protocol/netconf-client/src/test/java/org/opendaylight/netconf/client/NetconfClientFactoryImplTest.java

   1 /*
   2  * Copyright (c) 2023 PANTHEON.tech s.r.o. and others. All rights reserved.
   3  *
   4  * This program and the accompanying materials are made available under the
   5  * terms of the Eclipse Public License v1.0 which accompanies this distribution,
   6  * and is available at http://www.eclipse.org/legal/epl-v10.html
   7  */
   8 package org.opendaylight.netconf.client;
   9
  10 import static org.junit.jupiter.api.Assertions.assertNotNull;
  11 import static org.mockito.ArgumentMatchers.any;
  12 import static org.mockito.Mockito.doNothing;
  13 import static org.mockito.Mockito.doReturn;
  14 import static org.mockito.Mockito.timeout;
  15 import static org.mockito.Mockito.verify;
  16
  17 import io.netty.handler.ssl.SslContextBuilder;
  18 import java.math.BigInteger;
  19 import java.net.InetAddress;
  20 import java.net.ServerSocket;
  21 import java.security.KeyPairGenerator;
  22 import java.security.KeyStore;
  23 import java.security.SecureRandom;
  24 import java.security.cert.Certificate;
  25 import java.security.spec.RSAKeyGenParameterSpec;
  26 import java.time.Duration;
  27 import java.time.Instant;
  28 import java.util.Date;
  29 import java.util.List;
  30 import java.util.Map;
  31 import java.util.concurrent.TimeUnit;
  32 import javax.net.ssl.KeyManagerFactory;
  33 import javax.net.ssl.TrustManagerFactory;
  34 import org.bouncycastle.asn1.x500.X500Name;
  35 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
  36 import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
  37 import org.bouncycastle.jce.provider.BouncyCastleProvider;
  38 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
  39 import org.junit.jupiter.api.AfterAll;
  40 import org.junit.jupiter.api.AfterEach;
  41 import org.junit.jupiter.api.BeforeAll;
  42 import org.junit.jupiter.api.BeforeEach;
  43 import org.junit.jupiter.api.Test;
  44 import org.junit.jupiter.api.extension.ExtendWith;
  45 import org.mockito.Mock;
  46 import org.mockito.junit.jupiter.MockitoExtension;
  47 import org.opendaylight.netconf.client.conf.NetconfClientConfiguration;
  48 import org.opendaylight.netconf.client.conf.NetconfClientConfigurationBuilder;
  49 import org.opendaylight.netconf.common.impl.DefaultNetconfTimer;
  50 import org.opendaylight.netconf.shaded.sshd.client.auth.password.PasswordIdentityProvider;
  51 import org.opendaylight.netconf.shaded.sshd.server.auth.password.UserAuthPasswordFactory;
  52 import org.opendaylight.netconf.shaded.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider;
  53 import org.opendaylight.netconf.transport.api.TransportChannel;
  54 import org.opendaylight.netconf.transport.api.TransportChannelListener;
  55 import org.opendaylight.netconf.transport.ssh.ClientFactoryManagerConfigurator;
  56 import org.opendaylight.netconf.transport.ssh.SSHTransportStackFactory;
  57 import org.opendaylight.netconf.transport.ssh.ServerFactoryManagerConfigurator;
  58 import org.opendaylight.netconf.transport.tcp.TCPServer;
  59 import org.opendaylight.netconf.transport.tls.TLSServer;
  60 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.iana.crypt.hash.rev140806.CryptHash;
  61 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev231228.RsaPrivateKeyFormat;
  62 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev231228.SubjectPublicKeyInfoFormat;
  63 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev231228._private.key.grouping._private.key.type.CleartextPrivateKeyBuilder;
  64 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev231228.password.grouping.password.type.CleartextPasswordBuilder;
  65 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.Host;
  66 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.IetfInetUtil;
  67 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.PortNumber;
  68 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.keystore.rev231228.inline.or.keystore.asymmetric.key.grouping.inline.or.keystore.InlineBuilder;
  69 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.keystore.rev231228.inline.or.keystore.asymmetric.key.grouping.inline.or.keystore.inline.InlineDefinitionBuilder;
  70 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.netconf.client.rev231228.netconf.client.initiate.stack.grouping.transport.tls.tls.TcpClientParametersBuilder;
