package Ġnet . cord a . services . messaging Ċ Ċ import Ġco . parallel universe . fib ers . Suspend able Ċ import Ġnet . cord a . client . rpc . C ord a RPC Client Ċ import Ġnet . cord a . client . rpc . C ord a RPC Connection Ċ import Ġnet . cord a . core . crypto . random 6 3 Bit Value Ċ import Ġnet . cord a . core . flows . Flow Logic Ċ import Ġnet . cord a . core . flows . Flow Session Ċ import Ġnet . cord a . core . flows . Initi ated By Ċ import Ġnet . cord a . core . flows . Initi ating Flow Ċ import Ġnet . cord a . core . identity . C ord a X 5 0 0 Name Ċ import Ġnet . cord a . core . identity . Party Ċ import Ġnet . cord a . core . messaging . C ord a RP CO ps Ċ import Ġnet . cord a . core . utilities . Network Host And Port Ċ import Ġnet . cord a . core . utilities . get OrThrow Ċ import Ġnet . cord a . core . utilities . unwrap Ċ import Ġnet . cord a . core testing . internal . configure Test SSL Ċ import Ġnet . cord a . node . internal . Node With Info Ċ import Ġnet . cord a . node api . RPC Api Ċ import Ġnet . cord a . node api . internal . Art emis Messaging Component . Companion . INTERNAL _ PREFIX Ċ import Ġnet . cord a . node api . internal . Art emis Messaging Component . Companion . NOTIFICATION S _ ADDRESS Ċ import Ġnet . cord a . node api . internal . config . Mut ual Ssl Configuration Ċ import Ġnet . cord a . testing . core . AL ICE _ NAME Ċ import Ġnet . cord a . testing . core . BO B _ NAME Ċ import Ġnet . cord a . testing . core . single Identity Ċ import Ġnet . cord a . testing . node . User Ċ import Ġnet . cord a . testing . node . internal . Node Based Test Ċ import Ġnet . cord a . testing . node . internal . start Flow Ċ import Ġorg . apache . activ emq . art emis . api . core . Active MQ Non Ex istent Queue Exception Ċ import Ġorg . apache . activ emq . art emis . api . core . Active MQ Security Exception Ċ import Ġorg . apache . activ emq . art emis . api . core . Routing Type Ċ import Ġorg . apache . activ emq . art emis . api . core . Simple String Ċ import Ġorg . assertj . core . api . Assertions . assertThat Exception OfType Ċ import Ġorg . junit . After Ċ import Ġorg . junit . Before Ċ import Ġorg . junit . Test Ċ import Ġjava . util .* Ċ import Ġkotlin . test . assertEquals Ċ Ċ /** Ċ Ġ* ĠRuns Ġa Ġseries Ġof ĠMQ - related Ġattacks Ġagainst Ġa Ġnode . ĠSub classes Ġneed Ġto Ġcall Ġ[ start Attack er ] Ġto Ġconnect Ċ Ġ* Ġthe Ġattacker Ġto Ġ[ alice ]. Ċ Ġ*/ Ċ abstract Ġclass ĠMQ Security Test Ġ: ĠNode Based Test () Ġ{ ĊĠĠĠ Ġprivate Ġval Ġrpc User Ġ= ĠUser (" user 1 ", Ġ" pass ", Ġpermissions Ġ= Ġempty Set ()) ĊĠĠĠ Ġlateinit Ġvar Ġalice : ĠNode With Info ĊĠĠĠ Ġlateinit Ġvar Ġattacker : ĠSimple MQ Client ĊĠĠĠ Ġprivate Ġval Ġclients Ġ= ĠArrayList < Simple MQ Client >() ĊĊĠĠĠ Ġ@ Before ĊĠĠĠ Ġoverride Ġfun ĠsetUp () Ġ{ ĊĠĠĠĠĠĠĠ Ġsuper . setUp () ĊĠĠĠĠĠĠĠ Ġalice Ġ= Ġstart Node ( AL ICE _ NAME , Ġrpc Users Ġ= Ġextra RPC Users Ġ+ Ġrpc User ) ĊĠĠĠĠĠĠĠ Ġattacker Ġ= Ġcreate Attack er () ĊĠĠĠĠĠĠĠ Ġstart Attack er ( attack er ) ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġopen Ġval Ġextra RPC Users : ĠList < User > Ġget () Ġ= Ġempty List () ĊĊĠĠĠ Ġabstract Ġfun Ġcreate Attack er (): ĠSimple MQ Client ĊĊĠĠĠ Ġabstract Ġfun Ġstart Attack er ( attack er : ĠSimple MQ Client ) ĊĊĠĠĠ Ġ@ After ĊĠĠĠ Ġfun Ġstop Clients () Ġ{ ĊĠĠĠĠĠĠĠ Ġclients . forEach Ġ{ Ġit . stop () Ġ} ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġ@ Test ( timeout = 3 0 0 _ 0 0 0 ) Ċ ĉ fun Ġ` create Ġqueue Ġfor Ġvalid ĠRPC Ġuser `() Ġ{ ĊĠĠĠĠĠĠĠ Ġval Ġuser 1 Queue Ġ= Ġ"${ RPC Api . RPC _ CLIENT _ QUEUE _ NAME _ PREFIX }.${ rpc User . username }.${ random 6 3 Bit Value () }" ĊĠĠĠĠĠĠĠ Ġassert Temp Queue Creation Attack Fails ( user 1 Queue ) ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġ@ Test ( timeout = 3 0 0 _ 0 0 0 ) Ċ ĉ fun Ġ` create Ġqueue Ġfor Ġinvalid ĠRPC Ġuser `() Ġ{ ĊĠĠĠĠĠĠĠ Ġval Ġinvalid RPC Queue Ġ= Ġ"${ RPC Api . RPC _ CLIENT _ QUEUE _ NAME _ PREFIX }.${ random 6 3 Bit Value ()}. ${ random 6 3 Bit Value () }" ĊĠĠĠĠĠĠĠ Ġassert Temp Queue Creation Attack Fails ( invalid RPC Queue ) ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġ@ Test ( timeout = 3 0 0 _ 0 0 0 ) Ċ ĉ open Ġfun Ġ` send Ġmessage Ġto Ġnotifications Ġaddress `() Ġ{ ĊĠĠĠĠĠĠĠ Ġassert Send Attack Fails ( NOTIFICATION S _ ADDRESS ) ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġ@ Test ( timeout = 3 0 0 _ 0 0 0 ) Ċ ĉ fun Ġ` create Ġrandom Ġinternal Ġqueue `() Ġ{ ĊĠĠĠĠĠĠĠ Ġval Ġrandom Queue Ġ= Ġ"$ INTERNAL _ PREFIX ${ random 6 3 Bit Value () }" ĊĠĠĠĠĠĠĠ Ġassert All Queue Creation Attack s Fail ( random Queue ) ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġ@ Test ( timeout = 3 0 0 _ 0 0 0 ) Ċ ĉ fun Ġ` create Ġrandom Ġqueue `() Ġ{ ĊĠĠĠĠĠĠĠ Ġval Ġrandom Queue Ġ= Ġrandom 6 3 Bit Value (). toString () ĊĠĠĠĠĠĠĠ Ġassert All Queue Creation Attack s Fail ( random Queue ) ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġfun Ġclient To ( target : ĠNetwork Host And Port , Ġssl Configuration : ĠMut ual Ssl Configuration ? Ġ= Ġconfigure Test SSL ( C ord a X 5 0 0 Name (" Me ga Cor p ", Ġ" L ondon ", Ġ" GB ")) ): ĠSimple MQ Client Ġ{ ĊĠĠĠĠĠĠĠ Ġval Ġclient Ġ= ĠSimple MQ Client ( target , Ġssl Configuration ) ĊĠĠĠĠĠĠĠ Ġclients Ġ+= Ġclient ĊĠĠĠĠĠĠĠ Ġreturn Ġclient ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġprivate Ġval Ġrpc Connections Ġ= Ġmutable ListOf < C ord a RPC Connection >() ĊĠĠĠ Ġprivate Ġfun Ġlogin To RPC ( target : ĠNetwork Host And Port , Ġrpc User : ĠUser ): ĠC ord a RP CO ps Ġ{ ĊĠĠĠĠĠĠĠ Ġreturn ĠC ord a RPC