOPED_CLIENT_IDENTITY_SECRET.getBytes(), SERVERNAME_ALT);
    serverPskStore = new AsyncAdvancedPskStore(pskStore);
    serverCertificateVerifier = (AsyncNewAdvancedCertificateVerifier) AsyncNewAdvancedCertificateVerifier.builder().setTrustedCertificates(DtlsTestTools.getTrustedCertificates()).setTrustAllRPKs().build();
    serverResumptionVerifier = new AsyncResumptionVerifier();
    serverCertificateProvider = new AsyncCertificateProvider(DtlsTestTools.getPrivateKey(), DtlsTestTools.getServerCertificateChain(), CertificateType.RAW_PUBLIC_KEY, CertificateType.X_509);
    serverHelper = new ConnectorHelper(network);
    serverHelper.serverBuilder.set(DtlsConfig.DTLS_USE_SERVER_NAME_INDICATION, true).set(DtlsConfig.DTLS_CONNECTION_ID_LENGTH, 6).set(DtlsConfig.DTLS_SUPPORT_DEPRECATED_CID, true).setSessionStore(new TestInMemorySessionStore(false)).setApplicationLevelInfoSupplier(supplier).setAdvancedCertificateVerifier(serverCertificateVerifier).setAdvancedPskStore(serverPskStore).setCertificateIdentityProvider(serverCertificateProvider).setResumptionVerifier(serverResumptionVerifier);
    serverHelper.startServer();
    executor = ExecutorsUtil.newFixedThreadPool(2, new TestThreadFactory("DTLS-RESUME-"));
    clientPrivateKey = DtlsTestTools.getClientPrivateKey();
    clientCertificateChain = DtlsTestTools.getClientCertificateChain();
    clientInMemoryPskStore = new AdvancedMultiPskStore();
    clientInMemoryPskStore.addKnownPeer(serverHelper.serverEndpoint, CLIENT_IDENTITY, CLIENT_IDENTITY_SECRET.getBytes());
    clientInMemoryPskStore.addKnownPeer(serverHelper.serverEndpoint, SERVERNAME, SCOPED_CLIENT_IDENTITY, SCOPED_CLIENT_IDENTITY_SECRET.getBytes());
    clientInMemoryPskStore.addKnownPeer(serverHelper.serverEndpoint, SERVERNAME_ALT, SCOPED_CLIENT_IDENTITY, SCOPED_CLIENT_IDENTITY_SECRET.getBytes());
    clientPskStore = new AsyncAdvancedPskStore(clientInMemoryPskStore);
    clientCertificateVerifier = (AsyncNewAdvancedCertificateVerifier) AsyncNewAdvancedCertificateVerifier.builder().setTrustedCertificates(DtlsTestTools.getTrustedCertificates()).setTrustAllRPKs().build();
    clientCertificateProvider = new AsyncCertificateProvider(clientPrivateKey, clientCertificateChain, CertificateType.RAW_PUBLIC_KEY, CertificateType.X_509);
}

Example 3 with AsyncResumptionVerifier

use of org.eclipse.californium.scandium.dtls.resumption.AsyncResumptionVerifier in project californium by eclipse.

the class DTLSConnectorAdvancedTest method loadKeys.

@BeforeClass
public static void loadKeys() throws IOException, GeneralSecurityException {
    serverHelper = new ConnectorHelper(network);
    serverHealth = new DtlsHealthLogger("server");
    serverCidGenerator = new SingleNodeConnectionIdGenerator(6);
    AdvancedMultiPskStore pskStore = new AdvancedMultiPskStore();
    pskStore.setKey(CLIENT_IDENTITY, CLIENT_IDENTITY_SECRET.getBytes());
    pskStore.setKey(SCOPED_CLIENT_IDENTITY, SCOPED_CLIENT_IDENTITY_SECRET.getBytes(), SERVERNAME);
    serverPskStore = new AsyncAdvancedPskStore(pskStore) {

        @Override
        public PskSecretResult requestPskSecretResult(final ConnectionId cid, final ServerNames serverNames, final PskPublicInformation identity, final String hmacAlgorithm, SecretKey otherSecret, byte[] seed, boolean useExtendedMasterSecret) {
            LOGGER.info("get PSK secrets");
            PskSecretResult result = null;
            if (0 < pskHandshakeResponses) {
                result = super.requestPskSecretResult(cid, serverNames, identity, hmacAlgorithm, otherSecret, seed, useExtendedMasterSecret);
                if (1 < pskHandshakeResponses) {
                    final int delay = getDelay();
                    try {
                        setDelay(1);
                        for (int index = 1; index < pskHandshakeResponses; ++index) {
                            super.requestPskSecretResult(cid, serverNames, identity, hmacAlgorithm, otherSecret, seed, useExtendedMasterSecret);
                        }
                    } finally {
                        setDelay(delay);
                    }
                }
            }
            return result;
        }
    };
    serverCertificateVerifier = new AsyncNewAdvancedCertificateVerifier(DtlsTestTools.getTrustedCertificates(), new RawPublicKeyIdentity[0], null) {