  71 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.netconf.client.rev231228.netconf.client.listen.stack.grouping.transport.ssh.ssh.SshClientParametersBuilder;
  72 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.netconf.client.rev231228.netconf.client.listen.stack.grouping.transport.ssh.ssh.TcpServerParametersBuilder;
  73 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.client.rev231228.ssh.client.grouping.ClientIdentityBuilder;
  74 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.client.rev231228.ssh.client.grouping.client.identity.PasswordBuilder;
  75 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev231228.SshServerGrouping;
  76 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev231228.ssh.server.grouping.ClientAuthentication;
  77 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev231228.ssh.server.grouping.ClientAuthenticationBuilder;
  78 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev231228.ssh.server.grouping.ServerIdentity;
  79 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev231228.ssh.server.grouping.ServerIdentityBuilder;
  80 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev231228.ssh.server.grouping.client.authentication.UsersBuilder;
  81 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev231228.ssh.server.grouping.client.authentication.users.UserBuilder;
  82 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev231228.ssh.server.grouping.server.identity.HostKeyBuilder;
  83 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev231228.ssh.server.grouping.server.identity.host.key.host.key.type.PublicKeyBuilder;
  84 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tcp.client.rev231228.TcpClientGrouping;
  85 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tcp.server.rev231228.TcpServerGrouping;
  86 import org.opendaylight.yangtools.yang.common.Uint16;
  87
  88 @ExtendWith(MockitoExtension.class)
  89 class NetconfClientFactoryImplTest {
  90     private static final String USERNAME = "username";
  91     private static final String PASSWORD = "pa$$w0rd";
  92     private static final String RSA = "RSA";
  93     private static final char[] EMPTY_SECRET = new char[0];
  94
  95     private static SSHTransportStackFactory SERVER_FACTORY;
  96     private static DefaultNetconfTimer TIMER;
  97
  98     @Mock
  99     private NetconfClientSessionListener sessionListener;
 100     @Mock
 101     private TransportChannelListener serverTransportListener;
 102     @Mock
 103     private SshServerGrouping sshServerParams;
 104
 105     private NetconfClientFactory factory;
 106     private TcpServerGrouping tcpServerParams;
 107     private TcpClientGrouping tcpClientParams;
 108
 109     @BeforeAll
 110     static void beforeAll() {
 111         SERVER_FACTORY = new SSHTransportStackFactory("server", 0);
 112         TIMER = new DefaultNetconfTimer();
 113     }
 114
 115     @AfterAll
 116     static void afterAll() {
 117         SERVER_FACTORY.close();
 118         TIMER.close();
 119     }
 120
 121     @BeforeEach
 122     void beforeEach() throws Exception {
 123         factory = new NetconfClientFactoryImpl(TIMER);
 124         doNothing().when(serverTransportListener).onTransportChannelEstablished(any());
 125
 126         // create temp socket to get available port for test
 127         final var socket = new ServerSocket(0);
 128         final var address = IetfInetUtil.ipAddressFor(InetAddress.getLoopbackAddress());
 129         final var port = new PortNumber(Uint16.valueOf(socket.getLocalPort()));
 130         socket.close();
 131
 132         tcpServerParams = new TcpServerParametersBuilder().setLocalAddress(address).setLocalPort(port).build();
 133         tcpClientParams =
 134             new TcpClientParametersBuilder().setRemoteAddress(new Host(address)).setRemotePort(port).build();
 135     }
 136
 137     @AfterEach
 138     void afterEach() throws Exception {
 139         if (factory != null) {
 140             factory.close();
 141         }
 142     }
 143
 144     @Test
 145     void tcpClient() throws Exception {
 146         final var server = TCPServer.listen(serverTransportListener,
 147             SERVER_FACTORY.newServerBootstrap(), tcpServerParams).get(1, TimeUnit.SECONDS);
 148         try {
 149             final var clientConfig = NetconfClientConfigurationBuilder.create()
 150                 .withProtocol(NetconfClientConfiguration.NetconfClientProtocol.TCP)
 151                 .withTcpParameters(tcpClientParams).withSessionListener(sessionListener).build();
