Fix cases where a cancellable WaitAsync(ct) on a SemaphoreSlim within a try/finally could end up in a deadlock.
Fix: The WaitAsync must be outside the try/finally block. if the WaitAsync is cancelled, it should not release the semaphore
Since some distributions stop to trust SHA1 signatures by default, replace some internal algorithm checks with SHA256 versions.
The test case to force signature check also reenables ECC tests for .NET 4.8 which had been previously disabled.
- Add a property to `ApplicationInstance` to `DisableCertificateAutoCreation`
- Add the test case to validate property function
- Refactor some private API to follow coding style with `Async`suffix
- By default behavior is unchanged
- Improvements when many sessions need to be opened
- Introduce a OpenAsync version which usesmore async calls for session creation
- add async interfaces to cert validator
- refactor lock of encodeable factory
- add a `EndAsync` property to WriteRequest to allow to await a service call
- add a `EndSendRequestAsync` method to allow implementation of awaitable service calls
- With the `sequentialPublishing` flag enabled, no data is received after transfer. Fix: add a resync flag to update the last sequence counter after transfer.
- Instead of the semaphore slim use a dedicated Task per subscription. The task is using `AsyncAutoResetEvent` to be task friendly, becasue every subscription gets a worker task.
- Add more tests for the use case republish with delayed ack.
- Add a test and a missing method to support reconnect of a session on a different secure channel without reconnect handler.
In some use cases (e.g. Kubernetes secrets) it would be beneficial to store the certificates, private keys, crl etc. in a flat directory instead of having a root which contains a hierarchy with certs/crl/private etc.
- Modify the `DirectoryCertificateStore` to allow it to use a flat structure by adding a special constructor.
- Add the configuration builder functions to allow to specify custom certificate stores for app/user/https.
- Add a test sample which shows how to use the 'flat store' with a custom cert store wrapper.
- By default, behavior of `DirectoryCertificateStore` is unchanged. Needs an external wrapper to expose the flat mode.
- ICloneable was removed from generated code for the first port to .NET Standard 1.x, instead MemberwiseClone was used
- Reenable ICloneable for generated code
- Add ICloneable to built in types
- Fix code where MemberwiseClone is called instead of Clone
- Problem to be solved: Currently using dictionaries of NodeId or ExpandedNodeId may not work correctly due to the homebrew hash code generation, which may cause false duplicates.
- Use the HashCode library to calculate the hashcodes for some BuiltInTypes, mostly NodeId/ExpandedNodeId.
- Fix an issue with csproj where VS 2019 did not show errors
- Update copyright year
- After discussion default SendCertChain to true
- Bring back part of the code which was removed by Modelcompiler to fix the BuildStatus variable
- Fix the GDS Server Push, which does not fully update the server descriptions with a chain, if sendcertchain is selected
- fix issue in macOS, when cert chains are used the X509Certificate2 constructor throws exception
- Missing await on async call to write cert to rejected store. Found with analyzer `Microsoft.VisualStudio.Threading.Analyzers`
- Simplify the write by not deleting certificate with the same thumbprint, just override.
- Accidently writing a private key is not possible anymore, the cert stores are now flagged with noprivatekey support. Remove special handling.
.NET7 introduces a X509AuthorityKeyIdentifierExtension datatype which causes some ambigous datatype build errors.
Tested on .NET7 rc2
Note: Targetframework as .NET7 has not been added yet. Fix just the build if somebody tries.
Currently, the validated certificates are stored in a dictionary for fast compare of the certificate validation when an application reconnects, until manually cleared by e.g. `ResetValidatedCertificates()`. After discussion it was decided to make this function an opt-in feature to avoid use cases where changes in the trusted store or CRL are not reflected in the list of validated certificates.
The runtime penalty of a full check can be avoided if needed with the 'Opt-In' by configuration or by application setting the property. After opt-in it is the application responsibility to clear the list of validated certificates if needed.
+++ Other cert validator improvements/fixes
- Setting the `ValidationOptions.SuppressRevocationStatusUnknown` on a trustlist (e.g. issuer) was ignored
- If another client/server connects with a chain, the whole chain is saved to the rejected store, not only the leaf certificate.
* change the Certificate domain validation to work also for the server case
* do not refuse a connection if the check fails, only trigger the audit event
* bump up test Nuget
-Make the https callbacks fully async / code cleanup.