        @Override
        public CertificateVerificationResult verifyCertificate(final ConnectionId cid, final ServerNames serverName, InetSocketAddress remotePeer, final boolean clientUsage, boolean verifyDestination, final boolean truncateCertificatePath, final CertificateMessage message) {
            LOGGER.info("verify certificate");
            CertificateVerificationResult result = null;
            if (0 < verifyHandshakeResponses) {
                result = super.verifyCertificate(cid, serverName, remotePeer, clientUsage, verifyDestination, truncateCertificatePath, message);
                if (1 < verifyHandshakeResponses) {
                    final int delay = getDelay();
                    try {
                        setDelay(1);
                        for (int index = 1; index < verifyHandshakeResponses; ++index) {
                            super.verifyCertificate(cid, serverName, remotePeer, clientUsage, verifyDestination, truncateCertificatePath, message);
                        }
                    } finally {
                        setDelay(delay);
                    }
                }
            }
            return result;
        }
    };
    serverResumptionVerifier = new AsyncResumptionVerifier() {

        @Override
        public ResumptionVerificationResult verifyResumptionRequest(final ConnectionId cid, final ServerNames serverName, final SessionId sessionId) {
            LOGGER.info("verify resumption");
            ResumptionVerificationResult result = null;
            if (0 < resumeHandshakeResponses) {
                result = super.verifyResumptionRequest(cid, serverName, sessionId);
                if (1 < resumeHandshakeResponses) {
                    final int delay = getDelay();
                    try {
                        setDelay(1);
                        for (int index = 1; index < resumeHandshakeResponses; ++index) {
                            super.verifyResumptionRequest(cid, serverName, sessionId);
                        }
                    } finally {
                        setDelay(delay);
                    }
                }
            }
            return result;
        }
    };
    serverCertificateProvider = new AsyncCertificateProvider(DtlsTestTools.getPrivateKey(), DtlsTestTools.getServerCertificateChain(), CertificateType.RAW_PUBLIC_KEY, CertificateType.X_509) {

        @Override
        public CertificateIdentityResult requestCertificateIdentity(final ConnectionId cid, final boolean client, final List<X500Principal> issuers, final ServerNames serverName, final List<CertificateKeyAlgorithm> certificateKeyAlgorithms, final List<SignatureAndHashAlgorithm> signaturesAndHashAlgorithms, final List<SupportedGroup> curves) {
            LOGGER.info("verify resumption");
            CertificateIdentityResult result = null;
            if (0 < certificateHandshakeResponses) {
                result = super.requestCertificateIdentity(cid, client, issuers, serverName, certificateKeyAlgorithms, signaturesAndHashAlgorithms, curves);
                if (1 < certificateHandshakeResponses) {
                    final int delay = getDelay();
                    try {
                        setDelay(1);
                        for (int index = 1; index < certificateHandshakeResponses; ++index) {
                            super.requestCertificateIdentity(cid, client, issuers, serverName, certificateKeyAlgorithms, signaturesAndHashAlgorithms, curves);
                        }
                    } finally {
                        setDelay(delay);
                    }
                }
            }
            return result;
        }
    };
    serverHelper.serverBuilder.set(DtlsConfig.DTLS_RETRANSMISSION_TIMEOUT, RETRANSMISSION_TIMEOUT_MS, TimeUnit.MILLISECONDS).set(DtlsConfig.DTLS_MAX_RETRANSMISSIONS, MAX_RETRANSMISSIONS).set(DtlsConfig.DTLS_MAX_TRANSMISSION_UNIT, 1024).setConnectionIdGenerator(serverCidGenerator).setHealthHandler(serverHealth).setAdvancedPskStore(serverPskStore).setCertificateIdentityProvider(serverCertificateProvider).setAdvancedCertificateVerifier(serverCertificateVerifier).setResumptionVerifier(serverResumptionVerifier);
    serverHelper.startServer();
    serverConfigSingleRecord = DtlsConnectorConfig.builder(serverHelper.serverConfig).set(DtlsConfig.DTLS_USE_MULTI_RECORD_MESSAGES, false).build();
    executor = ExecutorsUtil.newFixedThreadPool(2, new TestThreadFactory("DTLS-ADVANCED-"));
    timer = new TestScheduledExecutorService();
    clientHealth = new DtlsHealthLogger("client");
}