Moved project package from org.eclipse.moquette to io.moquette

broker/src/main/java/io/moquette/spi/impl/security/ACLFileParser.java

@@ -0,0 +1,96 @@
+/*
+ * Copyright (c) 2012-2015 The original author or authors
+ * ------------------------------------------------------
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * and Apache License v2.0 which accompanies this distribution.
+ *
+ * The Eclipse Public License is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * The Apache License v2.0 is available at
+ * http://www.opensource.org/licenses/apache2.0.php
+ *
+ * You may elect to redistribute this code under either of these licenses.
+ */
+package io.moquette.spi.impl.security;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.*;
+import java.text.ParseException;
+
+/**
+ * Parses the acl configuration file.
+ * If a line starts with # it's comment.
+ * Blank lines are skipped. The format is "topic [read|write|readwrite] <topic name>"
+ *
+ * @author andrea
+ * */
+public class ACLFileParser {
+    private static final Logger LOG = LoggerFactory.getLogger(ACLFileParser.class);
+
+    /**
+     * Parse the configuration from file.
+     */
+    public static AuthorizationsCollector parse(File file) throws ParseException {
+        if (file == null) {
+            LOG.warn("parsing NULL file, so fallback on default configuration!");
+            return AuthorizationsCollector.emptyImmutableCollector();
+        }
+        if (!file.exists()) {
+            LOG.warn(String.format("parsing not existing file %s, so fallback on default configuration!", file.getAbsolutePath()));
+            return AuthorizationsCollector.emptyImmutableCollector();
+        }
+        try {
+            FileReader reader = new FileReader(file);
+            return parse(reader);
+        } catch (FileNotFoundException fex) {
+            LOG.warn(String.format("parsing not existing file %s, so fallback on default configuration!", file.getAbsolutePath()), fex);
+            return AuthorizationsCollector.emptyImmutableCollector();
+        }
+    }
+
+    /**
+     * Parse the ACL configuration file
+     *
+     * @throws java.text.ParseException if the format is not compliant.
+     */
+    public static AuthorizationsCollector parse(Reader reader) throws ParseException {
+        if (reader == null) {
+            //just log and return default properties
+            LOG.warn("parsing NULL reader, so fallback on default configuration!");
+            return AuthorizationsCollector.emptyImmutableCollector();
+        }
+
+        BufferedReader br = new BufferedReader(reader);
+        String line;
+        AuthorizationsCollector collector = new AuthorizationsCollector();
+
+        try {
+            while ((line = br.readLine()) != null) {
+                int commentMarker = line.indexOf('#');
+                if (commentMarker != -1) {
+                    if (commentMarker == 0) {
+                        //skip its a comment
+                        continue;
+                    } else {
+                        //it's a malformed comment
+                        throw new ParseException(line, commentMarker);
+                    }
+                } else {
+                    if (line.isEmpty() || line.matches("^\\s*$")) {
+                        //skip it's a black line
+                        continue;
+                    }
+
+                    collector.parse(line);
+                }
+            }
+        } catch (IOException ex) {
+            throw new ParseException("Failed to read", 1);
+        }
+        return collector;
+    }
+}

broker/src/main/java/io/moquette/spi/impl/security/AcceptAllAuthenticator.java

@@ -0,0 +1,10 @@
+package io.moquette.spi.impl.security;
+
+/**
+ * Created by andrea on 8/23/14.
+ */
+public class AcceptAllAuthenticator implements IAuthenticator {
+    public boolean checkValid(String username, byte[] password) {
+        return true;
+    }
+}

broker/src/main/java/io/moquette/spi/impl/security/Authorization.java

@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 2012-2015 The original author or authors
+ * ------------------------------------------------------
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * and Apache License v2.0 which accompanies this distribution.
+ *
+ * The Eclipse Public License is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * The Apache License v2.0 is available at
+ * http://www.opensource.org/licenses/apache2.0.php
+ *
+ * You may elect to redistribute this code under either of these licenses.
+ */
+package io.moquette.spi.impl.security;
+
+import static io.moquette.spi.impl.security.Authorization.Permission.READWRITE;
+
+/**
+ * Carries the read/write authorization to topics for the users.
+ *
+ * @author andrea
+ */
+public class Authorization {
+    protected final String topic;
+    protected final Permission permission;
+
+    /**
+     * Access rights
+     * */
+    enum Permission {
+        READ, WRITE, READWRITE
+    }
+
+    Authorization(String topic) {
+        this(topic, Permission.READWRITE);
+    }
+
+    Authorization(String topic, Permission permission) {
+        this.topic = topic;
+        this.permission = permission;
+    }
+
+    public boolean grant(Permission desiredPermission) {
+        return permission == desiredPermission || permission == READWRITE;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        Authorization that = (Authorization) o;
+
+        if (permission != that.permission) return false;
+        if (!topic.equals(that.topic)) return false;
+
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        int result = topic.hashCode();
+        result = 31 * result + permission.hashCode();
+        return result;
+    }
+}

