Joseph Doherty
293 lines
17 KiB
C#
293 lines
17 KiB
C#
using System.Text;
|
|
using System.Net;
|
|
using System.Collections.Concurrent;
|
|
using Microsoft.Extensions.Logging.Abstractions;
|
|
using Opc.Ua;
|
|
using Opc.Ua.Client;
|
|
using Shouldly;
|
|
using Xunit;
|
|
using Opc.Ua.Configuration;
|
|
using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
|
|
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
|
|
using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
|
|
using ZB.MOM.WW.OtOpcUa.Core.Authorization;
|
|
using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests;
|
|
|
|
/// <summary>Real, mutually trusted channels: no auto-accept callbacks or insecure fallback.</summary>
|
|
public sealed class Sdk2TrustedChannelTests
|
|
{
|
|
[Theory]
|
|
[InlineData(OpcUaSecurityProfile.Basic256Sha256Sign, MessageSecurityMode.Sign)]
|
|
[InlineData(OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt, MessageSecurityMode.SignAndEncrypt)]
|
|
public async Task Trusted_key_retains_narrow_authority_and_revocation_reaches_its_open_session(
|
|
OpcUaSecurityProfile profile, MessageSecurityMode mode)
|
|
{
|
|
var ct = TestContext.Current.CancellationToken;
|
|
await using var rig = await TrustedRig.StartAsync(profile, ct);
|
|
using var session = await rig.ConnectAsync("contract-key", ct);
|
|
session.Endpoint.SecurityMode.ShouldBe(mode);
|
|
(await session.ReadValueAsync(rig.Node(session), ct)).WrappedValue.GetInt32().ShouldBe(7);
|
|
(await rig.WriteAsync(session, 42, ct)).ShouldBe(StatusCodes.Good);
|
|
rig.Writes.ShouldBe(1, "a narrow grant with no application-wide roles must permit the write");
|
|
var observedPeer = rig.Peers.ShouldHaveSingleItem();
|
|
observedPeer.ShouldNotBeNull();
|
|
IPAddress.IsLoopback(observedPeer.Address).ShouldBeTrue();
|
|
observedPeer.Port.ShouldBe(0, "the public SDK evidence supplies an IP address, not an invented client port");
|
|
var originalSessionId = session.SessionId;
|
|
await session.ReconnectAsync(null, null, ct);
|
|
session.SessionId.ShouldBe(originalSessionId, "the test must reactivate the existing session on a new channel");
|
|
rig.Peers.Count.ShouldBe(2);
|
|
rig.Peers.Last().ShouldNotBeNull().Address.ShouldBe(observedPeer.Address);
|
|
(await session.ReadValueAsync(rig.Node(session), ct)).StatusCode.ShouldBe(StatusCodes.Good);
|
|
var identity = rig.Server.CurrentInstance.SessionManager.GetSessions().ShouldHaveSingleItem().EffectiveIdentity
|
|
.ShouldBeOfType<RoleCarryingUserIdentity>();
|
|
identity.Principal.ShouldBe(TrustedRig.Principal);
|
|
identity.ApiKeyId.ShouldBe(TrustedRig.KeyId);
|
|
identity.Roles.ShouldBeEmpty();
|
|
|
|
rig.Revoke();
|
|
(await rig.WriteAsync(session, 99, ct)).ShouldBe(StatusCodes.BadUserAccessDenied);
|
|
rig.Writes.ShouldBe(1, "revocation must be checked before a cached narrow grant or dispatch");
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData(OpcUaSecurityProfile.Basic256Sha256Sign)]
|
|
[InlineData(OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt)]
|
|
public async Task Concurrent_IPv4_and_IPv6_activations_keep_their_own_transport_peer(OpcUaSecurityProfile profile)
|
|
{
|
|
var ct = TestContext.Current.CancellationToken;
|
|
await using var rig = await TrustedRig.StartAsync(profile, ct);
|
|
rig.HoldPeerActivations = true;
|
|
// Distinct test attempt markers share one key identity and trusted certificate. Both auth flows await the barrier.
