server api时间戳检查开关

broker/config/wildfirechat.conf

@@ -32,6 +32,10 @@ embed.db 1
 ##服务器管理接口密钥
 http.admin.secret_key 123456
 
+##服务器API接口参数是否检查时间。当设置为false时，所有的请求会检查时间的有效性；当设置为true时，可以在http.admin.secret_key保持不变的情况下，使用固定的服务API签名
+##nonce = "76616", timestamp = "1558350862502", sign = "b98f9b0717f59febccf1440067a7f50d9b31bdde"
+http.admin.no_check_time true
+
 ##客户端协议栈密钥，需要与客户端协议栈文件libemqq.cc文件中的aes_key值保持一致，16进制byte用逗号分割。这个密钥对安全性帮助不大，客户不要修改
 client.proto.secret_key 0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x78,0x79,0x7A,0x7B,0x7C,0x7D,0x7E,0x7F
 

broker/src/main/java/com/xiaoleilu/loServer/action/admin/AdminAction.java

@@ -26,11 +26,20 @@ import win.liyufan.im.RateLimiter;
 
 abstract public class AdminAction extends Action {
     private static String SECRET_KEY = "123456";
+    private static boolean NO_CHECK_TIME = false;
     private final RateLimiter mLimitCounter = new RateLimiter(10, 500);
     public static void setSecretKey(String secretKey) {
         SECRET_KEY = secretKey;
     }
 
+    public static void setNoCheckTime(String noCheckTime) {
+        try {
+            NO_CHECK_TIME = Boolean.parseBoolean(noCheckTime);
+        } catch (Exception e) {
+
+        }
+    }
+
     @Override
     public ErrorCode preAction(Request request, Response response) {
         if (!mLimitCounter.isGranted("admin")) {
@@ -51,8 +60,8 @@ abstract public class AdminAction extends Action {
             return ErrorCode.INVALID_PARAMETER;
         }
 
-        if (System.currentTimeMillis() - ts > 2 * 60 * 60 * 1000) {
-//            return ErrorCode.ERROR_CODE_SIGN_EXPIRED;
+        if (!NO_CHECK_TIME && System.currentTimeMillis() - ts > 2 * 60 * 60 * 1000) {
+            return ErrorCode.ERROR_CODE_SIGN_EXPIRED;
         }
 
         String str = nonce + "|" + SECRET_KEY + "|" + timestamp;

broker/src/main/java/io/moquette/BrokerConstants.java

@@ -100,6 +100,8 @@ public final class BrokerConstants {
     public static final String HZ_Cluster_Node_External_Short_Port = "node_external_short_port";
     public static final String HZ_Cluster_Node_ID = "node_id";
     public static final String HTTP_SERVER_SECRET_KEY = "http.admin.secret_key";
+    public static final String HTTP_SERVER_API_NO_CHECK_TIME = "http.admin.no_check_time";
+
     public static final String CLIENT_PROTO_SECRET_KEY = "client.proto.secret_key";
     public static final String TOKEN_SECRET_KEY = "token.key ";
 

broker/src/main/java/io/moquette/server/Server.java

@@ -112,6 +112,8 @@ public class Server {
         int httpAdminPort = Integer.parseInt(config.getProperty(BrokerConstants.HTTP_ADMIN_PORT));
 
         AdminAction.setSecretKey(config.getProperty(HTTP_SERVER_SECRET_KEY));
+        AdminAction.setNoCheckTime(config.getProperty(HTTP_SERVER_API_NO_CHECK_TIME));
+
         final LoServer httpServer = new LoServer(httpLocalPort, httpAdminPort, instance.m_processor.getMessagesStore(), instance.m_store.sessionsStore());
         try {
             httpServer.start();