broker/src/main/java/io/moquette/spi/impl/security/AuthorizationsCollector.java

@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2012-2015 The original author or authors
+ * ------------------------------------------------------
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * and Apache License v2.0 which accompanies this distribution.
+ *
+ * The Eclipse Public License is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * The Apache License v2.0 is available at
+ * http://www.opensource.org/licenses/apache2.0.php
+ *
+ * You may elect to redistribute this code under either of these licenses.
+ */
+package io.moquette.spi.impl.security;
+
+import io.moquette.spi.impl.subscriptions.SubscriptionsStore;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.text.ParseException;
+import java.util.*;
+
+/**
+ * Used by the ACLFileParser to push all authorizations it finds.
+ * ACLAuthorizator uses it in read mode to check it topics matches the ACLs.
+ *
+ * Not thread safe.
+ *
+ * @author andrea
+ */
+class AuthorizationsCollector implements IAuthorizator {
+
+    private static final Logger LOG = LoggerFactory.getLogger(AuthorizationsCollector.class);
+
+    private List<Authorization> m_globalAuthorizations = new ArrayList();
+    private List<Authorization> m_patternAuthorizations = new ArrayList();
+    private Map<String, List<Authorization>> m_userAuthorizations = new HashMap();
+    private boolean m_parsingUsersSpecificSection = false;
+    private boolean m_parsingPatternSpecificSection = false;
+    private String m_currentUser = "";
+
+    static final AuthorizationsCollector emptyImmutableCollector() {
+        AuthorizationsCollector coll = new AuthorizationsCollector();
+        coll.m_globalAuthorizations = Collections.emptyList();
+        coll.m_patternAuthorizations = Collections.emptyList();
+        coll.m_userAuthorizations = Collections.emptyMap();
+        return coll;
+    }
+
+    void parse(String line) throws ParseException {
+        Authorization acl = parseAuthLine(line);
+        if (acl == null) {
+            //skip it's a user
+            return;
+        }
+        if (m_parsingUsersSpecificSection) {
+            //TODO in java 8 switch to m_userAuthorizations.putIfAbsent(m_currentUser, new ArrayList());
+            if (!m_userAuthorizations.containsKey(m_currentUser)) {
+                m_userAuthorizations.put(m_currentUser, new ArrayList());
+            }
+            List<Authorization> userAuths = m_userAuthorizations.get(m_currentUser);
+            userAuths.add(acl);
+        } else if (m_parsingPatternSpecificSection) {
+            m_patternAuthorizations.add(acl);
+        } else {
+            m_globalAuthorizations.add(acl);
+        }
+    }
+
+    protected Authorization parseAuthLine(String line) throws ParseException {
+        String[] tokens = line.split("\\s+");
+        String keyword = tokens[0].toLowerCase();
+        switch (keyword) {
+            case "topic":
+                return createAuthorization(line, tokens);
+            case "user":
+                m_parsingUsersSpecificSection = true;
+                m_currentUser = tokens[1];
+                m_parsingPatternSpecificSection = false;
+                return null;
+            case "pattern":
+                m_parsingUsersSpecificSection = false;
+                m_currentUser = "";
+                m_parsingPatternSpecificSection = true;
+                return createAuthorization(line, tokens);
+            default:
+                throw new ParseException(String.format("invalid line definition found %s", line), 1);
+        }
+    }
+
+    private Authorization createAuthorization(String line, String[] tokens) throws ParseException {
+        if (tokens.length > 2) {
+            //if the tokenized lines has 3 token the second must be the permission
+            try {
+                Authorization.Permission permission = Authorization.Permission.valueOf(tokens[1].toUpperCase());
+                //bring topic with all original spacing
+                String topic = line.substring(line.indexOf(tokens[2]));
+
+                return new Authorization(topic, permission);
+            } catch (IllegalArgumentException iaex) {
+                throw new ParseException("invalid permission token", 1);
+            }
+        }
+        String topic = tokens[1];
+        return new Authorization(topic);
+    }
+
+    @Override
+    public boolean canWrite(String topic, String user, String client) {
+        return canDoOperation(topic, Authorization.Permission.WRITE, user, client);
+    }
+
+    @Override
+    public boolean canRead(String topic, String user, String client) {
+        return canDoOperation(topic, Authorization.Permission.READ, user, client);
+    }
+
+    private boolean canDoOperation(String topic, Authorization.Permission permission, String username, String client) {
+        if (matchACL(m_globalAuthorizations, topic, permission))  {
+            return true;
+        }
+
+        if (isNotEmpty(client) || isNotEmpty(username)) {
+            for (Authorization auth : m_patternAuthorizations) {
+                String substitutedTopic = auth.topic.replace("%c", client).replace("%u", username);
+                if (auth.grant(permission)) {
+                    if (SubscriptionsStore.matchTopics(topic, substitutedTopic)) {
+                        return true;
+                    }
+                }
+            }
+        }
+
+        if (isNotEmpty(username)) {
+            if (m_userAuthorizations.containsKey(username)) {
+                List<Authorization> auths = m_userAuthorizations.get(username);
+                if (matchACL(auths, topic, permission))  {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    private boolean matchACL(List<Authorization> auths, String topic, Authorization.Permission permission) {
+        for (Authorization auth : auths) {
+            if (auth.grant(permission)) {
+                if (SubscriptionsStore.matchTopics(topic, auth.topic)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    private boolean isNotEmpty(String client) {
+        return client != null && !client.isEmpty();
+    }
+
+    public boolean isEmpty() {
+        return m_globalAuthorizations.isEmpty();
+    }
+}

