Commit Graph
148 Commits
Author SHA1 Message Date
Erich Barnstedt c171b14c7e Fix spelling in cert validation service results. (#1211) 2020-12-09 16:49:21 +01:00
Martin Regen 62eedc19be Reduce core dependencies, move https binding to optional assembly. (#1157)
* implement transport binding factory
* split https transport into seperate nuget package
* new Opc.Ua.Binding.Https assembly
* Https binding is loaded on demand, if available
* reduce core dependencies to kestrel and others
fixes #600
2020-10-21 00:03:37 +02:00
Martin Regen 7f3f0dbbb4 Service update, fix many warnings for Xml comments (#1146)
- no bug fixes, just documentation and formatting
- fix all warnings for xml in core libraries, except
-- protected members
-- suppressed warnings in Opc.Ua.Gds libraries (tbd)
2020-10-14 12:00:01 +02:00
AlinMoldovean 764c481405 Update Copyright year to 2020 2020-10-07 18:04:34 +03:00
Martin Regen 38c37acd8f Add support for netstandard2.1 in core libs and nuget packages (#1110)
- solutions support still VS2017 and VS 2019
- ci now also tests net462 & netcoreapp3.1
- next rev of nuget packages will have netstandard2.1 support
- a few small fixes for netcoreapp3.1
2020-09-04 22:56:20 +02:00
Martin Regen 838b99806d Reverse connect improvements for aggregation server (#1073)
- This improvement was tested with an aggregation server update on this branch:

Required for testing: https://github.com/mregen/UA-.NETStandard-Samples/tree/aggregationserver

Main changes: 
- Support holding of reverse connections, then a client can connect faster on a hold connection instead of waiting for the next reverse hello.
- Simplify API to connect with or without reverseconnect manager.
- Reconnect handlers code path added, tested with SessionReconnectHandler
- some locks on lists were not correctly implemented.
2020-08-13 12:50:17 +02:00
Martin Regen e7d8214798 Fix for self signed certs (#1036)
- The self signed certs should have the CA flag set
- small cleanup fixes for cert code
- make sure public key is always disposed
- breaking change: defaults for certs naming convention was not quite right and it should be a readonly, to make sure policy changes are reflected in calling code
- add test cases for validation of extension
2020-07-06 18:40:51 +02:00
AlinMoldovean 44c26c42f2 remove empty lines 2020-06-23 19:08:39 +03:00
AlinMoldovean 5d57ae58f2 Fix for chain status check. #948 Fixes #960 Fixes #996 Fixes #1025 2020-06-23 19:07:58 +03:00
Martin Regen 2e47eaa44f Support Reverse Connect in the stack with samples (#998)
- Ported from prototyping branch in .Net Legacy stack
- Client and server support
- Aggregation server sample
- .Net Core samples

more info in docs/ReverseConnect.md
2020-06-03 16:48:25 +02:00
Martin Regen f53f71f8a4 Complex types fixes (#978)
fix #940 and #975 
- add namespace qualifier to complex type name
- improve handling of known subtypes
- fix Pss detection on .Net 462
- stronger check of valid DataTypeDefinition for servers which expose invalid structure (nodejs)
2020-05-15 12:54:20 +02:00
Martin Regen 1ff1ae7e52 IOP 2020: Workshop fixes (#916)
- fix to validate structuredefinition if servers do not fill out the DataTypeDefinition correctly
- The GDS creates the CRL cert with its own CA serial number, invalidating the CA by default on some stacks
- complex structuretype must be virtual, non reversible union encoding could not be detected 
- fix binary schema validation, allow the \" character in a qualified name
- support use of simple subtypes in a complex type. For custom and standard subtypes.
- only support structure objects with valuerank scalar or onedimension
2020-03-18 18:49:53 +01:00
AlinMoldovean 926b5915da Fix for CertificateUpdate during application runtime. 2020-03-11 17:55:05 +02:00
Kurt 300d9ffd62 Minor analyzer (roslynator) fixes (#880)
* Use nameof() where applicable

Category: Maintainability
https://github.com/JosefPihrt/Roslynator/blob/master/docs/analyzers/RCS1015.md

* Rethrow original exception

Preserves original stack trace of the exception, easier to diagnose
Category: Maintainability
https://github.com/JosefPihrt/Roslynator/blob/master/docs/analyzers/RCS1044.md
https://stackoverflow.com/a/178464

Remove variable from the catch if not logged (compiler warning).

