protocol/netconf-client/src/test/java/org/opendaylight/netconf/client/NetconfClientFactoryImplTest.java

   1 /*
   2  * Copyright (c) 2023 PANTHEON.tech s.r.o. and others. All rights reserved.
   3  *
   4  * This program and the accompanying materials are made available under the
   5  * terms of the Eclipse Public License v1.0 which accompanies this distribution,
   6  * and is available at http://www.eclipse.org/legal/epl-v10.html
   7  */
   8 package org.opendaylight.netconf.client;
   9
  10 import static org.junit.jupiter.api.Assertions.assertNotNull;
  11 import static org.mockito.ArgumentMatchers.any;
  12 import static org.mockito.Mockito.doNothing;
  13 import static org.mockito.Mockito.doReturn;
  14 import static org.mockito.Mockito.timeout;
  15 import static org.mockito.Mockito.verify;
  16
  17 import io.netty.handler.ssl.SslContextBuilder;
  18 import java.math.BigInteger;
  19 import java.net.InetAddress;
  20 import java.net.ServerSocket;
  21 import java.security.KeyPairGenerator;
  22 import java.security.KeyStore;
  23 import java.security.SecureRandom;
  24 import java.security.cert.Certificate;
  25 import java.security.spec.RSAKeyGenParameterSpec;
  26 import java.time.Duration;
  27 import java.time.Instant;
  28 import java.util.Date;
  29 import java.util.List;
  30 import java.util.Map;
  31 import java.util.concurrent.TimeUnit;
  32 import javax.net.ssl.KeyManagerFactory;
  33 import javax.net.ssl.TrustManagerFactory;
  34 import org.bouncycastle.asn1.x500.X500Name;
  35 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
  36 import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
  37 import org.bouncycastle.jce.provider.BouncyCastleProvider;
  38 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
  39 import org.junit.jupiter.api.AfterAll;
  40 import org.junit.jupiter.api.AfterEach;
  41 import org.junit.jupiter.api.BeforeAll;
  42 import org.junit.jupiter.api.BeforeEach;
  43 import org.junit.jupiter.api.Test;
  44 import org.junit.jupiter.api.extension.ExtendWith;
  45 import org.mockito.Mock;
  46 import org.mockito.junit.jupiter.MockitoExtension;
  47 import org.opendaylight.netconf.client.conf.NetconfClientConfiguration;
  48 import org.opendaylight.netconf.client.conf.NetconfClientConfigurationBuilder;
  49 import org.opendaylight.netconf.common.impl.DefaultNetconfTimer;
  50 import org.opendaylight.netconf.shaded.sshd.client.auth.password.PasswordIdentityProvider;
  51 import org.opendaylight.netconf.shaded.sshd.server.auth.password.UserAuthPasswordFactory;
  52 import org.opendaylight.netconf.shaded.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider;
  53 import org.opendaylight.netconf.transport.api.TransportChannel;
  54 import org.opendaylight.netconf.transport.api.TransportChannelListener;
  55 import org.opendaylight.netconf.transport.ssh.ClientFactoryManagerConfigurator;
  56 import org.opendaylight.netconf.transport.ssh.SSHTransportStackFactory;
  57 import org.opendaylight.netconf.transport.ssh.ServerFactoryManagerConfigurator;
  58 import org.opendaylight.netconf.transport.tcp.TCPServer;
  59 import org.opendaylight.netconf.transport.tls.FixedSslHandlerFactory;
  60 import org.opendaylight.netconf.transport.tls.TLSServer;
  61 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.iana.crypt.hash.rev140806.CryptHash;
  62 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev240208.RsaPrivateKeyFormat;
  63 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev240208.SubjectPublicKeyInfoFormat;
  64 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev240208._private.key.grouping._private.key.type.CleartextPrivateKeyBuilder;
  65 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev240208.password.grouping.password.type.CleartextPasswordBuilder;
  66 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.Host;
  67 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.IetfInetUtil;
  68 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.PortNumber;
  69 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.keystore.rev240208.inline.or.keystore.asymmetric.key.grouping.inline.or.keystore.InlineBuilder;
  70 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.keystore.rev240208.inline.or.keystore.asymmetric.key.grouping.inline.or.keystore.inline.InlineDefinitionBuilder;
  71 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.netconf.client.rev240208.netconf.client.initiate.stack.grouping.transport.tls.tls.TcpClientParametersBuilder;
