2 * Copyright (c) 2023 PANTHEON.tech s.r.o. All rights reserved.
4 * This program and the accompanying materials are made available under the
5 * terms of the Eclipse Public License v1.0 which accompanies this distribution,
6 * and is available at http://www.eclipse.org/legal/epl-v10.html
8 package org.opendaylight.netconf.transport.tls;
10 import static org.junit.jupiter.api.Assertions.assertEquals;
11 import static org.junit.jupiter.api.Assertions.assertInstanceOf;
12 import static org.junit.jupiter.api.Assertions.assertNotNull;
13 import static org.junit.jupiter.api.Assertions.assertTrue;
14 import static org.mockito.Mockito.timeout;
15 import static org.mockito.Mockito.verify;
16 import static org.mockito.Mockito.when;
17 import static org.opendaylight.netconf.transport.tls.KeyStoreUtils.buildKeyManagerFactory;
18 import static org.opendaylight.netconf.transport.tls.KeyStoreUtils.buildTrustManagerFactory;
19 import static org.opendaylight.netconf.transport.tls.KeyStoreUtils.newKeyStore;
20 import static org.opendaylight.netconf.transport.tls.KeyUtils.EC_ALGORITHM;
21 import static org.opendaylight.netconf.transport.tls.KeyUtils.RSA_ALGORITHM;
22 import static org.opendaylight.netconf.transport.tls.TestUtils.buildEndEntityCertWithKeyGrouping;
23 import static org.opendaylight.netconf.transport.tls.TestUtils.buildInlineOrTruststore;
24 import static org.opendaylight.netconf.transport.tls.TestUtils.generateX509CertData;
25 import static org.opendaylight.netconf.transport.tls.TestUtils.isRSA;
27 import com.google.common.util.concurrent.ListenableFuture;
28 import io.netty.channel.Channel;
29 import io.netty.channel.EventLoopGroup;
30 import io.netty.handler.ssl.ClientAuth;
31 import io.netty.handler.ssl.SslContextBuilder;
32 import io.netty.handler.ssl.SslHandler;
33 import java.io.IOException;
34 import java.net.InetAddress;
35 import java.net.ServerSocket;
36 import java.security.KeyStore;
37 import java.security.cert.Certificate;
38 import java.util.ArrayList;
39 import java.util.Comparator;
40 import java.util.List;
42 import java.util.concurrent.TimeUnit;
43 import org.junit.jupiter.api.AfterAll;
44 import org.junit.jupiter.api.BeforeAll;
45 import org.junit.jupiter.api.BeforeEach;
46 import org.junit.jupiter.api.DisplayName;
47 import org.junit.jupiter.api.Test;
48 import org.junit.jupiter.api.extension.ExtendWith;
49 import org.junit.jupiter.params.ParameterizedTest;
50 import org.junit.jupiter.params.provider.ValueSource;
51 import org.mockito.ArgumentCaptor;
52 import org.mockito.Captor;
53 import org.mockito.Mock;
54 import org.mockito.junit.jupiter.MockitoExtension;
55 import org.opendaylight.netconf.transport.api.TransportChannel;
56 import org.opendaylight.netconf.transport.api.TransportChannelListener;
57 import org.opendaylight.netconf.transport.api.UnsupportedConfigurationException;
58 import org.opendaylight.netconf.transport.tcp.NettyTransportSupport;
59 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev231228.EcPrivateKeyFormat;
60 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev231228.RsaPrivateKeyFormat;
61 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev231228.SubjectPublicKeyInfoFormat;
62 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.Host;
63 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.IetfInetUtil;
64 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.PortNumber;
65 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tcp.client.rev231228.TcpClientGrouping;
66 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tcp.server.rev231228.TcpServerGrouping;
67 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.client.rev231228.TlsClientGrouping;