-Default https client to use MaxConnectionsToServer = 64 for #1550
-Fix https missing reconnect error code
other fixes unrelated to https:
- move trust list audit event to AuditEvents.cs, fix issue that the event is not filtered since reportAuditEvent cannot be used
- fix an issue when BrowseNext for multiple continuation tokens doesn't add the results array properly
- bump up .NET Core 3.1 Nuget dependencies
- improve .NET reference client app for use with https
* Add new methods for reading a set of nodes
* ReadNodes(NodeIdCollection, out DataValueCollection, out IList<ServiceResult>, bool optionalAttributes)
* (DataValueCollection, IList<ServiceResult>) ReadNodesAsync (NodeIdCollection, bool optionalAttributes)
to reduce the amount of attributes read from a server ReadNodes first reads only the NodeClass, then reads only the mandatory attributes per nodeclass to reduce the overall number of attributes to read.
If the NodeClass of all nodes is already known, the read can be further optimized to read only the attributes for a known class:
* ReadNodes(NodeIdCollection, NodeClass, out DataValueCollection, out IList<ServiceResult>, bool optionalAttributes)
* (DataValueCollection, IList<ServiceResult>) ReadNodesAsync (NodeIdCollection, NodeClass, bool optionalAttributes)
to complete async and collection operation, there is a:
* ReadNodeAsync and
* ReadValues/ReadValuesAsync
* An issue was fixed in the https async codepath, the security header was not properly set in async operation
sidenote: operation limits must be handled by caller!
Co-authored-by: Martin Regen <mregen@microsoft.com>
-Added a loader if no PFX private key exists, the PEM private key is loaded.
-Added the support in certificate validator for custom application error messages.
- Certificates should compare X500DistinguishedName with binary ASN.1 compare
- Other compares should follow ordinal and not resort DN entries
- Fix all related issues to pass tests, e.g. GDS certificates accepted with reversed Subject, cert validation
- Add defensive checks in cert validation
Co-authored-by: mrsuciu <Mircea-Adrian.Suciu@softing.com>
Headers incorrectly state that the RCL applies to members, however the OPC Source Deliverables license states RCL is applicable only to corporate members.
The OPC Foundation Technical Control Board on March 30th decided on the following changes with regard of the license headers:
• Change the dual license in the source files so that “members” are replaced with “corporate members”.
Co-authored-by: Suciu Mircea Adrian <Mircea-Adrian.Suciu@softing.com>
- Doc, docs, docs updates for new 368 support
- fix a missing null pointer check when ConditionRefresh is run
- Ref server: move NodeManager factory API to StandardServer, decoupling the NodeManager implementation from Ref server
- Ref server: add shadow mode flag, to allow to map a docker configuration in a mapped folder.
- Ref server: sample batch files how to run Github CR and local docker images
- Improve some misleading 'delete application certificate' log messages.
- integrate 'LoadPrivateKey' in the interface to allow to implement cert stores which require a passcode to load/store certificates
Change of behavior:
- Introduce a 'NoPrivateKeys' flag to reduce the risk of leaking a private key to a unsecure store.
- CertificateStoreIdentifier opens 'NoPrivateKey' stores
- CertificateTrustList opens 'NoPrivateKey' stores
- CertificateIdentifier opens store with private keys for application or GDS authority certificates
- CertificateTrustList reuses a store if it is not disposed. A user can just close the store to keep the list of certificates in memory.
- DirectoryStore `Load` does not read private keys anymore, only file names for delete. Reading all private keys caused false errors, e.g. here: #1670
Co-authored-by: mheege-abb <marcus.heege@de.abb.com>
Co-authored-by: mheege-abb <85437567+mheege-abb@users.noreply.github.com>
- In windows container this non deterministic error can occur:
`[WindowsCryptographicException] The specified network password is not correct.`
even if the private key was saved with empty password.
- Fix: After a delayed retry the private key can be loaded successfully.
- fixes#1670
- see also https://github.com/OPCFoundation/UA-.NETStandard/commit/ae9ecac2be6b2f9ed6c639eb60205896c27791e0 for 367 milestone
The current SDK supports only Windows and Directory certificate stores. For security reasons, it can be necessary to use custom certificate stores.
* Add support for custom certificate stores
* Certificate Store Type UnitTests
* Start cleanup of ICertificateStore interface in the CRL section (Co-authored-by: Martin Regen <mregen@microsoft.com>)
- Adapted getIssuer and getIssuers so that all findings get aggregated for later processing in the validation methods.