  72 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.netconf.client.rev240208.netconf.client.listen.stack.grouping.transport.ssh.ssh.SshClientParametersBuilder;
  73 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.netconf.client.rev240208.netconf.client.listen.stack.grouping.transport.ssh.ssh.TcpServerParametersBuilder;
  74 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.client.rev240208.ssh.client.grouping.ClientIdentityBuilder;
  75 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.client.rev240208.ssh.client.grouping.client.identity.PasswordBuilder;
  76 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev240208.SshServerGrouping;
  77 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev240208.ssh.server.grouping.ClientAuthentication;
  78 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev240208.ssh.server.grouping.ClientAuthenticationBuilder;
  79 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev240208.ssh.server.grouping.ServerIdentity;
  80 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev240208.ssh.server.grouping.ServerIdentityBuilder;
  81 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev240208.ssh.server.grouping.client.authentication.UsersBuilder;
  82 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev240208.ssh.server.grouping.client.authentication.users.UserBuilder;
  83 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev240208.ssh.server.grouping.server.identity.HostKeyBuilder;
  84 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev240208.ssh.server.grouping.server.identity.host.key.host.key.type.PublicKeyBuilder;
  85 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tcp.client.rev240208.TcpClientGrouping;
  86 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tcp.server.rev240208.TcpServerGrouping;
  87 import org.opendaylight.yangtools.yang.common.Uint16;
  88
  89 @ExtendWith(MockitoExtension.class)
  90 class NetconfClientFactoryImplTest {
  91     private static final String USERNAME = "username";
  92     private static final String PASSWORD = "pa$$w0rd";
  93     private static final String RSA = "RSA";
  94     private static final char[] EMPTY_SECRET = new char[0];
  95
  96     private static SSHTransportStackFactory SERVER_FACTORY;
  97     private static DefaultNetconfTimer TIMER;
  98
  99     @Mock
 100     private NetconfClientSessionListener sessionListener;
 101     @Mock
 102     private TransportChannelListener serverTransportListener;
 103     @Mock
 104     private SshServerGrouping sshServerParams;
 105
 106     private NetconfClientFactory factory;
 107     private TcpServerGrouping tcpServerParams;
 108     private TcpClientGrouping tcpClientParams;
 109
 110     @BeforeAll
 111     static void beforeAll() {
 112         SERVER_FACTORY = new SSHTransportStackFactory("server", 0);
 113         TIMER = new DefaultNetconfTimer();
 114     }
 115
 116     @AfterAll
 117     static void afterAll() {
 118         SERVER_FACTORY.close();
 119         TIMER.close();
 120     }
 121
 122     @BeforeEach
 123     void beforeEach() throws Exception {
 124         factory = new NetconfClientFactoryImpl(TIMER);
 125         doNothing().when(serverTransportListener).onTransportChannelEstablished(any());
 126
 127         // create temp socket to get available port for test
 128         final var socket = new ServerSocket(0);
 129         final var address = IetfInetUtil.ipAddressFor(InetAddress.getLoopbackAddress());
 130         final var port = new PortNumber(Uint16.valueOf(socket.getLocalPort()));
 131         socket.close();
 132
 133         tcpServerParams = new TcpServerParametersBuilder().setLocalAddress(address).setLocalPort(port).build();
 134         tcpClientParams =
 135             new TcpClientParametersBuilder().setRemoteAddress(new Host(address)).setRemotePort(port).build();
 136     }
 137
 138     @AfterEach
 139     void afterEach() throws Exception {
 140         if (factory != null) {
 141             factory.close();
 142         }
 143     }
 144
 145     @Test
 146     void tcpClient() throws Exception {
 147         final var server = TCPServer.listen(serverTransportListener,
 148             SERVER_FACTORY.newServerBootstrap(), tcpServerParams).get(1, TimeUnit.SECONDS);
 149         try {
 150             final var clientConfig = NetconfClientConfigurationBuilder.create()
 151                 .withProtocol(NetconfClientConfiguration.NetconfClientProtocol.TCP)
 152                 .withTcpParameters(tcpClientParams).withSessionListener(sessionListener).build();
 153             assertNotNull(factory.createClient(clientConfig));