68 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.client.rev231228.tls.client.grouping.ClientIdentityBuilder;
69 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.client.rev231228.tls.client.grouping.ServerAuthenticationBuilder;
70 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.server.rev231228.TlsServerGrouping;
71 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.server.rev231228.tls.server.grouping.ClientAuthenticationBuilder;
72 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.server.rev231228.tls.server.grouping.ServerIdentityBuilder;
73 import org.opendaylight.yangtools.yang.common.Uint16;
75 @ExtendWith(MockitoExtension.class)
76 class TlsClientServerTest {
79 private TcpClientGrouping tcpClientConfig;
81 private TlsClientGrouping tlsClientConfig;
83 private TransportChannelListener clientListener;
85 private TcpServerGrouping tcpServerConfig;
87 private TlsServerGrouping tlsServerConfig;
89 private TransportChannelListener serverListener;
91 private TransportChannelListener otherServerListener;
94 ArgumentCaptor<TransportChannel> clientTransportChannelCaptor;
96 ArgumentCaptor<TransportChannel> serverTransportChannelCaptor;
98 private static EventLoopGroup group;
99 private ServerSocket socket;
102 static void beforeAll() {
103 group = NettyTransportSupport.newEventLoopGroup("IntegrationTest");
107 static void afterAll() {
108 group.shutdownGracefully();
113 void beforeEach() throws IOException {
115 // create temp socket to get available port for test
116 socket = new ServerSocket(0);
117 final var localAddress = IetfInetUtil.ipAddressFor(InetAddress.getLoopbackAddress());
118 final var localPort = new PortNumber(Uint16.valueOf(socket.getLocalPort()));
121 when(tcpServerConfig.getLocalAddress()).thenReturn(localAddress);
122 when(tcpServerConfig.requireLocalAddress()).thenCallRealMethod();
123 when(tcpServerConfig.getLocalPort()).thenReturn(localPort);
124 when(tcpServerConfig.requireLocalPort()).thenCallRealMethod();
126 when(tcpClientConfig.getRemoteAddress()).thenReturn(new Host(localAddress));
127 when(tcpClientConfig.requireRemoteAddress()).thenCallRealMethod();
128 when(tcpClientConfig.getRemotePort()).thenReturn(localPort);
129 when(tcpClientConfig.requireRemotePort()).thenCallRealMethod();
132 @ParameterizedTest(name = "TLS using X.509 certificates: {0}")
133 @ValueSource(strings = {RSA_ALGORITHM, EC_ALGORITHM})
134 void itWithCertificateConfig(final String algorithm) throws Exception {
136 final var data = generateX509CertData(algorithm);
138 // common config parts
139 var inlineOrKeystore = buildEndEntityCertWithKeyGrouping(
140 SubjectPublicKeyInfoFormat.VALUE, data.publicKey(),
141 isRSA(algorithm) ? RsaPrivateKeyFormat.VALUE : EcPrivateKeyFormat.VALUE,
142 data.privateKey(), data.certBytes()).getInlineOrKeystore();
143 var inlineOrTrustStore = buildInlineOrTruststore(Map.of("cert", data.certBytes()));
146 final var clientIdentity = new ClientIdentityBuilder()
147 .setAuthType(new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.client.rev231228
148 .tls.client.grouping.client.identity.auth.type.CertificateBuilder()
149 .setCertificate(new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.client.rev231228
150 .tls.client.grouping.client.identity.auth.type.certificate.CertificateBuilder()
151 .setInlineOrKeystore(inlineOrKeystore)
155 final var serverAuth = new ServerAuthenticationBuilder()
156 .setCaCerts(new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.client.rev231228
157 .tls.client.grouping.server.authentication.CaCertsBuilder()
158 .setInlineOrTruststore(inlineOrTrustStore)
161 when(tlsClientConfig.getClientIdentity()).thenReturn(clientIdentity);
