transport/transport-tls/src/test/java/org/opendaylight/netconf/transport/tls/TlsClientServerTest.java

   1 /*
   2  * Copyright (c) 2023 PANTHEON.tech s.r.o. All rights reserved.
   3  *
   4  * This program and the accompanying materials are made available under the
   5  * terms of the Eclipse Public License v1.0 which accompanies this distribution,
   6  * and is available at http://www.eclipse.org/legal/epl-v10.html
   7  */
   8 package org.opendaylight.netconf.transport.tls;
   9
  10 import static org.junit.jupiter.api.Assertions.assertEquals;
  11 import static org.junit.jupiter.api.Assertions.assertInstanceOf;
  12 import static org.junit.jupiter.api.Assertions.assertNotNull;
  13 import static org.junit.jupiter.api.Assertions.assertTrue;
  14 import static org.mockito.Mockito.timeout;
  15 import static org.mockito.Mockito.verify;
  16 import static org.mockito.Mockito.when;
  17 import static org.opendaylight.netconf.transport.tls.KeyUtils.EC_ALGORITHM;
  18 import static org.opendaylight.netconf.transport.tls.KeyUtils.RSA_ALGORITHM;
  19 import static org.opendaylight.netconf.transport.tls.TestUtils.buildEndEntityCertWithKeyGrouping;
  20 import static org.opendaylight.netconf.transport.tls.TestUtils.buildLocalOrTruststore;
  21 import static org.opendaylight.netconf.transport.tls.TestUtils.generateX509CertData;
  22 import static org.opendaylight.netconf.transport.tls.TestUtils.isRSA;
  23
  24 import io.netty.channel.Channel;
  25 import io.netty.channel.EventLoopGroup;
  26 import io.netty.handler.ssl.SslHandler;
  27 import java.io.IOException;
  28 import java.net.InetAddress;
  29 import java.net.ServerSocket;
  30 import java.util.List;
  31 import java.util.Map;
  32 import java.util.concurrent.TimeUnit;
  33 import org.junit.jupiter.api.AfterAll;
  34 import org.junit.jupiter.api.BeforeAll;
  35 import org.junit.jupiter.api.BeforeEach;
  36 import org.junit.jupiter.api.extension.ExtendWith;
  37 import org.junit.jupiter.params.ParameterizedTest;
  38 import org.junit.jupiter.params.provider.ValueSource;
  39 import org.mockito.ArgumentCaptor;
  40 import org.mockito.Captor;
  41 import org.mockito.Mock;
  42 import org.mockito.junit.jupiter.MockitoExtension;
  43 import org.opendaylight.netconf.transport.api.TransportChannel;
  44 import org.opendaylight.netconf.transport.api.TransportChannelListener;
  45 import org.opendaylight.netconf.transport.tcp.NettyTransportSupport;
  46 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev221212.EcPrivateKeyFormat;
  47 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev221212.RsaPrivateKeyFormat;
  48 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.crypto.types.rev221212.SubjectPublicKeyInfoFormat;
  49 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.Host;
  50 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.IetfInetUtil;
  51 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.rev130715.PortNumber;
  52 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tcp.client.rev221212.TcpClientGrouping;
  53 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tcp.server.rev221212.TcpServerGrouping;
  54 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.client.rev221212.TlsClientGrouping;
  55 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.client.rev221212.tls.client.grouping.ClientIdentityBuilder;
  56 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.client.rev221212.tls.client.grouping.ServerAuthenticationBuilder;
  57 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.server.rev221212.TlsServerGrouping;
  58 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.server.rev221212.tls.server.grouping.ClientAuthenticationBuilder;
  59 import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.server.rev221212.tls.server.grouping.ServerIdentityBuilder;
  60 import org.opendaylight.yangtools.yang.common.Uint16;
  61
  62 @ExtendWith(MockitoExtension.class)
  63 class TlsClientServerTest {
  64
  65     @Mock
  66     private TcpClientGrouping tcpClientConfig;
  67     @Mock
  68     private TlsClientGrouping tlsClientConfig;
  69     @Mock
  70     private TransportChannelListener clientListener;
  71     @Mock
  72     private TcpServerGrouping tcpServerConfig;
  73     @Mock
  74     private TlsServerGrouping tlsServerConfig;
  75     @Mock
  76     private TransportChannelListener serverListener;
  77
  78     @Captor
  79     ArgumentCaptor<TransportChannel> clientTransportChannelCaptor;
  80     @Captor
  81     ArgumentCaptor<TransportChannel> serverTransportChannelCaptor;
  82
  83     private static EventLoopGroup group;
  84     private ServerSocket socket;
  85
  86     @BeforeAll
  87     static void beforeAll() {
  88         group = NettyTransportSupport.newEventLoopGroup("IntegrationTest");
  89     }
  90
  91     @AfterAll
  92     static void afterAll() {
  93         group.shutdownGracefully();
  94         group = null;
  95     }
  96
  97     @BeforeEach
  98     void beforeEach() throws IOException {
  99
 100         // create temp socket to get available port for test
 101         socket = new ServerSocket(0);
 102         final var localAddress = IetfInetUtil.INSTANCE.ipAddressFor(InetAddress.getLoopbackAddress());
 103         final var localPort = new PortNumber(Uint16.valueOf(socket.getLocalPort()));
 104         socket.close();
 105
 106         when(tcpServerConfig.getLocalAddress()).thenReturn(localAddress);
 107         when(tcpServerConfig.requireLocalAddress()).thenCallRealMethod();
 108         when(tcpServerConfig.getLocalPort()).thenReturn(localPort);
 109         when(tcpServerConfig.requireLocalPort()).thenCallRealMethod();
 110
 111         when(tcpClientConfig.getRemoteAddress()).thenReturn(new Host(localAddress));
