diff options
Diffstat (limited to 'juick-server')
5 files changed, 112 insertions, 13 deletions
diff --git a/juick-server/src/main/java/com/juick/server/XMPPServer.java b/juick-server/src/main/java/com/juick/server/XMPPServer.java index e2018213..643bc37b 100644 --- a/juick-server/src/main/java/com/juick/server/XMPPServer.java +++ b/juick-server/src/main/java/com/juick/server/XMPPServer.java @@ -33,6 +33,8 @@ import javax.annotation.PostConstruct; import javax.annotation.PreDestroy; import javax.inject.Inject; import javax.net.ssl.*; +import java.security.InvalidAlgorithmParameterException; +import java.security.cert.*; import javax.xml.bind.JAXBException; import javax.xml.bind.Unmarshaller; import java.io.FileInputStream; @@ -84,6 +86,9 @@ public class XMPPServer implements ConnectionListener, AutoCloseable { private final AtomicBoolean closeFlag = new AtomicBoolean(false); SSLContext sc; + CertificateFactory cf; + CertPathValidator cpv; + PKIXParameters params; private TrustManager[] trustAllCerts = new TrustManager[]{ new X509TrustManager() { public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) { @@ -91,8 +96,9 @@ public class XMPPServer implements ConnectionListener, AutoCloseable { public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) { } + public java.security.cert.X509Certificate[] getAcceptedIssuers() { - return null; + return new X509Certificate[0]; } } }; @@ -117,6 +123,16 @@ public class XMPPServer implements ConnectionListener, AutoCloseable { kmf.init(ks, keystorePassword.toCharArray()); sc = SSLContext.getInstance("TLSv1.2"); sc.init(kmf.getKeyManagers(), trustAllCerts, new SecureRandom()); + TrustManagerFactory trustManagerFactory = + TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); + + Set<TrustAnchor> ca = new HashSet<>(); + trustManagerFactory.init((KeyStore)null); + Arrays.stream(trustManagerFactory.getTrustManagers()).forEach(t -> Arrays.stream(((X509TrustManager)t).getAcceptedIssuers()).forEach(cert -> ca.add(new TrustAnchor(cert, null)))); + params = new PKIXParameters(ca); + params.setRevocationEnabled(false); + cpv = CertPathValidator.getInstance("PKIX"); + cf = CertificateFactory.getInstance( "X.509" ); tlsConfigured = true; } catch (Exception e) { logger.warn("tls unavailable"); @@ -295,10 +311,22 @@ public class XMPPServer implements ConnectionListener, AutoCloseable { try { connection.setSocket(sc.getSocketFactory().createSocket(connection.getSocket(), connection.getSocket().getInetAddress().getHostAddress(), connection.getSocket().getPort(), true)); - ((SSLSocket) connection.getSocket()).setUseClientMode(false); - ((SSLSocket) connection.getSocket()).startHandshake(); + SSLSocket sslSocket = (SSLSocket) connection.getSocket(); + sslSocket.addHandshakeCompletedListener(handshakeCompletedEvent -> { + try { + CertPath certPath = cf.generateCertPath(Arrays.asList(handshakeCompletedEvent.getPeerCertificates())); + cpv.validate(certPath, params); + connection.setTrusted(true); + logger.info("connection from {} is trusted", connection.from); + } catch (SSLPeerUnverifiedException | CertificateException | CertPathValidatorException | InvalidAlgorithmParameterException e) { + logger.info("connection from {} is NOT trusted, falling back to dialback", connection.from); + } + }); + sslSocket.setUseClientMode(false); + sslSocket.setNeedClientAuth(true); + sslSocket.startHandshake(); connection.setSecured(true); - logger.debug("stream {} secured", connection.streamID); + logger.debug("stream from {} secured", connection.streamID); connection.restartParser(); } catch (XmlPullParserException | IOException sex) { logger.warn("stream {} ssl error {}", connection.streamID, sex); @@ -314,9 +342,21 @@ public class XMPPServer implements ConnectionListener, AutoCloseable { Socket socket = outConnections.get(connection).get(); socket = sc.getSocketFactory().createSocket(socket, socket.getInetAddress().getHostAddress(), socket.getPort(), true); - ((SSLSocket) socket).startHandshake(); + SSLSocket sslSocket = (SSLSocket) socket; + sslSocket.addHandshakeCompletedListener(handshakeCompletedEvent -> { + try { + CertPath certPath = cf.generateCertPath(Arrays.asList(handshakeCompletedEvent.getPeerCertificates())); + cpv.validate(certPath, params); + connection.setTrusted(true); + logger.info("connection to {} is trusted", connection.to); + } catch (SSLPeerUnverifiedException | CertificateException | CertPathValidatorException | InvalidAlgorithmParameterException e) { + logger.info("connection to {} is NOT trusted, falling back to dialback", connection.to); + } + }); + sslSocket.setNeedClientAuth(true); + sslSocket.startHandshake(); connection.setSecured(true); - logger.debug("stream {} secured", connection.getStreamID()); + logger.debug("stream to {} secured", connection.getStreamID()); connection.setInputStream(socket.getInputStream()); connection.setOutputStream(socket.getOutputStream()); connection.restartStream(); diff --git a/juick-server/src/main/java/com/juick/server/configuration/ApiAppConfiguration.java b/juick-server/src/main/java/com/juick/server/configuration/ApiAppConfiguration.java index 91f5446a..001f72fe 100644 --- a/juick-server/src/main/java/com/juick/server/configuration/ApiAppConfiguration.java +++ b/juick-server/src/main/java/com/juick/server/configuration/ApiAppConfiguration.java @@ -49,6 +49,7 @@ import springfox.documentation.swagger2.annotations.EnableSwagger2; import javax.annotation.Nonnull; import javax.inject.Inject; +import java.time.Duration; import java.util.Collections; /** @@ -104,6 +105,7 @@ public class ApiAppConfiguration implements WebMvcConfigurer, WebSocketConfigure XmppSessionConfiguration configuration = XmppSessionConfiguration.builder() .extensions(Extension.of(com.juick.Message.class), Extension.of(MessageQuery.class)) .debugger(LogbackDebugger.class) + .defaultResponseTimeout(Duration.ofMillis(120000)) .build(); return BasicXmppSession.create(hostname, configuration); } diff --git a/juick-server/src/main/java/com/juick/server/xmpp/s2s/Connection.java b/juick-server/src/main/java/com/juick/server/xmpp/s2s/Connection.java index 6bf61169..4fa8e741 100644 --- a/juick-server/src/main/java/com/juick/server/xmpp/s2s/Connection.java +++ b/juick-server/src/main/java/com/juick/server/xmpp/s2s/Connection.java @@ -50,11 +50,14 @@ public class Connection { private Socket socket; public static final String NS_DB = "jabber:server:dialback"; public static final String NS_TLS = "urn:ietf:params:xml:ns:xmpp-tls"; + public static final String NS_SASL = "urn:ietf:params:xml:ns:xmpp-sasl"; public static final String NS_STREAM = "http://etherx.jabber.org/streams"; XmlPullParserFactory factory = XmlPullParserFactory.newInstance(); XmlPullParser parser = factory.newPullParser(); OutputStreamWriter writer; private boolean secured = false; + private boolean authenticated = false; + private boolean trusted = false; @@ -136,4 +139,20 @@ public class Connection { public void setSocket(Socket socket) { this.socket = socket; } + + public boolean isAuthenticated() { + return authenticated; + } + + public void setAuthenticated(boolean authenticated) { + this.authenticated = authenticated; + } + + public boolean isTrusted() { + return trusted; + } + + public void setTrusted(boolean trusted) { + this.trusted = trusted; + } } diff --git a/juick-server/src/main/java/com/juick/server/xmpp/s2s/ConnectionIn.java b/juick-server/src/main/java/com/juick/server/xmpp/s2s/ConnectionIn.java index 9ee81d4d..414c6d8b 100644 --- a/juick-server/src/main/java/com/juick/server/xmpp/s2s/ConnectionIn.java +++ b/juick-server/src/main/java/com/juick/server/xmpp/s2s/ConnectionIn.java @@ -34,6 +34,7 @@ import java.util.Arrays; import java.util.List; import java.util.UUID; import java.util.concurrent.CopyOnWriteArrayList; +import java.util.stream.Collectors; /** * @author ugnich @@ -118,11 +119,12 @@ public class ConnectionIn extends Connection implements Runnable { if (valid[0]) { sendStanza("<db:verify from='" + vto + "' to='" + vfrom + "' id='" + vid + "' type='valid'/>"); logger.debug("stream from {} {} dialback verify valid", vfrom, streamID); + setAuthenticated(true); } else { sendStanza("<db:verify from='" + vto + "' to='" + vfrom + "' id='" + vid + "' type='invalid'/>"); logger.warn("stream from {} {} dialback verify invalid", vfrom, streamID); } - } else if (tag.equals("presence") && checkFromTo(parser)) { + } else if (tag.equals("presence") && checkFromTo(parser) && isAuthenticated()) { String xml = XmlUtils.parseToString(parser, false); logger.debug("stream {} presence: {}", streamID, xml); xmpp.onStanzaReceived(xml); @@ -132,7 +134,7 @@ public class ConnectionIn extends Connection implements Runnable { logger.debug("stream {} message: {}", streamID, xml); xmpp.onStanzaReceived(xml); - } else if (tag.equals("iq") && checkFromTo(parser)) { + } else if (tag.equals("iq") && checkFromTo(parser) && isAuthenticated()) { updateTsRemoteData(); String type = parser.getAttributeValue(null, "type"); String xml = XmlUtils.parseToString(parser, false); @@ -140,10 +142,18 @@ public class ConnectionIn extends Connection implements Runnable { logger.debug("stream {} iq: {}", streamID, xml); xmpp.onStanzaReceived(xml); } - } else if (!isSecured() && tag.equals("starttls")) { + } else if (!isSecured() && tag.equals("starttls") && !isAuthenticated()) { listener.starttls(this); } else