* Combine Where->FirstOrDefault, use Find if applicable

Category: Performance
https://github.com/JosefPihrt/Roslynator/blob/master/docs/analyzers/RCS1077.md

In ApplicationConfiguration:
ServerSecurityPolicyCollection inherits from List<T>, so use List.Find (better performance than FirstOrDefault)

* Use List.Count rather than LINQ Any()

Category: Performance
https://github.com/JosefPihrt/Roslynator/blob/master/docs/analyzers/RCS1080.md
refsToRemove is a List<T>, which we know the count of (no need to iterate).

* Add [Flags] Attribute for OpenFileMode

Each enum is a bitflag here
Just noticed this is in the "Generated" folder... some prior commits had touched other "Generated" files -- see nameof commit.

* Minor performance behavior

- EventArgs.Empty instead of allocating a new blank EventArgs

It only really happens on Connect/Disconnect so it's not like a single allocation really matters

- Use array[0] instead of First()
https://stackoverflow.com/a/25607951
- Use !Any() instead of Count() == 0
If a dependent field is found, it will stop evaluating the rest and Add instead of Insert. Count() == 0 required evaluation of all

- Use All() instead of FirstOrDefault(any) == null
Clearer intent (all are not matching the group BrowseName => clear default)
Slightly faster as the first match found doesn't have to be compared against null

* Revert changes to generated files

* Fix mistake

fixes compile error
2020-01-09 09:28:37 +02:00
AlinMoldovean 13cba2baf7 Length validation in user token decryption. 2019-11-19 16:01:28 +02:00
Alin Moldovean dc9fa85a38 Fixes #822 - Certificate Validation fix. (#843)
* Remove BadCertificateUriInvalid from list of certificate validation errors that may be suppressed.
2019-11-06 09:49:08 +02:00
AlinMoldovean b53ec37199 Copy invalid certificate to rejected store for all validation errors. 2019-07-23 17:17:39 +03:00
Alin Moldovean 07e2b807fb Fixes #748. CertificateValidation event not fired for BadCertificateChainIncomplete. (#752) 2019-07-10 10:25:54 +03:00
AlinMoldovean 9b02652262 Fixes #729. Connection with self-signed certificate fails with BadCertificateChainIncomplete. 2019-06-07 16:08:09 +03:00
AlinMoldovean 24e44dd3f3 Compliance fix in CertificateValidator 2019-05-23 15:12:39 +03:00
AlinMoldovean f062bfdc89 Compliance fixes in CertificateValidator.
Added setting in SecurityConfiguration to require revocation lists for all CAs
2019-05-21 17:42:59 +03:00
Martin Regen 93146020a4 Certificate Validator tests and Pem writer fix (#701)
- add more tests verify how longer cert chains are built and verified with the cert validator
- some tweaks to cert factory to allow for building Sub CA certs
- allow to set the Basic Constraint  / Path Length for CA certs
- fix #695 PKCS#8 format is now used
- add additional check to verify incomplete chain signatures
2019-04-12 16:47:34 +02:00
AlinMoldovean c8ac8e6b5e Fixes #673 - Incorrect IssuedTokenType for JWT tokens 2019-04-02 16:49:40 +03:00
AlinMoldovean 65502ccd62 Update in CertificateValidator.Validate() to require the complete chain. 2019-03-19 16:31:31 +02:00
Martin Regen 64db8c73a9 IOP GDS cert related fixes (#674)
* do not require server capabilities
* fixes for cert creation key usage flags
2019-03-18 12:37:04 +01:00
AlinMoldovean 8b374a7448 Copyright year set to 2019 in license notices. 2019-02-14 12:34:33 +02:00
Marc Schier def3126c5d Fix travis build and interop in binary decoder (#645)
* Fix interop where a server is responding with a 0 terminated string.  In particular xml document read with malformed string causes XML exception. 

* Do not check position before checking Stream.CanSeek when decoding to avoid exception.  This will use the memory allocation path to do random access read.

