[tipatterson-dev]

Fixes a permission bypass in the HiveMQ extension: a retried SUBSCRIBE was accepted without a permission check.

Closes #257. Part of #249.

Problem

OshExtension.subscribeToTopic recorded the topic for the client before the handler checked permissions. When the check failed, the topic stayed recorded. The same SUBSCRIBE sent again found the topic, skipped the handler, and was accepted. The client then got every message on that topic, for example data that an allowed client had subscribed to. Two SUBSCRIBEs sent at the same time had the same gap.

Fix

• Record the topic only after the handler accepts it. A rejected subscribe is never recorded, so a retry is checked again.
• If two subscribes to the same topic both pass, the second undoes its extra handler subscription, so the subscriber count stays right.
• Module version 0.1.0 to 0.1.1.

Testing

• New TestOshExtension (the module had no tests):

  • a rejected subscribe is rejected again on retry, and accepted once the user is allowed
  • a repeated accepted subscribe calls the handler once; another client is checked separately
  • a topic without a handler is not taken
  • The first test fails on the code before this fix.

• On a test node with CS API access control on, an admin client subscribed to an observation topic and an anonymous client tried the same topic:

  	before	after
  anonymous subscribe	Not authorized	Not authorized
  anonymous retry	Granted	Not authorized
  two subscribes at once	Not authorized, Granted	Not authorized, Not authorized
  messages to anonymous clients in 5 s	6 each	0

Independent of the consys-mqtt stack (#261). It merges cleanly with master and with #204, which also changes OshExtension.java.