|
|
var firstConnection = rig.ConnectAsync("contract-key-ipv4", ct, transportHost: "127.0.0.1");
|
|
var secondConnection = rig.ConnectAsync("contract-key-ipv6", ct, transportHost: "[::1]");
|
|
ISession[] connections;
|
|
try { connections = await Task.WhenAll(firstConnection, secondConnection); }
|
|
catch
|
|
{
|
|
if (firstConnection.IsCompletedSuccessfully) (await firstConnection).Dispose();
|
|
if (secondConnection.IsCompletedSuccessfully) (await secondConnection).Dispose();
|
|
throw;
|
|
}
|
|
using var ipv4 = connections[0];
|
|
using var ipv6 = connections[1];
|
|
rig.Peers.Count.ShouldBe(2);
|
|
var first4 = rig.PeerObservations.Single(x => x.Attempt == "IPv4");
|
|
var first6 = rig.PeerObservations.Single(x => x.Attempt == "IPv6");
|
|
first4.Peer.ShouldNotBeNull().Address.ShouldBe(IPAddress.Loopback);
|
|
first6.Peer.ShouldNotBeNull().Address.ShouldBe(IPAddress.IPv6Loopback);
|
|
first4.AfterAwaitPeer.ShouldBe(first4.Peer.Address);
|
|
first6.AfterAwaitPeer.ShouldBe(first6.Peer.Address);
|
|
foreach (var session in connections)
|
|
(await session.ReadValueAsync(rig.Node(session), ct)).StatusCode.ShouldBe(StatusCodes.Good);
|
|
await ipv4.ReconnectAsync(null, null, ct);
|
|
rig.Peers.Count.ShouldBe(3);
|
|
rig.Peers.Last().ShouldNotBeNull().Address.ShouldBe(IPAddress.Loopback,
|
|
"reactivation cannot inherit the concurrent IPv6 activation's peer");
|
|
await ipv6.CloseAsync(ct);
|
|
await ipv4.CloseAsync(ct);
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData(OpcUaSecurityProfile.Basic256Sha256Sign)]
|
|
[InlineData(OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt)]
|
|
public async Task Trusted_channel_does_not_turn_invalid_credentials_into_another_identity(OpcUaSecurityProfile profile)
|
|
{
|
|
var ct = TestContext.Current.CancellationToken;
|
|
await using var rig = await TrustedRig.StartAsync(profile, ct);
|
|
var error = await Should.ThrowAsync<ServiceResultException>(() => rig.ConnectAsync("invalid", ct));
|
|
error.StatusCode.ShouldBe(StatusCodes.BadIdentityTokenRejected);
|
|
rig.Writes.ShouldBe(0);
|
|
rig.Server.CurrentInstance.SessionManager.GetSessions().ShouldAllBe(s => !s.Activated);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task An_untrusted_client_is_rejected_before_application_authentication()
|
|
{
|
|
var ct = TestContext.Current.CancellationToken;
|
|
await using var rig = await TrustedRig.StartAsync(OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt, ct);
|
|
var before = rig.AuthCalls;
|
|
var error = await Should.ThrowAsync<ServiceResultException>(() => rig.ConnectAsync("contract-key", ct, untrustedClient: true));
|
|
new[] { StatusCodes.BadCertificateUntrusted, StatusCodes.BadSecurityChecksFailed, StatusCodes.BadSecureChannelClosed }
|
|
.ShouldContain(error.StatusCode);
|
|
rig.AuthCalls.ShouldBe(before);
|
|
rig.Writes.ShouldBe(0);
|
|
}
|
|
|
|
private sealed class TrustedRig : IAsyncDisposable, IOpcUaUserAuthenticator, IOpcUaNodeWriteGateway
|
|
{
|
|
internal const string Principal = "trusted-contract";
|
|
internal const string KeyId = "k-trusted-contract";