 112         when(tcpClientConfig.requireRemoteAddress()).thenCallRealMethod();
 113         when(tcpClientConfig.getRemotePort()).thenReturn(localPort);
 114         when(tcpClientConfig.requireRemotePort()).thenCallRealMethod();
 115     }
 116
 117     @ParameterizedTest(name = "TLS using X.509 certificates: {0}")
 118     @ValueSource(strings = {RSA_ALGORITHM, EC_ALGORITHM})
 119     void itWithCertificateConfig(final String algorithm) throws Exception {
 120
 121         final var data = generateX509CertData(algorithm);
 122
 123         // common config parts
 124         var localOrKeystore = buildEndEntityCertWithKeyGrouping(
 125                 SubjectPublicKeyInfoFormat.VALUE, data.publicKey(),
 126                 isRSA(algorithm) ? RsaPrivateKeyFormat.VALUE : EcPrivateKeyFormat.VALUE,
 127                 data.privateKey(), data.certBytes()).getLocalOrKeystore();
 128         var localOrTrustStore = buildLocalOrTruststore(Map.of("cert", data.certBytes()));
 129
 130         // client config
 131         final var clientIdentity = new ClientIdentityBuilder()
 132                 .setAuthType(new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.client.rev221212
 133                         .tls.client.grouping.client.identity.auth.type.CertificateBuilder()
 134                         .setCertificate(
 135                                 new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.client.rev221212
 136                                         .tls.client.grouping.client.identity.auth.type.certificate.CertificateBuilder()
 137                                         .setLocalOrKeystore(localOrKeystore)
 138                                         .build()).build()).build();
 139         final var serverAuth = new ServerAuthenticationBuilder().setCaCerts(
 140                 new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.client.rev221212
 141                         .tls.client.grouping.server.authentication.CaCertsBuilder()
 142                         .setLocalOrTruststore(localOrTrustStore).build()).build();
 143         when(tlsClientConfig.getClientIdentity()).thenReturn(clientIdentity);
 144         when(tlsClientConfig.getServerAuthentication()).thenReturn(serverAuth);
 145
 146         // server config
 147         final var serverIdentity = new ServerIdentityBuilder()
 148                 .setAuthType(new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.server.rev221212
 149                         .tls.server.grouping.server.identity.auth.type.CertificateBuilder()
 150                         .setCertificate(
 151                                 new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.server.rev221212
 152                                         .tls.server.grouping.server.identity.auth.type.certificate.CertificateBuilder()
 153                                         .setLocalOrKeystore(localOrKeystore)
 154                                         .build()).build()).build();
 155         final var clientAuth = new ClientAuthenticationBuilder().setCaCerts(
 156                 new org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.tls.server.rev221212
 157                         .tls.server.grouping.client.authentication.CaCertsBuilder()
 158                         .setLocalOrTruststore(localOrTrustStore).build()).build();
 159         when(tlsServerConfig.getServerIdentity()).thenReturn(serverIdentity);
 160         when(tlsServerConfig.getClientAuthentication()).thenReturn(clientAuth);
 161
 162         integrationTest();
 163     }
 164
 165     private void integrationTest() throws Exception {
 166         // start server
 167         final var server = TLSServer.listen(serverListener, NettyTransportSupport.newServerBootstrap().group(group),
 168                 tcpServerConfig, tlsServerConfig).get(2, TimeUnit.SECONDS);
 169         try {
 170             // connect with client
 171             final var client = TLSClient.connect(clientListener, NettyTransportSupport.newBootstrap().group(group),
 172                     tcpClientConfig, tlsClientConfig).get(2, TimeUnit.SECONDS);
 173             try {
 174                 verify(serverListener, timeout(500))
 175                         .onTransportChannelEstablished(serverTransportChannelCaptor.capture());
 176                 verify(clientListener, timeout(500))
 177                         .onTransportChannelEstablished(clientTransportChannelCaptor.capture());
 178                 // validate channels are in expected state
 179                 var serverChannel = assertChannel(serverTransportChannelCaptor.getAllValues());
 180                 var clientChannel = assertChannel(clientTransportChannelCaptor.getAllValues());
 181                 // validate channels are connecting same sockets
 182                 assertEquals(serverChannel.remoteAddress(), clientChannel.localAddress());
 183                 assertEquals(serverChannel.localAddress(), clientChannel.remoteAddress());
 184
 185             } finally {
 186                 client.shutdown().get(2, TimeUnit.SECONDS);
 187             }
 188         } finally {
 189             server.shutdown().get(2, TimeUnit.SECONDS);
 190         }
 191     }
 192
 193     private static Channel assertChannel(List<TransportChannel> transportChannels) {
 194         assertNotNull(transportChannels);
 195         assertEquals(1, transportChannels.size());
 196         final var channel = assertInstanceOf(TLSTransportChannel.class, transportChannels.get(0)).channel();
 197         assertNotNull(channel);
 198         assertTrue(channel.isOpen()); // connection is open
 199         assertNotNull(channel.pipeline().get(SslHandler.class)); //  has an SSL handler within a pipeline
 200         return channel;
 201     }
 202 }