* Fix .travis build due to failing test on mono
2019-02-13 17:02:21 +01:00
Martin Regen a0c4631d28 enable Pss padding for Aes 256 profile on .Net4.x (#638) 2019-02-05 15:01:31 +01:00
Martin Regen 7deec9d782 Update Bouncy Castle to 1.8.4 (#583) 2018-11-09 09:42:58 +01:00
Martin Regen d007a41d15 Add Aes profile support (#574)
* add the Aes128 and Aes256 profiles
* Aes profies were tested on IoP workshop against Ascolab, Softing, Matrikon, Milo, ProSys and others
* Pss padding is not supported on all platforms, so autodetect if it is supported and filter out Aes256 if not
* not a breaking change: not specifying the SecurityProfileUri in the config xml will automatically add all supported profiles but not deprecated profiles (e.g. Basic256Sha256, Aes128, Aes256). Aes256 is only added if the platform supports Pss padding. This will simplify the maintenance of config xml, since automatically all supported and secure profiles are exposed.
2018-10-29 09:58:45 +01:00
Martin Regen ced33e1957 Improvements for cloud based Gds and V1.04 nodes (#508)
- all changes for cloud based GDS
 - build version of .net standard libs is now set in version.props, it may require updates for the official builds.
  - add new stuff for v1.04 nodeset, e.g. QueryApplications Api
  - gds.client/gds.server common dll changes to support a cloud based GDS.
2018-07-31 13:32:21 +02:00
Martin Regen 23f0e3abd7 add App Uri to csr / test app uri in signing request. Use domain names in signing request. 2018-02-28 11:49:37 +01:00
Martin Regen 75d8b2ca3c Fix .Net 4.6 Https client and server (#359)
- best possible fix for #189 to reenable https servers 
- `UA Sample Client` and `UA Sample Server` expose https server. libuv.dll is by default for x64. Change 
```
<PropertyGroup>
   <RuntimeIdentifier>win7-x64</RuntimeIdentifier>
   <BaseNuGetRuntimeIdentifier>win7-x64</BaseNuGetRuntimeIdentifier>
</PropertyGroup>
```
to win7-x86 if required.
- fix exception in https client when setting the Timeout
- fix travis build script for linux. kestrel server on ubuntu doesn't respond on ipv6Any ipaddress.
- fix a timing problem in the travis script.
2018-02-20 11:27:00 +01:00
Martin Regen dbef06aa82 Fix ip address parser, domain name check and reconnect (#333)
* bug fix in cert parser: return normalized ipaddress string instead of hex byte array string
* connect with domain cert check,
* fix ip address compares,
* add dialog to connect anyway if cert domain check fails
* fix reconnect case when cert domain check fails
2018-01-25 08:55:26 -07:00
Martin Regen 9f8affb05f Determine RSA dispose at runtime 2018-01-09 15:38:38 +01:00
Martin Regen 1f444a5186 Revert "keep readable store open"
This reverts commit 217f03099b.
2018-01-09 13:58:32 +01:00
Martin Regen 6c417322ea Merge remote-tracking branch 'origin/master' into mono 2018-01-09 13:36:29 +01:00
Martin Regen 390b481ea9 fix from stefano to pass cert creation 2017-12-22 13:54:32 +01:00
Martin Regen 217f03099b keep readable store open 2017-12-22 10:58:54 +01:00
Martin Regen 83365f3c05 return copy of enumeration, or mono may dispose Certificates 2017-12-21 16:42:50 +01:00
Martin Regen 806df6127d fix build 2017-12-21 15:58:07 +01:00
Martin Regen 032bc6ade7 remove all dispose from RSA objects to work around mono bug 2017-12-21 15:41:46 +01:00
Martin Regen 2e4d719a19 Revert "do not dispose keys on mono"
This reverts commit bdac9fa356.
2017-12-21 13:20:53 +01:00
Martin Regen 8e89b941ed Revert "missed a few usings..."
This reverts commit 4720125a37.
2017-12-21 13:20:43 +01:00
Martin Regen 4720125a37 missed a few usings... 2017-12-20 22:24:59 +01:00
Martin Regen bdac9fa356 do not dispose keys on mono 2017-12-20 16:35:25 +01:00
Martin Regen 256ac8e5bd False existing cert might be loaded if only subject is given in Application Configuration. Test the full CN= distiguished name entry to ensure the subjectname of the cert matches. 2017-12-13 12:22:00 +01:00
Martin Regen 4345640c03 Fix CR feedback & travis macOS build fix (#36)
* improve gds creation test, verifiy integrity of returned certs

* split test runs to avoid file handle problem on macOS

* cr feedback
2017-12-08 22:55:27 +01:00
Martin Regen eeec2a8389 Update cert without restarting the TCP listener 2017-12-07 12:05:31 +01:00
Martin Regen 9926e40be8 my own CR feedback 2017-12-06 16:55:43 +01:00