 152             assertNotNull(factory.createClient(clientConfig));
 153             verify(serverTransportListener, timeout(1000L))
 154                 .onTransportChannelEstablished(any(TransportChannel.class));
 155         } finally {
 156             server.shutdown().get(1, TimeUnit.SECONDS);
 157         }
 158     }
 159
 160     @Test
 161     void tlsClient() throws Exception {
 162         final var keyStore = buildKeystoreWithGeneratedCertificate();
 163         final var keyMgr = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
 164         keyMgr.init(keyStore, EMPTY_SECRET);
 165         final var trustMgr = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
 166         trustMgr.init(keyStore);
 167         final var serverContext = SslContextBuilder.forServer(keyMgr).trustManager(trustMgr).build();
 168         final var clientContext = SslContextBuilder.forClient().keyManager(keyMgr).trustManager(trustMgr).build();
 169
 170         final var server = TLSServer.listen(serverTransportListener, SERVER_FACTORY.newServerBootstrap(),
 171             tcpServerParams, channel -> serverContext.newHandler(channel.alloc())).get(1, TimeUnit.SECONDS);
 172         try {
 173             final var clientConfig = NetconfClientConfigurationBuilder.create()
 174                 .withProtocol(NetconfClientConfiguration.NetconfClientProtocol.TLS)
 175                 .withTcpParameters(tcpClientParams)
 176                 .withSslHandlerFactory(channel -> clientContext.newHandler(channel.alloc()))
 177                 .withSessionListener(sessionListener).build();
 178             assertNotNull(factory.createClient(clientConfig));
 179             verify(serverTransportListener, timeout(1000L))
 180                 .onTransportChannelEstablished(any(TransportChannel.class));
 181         } finally {
 182             server.shutdown().get(1, TimeUnit.SECONDS);
 183         }
 184     }
 185
 186     private static KeyStore buildKeystoreWithGeneratedCertificate() throws Exception {
 187         // key pair
 188         final var keyPairGenerator = KeyPairGenerator.getInstance("RSA");
 189         keyPairGenerator.initialize(new RSAKeyGenParameterSpec(2048, RSAKeyGenParameterSpec.F4), new SecureRandom());
 190         final var keyPair = keyPairGenerator.generateKeyPair();
 191         // certificate
 192         final var now = Instant.now();
 193         final var contentSigner = new JcaContentSignerBuilder("SHA256withRSA").build(keyPair.getPrivate());
 194         final var x500Name = new X500Name("CN=TestCertificate");
 195         final var certificateBuilder = new JcaX509v3CertificateBuilder(x500Name,
 196             BigInteger.valueOf(now.toEpochMilli()),
 197             Date.from(now), Date.from(now.plus(Duration.ofDays(365))),
 198             x500Name,
 199             keyPair.getPublic());
 200         final var certificate = new JcaX509CertificateConverter()
 201             .setProvider(new BouncyCastleProvider()).getCertificate(certificateBuilder.build(contentSigner));
 202         // keystore with certificate and key
 203         final var keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
 204         keyStore.load(null, null);
 205         keyStore.setCertificateEntry("cert", certificate);
 206         keyStore.setKeyEntry("key", keyPair.getPrivate(), EMPTY_SECRET, new Certificate[]{certificate});
 207         return keyStore;
 208     }
 209
 210     @Test
 211     void sshClient() throws Exception {
 212         doReturn(buildSshServerIdentity()).when(sshServerParams).getServerIdentity();
 213         doReturn(buildSshClientAuth()).when(sshServerParams).getClientAuthentication();
 214         doReturn(null).when(sshServerParams).getTransportParams();
 215         doReturn(null).when(sshServerParams).getKeepalives();
 216
 217         final var server = SERVER_FACTORY.listenServer("netconf", serverTransportListener, tcpServerParams,
 218             sshServerParams).get(10, TimeUnit.SECONDS);
 219
 220         try {
 221             final var clientConfig = NetconfClientConfigurationBuilder.create()
 222                 .withProtocol(NetconfClientConfiguration.NetconfClientProtocol.SSH)
 223                 .withTcpParameters(tcpClientParams)
 224                 .withSshParameters(new SshClientParametersBuilder()
 225                     .setClientIdentity(new ClientIdentityBuilder().setUsername(USERNAME)