|
|
private const string Cluster = "SDK2";
|
|
private const string PathId = "Plant/Device/Value";
|
|
private readonly string _root = Path.Combine(Path.GetTempPath(), $"otua-trusted-{Guid.NewGuid():N}");
|
|
private readonly ConcurrentDictionary<ApplicationConfiguration, ApplicationInstance> _applications = new();
|
|
private readonly DataPlaneAuthorityState _authority = new();
|
|
private readonly OpcUaApplicationHostOptions _options;
|
|
private OpcUaApplicationHost _host = null!;
|
|
private int _port;
|
|
private int _writes;
|
|
private int _authCalls;
|
|
internal sealed record PeerObservation(string Attempt, IPEndPoint? Peer, IPAddress? AfterAwaitPeer);
|
|
internal ConcurrentQueue<PeerObservation> PeerObservations { get; } = new();
|
|
internal IReadOnlyList<IPEndPoint?> Peers => PeerObservations.Select(x => x.Peer).ToArray();
|
|
internal bool HoldPeerActivations { get; set; }
|
|
private readonly TaskCompletionSource _peerBarrier = new(TaskCreationOptions.RunContinuationsAsynchronously);
|
|
private int _peerBarrierArrivals;
|
|
internal OtOpcUaSdkServer Server { get; private set; } = null!;
|
|
internal int Writes => Volatile.Read(ref _writes);
|
|
internal int AuthCalls => Volatile.Read(ref _authCalls);
|
|
private string ServerPki => System.IO.Path.Combine(_root, "server");
|
|
private string ClientPki => System.IO.Path.Combine(_root, "client");
|
|
|
|
private TrustedRig(OpcUaSecurityProfile profile)
|
|
{
|
|
_options = new OpcUaApplicationHostOptions
|
|
{
|
|
ApplicationName = "Sdk2TrustedContract", ApplicationUri = $"urn:Sdk2TrustedContract:{Guid.NewGuid():N}",
|
|
PublicHostname = "localhost", PkiStoreRoot = ServerPki, AllowAnonymous = false,
|
|
AutoAcceptUntrustedClientCertificates = false, EnabledSecurityProfiles = [profile],
|
|
};
|
|
}
|
|
|
|
internal static async Task<TrustedRig> StartAsync(OpcUaSecurityProfile profile, CancellationToken ct)
|
|
{
|
|
var rig = new TrustedRig(profile);
|
|
try
|
|
{
|
|
// Provision both certificates, then reload the managers with explicit trusted-peer stores.
|
|
await rig.BootAsync(ct);
|
|
await rig._host.DisposeAsync();
|
|
var client = await rig.ConfigurationAsync(rig.ClientPki, ct);
|
|
CopyCertificates(rig.ServerPki, rig.ClientPki);
|
|
CopyCertificates(rig.ClientPki, rig.ServerPki);
|
|
await rig.ReleaseConfigurationAsync(client);
|
|
await rig.BootAsync(ct);
|
|
rig.InstallAuthority(enabled: true);
|
|
var nm = rig.Server.NodeManager!;
|
|
nm.DataPlaneAuthority = rig._authority;
|
|
nm.Authorizer = new DataPlaneAuthorizer(rig._authority, new TriePermissionEvaluator(rig._authority.Tries),
|
|
true, NullLogger.Instance, TimeProvider.System);
|
|
nm.NodeWriteGateway = rig;
|
|
var sink = new SdkAddressSpaceSink(nm);
|
|
sink.EnsureFolder("Plant", null, "Plant", AddressSpaceRealm.Raw);
|
|
sink.EnsureFolder("Plant/Device", "Plant", "Device", AddressSpaceRealm.Raw);
|
|
sink.EnsureVariable(PathId, "Plant/Device", "Value", "Int32", true, AddressSpaceRealm.Raw);
|
|
sink.WriteValue(PathId, 7, OpcUaStatus.Good, DateTime.UtcNow, AddressSpaceRealm.Raw);