 154             verify(serverTransportListener, timeout(1000L))
 155                 .onTransportChannelEstablished(any(TransportChannel.class));
 156         } finally {
 157             server.shutdown().get(1, TimeUnit.SECONDS);
 158         }
 159     }
 160
 161     @Test
 162     void tlsClient() throws Exception {
 163         final var keyStore = buildKeystoreWithGeneratedCertificate();
 164         final var keyMgr = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
 165         keyMgr.init(keyStore, EMPTY_SECRET);
 166         final var trustMgr = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
 167         trustMgr.init(keyStore);
 168         final var serverContext = SslContextBuilder.forServer(keyMgr).trustManager(trustMgr).build();
 169         final var clientContext = SslContextBuilder.forClient().keyManager(keyMgr).trustManager(trustMgr).build();
 170
 171         final var server = TLSServer.listen(serverTransportListener, SERVER_FACTORY.newServerBootstrap(),
 172             tcpServerParams, new FixedSslHandlerFactory(serverContext)).get(1, TimeUnit.SECONDS);
 173         try {
 174             final var clientConfig = NetconfClientConfigurationBuilder.create()
 175                 .withProtocol(NetconfClientConfiguration.NetconfClientProtocol.TLS)
 176                 .withTcpParameters(tcpClientParams)
 177                 .withSslHandlerFactory(new FixedSslHandlerFactory(clientContext))
 178                 .withSessionListener(sessionListener).build();
 179             assertNotNull(factory.createClient(clientConfig));
 180             verify(serverTransportListener, timeout(1000L))
 181                 .onTransportChannelEstablished(any(TransportChannel.class));
 182         } finally {
 183             server.shutdown().get(1, TimeUnit.SECONDS);
 184         }
 185     }
 186
 187     private static KeyStore buildKeystoreWithGeneratedCertificate() throws Exception {
 188         // key pair
 189         final var keyPairGenerator = KeyPairGenerator.getInstance("RSA");
 190         keyPairGenerator.initialize(new RSAKeyGenParameterSpec(2048, RSAKeyGenParameterSpec.F4), new SecureRandom());
 191         final var keyPair = keyPairGenerator.generateKeyPair();
 192         // certificate
 193         final var now = Instant.now();
 194         final var contentSigner = new JcaContentSignerBuilder("SHA256withRSA").build(keyPair.getPrivate());
 195         final var x500Name = new X500Name("CN=TestCertificate");
 196         final var certificateBuilder = new JcaX509v3CertificateBuilder(x500Name,
 197             BigInteger.valueOf(now.toEpochMilli()),
 198             Date.from(now), Date.from(now.plus(Duration.ofDays(365))),
 199             x500Name,
 200             keyPair.getPublic());
 201         final var certificate = new JcaX509CertificateConverter()
 202             .setProvider(new BouncyCastleProvider()).getCertificate(certificateBuilder.build(contentSigner));
 203         // keystore with certificate and key
 204         final var keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
 205         keyStore.load(null, null);
 206         keyStore.setCertificateEntry("cert", certificate);
 207         keyStore.setKeyEntry("key", keyPair.getPrivate(), EMPTY_SECRET, new Certificate[]{certificate});
 208         return keyStore;
 209     }
 210
 211     @Test
 212     void sshClient() throws Exception {
 213         doReturn(buildSshServerIdentity()).when(sshServerParams).getServerIdentity();
 214         doReturn(buildSshClientAuth()).when(sshServerParams).getClientAuthentication();
 215         doReturn(null).when(sshServerParams).getTransportParams();
 216         doReturn(null).when(sshServerParams).getKeepalives();
 217
 218         final var server = SERVER_FACTORY.listenServer("netconf", serverTransportListener, tcpServerParams,
 219             sshServerParams).get(10, TimeUnit.SECONDS);
 220
 221         try {
 222             final var clientConfig = NetconfClientConfigurationBuilder.create()
 223                 .withProtocol(NetconfClientConfiguration.NetconfClientProtocol.SSH)
 224                 .withTcpParameters(tcpClientParams)
 225                 .withSshParameters(new SshClientParametersBuilder()
 226                     .setClientIdentity(new ClientIdentityBuilder().setUsername(USERNAME)
 227                         .setPassword(new PasswordBuilder().setPasswordType(
 228                             new CleartextPasswordBuilder().setCleartextPassword(PASSWORD)
 229                                 .build()).build()).build())