162 when(tlsClientConfig.getServerAuthentication()).thenReturn(serverAuth);
165 final var serverIdentity = new ServerIdentityBuilder()
166 .setAuthType(new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.server.rev231228
167 .tls.server.grouping.server.identity.auth.type.CertificateBuilder()
168 .setCertificate(new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.server.rev231228
169 .tls.server.grouping.server.identity.auth.type.certificate.CertificateBuilder()
170 .setInlineOrKeystore(inlineOrKeystore)
174 final var clientAuth = new ClientAuthenticationBuilder()
175 .setCaCerts(new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.server.rev231228
176 .tls.server.grouping.client.authentication.CaCertsBuilder()
177 .setInlineOrTruststore(inlineOrTrustStore)
180 when(tlsServerConfig.getServerIdentity()).thenReturn(serverIdentity);
181 when(tlsServerConfig.getClientAuthentication()).thenReturn(clientAuth);
184 () -> TLSServer.listen(serverListener, NettyTransportSupport.newServerBootstrap().group(group),
185 tcpServerConfig, tlsServerConfig),
186 () -> TLSClient.connect(clientListener, NettyTransportSupport.newBootstrap().group(group),
187 tcpClientConfig, tlsClientConfig)
192 @DisplayName("External SslHandlerFactory integration")
193 void sslHandlerFactory() throws Exception {
195 final var serverKs = buildKeystoreWithGeneratedCert(RSA_ALGORITHM);
196 final var clientKs = buildKeystoreWithGeneratedCert(EC_ALGORITHM);
197 final var serverContext = SslContextBuilder.forServer(buildKeyManagerFactory(serverKs))
198 .clientAuth(ClientAuth.REQUIRE).trustManager(buildTrustManagerFactory(clientKs)).build();
199 final var clientContext = SslContextBuilder.forClient().keyManager(buildKeyManagerFactory(clientKs))
200 .trustManager(buildTrustManagerFactory(serverKs)).build();
203 () -> TLSServer.listen(serverListener, NettyTransportSupport.newServerBootstrap().group(group),
204 tcpServerConfig, channel -> serverContext.newHandler(channel.alloc())),
205 () -> TLSClient.connect(clientListener, NettyTransportSupport.newBootstrap().group(group),
206 tcpClientConfig, channel -> clientContext.newHandler(channel.alloc()))
210 private static KeyStore buildKeystoreWithGeneratedCert(final String algorithm) throws Exception {
211 final var data = generateX509CertData(algorithm);
212 final var ret = newKeyStore();
213 ret.setCertificateEntry("certificate", data.certificate());
214 ret.setKeyEntry("key", data.keyPair().getPrivate(), new char[0], new Certificate[]{data.certificate()});
218 private void integrationTest(final Builder<TLSServer> serverBuilder,
219 final Builder<TLSClient> clientBuilder) throws Exception {
221 final var server = serverBuilder.build().get(2, TimeUnit.SECONDS);
223 // connect with client
224 final var client = clientBuilder.build().get(2, TimeUnit.SECONDS);
226 verify(serverListener, timeout(500))
227 .onTransportChannelEstablished(serverTransportChannelCaptor.capture());
228 verify(clientListener, timeout(500))
229 .onTransportChannelEstablished(clientTransportChannelCaptor.capture());
230 // validate channels are in expected state
231 var serverChannel = assertChannel(serverTransportChannelCaptor.getAllValues());
232 var clientChannel = assertChannel(clientTransportChannelCaptor.getAllValues());
233 // validate channels are connecting same sockets
234 assertEquals(serverChannel.remoteAddress(), clientChannel.localAddress());
235 assertEquals(serverChannel.localAddress(), clientChannel.remoteAddress());
238 client.shutdown().get(2, TimeUnit.SECONDS);
241 server.shutdown().get(2, TimeUnit.SECONDS);
246 @DisplayName("Call-Home client + 2 servers with external SslHandlerFactory integration")