|
|
return rig;
|
|
}
|
|
catch { await rig.DisposeAsync(); throw; }
|
|
}
|
|
|
|
private async Task BootAsync(CancellationToken ct)
|
|
{
|
|
(_host, Server) = await OpcUaHostStart.StartAsync(port =>
|
|
{
|
|
_port = port; _options.OpcUaPort = port;
|
|
return new OpcUaApplicationHost(_options, NullLogger<OpcUaApplicationHost>.Instance, this);
|
|
}, () => new OtOpcUaSdkServer(), ct);
|
|
}
|
|
|
|
private static void CopyCertificates(string from, string to)
|
|
{
|
|
var destination = System.IO.Path.Combine(to, "trusted", "certs");
|
|
Directory.CreateDirectory(destination);
|
|
foreach (var file in Directory.GetFiles(System.IO.Path.Combine(from, "own", "certs"), "*.der"))
|
|
File.Copy(file, System.IO.Path.Combine(destination, System.IO.Path.GetFileName(file)), overwrite: true);
|
|
}
|
|
|
|
private async Task<ApplicationConfiguration> ConfigurationAsync(string pki, CancellationToken ct)
|
|
{
|
|
var telemetry = DefaultTelemetry.Create(_ => { });
|
|
var security = TestClientSecurity.Build(pki);
|
|
security.AutoAcceptUntrustedCertificates = false;
|
|
security.ApplicationCertificate!.SubjectName = "CN=Sdk2TrustedClient";
|
|
var config = new ApplicationConfiguration(telemetry)
|
|
{
|
|
ApplicationName = "Sdk2TrustedClient", ApplicationUri = "urn:localhost:Sdk2TrustedClient",
|
|
ApplicationType = ApplicationType.Client, SecurityConfiguration = security,
|
|
ClientConfiguration = new ClientConfiguration { DefaultSessionTimeout = 60_000 },
|
|
};
|
|
var app = new ApplicationInstance(telemetry)
|
|
{ ApplicationName = config.ApplicationName, ApplicationType = ApplicationType.Client, ApplicationConfiguration = config };
|
|
try
|
|
{
|
|
await config.ValidateAsync(ApplicationType.Client, ct);
|
|
await app.CheckApplicationInstanceCertificatesAsync(true, lifeTimeInMonths: 12, ct);
|
|
_applications[config] = app;
|
|
return config;
|
|
}
|
|
catch { await app.DisposeAsync(); throw; }
|
|
}
|
|
|
|
private async Task ReleaseConfigurationAsync(ApplicationConfiguration config)
|
|
{
|
|
if (_applications.TryRemove(config, out var app)) await app.DisposeAsync();
|
|
}
|
|
|
|
internal async Task<ISession> ConnectAsync(string credential, CancellationToken ct, bool untrustedClient = false, string? transportHost = null)
|
|
{
|
|
var pki = untrustedClient ? System.IO.Path.Combine(_root, $"untrusted-{Guid.NewGuid():N}") : ClientPki;
|
|
var config = await ConfigurationAsync(pki, ct);
|
|
if (untrustedClient)
|
|
{
|
|
await ReleaseConfigurationAsync(config);
|
|
CopyCertificates(ServerPki, pki);
|
|
config = await ConfigurationAsync(pki, ct);
|
|
}
|
|
config.SecurityConfiguration.AutoAcceptUntrustedCertificates.ShouldBeFalse();
|
|
var telemetry = DefaultTelemetry.Create(_ => { });
|
|
var endpoint = await CoreClientUtils.SelectEndpointAsync(config, $"opc.tcp://localhost:{_port}/OtOpcUa", true, telemetry, ct)
|
|
?? throw new InvalidOperationException("No secure endpoint.");
|
|
if (transportHost is not null) endpoint.EndpointUrl = $"opc.tcp://{transportHost}:{_port}/OtOpcUa";
|
|