- Ensured that other methods calling getIssuer(s) will experience unchanged behavior
- Adapted unit tests
- AuthorityKeyIdentifier in the SubCA contains the SubjectName of the Issuer instead of the IssuerName. Also an application certificate that is signed by a SubCA would contain the false information.
- The false information has no effect on Windows and macOS, however on linux OpenSSL tests all fields and a chain cannot be fully validated.
- For CTT tests a few error codes were return false codes because ServiceResult replaces the error code with the InnerException error.
- Do not allow to ignore PartialChain validation error, it may have different root cause then the error returned by GetIssuer.
- For EventSource and legacy logger refactor logging to support the built in LogValueFormatter, which provides the format strings suitable for `string.Format`.
- **Breaking change**: For `TraceEvent` this is a breaking change, because there is no implementation yet to support to provide the reformatted format string. With this implementation if a logging framework is used which supports the semantic logging, there is no issue. With frameworks which do not understand semantic logging strings(e.g. log4net) it is a breaking change, string.format will throw exceptions --> move to ILogger hook using `SetLogger`.
- **Warning**: When Microsoft.Extensions.Logger based loggers are used, format strings must follow this convention:
i) All variable entries must follow order and count up, e.g. "{0} -- {1}" etc., no mix of "{2}--{0}"
ii) in the same way the args must follow this strict ordering.
- Format strings will be changed by future PR to include the semantic values.
* smaller API changes for .368 and minor cleanup / uncritical bug fixes
* refactor GDS server lib to get rid of UA configuration dependency
* app config builder enhancements to simplify someuse cases
-- add a few default parameter to simplify fluent API
-- Rejected folder doesn't default to pki root
-- if the leaf pki folder is already provided, the default leaf folder is stil added (e.g. becomes own/own)
* certificate validator match were to return true even if no keyId/serial number was checked
* Directory store delete cert add retry if cert is still in use.
* enable reverse connect tests on macOS
* fixes CVE-2020-1045 (High) detected in microsoft.aspnetcore.http.2.1.1.nupkg mregen/UA-.NetStandardLibrary#114
- support for Microsoft.Extensions.Logger.ILogger in Opc.Ua.Core as the new logging interface
- backward compatible with config and TraceEvents
- new API Utils.SetLogger allows to set ILogger
- updated Console samples to demonstrate ILogger support with Serilog
- support for EventSource logging
- see Docs/Logging.md for more info
-fixes for complex types:
- a structure which contains an enum from namespace 0 can not be created. fixes#1561.
- a structure with multidimensional array may lead to a endless loop in `ComplexTypeSystem.Load`
- a malformed namespace Uri which contains a space character prevents creation of type system.
- select endpoint doesn't pick the right scheme if the default endpoint must be picked
-prep for net472 or greater and net5.0 or greater build, only build #ifdef
- do not silent recreate a certificate if a matching cert subject is available, enforce manual deletion or replacement
- allow the application cert to be used when expired or not yet valid
- warn in trace if an app cert is loaded without loading the private key
fixes#1162 , fixes#1102
* Add no file configuration fluent API
* ensure secure settings are produced by default
* most if not all settings can be reached by .Set/.Add functions
* switched gds tests to use no file config (also good as starter)
- if a cert validator is enabled, use it and ignore auto accept flag.
- trace auto accept message, if used
- make all config flags public, otherwise they can only be configured using a SecurityConfiguration. Once a config flag is set using a property, it is protected from modification by a SecurityConfiguration. This way apps can consistently override.
- add tests for the SHA1 and AutoAccept configuration flags
- add a method to reset the validated list of certificates. The list of certs should be revalidated from time to time to catch expired or revoked certificates. Applications can call `ResetValidatedCertificates` to clear the list with a daily timer.
- Use updated Modelcompiler code generator to produce code which has no dependency on System.Servicemodel
- breaking change, .NET stack which used the NET_STANDARD version have to fix dependencies on System.Servicemodel
- new codegenerator also provides stubs for async client API (NET_STANDARD_ASYNC), currently disabled
- latest V1.04.9 Nodeset
- Fix only build and LGTM warnings
- no bug fixes - - oh wait -- found and fixed root cause for flaky builds, forgotten await when add cert to trusted folder
- remove source files from WinForms libraries which are not used in the projects
- added test cases to repro fact
- added code to transfer ephemeral private key to persisted state as suggested by @ChristofferGersen pointing to dotnet/runtime#29144
- fixes#1238
- note: on .NET Standard 2.1 with this change the private keys stored in the windows certificate store are not exportable
Martin Regen