Examples with ValidateDeviceCredentialsResponse org.thingsboard.server.common.transport.auth.ValidateDeviceCredentialsResponse used on opensource projects

Example 1 with ValidateDeviceCredentialsResponse

use of org.thingsboard.server.common.transport.auth.ValidateDeviceCredentialsResponse in project thingsboard by thingsboard.

the class TbLwM2MDtlsBootstrapCertificateVerifier method verifyCertificate.

@Override
public CertificateVerificationResult verifyCertificate(ConnectionId cid, ServerNames serverName, InetSocketAddress remotePeer, boolean clientUsage, boolean verifySubject, boolean truncateCertificatePath, CertificateMessage message) {
    CertPath certChain = message.getCertificateChain();
    if (certChain == null) {
        // We trust all RPK on this layer, and use TbLwM2MAuthorizer
        PublicKey publicKey = message.getPublicKey();
        return new CertificateVerificationResult(cid, publicKey, null);
    } else {
        try {
            boolean x509CredentialsFound = false;
            X509Certificate[] chain = certChain.getCertificates().toArray(new X509Certificate[0]);
            for (X509Certificate cert : chain) {
                try {
                    if (!skipValidityCheckForClientCert) {
                        cert.checkValidity();
                    }
                    TbLwM2MSecurityInfo securityInfo = null;
                    // verify if trust
                    if (staticCertificateVerifier != null) {
                        HandshakeException exception = staticCertificateVerifier.verifyCertificate(cid, serverName, remotePeer, clientUsage, verifySubject, truncateCertificatePath, message).getException();
                        if (exception == null) {
                            String endpoint = config.getTrustSslCredentials().getValueFromSubjectNameByKey(cert.getSubjectX500Principal().getName(), "CN");
                            if (StringUtils.isNotEmpty(endpoint)) {
                                securityInfo = bsSecurityStore.getX509ByEndpoint(endpoint);
                            }
                        } else {
                            log.trace("Certificate validation failed.", exception);
                        }
                    }
                    // if not trust or cert trust securityInfo == null
                    if (securityInfo == null || securityInfo.getMsg() == null) {
                        String strCert = SslUtil.getCertificateString(cert);
                        String sha3Hash = EncryptionUtil.getSha3Hash(strCert);
                        try {
                            securityInfo = bsSecurityStore.getX509ByEndpoint(sha3Hash);
                        } catch (LwM2MAuthException e) {
                            log.trace("Failed to find security info: [{}]", sha3Hash, e);
                        }
                    }
                    ValidateDeviceCredentialsResponse msg = securityInfo != null ? securityInfo.getMsg() : null;
                    if (msg != null && StringUtils.isNotEmpty(msg.getCredentials())) {
                        x509CredentialsFound = true;
                        break;
                    }
                } catch (CertificateEncodingException | CertificateExpiredException | CertificateNotYetValidException e) {
                    log.trace("Failed to find security info: [{}]", cert.getSubjectX500Principal().getName(), e);
                }
            }
            if (!x509CredentialsFound) {
                AlertMessage alert = new AlertMessage(AlertMessage.AlertLevel.FATAL, AlertMessage.AlertDescription.INTERNAL_ERROR);
                throw new HandshakeException("x509 verification not enabled!", alert);
            }
            return new CertificateVerificationResult(cid, certChain, null);
        } catch (HandshakeException e) {
            log.trace("Certificate validation failed!", e);
            return new CertificateVerificationResult(cid, e, null);
        }
    }
}

Example 2 with ValidateDeviceCredentialsResponse

use of org.thingsboard.server.common.transport.auth.ValidateDeviceCredentialsResponse in project thingsboard by thingsboard.

the class TbLwM2MDtlsCertificateVerifier method verifyCertificate.