 230                     .build())
 231                 .withSessionListener(sessionListener)
 232                 .withConnectionTimeoutMillis(10_000)
 233                 .build();
 234             assertNotNull(factory.createClient(clientConfig));
 235             verify(serverTransportListener, timeout(10_000L))
 236                 .onTransportChannelEstablished(any(TransportChannel.class));
 237         } finally {
 238             server.shutdown().get(1, TimeUnit.SECONDS);
 239         }
 240     }
 241
 242     private static ServerIdentity buildSshServerIdentity() throws Exception {
 243         final var keyPair = KeyPairGenerator.getInstance(RSA).generateKeyPair();
 244         final var inlineDef = new InlineDefinitionBuilder()
 245             .setPublicKeyFormat(SubjectPublicKeyInfoFormat.VALUE)
 246             .setPublicKey(keyPair.getPublic().getEncoded())
 247             .setPrivateKeyFormat(RsaPrivateKeyFormat.VALUE)
 248             .setPrivateKeyType(
 249                 new CleartextPrivateKeyBuilder().setCleartextPrivateKey(
 250                     keyPair.getPrivate().getEncoded()
 251                 ).build()
 252             ).build();
 253         final var inline = new InlineBuilder().setInlineDefinition(inlineDef).build();
 254         final var publicKey = new PublicKeyBuilder().setPublicKey(
 255             new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev240208
 256                 .ssh.server.grouping.server.identity.host.key.host.key.type._public.key
 257                 .PublicKeyBuilder().setInlineOrKeystore(inline).build()
 258         ).build();
 259         return new ServerIdentityBuilder().setHostKey(
 260             List.of(new HostKeyBuilder().setName("test-name").setHostKeyType(publicKey).build())
 261         ).build();
 262     }
 263
 264     private static ClientAuthentication buildSshClientAuth() {
 265         final var user = new UserBuilder().setName(USERNAME)
 266             .setPassword(new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.ssh.server.rev240208.ssh
 267                 .server.grouping.client.authentication.users.user.PasswordBuilder()
 268                 .setHashedPassword(new CryptHash("$0$" + PASSWORD))
 269                 .build())
 270             .build();
 271         return new ClientAuthenticationBuilder().setUsers(
 272             new UsersBuilder().setUser(Map.of(user.key(), user)).build()
 273         ).build();
 274     }
 275
 276     @Test
 277     void sshClientWithConfigurator() throws Exception {
 278         final ServerFactoryManagerConfigurator serverConfigurator = factoryManager -> {
 279             factoryManager.setUserAuthFactories(List.of(new UserAuthPasswordFactory()));
 280             factoryManager.setPasswordAuthenticator(
 281                 (usr, psw, session) -> USERNAME.equals(usr) && PASSWORD.equals(psw));
 282             factoryManager.setKeyPairProvider(new SimpleGeneratorHostKeyProvider());
 283         };
 284         final ClientFactoryManagerConfigurator clientConfigurator = factoryManager -> {
 285             factoryManager.setPasswordIdentityProvider(PasswordIdentityProvider.wrapPasswords(PASSWORD));
 286             factoryManager.setUserAuthFactories(List.of(
 287                 new org.opendaylight.netconf.shaded.sshd.client.auth.password.UserAuthPasswordFactory()));
 288         };
 289
 290         final var server = SERVER_FACTORY.listenServer("netconf", serverTransportListener, tcpServerParams,
 291             null, serverConfigurator).get(10, TimeUnit.SECONDS);
 292         try {
 293             final var clientConfig = NetconfClientConfigurationBuilder.create()
 294                 .withProtocol(NetconfClientConfiguration.NetconfClientProtocol.SSH)
 295                 .withTcpParameters(tcpClientParams)
 296                 .withSshParameters(new SshClientParametersBuilder()
 297                     .setClientIdentity(new ClientIdentityBuilder().setUsername(USERNAME).build()).build())
 298                 .withSshConfigurator(clientConfigurator)
 299                 .withSessionListener(sessionListener)
 300                 .withConnectionTimeoutMillis(10_000)
 301                 .build();
 302             assertNotNull(factory.createClient(clientConfig));
 303             verify(serverTransportListener, timeout(10_000L))
 304                 .onTransportChannelEstablished(any(TransportChannel.class));
 305         } finally {
 306             server.shutdown().get(1, TimeUnit.SECONDS);
 307         }
 308     }
 309 }