247 void callHome() throws Exception {
249 final var serverKs = buildKeystoreWithGeneratedCert(RSA_ALGORITHM);
250 final var clientKs = buildKeystoreWithGeneratedCert(EC_ALGORITHM);
251 final var serverContext = SslContextBuilder.forServer(buildKeyManagerFactory(serverKs))
252 .clientAuth(ClientAuth.REQUIRE).trustManager(buildTrustManagerFactory(clientKs)).build();
253 final var clientContext = SslContextBuilder.forClient().keyManager(buildKeyManagerFactory(clientKs))
254 .trustManager(buildTrustManagerFactory(serverKs)).build();
256 // start call-home client
257 final var client = TLSClient.listen(clientListener, NettyTransportSupport.newServerBootstrap().group(group),
258 tcpServerConfig, channel -> clientContext.newHandler(channel.alloc())).get(2, TimeUnit.SECONDS);
260 // connect with call-home servers
261 final var server1 = TLSServer.connect(serverListener, NettyTransportSupport.newBootstrap().group(group),
262 tcpClientConfig, channel -> serverContext.newHandler(channel.alloc())).get(2, TimeUnit.SECONDS);
263 final var server2 = TLSServer.connect(otherServerListener,
264 NettyTransportSupport.newBootstrap().group(group),
265 tcpClientConfig, channel -> serverContext.newHandler(channel.alloc())).get(2, TimeUnit.SECONDS);
267 verify(serverListener, timeout(500))
268 .onTransportChannelEstablished(serverTransportChannelCaptor.capture());
269 verify(otherServerListener, timeout(500))
270 .onTransportChannelEstablished(serverTransportChannelCaptor.capture());
271 verify(clientListener, timeout(500).times(2))
272 .onTransportChannelEstablished(clientTransportChannelCaptor.capture());
273 // extract channels sorted by server address
274 var serverChannels = assertChannels(serverTransportChannelCaptor.getAllValues(), 2,
275 Comparator.comparing((Channel channel) -> channel.localAddress().toString()));
276 var clientChannels = assertChannels(clientTransportChannelCaptor.getAllValues(), 2,
277 Comparator.comparing((Channel channel) -> channel.remoteAddress().toString()));
278 for (int i = 0; i < 2; i++) {
279 // validate channels are connecting same sockets
280 assertEquals(serverChannels.get(i).remoteAddress(), clientChannels.get(i).localAddress());
281 assertEquals(serverChannels.get(i).localAddress(), clientChannels.get(i).remoteAddress());
285 server1.shutdown().get(2, TimeUnit.SECONDS);
286 server2.shutdown().get(2, TimeUnit.SECONDS);
289 client.shutdown().get(2, TimeUnit.SECONDS);
293 private static Channel assertChannel(final List<TransportChannel> transportChannels) {
294 assertNotNull(transportChannels);
295 assertEquals(1, transportChannels.size());
296 final var channel = assertInstanceOf(TLSTransportChannel.class, transportChannels.get(0)).channel();
297 assertNotNull(channel);
298 assertTrue(channel.isOpen()); // connection is open
299 assertNotNull(channel.pipeline().get(SslHandler.class)); // has an SSL handler within a pipeline
303 private static List<Channel> assertChannels(final List<TransportChannel> transportChannels, final int channelsNum,
304 final Comparator<Channel> comparator) {
305 assertNotNull(transportChannels);
306 assertEquals(channelsNum, transportChannels.size());
307 final var res = new ArrayList<Channel>(channelsNum);
308 for (var transportChannel : transportChannels) {
309 final var channel = assertInstanceOf(TLSTransportChannel.class, transportChannel).channel();
310 assertNotNull(channel);
311 assertTrue(channel.isOpen());
312 assertNotNull(channel.pipeline().get(SslHandler.class));
315 res.sort(comparator);
319 private interface Builder<T extends TLSTransportStack> {
320 ListenableFuture<T> build() throws UnsupportedConfigurationException;