if (isSecured() && tag.equals("stream") && parser.getNamespace().equals(NS_STREAM)) { sendOpenStream(null, true); + } else if (isSecured() && tag.equals("auth") && parser.getNamespace().equals(NS_SASL) + && parser.getAttributeValue(null, "mechanism").equals("EXTERNAL") + && !isAuthenticated() && isTrusted()) { + sendStanza("<success xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>"); + logger.info("stream {} authenticated externally", streamID); + this.from.add(Jid.of(from)); + setAuthenticated(true); + restartParser(); } else if (tag.equals("error")) { StreamError streamError = StreamError.parse(parser); logger.debug("Stream error from {}: {}", streamID, streamError.getCondition()); @@ -178,8 +188,14 @@ public class ConnectionIn extends Connection implements Runnable { xmpp.getJid().toEscapedString() + "' id='" + streamID + "' version='1.0'>"; if (xmppversionnew) { openStream += "<stream:features>"; - if (listener != null && listener.isTlsAvailable() && !isSecured() && !Arrays.asList(xmpp.brokenSSLhosts).contains(from)) { - openStream += "<starttls xmlns=\"" + NS_TLS + "\"><optional/></starttls>"; + if (listener != null && listener.isTlsAvailable() && !Arrays.asList(xmpp.brokenSSLhosts).contains(from)) { + if (!isSecured()) { + openStream += "<starttls xmlns='" + NS_TLS + "'><optional/></starttls>"; + } else if (!isAuthenticated() && isTrusted()) { + openStream += "<mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>" + + "<mechanism>EXTERNAL</mechanism>" + + "</mechanisms>"; + } } openStream += "</stream:features>"; } @@ -205,6 +221,7 @@ public class ConnectionIn extends Connection implements Runnable { } } } + logger.warn("rejected from {}, to {}, stream {}", cfrom, cto, from.stream().collect(Collectors.joining(","))); return false; } public void setListener(ConnectionListener listener) { diff --git a/juick-server/src/main/java/com/juick/server/xmpp/s2s/ConnectionOut.java b/juick-server/src/main/java/com/juick/server/xmpp/s2s/ConnectionOut.java index e3bd53e9..0c991553 100644 --- a/juick-server/src/main/java/com/juick/server/xmpp/s2s/ConnectionOut.java +++ b/juick-server/src/main/java/com/juick/server/xmpp/s2s/ConnectionOut.java @@ -22,6 +22,8 @@ import com.juick.xmpp.Stream; import com.juick.xmpp.extensions.StreamError; import com.juick.xmpp.extensions.StreamFeatures; import com.juick.xmpp.utils.XmlUtils; +import org.apache.commons.codec.Charsets; +import org.apache.commons.codec.binary.Base64; import org.apache.commons.text.RandomStringGenerator; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -35,6 +37,8 @@ import java.io.OutputStream; import java.net.SocketException; import java.util.UUID; +import static com.juick.server.xmpp.s2s.Connection.NS_SASL; + /** * @author ugnich */ @@ -43,7 +47,7 @@ public class ConnectionOut extends Stream { public static final String NS_TLS = "urn:ietf:params:xml:ns:xmpp-tls"; public static final String NS_DB = "jabber:server:dialback"; private boolean secured = false; - + private boolean trusted = false; public boolean streamReady = false; String checkSID = null; String dbKey = null; @@ -122,18 +126,27 @@ public class ConnectionOut extends Stream { && listener.securing(this)) { logger.debug("stream to {} {} securing", to.toEscapedString(), streamID); send("<starttls xmlns=\"" + NS_TLS + "\" />"); + } else if (secured && features.EXTERNAL >=0) { + String authid = Base64.encodeBase64String(from.toEscapedString().getBytes(Charsets.UTF_8)); + send(String.format("<auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='EXTERNAL'>%s</auth>", authid)); + } else if (secured && streamReady) { + listener.ready(this); } else { processDialback(); } } else if (tag.equals("proceed") && parser.getNamespace().equals(NS_TLS)) { listener.proceed(this); + } else if (tag.equals("success") && parser.getNamespace().equals(NS_SASL)) { + streamReady = true; + restartStream(); + sendOpenStream(); } else if (secured && tag.equals("stream") && parser.getNamespace().equals(NS_STREAM)) { streamID = parser.getAttributeValue(null, "id"); } else if (tag.equals("error")) { StreamError streamError = StreamError.parse(parser); listener.dialbackError(this, streamError); } else { - String unhandledStanza = XmlUtils.parseToString(parser, true); + String unhandledStanza = XmlUtils.parseToString(parser, false); logger.warn("Unhandled stanza from {} {} : {}", to, streamID, unhandledStanza); } } @@ -164,4 +177,12 @@ public class ConnectionOut extends Stream { public void setSecured(boolean secured) { this.secured = secured; } + + public boolean isTrusted() { + return trusted; + } + + public void setTrusted(boolean trusted) { + this.trusted = trusted; + } } |