broker/src/main/java/io/moquette/spi/impl/security/DenyAllAuthorizator.java

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2012-2015 The original author or authors
+ * ------------------------------------------------------
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * and Apache License v2.0 which accompanies this distribution.
+ *
+ * The Eclipse Public License is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * The Apache License v2.0 is available at
+ * http://www.opensource.org/licenses/apache2.0.php
+ *
+ * You may elect to redistribute this code under either of these licenses.
+ */
+package io.moquette.spi.impl.security;
+
+/**
+ * @author andrea
+ */
+public class DenyAllAuthorizator implements IAuthorizator {
+    @Override
+    public boolean canWrite(String topic, String user, String client) {
+        return true;
+    }
+
+    @Override
+    public boolean canRead(String topic, String user, String client) {
+        return true;
+    }
+}

broker/src/main/java/io/moquette/spi/impl/security/FileAuthenticator.java

@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2012-2015 The original author or authors
+ * ------------------------------------------------------
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * and Apache License v2.0 which accompanies this distribution.
+ *
+ * The Eclipse Public License is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * The Apache License v2.0 is available at
+ * http://www.opensource.org/licenses/apache2.0.php
+ *
+ * You may elect to redistribute this code under either of these licenses.
+ */
+package io.moquette.spi.impl.security;
+
+import org.apache.commons.codec.binary.Hex;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.*;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.text.ParseException;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Load user credentials from a text file.
+ * Each line of the file is formatted as "<username>:<sha256(password)>". The username mustn't contains : char.
+ *
+ * To encode your password from command line on Linux systems, you could use:
+ * <pre>
+ *     echo -n "yourpassword" | sha256sum
+ * </pre>
+ * NB -n is important because echo append a newline by default at the of string. -n avoid this behaviour.
+ *
+ * @author andrea
+ */
+public class FileAuthenticator implements IAuthenticator {
+
+    private static final Logger LOG = LoggerFactory.getLogger(FileAuthenticator.class);
+    
+    private Map<String, String> m_identities = new HashMap<>();
+    private MessageDigest m_digest;
+
+    public FileAuthenticator(String parent, String filePath) {
+        File file = new File(parent, filePath);
+        LOG.info("Loading password file: " + file);
+        if (file.isDirectory()) {
+            LOG.warn(String.format("Bad file reference %s is a directory", file));
+            return;
+        }
+        try {
+            this.m_digest = MessageDigest.getInstance("SHA-256");
+        } catch (NoSuchAlgorithmException nsaex) {
+            LOG.error("Can't find SHA-256 for password encoding", nsaex);
+            throw new RuntimeException(nsaex);
+        }
+
+        try {
+            FileReader reader = new FileReader(file);
+            parse(reader);
+        } catch (FileNotFoundException fex) {
+            LOG.warn(String.format("Parsing not existing file %s", file), fex);
+        } catch (ParseException pex) {
+            LOG.warn(String.format("Format error in parsing password file %s", file), pex);
+        }
+    }
+    
+    private void parse(Reader reader) throws ParseException {
+        if (reader == null) {
+            return;
+        }
+        
+        BufferedReader br = new BufferedReader(reader);
+        String line;
+        try {
+            while ((line = br.readLine()) != null) {
+                int commentMarker = line.indexOf('#');
+                if (commentMarker != -1) {
+                    if (commentMarker == 0) {
+                        //skip its a comment
+                        continue;
+                    } else {
+                        //it's a malformed comment
+                        throw new ParseException(line, commentMarker);
+                    }
+                } else {
