dendi-wang/thingsboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add validation for X509 trusted chain

Browse Source
This commit is contained in:
Andrii Landiak 2023-04-14 13:26:28 +03:00
parent 3b5270a29f
commit 1fc8d7a52b
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
common/transport/mqtt/src/main/java/org/thingsboard/server/transport/mqtt/MqttSslHandlerProvider.java
View File

@ -141,6 +141,9 @@ public class MqttSslHandlerProvider {
@Override @Override
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException { public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
if (!validateCertificateChain(chain)) {
throw new CertificateException("Invalid Chain of X509 Certificates. ");
}
String clientDeviceCertValue = SslUtil.getCertificateString(chain[0]); String clientDeviceCertValue = SslUtil.getCertificateString(chain[0]);
final String[] credentialsBodyHolder = new String[1]; final String[] credentialsBodyHolder = new String[1];
CountDownLatch latch = new CountDownLatch(1); CountDownLatch latch = new CountDownLatch(1);
@ -176,5 +179,21 @@ public class MqttSslHandlerProvider {
log.error(e.getMessage(), e); log.error(e.getMessage(), e);
} }
} }
private boolean validateCertificateChain(X509Certificate[] chain) {
try {
if (chain.length > 1) {
X509Certificate leafCert = chain[0];
for (int i = 1; i < chain.length; i++) {
X509Certificate intermediateCert = chain[i];
leafCert.verify(intermediateCert.getPublicKey());
leafCert = intermediateCert;
}
}
return true;
} catch (Exception e) {
return false;
}
}
} }
} }