@Override
public CertificateVerificationResult verifyCertificate(ConnectionId cid, ServerNames serverName, InetSocketAddress remotePeer, boolean clientUsage, boolean verifySubject, boolean truncateCertificatePath, CertificateMessage message) {
    CertPath certChain = message.getCertificateChain();
    if (certChain == null) {
        // We trust all RPK on this layer, and use TbLwM2MAuthorizer
        PublicKey publicKey = message.getPublicKey();
        return new CertificateVerificationResult(cid, publicKey, null);
    } else {
        try {
            boolean x509CredentialsFound = false;
            X509Certificate[] chain = certChain.getCertificates().toArray(new X509Certificate[0]);
            for (X509Certificate cert : chain) {
                try {
                    if (!skipValidityCheckForClientCert) {
                        cert.checkValidity();
                    }
                    TbLwM2MSecurityInfo securityInfo = null;
                    if (staticCertificateVerifier != null) {
                        HandshakeException exception = staticCertificateVerifier.verifyCertificate(cid, serverName, remotePeer, clientUsage, verifySubject, truncateCertificatePath, message).getException();
                        if (exception == null) {
                            try {
                                String endpoint = config.getTrustSslCredentials().getValueFromSubjectNameByKey(cert.getSubjectX500Principal().getName(), "CN");
                                if (StringUtils.isNotEmpty(endpoint)) {
                                    securityInfo = securityInfoValidator.getEndpointSecurityInfoByCredentialsId(endpoint, CLIENT);
                                }
                            } catch (LwM2MAuthException e) {
                                log.trace("Certificate trust validation failed.", e);
                            }
                        } else {
                            log.trace("Certificate trust validation failed.", exception);
                        }
                    }
                    // if not trust or cert trust securityInfo == null
                    String strCert = SslUtil.getCertificateString(cert);
                    String sha3Hash = EncryptionUtil.getSha3Hash(strCert);
                    if (securityInfo == null || securityInfo.getMsg() == null) {
                        try {
                            securityInfo = securityInfoValidator.getEndpointSecurityInfoByCredentialsId(sha3Hash, CLIENT);
                        } catch (LwM2MAuthException e) {
                            log.trace("Failed find security info: {}", sha3Hash, e);
                        }
                    }
                    ValidateDeviceCredentialsResponse msg = securityInfo != null ? securityInfo.getMsg() : null;
                    if (msg != null && StringUtils.isNotEmpty(msg.getCredentials())) {
                        LwM2MClientCredentials credentials = JacksonUtil.fromString(msg.getCredentials(), LwM2MClientCredentials.class);
                        if (!credentials.getClient().getSecurityConfigClientMode().equals(LwM2MSecurityMode.X509)) {
                            continue;
                        }
                        X509ClientCredential config = (X509ClientCredential) credentials.getClient();
                        String certBody = config.getCert();
                        String endpoint = config.getEndpoint();
                        if (StringUtils.isBlank(certBody) || strCert.equals(certBody)) {
                            x509CredentialsFound = true;
                            DeviceProfile deviceProfile = msg.getDeviceProfile();
                            if (msg.hasDeviceInfo() && deviceProfile != null) {
                                sessionStorage.put(endpoint, new TbX509DtlsSessionInfo(cert.getSubjectX500Principal().getName(), msg));
                                try {
                                    securityStore.putX509(securityInfo);
                                } catch (NonUniqueSecurityInfoException e) {
                                    log.trace("Failed to add security info: {}", securityInfo, e);
                                }
                                break;
                            }
                        } else {
                            log.trace("[{}][{}] Certificate mismatch. Expected: {}, Actual: {}", endpoint, sha3Hash, strCert, certBody);
                        }
                    }
                } catch (CertificateEncodingException | CertificateExpiredException | CertificateNotYetValidException e) {
                    log.error(e.getMessage(), e);
                }
            }
            if (!x509CredentialsFound) {
                AlertMessage alert = new AlertMessage(AlertMessage.AlertLevel.FATAL, AlertMessage.AlertDescription.INTERNAL_ERROR);
                throw new HandshakeException("x509 verification not enabled!", alert);
            }
            return new CertificateVerificationResult(cid, certChain, null);
        } catch (HandshakeException e) {
            log.trace("Certificate validation failed!", e);
            return new CertificateVerificationResult(cid, e, null);
        }
    }
}

Example 3 with ValidateDeviceCredentialsResponse

use of org.thingsboard.server.common.transport.auth.ValidateDeviceCredentialsResponse in project thingsboard by thingsboard.

the class TbCoapDtlsCertificateVerifier method verifyCertificate.

@Override
public CertificateVerificationResult verifyCertificate(ConnectionId cid, ServerNames serverName, InetSocketAddress remotePeer, boolean clientUsage, boolean verifySubject, boolean truncateCertificatePath, CertificateMessage message) {
    try {
        CertPath certpath = message.getCertificateChain();
        X509Certificate[] chain = certpath.getCertificates().toArray(new X509Certificate[0]);
        for (X509Certificate cert : chain) {
            try {
                if (!skipValidityCheckForClientCert) {
                    cert.checkValidity();
                }
                String strCert = SslUtil.getCertificateString(cert);
                String sha3Hash = EncryptionUtil.getSha3Hash(strCert);
                final ValidateDeviceCredentialsResponse[] deviceCredentialsResponse = new ValidateDeviceCredentialsResponse[1];
                CountDownLatch latch = new CountDownLatch(1);
                transportService.process(DeviceTransportType.COAP, TransportProtos.ValidateDeviceX509CertRequestMsg.newBuilder().setHash(sha3Hash).build(), new TransportServiceCallback<>() {

                    @Override
                    public void onSuccess(ValidateDeviceCredentialsResponse msg) {
                        if (!StringUtils.isEmpty(msg.getCredentials())) {
                            deviceCredentialsResponse[0] = msg;
                        }
                        latch.countDown();
                    }