+                    if (line.isEmpty() || line.matches("^\\s*$")) {
+                        //skip it's a black line
+                        continue;
+                    }
+                    
+                    //split till the first space
+                    int delimiterIdx = line.indexOf(':');
+                    String username = line.substring(0, delimiterIdx).trim();
+                    String password = line.substring(delimiterIdx + 1).trim();
+                    
+                    m_identities.put(username, password);
+                }
+            }
+        } catch (IOException ex) {
+            throw new ParseException("Failed to read", 1);
+        }
+    }
+    
+    public boolean checkValid(String username, byte[] password) {
+        if (username == null || password == null) {
+            LOG.info("username or password was null");
+            return false;
+        }
+        String foundPwq = m_identities.get(username);
+        if (foundPwq == null) {
+            return false;
+        }
+        m_digest.update(password);
+        byte[] digest = m_digest.digest();
+        String encodedPasswd = new String(Hex.encodeHex(digest));
+        return foundPwq.equals(encodedPasswd);
+    }
+    
+}

broker/src/main/java/io/moquette/spi/impl/security/IAuthenticator.java

@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2012-2015 The original author or authors
+ * ------------------------------------------------------
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * and Apache License v2.0 which accompanies this distribution.
+ *
+ * The Eclipse Public License is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * The Apache License v2.0 is available at
+ * http://www.opensource.org/licenses/apache2.0.php
+ *
+ * You may elect to redistribute this code under either of these licenses.
+ */
+package io.moquette.spi.impl.security;
+
+/**
+ * username and password checker
+ * 
+ * @author andrea
+ */
+public interface IAuthenticator {
+
+    boolean checkValid(String username, byte[] password);
+}

broker/src/main/java/io/moquette/spi/impl/security/IAuthorizator.java

@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2012-2015 The original author or authors
+ * ------------------------------------------------------
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * and Apache License v2.0 which accompanies this distribution.
+ *
+ * The Eclipse Public License is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * The Apache License v2.0 is available at
+ * http://www.opensource.org/licenses/apache2.0.php
+ *
+ * You may elect to redistribute this code under either of these licenses.
+ */
+package io.moquette.spi.impl.security;
+
+/**
+ * ACL checker.
+ *
+ * Create an authorizator that matches topic names with same grammar of subscriptions.
+ * The # is always a terminator and its the multilevel matcher.
+ * The + sign is the single level matcher.
+ *
+ * @author andrea
+ */
+public interface IAuthorizator {
+
+    /**
+     * Ask the implementation of the authorizator if the topic can be used in a publish.
+     * */
+    boolean canWrite(String topic, String user, String client);
+
+    boolean canRead(String topic, String user, String client);
+}

broker/src/main/java/io/moquette/spi/impl/security/PermitAllAuthorizator.java

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2012-2015 The original author or authors
+ * ------------------------------------------------------
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * and Apache License v2.0 which accompanies this distribution.
+ *
+ * The Eclipse Public License is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * The Apache License v2.0 is available at
+ * http://www.opensource.org/licenses/apache2.0.php
+ *
+ * You may elect to redistribute this code under either of these licenses.
+ */
+package io.moquette.spi.impl.security;
+
+/**
+ * @author andrea
+ */
+public class PermitAllAuthorizator implements IAuthorizator {
+    @Override
+    public boolean canWrite(String topic, String user, String client) {
+        return true;
+    }
+
+    @Override
+    public boolean canRead(String topic, String user, String client) {
+        return true;
+    }
+}