 226                         .setPassword(new PasswordBuilder().setPasswordType(
 227                             new CleartextPasswordBuilder().setCleartextPassword(PASSWORD)
 228                                 .build()).build()).build())
 229                     .build())
 230                 .withSessionListener(sessionListener)
 231                 .withConnectionTimeoutMillis(10_000)
 232                 .build();
 233             assertNotNull(factory.createClient(clientConfig));
 234             verify(serverTransportListener, timeout(10_000L))
 235                 .onTransportChannelEstablished(any(TransportChannel.class));
 236         } finally {
 237             server.shutdown().get(1, TimeUnit.SECONDS);
 238         }
 239     }
 240
 241     private static ServerIdentity buildSshServerIdentity() throws Exception {
 242         final var keyPair = KeyPairGenerator.getInstance(RSA).generateKeyPair();
 243         final var inlineDef = new InlineDefinitionBuilder()
 244             .setPublicKeyFormat(SubjectPublicKeyInfoFormat.VALUE)
 245             .setPublicKey(keyPair.getPublic().getEncoded())
 246             .setPrivateKeyFormat(RsaPrivateKeyFormat.VALUE)
 247             .setPrivateKeyType(
 248                 new CleartextPrivateKeyBuilder().setCleartextPrivateKey(
 249                     keyPair.getPrivate().getEncoded()
 250                 ).build()
 251             ).build();
 252         final var inline = new InlineBuilder().setInlineDefinition(inlineDef).build();
 253         final var publicKey = new PublicKeyBuilder().setPublicKey(
 254             new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev231228
 255                 .ssh.server.grouping.server.identity.host.key.host.key.type._public.key
 256                 .PublicKeyBuilder().setInlineOrKeystore(inline).build()
 257         ).build();
 258         return new ServerIdentityBuilder().setHostKey(
 259             List.of(new HostKeyBuilder().setName("test-name").setHostKeyType(publicKey).build())
 260         ).build();
 261     }
 262
 263     private static ClientAuthentication buildSshClientAuth() {
 264         final var user = new UserBuilder().setName(USERNAME).setPassword(new CryptHash("$0$" + PASSWORD)).build();
 265         return new ClientAuthenticationBuilder().setUsers(
 266             new UsersBuilder().setUser(Map.of(user.key(), user)).build()
 267         ).build();
 268     }
 269
 270     @Test
 271     void sshClientWithConfigurator() throws Exception {
 272         final ServerFactoryManagerConfigurator serverConfigurator = factoryManager -> {
 273             factoryManager.setUserAuthFactories(List.of(new UserAuthPasswordFactory()));
 274             factoryManager.setPasswordAuthenticator(
 275                 (usr, psw, session) -> USERNAME.equals(usr) && PASSWORD.equals(psw));
 276             factoryManager.setKeyPairProvider(new SimpleGeneratorHostKeyProvider());
 277         };
 278         final ClientFactoryManagerConfigurator clientConfigurator = factoryManager -> {
 279             factoryManager.setPasswordIdentityProvider(PasswordIdentityProvider.wrapPasswords(PASSWORD));
 280             factoryManager.setUserAuthFactories(List.of(
 281                 new org.opendaylight.netconf.shaded.sshd.client.auth.password.UserAuthPasswordFactory()));
 282         };
 283
 284         final var server = SERVER_FACTORY.listenServer("netconf", serverTransportListener, tcpServerParams,
 285             null, serverConfigurator).get(10, TimeUnit.SECONDS);
 286         try {
 287             final var clientConfig = NetconfClientConfigurationBuilder.create()
 288                 .withProtocol(NetconfClientConfiguration.NetconfClientProtocol.SSH)
 289                 .withTcpParameters(tcpClientParams)
 290                 .withSshParameters(new SshClientParametersBuilder()
 291                     .setClientIdentity(new ClientIdentityBuilder().setUsername(USERNAME).build()).build())
 292                 .withSshConfigurator(clientConfigurator)
 293                 .withSessionListener(sessionListener)
 294                 .withConnectionTimeoutMillis(10_000)
 295                 .build();
 296             assertNotNull(factory.createClient(clientConfig));
 297             verify(serverTransportListener, timeout(10_000L))
 298                 .onTransportChannelEstablished(any(TransportChannel.class));
 299         } finally {
 300             server.shutdown().get(1, TimeUnit.SECONDS);
 301         }
 302     }
 303 }