return await new DefaultSessionFactory(telemetry).CreateAsync(config,
|
|
new ConfiguredEndpoint(null, endpoint, EndpointConfiguration.Create(config)), false, true,
|
|
"Sdk2TrustedContract", 60_000, new UserIdentity("apikey", Encoding.UTF8.GetBytes(credential)), default, ct);
|
|
}
|
|
|
|
internal NodeId Node(ISession session) => new(PathId, (ushort)session.NamespaceUris.GetIndex(V3NodeIds.RawNamespaceUri));
|
|
internal async Task<StatusCode> WriteAsync(ISession session, int value, CancellationToken ct) =>
|
|
(await session.WriteAsync(null, [new WriteValue { NodeId = Node(session), AttributeId = Attributes.Value,
|
|
Value = new DataValue(Variant.From(value)) }], ct)).Results[0];
|
|
internal void Revoke() => InstallAuthority(enabled: false);
|
|
private void InstallAuthority(bool enabled) => _authority.Apply(Cluster, enabled ? "allowed" : "revoked",
|
|
[new ApiKey { ApiKeyId = KeyId, Name = KeyId, Principal = Principal, Enabled = enabled,
|
|
SecretHash = "hash", CreatedUtc = DateTime.UtcNow.AddDays(-1) }],
|
|
[new NodeAcl { NodeAclId = "narrow", ClusterId = Cluster, Principal = Principal,
|
|
ScopeKind = NodeAclScopeKind.RawDevice, ScopeId = "device", PermissionFlags =
|
|
NodePermissions.Read | NodePermissions.Browse | NodePermissions.Subscribe | NodePermissions.WriteOperate }],
|
|
new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>
|
|
{ [new(NodeAclScopeKind.RawDevice, "device")] = [new([NodeAclRealms.Raw, "Plant", "Device"])] });
|
|
|
|
public async Task<OpcUaUserAuthResult> AuthenticateUserNameAsync(string username, string password, IPEndPoint? peer, CancellationToken ct)
|
|
{
|
|
var attempt = password switch { "contract-key-ipv4" => "IPv4", "contract-key-ipv6" => "IPv6", _ => "Other" };
|
|
if (HoldPeerActivations && attempt != "Other")
|
|
{
|
|
if (Interlocked.Increment(ref _peerBarrierArrivals) == 2) _peerBarrier.TrySetResult();
|
|
await _peerBarrier.Task.WaitAsync(TimeSpan.FromSeconds(15), ct);
|
|
}
|
|
PeerObservations.Enqueue(new(attempt, peer is null ? null : new IPEndPoint(peer.Address, peer.Port), Server.ActivationPeerAddress));
|
|
return await AuthenticateUserNameAsync(username, password, ct);
|
|
}
|
|
|
|
public Task<OpcUaUserAuthResult> AuthenticateUserNameAsync(string username, string password, CancellationToken ct)
|
|
{
|
|
Interlocked.Increment(ref _authCalls);
|
|
return Task.FromResult(username == "apikey" && (password is "contract-key" or "contract-key-ipv4" or "contract-key-ipv6")
|
|
? OpcUaUserAuthResult.AllowKey(Principal, [], KeyId) : OpcUaUserAuthResult.Deny("Invalid credential."));
|
|
}
|
|
public Task<NodeWriteOutcome> WriteAsync(string nodeId, object? value, AddressSpaceRealm realm, CancellationToken ct)
|
|
{ Interlocked.Increment(ref _writes); return Task.FromResult(new NodeWriteOutcome(true, null)); }
|
|
public async ValueTask DisposeAsync()
|
|
{
|
|
if (_host is not null) await _host.DisposeAsync();
|
|
foreach (var app in _applications.Values) await app.DisposeAsync();
|
|
_applications.Clear();
|
|
if (Directory.Exists(_root)) Directory.Delete(_root, true);
|
|
}
|
|
}
|
|
}
|