Client ( target ). start ( rpc User . username , Ġrpc User . password ). also Ġ{ Ġrpc Connections . add ( it ) Ġ}. proxy ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġ@ After ĊĠĠĠ Ġfun Ġclose RPC Connections () Ġ{ ĊĠĠĠĠĠĠĠ Ġrpc Connections . forEach Ġ{ Ġit . force Close () Ġ} ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġfun Ġlogin To RPC AndGet Client Queue (): ĠString Ġ{ ĊĠĠĠĠĠĠĠ Ġlogin To RPC ( alice . node . configuration . rpc Options . address , Ġrpc User ) ĊĠĠĠĠĠĠĠ Ġval Ġclient Queue Query Ġ= ĠSimple String ("${ RPC Api . RPC _ CLIENT _ QUEUE _ NAME _ PREFIX }.${ rpc User . username } .* ") ĊĠĠĠĠĠĠĠ Ġval Ġclient Ġ= Ġclient To ( alice . node . configuration . rpc Options . address ) ĊĠĠĠĠĠĠĠ Ġclient . start ( rpc User . username , Ġrpc User . password , Ġfalse ) ĊĠĠĠĠĠĠĠ Ġreturn Ġclient . session . address Query ( client Queue Query ). queue Names . single (). toString () ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġfun Ġassert All Queue Creation Attack s Fail ( queue : ĠString ) Ġ{ ĊĠĠĠĠĠĠĠ Ġassert Non Temp Queue Creation Attack Fails ( queue , Ġdur able Ġ= Ġtrue ) ĊĠĠĠĠĠĠĠ Ġassert Non Temp Queue Creation Attack Fails ( queue , Ġdur able Ġ= Ġfalse ) ĊĠĠĠĠĠĠĠ Ġassert Temp Queue Creation Attack Fails ( queue ) ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġfun Ġassert Temp Queue Creation Attack Fails ( queue : ĠString ) Ġ{ ĊĠĠĠĠĠĠĠ Ġassert Attack Fails ( queue , Ġ" CREATE _ NON _ D UR ABLE _ QUEUE ") Ġ{ ĊĠĠĠĠĠĠĠĠĠĠĠ Ġattacker . session . create Temporary Queue ( queue , ĠRouting Type . MULT IC AST , Ġqueue ) ĊĠĠĠĠĠĠĠ Ġ} ĊĠĠĠĠĠĠĠ Ġ// ĠDouble - check ĊĠĠĠĠĠĠĠ ĠassertThat Exception OfType ( Active MQ Non Ex istent Queue Exception :: class . java ). is Thrown By Ġ{ ĊĠĠĠĠĠĠĠĠĠĠĠ Ġattacker . session . create Consumer ( queue ) ĊĠĠĠĠĠĠĠ Ġ} ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġfun Ġassert Attack Fails Non existent ( queue : ĠString , Ġattack : Ġ() Ġ-> ĠUnit ) Ġ{ ĊĠĠĠĠĠĠĠ ĠassertThat Exception OfType ( Active MQ Non Ex istent Queue Exception :: class . java ) ĊĠĠĠĠĠĠĠĠĠĠĠĠĠĠĠ Ġ. is Thrown By ( attack ) ĊĠĠĠĠĠĠĠĠĠĠĠĠĠĠĠ Ġ. with Message Containing ( queue ) ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġfun Ġassert Non Temp Queue Creation Attack Fails ( queue : ĠString , Ġdur able : ĠBoolean ) Ġ{ ĊĠĠĠĠĠĠĠ Ġval Ġpermission Ġ= Ġif Ġ( dur able ) Ġ" CREATE _ D UR ABLE _ QUEUE " Ġelse Ġ" CREATE _ NON _ D UR ABLE _ QUEUE " ĊĠĠĠĠĠĠĠ Ġassert Attack Fails ( queue , Ġpermission ) Ġ{ ĊĠĠĠĠĠĠĠĠĠĠĠ Ġattacker . session . create Queue ( queue , ĠRouting Type . MULT IC AST , Ġqueue , Ġdur able ) ĊĠĠĠĠĠĠĠ Ġ} ĊĠĠĠĠĠĠĠ Ġ// ĠDouble - check ĊĠĠĠĠĠĠĠ ĠassertThat Exception OfType ( Active MQ Non Ex istent Queue Exception :: class . java ). is Thrown By Ġ{ ĊĠĠĠĠĠĠĠĠĠĠĠ Ġattacker . session . create Consumer ( queue ) ĊĠĠĠĠĠĠĠ Ġ} ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġfun Ġassert Send Attack Fails ( address : ĠString ) Ġ{ ĊĠĠĠĠĠĠĠ Ġval Ġmessage Ġ= Ġattacker . create Message () ĊĠĠĠĠĠĠĠ ĠassertEquals ( true , Ġattacker . producer . is Block On Non Dur able Send ) ĊĠĠĠĠĠĠĠ Ġassert Attack Fails ( address , Ġ" SEND ") Ġ{ ĊĠĠĠĠĠĠĠĠĠĠĠ Ġattacker . producer . send ( address , Ġmessage ) ĊĠĠĠĠĠĠĠ Ġ} ĊĠĠĠĠĠĠĠ ĠassertEquals ( 0 , Ġmessage . delivery Count ) ĊĠĠĠĠĠĠĠ ĠassertEquals ( 0 , Ġmessage . body Size ) ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġfun Ġassert Consume Attack Fails ( queue : ĠString ) Ġ{ ĊĠĠĠĠĠĠĠ Ġassert Attack Fails ( queue , Ġ" CON SU ME ") Ġ{ ĊĠĠĠĠĠĠĠĠĠĠĠ Ġattacker . session . create Consumer ( queue ) ĊĠĠĠĠĠĠĠ Ġ} ĊĠĠĠĠĠĠĠ Ġassert Attack Fails ( queue , Ġ" BROW SE ") Ġ{ ĊĠĠĠĠĠĠĠĠĠĠĠ Ġattacker . session . create Consumer ( queue , Ġtrue ) ĊĠĠĠĠĠĠĠ Ġ} ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġfun Ġassert Consume Attack Fails Non existent ( queue : ĠString ) Ġ{ ĊĠĠĠĠĠĠĠ Ġassert Attack Fails Non existent ( queue ) Ġ{ ĊĠĠĠĠĠĠĠĠĠĠĠ Ġattacker . session . create Consumer ( queue ) ĊĠĠĠĠĠĠĠ Ġ} ĊĠĠĠĠĠĠĠ Ġassert Attack Fails Non existent ( queue ) Ġ{ ĊĠĠĠĠĠĠĠĠĠĠĠ Ġattacker . session . create Consumer ( queue , Ġtrue ) ĊĠĠĠĠĠĠĠ Ġ} ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġfun Ġassert Attack Fails ( queue : ĠString , Ġpermission : ĠString , Ġattack : Ġ() Ġ-> ĠUnit ) Ġ{ ĊĠĠĠĠĠĠĠ ĠassertThat Exception OfType ( Active MQ Security Exception :: class . java ) ĊĠĠĠĠĠĠĠĠĠĠĠĠĠĠĠ Ġ. is Thrown By ( attack ) ĊĠĠĠĠĠĠĠĠĠĠĠĠĠĠĠ Ġ. with Message Containing ( queue ) ĊĠĠĠĠĠĠĠĠĠĠĠĠĠĠĠ Ġ. with Message Containing ( permission ) ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġprotected Ġfun Ġstart Bob And Com municate With Alice (): ĠParty Ġ{ ĊĠĠĠĠĠĠĠ Ġval Ġbob Ġ= Ġstart Node ( BO B _ NAME ) ĊĠĠĠĠĠĠĠ Ġval Ġbob Party Ġ= Ġbob . info . single Identity () ĊĠĠĠĠĠĠĠ Ġ// ĠPerform Ġa Ġprotocol Ġexchange Ġto Ġforce Ġthe Ġpeer Ġqueue Ġto Ġbe Ġcreated ĊĠĠĠĠĠĠĠ Ġalice . services . start Flow ( Send Flow ( bob Party , Ġ 0 )). result Future . get OrThrow () ĊĠĠĠĠĠĠĠ Ġreturn Ġbob Party ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġ@ Initi ating Flow ĊĠĠĠ Ġprivate Ġclass ĠSend Flow ( val Ġother Party : ĠParty , Ġval Ġpayload : ĠAny ) Ġ: ĠFlow Logic < Unit >() Ġ{ ĊĠĠĠĠĠĠĠ Ġ@ Suspend able ĊĠĠĠĠĠĠĠ Ġoverride Ġfun Ġcall () Ġ= Ġinitiate Flow ( other Party ). send ( payload ) ĊĠĠĠ Ġ} ĊĊĠĠĠ Ġ@ Initi ated By ( Send Flow :: class ) ĊĠĠĠ Ġprivate Ġclass ĠReceive Flow ( val Ġother Party Session : ĠFlow Session ) Ġ: ĠFlow Logic < Any >() Ġ{ ĊĠĠĠĠĠĠĠ Ġ@ Suspend able ĊĠĠĠĠĠĠĠ Ġoverride Ġfun Ġcall () Ġ= Ġother Party Session . receive < Any >(). unwrap Ġ{ Ġit Ġ} ĊĠĠĠ Ġ} Ċ }