                    @Override
                    public void onError(Throwable e) {
                        log.error(e.getMessage(), e);
                        latch.countDown();
                    }
                });
                latch.await(10, TimeUnit.SECONDS);
                ValidateDeviceCredentialsResponse msg = deviceCredentialsResponse[0];
                if (msg != null && strCert.equals(msg.getCredentials())) {
                    DeviceProfile deviceProfile = msg.getDeviceProfile();
                    if (msg.hasDeviceInfo() && deviceProfile != null) {
                        tbCoapDtlsSessionInMemoryStorage.put(remotePeer, new TbCoapDtlsSessionInfo(msg, deviceProfile));
                    }
                    break;
                }
            } catch (InterruptedException | CertificateEncodingException | CertificateExpiredException | CertificateNotYetValidException e) {
                log.error(e.getMessage(), e);
                AlertMessage alert = new AlertMessage(AlertMessage.AlertLevel.FATAL, AlertMessage.AlertDescription.BAD_CERTIFICATE);
                throw new HandshakeException("Certificate chain could not be validated", alert);
            }
        }
        return new CertificateVerificationResult(cid, certpath, null);
    } catch (HandshakeException e) {
        log.trace("Certificate validation failed!", e);
        return new CertificateVerificationResult(cid, e, null);
    }
}

Example 4 with ValidateDeviceCredentialsResponse

use of org.thingsboard.server.common.transport.auth.ValidateDeviceCredentialsResponse in project thingsboard by thingsboard.

the class LwM2mCredentialsSecurityInfoValidator method getEndpointSecurityInfoByCredentialsId.

public TbLwM2MSecurityInfo getEndpointSecurityInfoByCredentialsId(String credentialsId, LwM2mTypeServer keyValue) {
    CountDownLatch latch = new CountDownLatch(1);
    final TbLwM2MSecurityInfo[] resultSecurityStore = new TbLwM2MSecurityInfo[1];
    log.trace("Validating credentials [{}]", credentialsId);
    context.getTransportService().process(ValidateDeviceLwM2MCredentialsRequestMsg.newBuilder().setCredentialsId(credentialsId).build(), new TransportServiceCallback<>() {

        @Override
        public void onSuccess(ValidateDeviceCredentialsResponse msg) {
            log.trace("Validated credentials: [{}] [{}]", credentialsId, msg);
            resultSecurityStore[0] = createSecurityInfo(credentialsId, msg, keyValue);
            latch.countDown();
        }

        @Override
        public void onError(Throwable e) {
            log.trace("[{}] [{}] Failed to process credentials ", credentialsId, e);
            TbLwM2MSecurityInfo result = new TbLwM2MSecurityInfo();
            result.setEndpoint(credentialsId);
            resultSecurityStore[0] = result;
            latch.countDown();
        }
    });
    try {
        latch.await(config.getTimeout(), TimeUnit.MILLISECONDS);
    } catch (InterruptedException e) {
        log.error("Failed to await credentials!", e);
    }
    TbLwM2MSecurityInfo securityInfo = resultSecurityStore[0];
    if (securityInfo.getSecurityMode() == null) {
        throw new LwM2MAuthException();
    }
    return securityInfo;
}

Example 5 with ValidateDeviceCredentialsResponse

use of org.thingsboard.server.common.transport.auth.ValidateDeviceCredentialsResponse in project thingsboard by thingsboard.

the class DefaultTransportService method process.

@Override
public void process(TransportProtos.ValidateDeviceLwM2MCredentialsRequestMsg requestMsg, TransportServiceCallback<ValidateDeviceCredentialsResponse> callback) {
    log.trace("Processing msg: {}", requestMsg);
    TbProtoQueueMsg<TransportApiRequestMsg> protoMsg = new TbProtoQueueMsg<>(UUID.randomUUID(), TransportApiRequestMsg.newBuilder().setValidateDeviceLwM2MCredentialsRequestMsg(requestMsg).build());
    ListenableFuture<ValidateDeviceCredentialsResponse> response = Futures.transform(transportApiRequestTemplate.send(protoMsg), tmp -> {
        TransportProtos.ValidateDeviceCredentialsResponseMsg msg = tmp.getValue().getValidateCredResponseMsg();
        ValidateDeviceCredentialsResponse.ValidateDeviceCredentialsResponseBuilder result = ValidateDeviceCredentialsResponse.builder();
        if (msg.hasDeviceInfo()) {
            result.credentials(msg.getCredentialsBody());
            TransportDeviceInfo tdi = getTransportDeviceInfo(msg.getDeviceInfo());
            result.deviceInfo(tdi);
            ByteString profileBody = msg.getProfileBody();
            if (!profileBody.isEmpty()) {
                DeviceProfile profile = deviceProfileCache.getOrCreate(tdi.getDeviceProfileId(), profileBody);
                result.deviceProfile(profile);
            }
        }
        return result.build();
    }, MoreExecutors.directExecutor());
    AsyncCallbackTemplate.withCallback(response, callback::onSuccess, callback::onError, transportCallbackExecutor);
}