mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-21 09:06:37 +08:00
romanett
9b034f8291
# Description Nullable reference types are now enabled once, in `common.props`, and every project in the repository builds warning-clean with them. **Configuration** - `<Nullable>enable</Nullable>` lives in `common.props`. All per-project `<Nullable>` settings are removed: 178 project files (enable, annotations, and the `disable` in the three Aot test projects). - 419 per-file `#nullable enable`/`restore` directives and the 4 `#nullable disable` directives are removed. - Kept on purpose: - The 5 `<auto-generated>` schema files (`UANodeSet.cs`, `UA Type Dictionary.cs`, `OPCBinarySchema.cs`, `SecuredApplication.cs`, `PInvokeHelper.cs`) keep `#nullable enable`. The compiler ignores the project setting in generated code, so the directive is required there. - `tests/Opc.Ua.Interop.LegacyPeer` keeps `disable`. It builds against the 1.5.378 packages and does not import the repository props. - `docs/DeveloperGuide.md` and `.github/copilot-instructions.md` now describe the central setting. **Migration** (the 43 unset and 13 annotations-only projects, roughly 10k diagnostics) - **Production code: annotated at the declarations.** Covers `tools/Opc.Ua.SourceGeneration.Core`, `src/Opc.Ua.Lds.Server` and the LDS sample. - Members, parameters and returns are nullable where null actually flows. - Null-check helpers carry `[NotNullWhen]` (`IsNull`, `IsValidXmlName`, `IsMethodTypeDesign`). - `CoreUtils.Format`, `Utils.Format`, `ITemplateWriter.WriteLine` take `params object?[]`. `Template.AddReplacement` takes `string?` (rendering already skips null replacements). - `IRegisteredServerStore.RegisterAsync` returns `Task<RegistrationEntry?>`: it returns null when a registration is removed. - Dereferences backed by an invariant (for example, the validated model) use `!`, so runtime behaviour is unchanged. - **Behavioural changes in production code** (small, deliberate): - `NodeSetToModelDesign` throws `InvalidOperationException` when the file is not a NodeSet. Before, it threw a NullReferenceException on the next line. - `ModelDesignValidator` starts its lookup tables empty instead of null. A redundant `if (m_nodes == null) return;` guard is gone. - **Test code: minimal annotations.** - `?` on values that can be null, `!` where the test asserts non-null. - `= null!` for fixture members assigned in SetUp. - `TryGetStructure<T>(out T? x)` where the inferred `T?` broke the `IEncodeable` constraint. - A few redundant `== null` checks on structs (`NodeId`, `ArrayOf<T>`) folded into the adjacent `IsNull`/`Count` checks. **Notes for reviewers** - The diff is large (~1,500 files) but almost entirely mechanical: `?`, `!` and directive removal. The non-annotation changes are listed above. - Known follow-up, not done here: `IModelDesign.Namespaces/TargetNamespace/NamespaceUris` stay non-nullable even though the validator returns null before it loads a dictionary. Making them nullable would ripple through every generator call site. ## Related Issues - Fixes #4439 ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. The "no new warnings" box covers net10.0 and net48: full non-incremental builds of `UA.slnx`, `tools/SourceGeneration.slnx`, `tools/MigrationAnalyzer.slnx` and the Aot test projects finished with 0 warnings and 0 errors under the repository's warnings-as-errors settings. net9.0 and net8.0 also had no nullable diagnostics, but they were not rebuilt after the final fixes. Tests have not been run locally yet. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
945 lines
33 KiB
C#
945 lines
33 KiB
C#
/* ========================================================================
|
|
* Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
|
|
*
|
|
* OPC Foundation MIT License 1.00
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person
|
|
* obtaining a copy of this software and associated documentation
|
|
* files (the "Software"), to deal in the Software without
|
|
* restriction, including without limitation the rights to use,
|
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the
|
|
* Software is furnished to do so, subject to the following
|
|
* conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be
|
|
* included in all copies or substantial portions of the Software.
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
|
|
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
|
|
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
|
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
|
* OTHER DEALINGS IN THE SOFTWARE.
|
|
*
|
|
* The complete license agreement can be found here:
|
|
* http://opcfoundation.org/License/MIT/1.00/
|
|
* ======================================================================*/
|
|
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Security.Cryptography;
|
|
using System.Security.Cryptography.X509Certificates;
|
|
using System.Threading;
|
|
using System.Threading.Tasks;
|
|
using NUnit.Framework;
|
|
using Opc.Ua.Client;
|
|
using Opc.Ua.Client.TestFramework;
|
|
|
|
namespace Opc.Ua.Core.Security.Tests
|
|
{
|
|
/// <summary>
|
|
/// compliance depth tests for certificate validation, nonce
|
|
/// behaviour, security policy coverage, session context, and
|
|
/// connection edge cases.
|
|
/// </summary>
|
|
[TestFixture]
|
|
[Category("Conformance")]
|
|
[Category("SecurityCertValidation")]
|
|
public class SecurityCertValidationDepthTests : TestFixture
|
|
{
|
|
[Test]
|
|
public async Task CertErrorExpiredIsIgnoredAsync()
|
|
{
|
|
await GetEpsAsync().ConfigureAwait(false);
|
|
Assert.Ignore(
|
|
"Cannot force an expired certificate on the test server.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertErrorNotYetValidIsIgnoredAsync()
|
|
{
|
|
await GetEpsAsync().ConfigureAwait(false);
|
|
Assert.Ignore(
|
|
"Cannot force a not-yet-valid certificate on the test server.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertErrorHostnameMismatchIsIgnoredAsync()
|
|
{
|
|
await GetEpsAsync().ConfigureAwait(false);
|
|
Assert.Ignore(
|
|
"Cannot force a hostname-mismatch certificate on the test server.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertErrorUriMismatchIsIgnoredAsync()
|
|
{
|
|
await GetEpsAsync().ConfigureAwait(false);
|
|
Assert.Ignore(
|
|
"Cannot force a URI-mismatch certificate on the test server.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertErrorUntrustedIsIgnoredAsync()
|
|
{
|
|
await GetEpsAsync().ConfigureAwait(false);
|
|
Assert.Ignore(
|
|
"Cannot force an untrusted certificate on the test server.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertErrorRevokedIsIgnoredAsync()
|
|
{
|
|
await GetEpsAsync().ConfigureAwait(false);
|
|
Assert.Ignore(
|
|
"Cannot force a revoked certificate on the test server.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertErrorKeyTooShortIsIgnoredAsync()
|
|
{
|
|
await GetEpsAsync().ConfigureAwait(false);
|
|
Assert.Ignore(
|
|
"Cannot force a short-key certificate on the test server.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task SelfSignedCertificateIsAcceptedAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
bool selfSigned = cert!.Subject == cert.Issuer;
|
|
Assert.That(
|
|
selfSigned || !string.IsNullOrEmpty(cert.Issuer), Is.True,
|
|
"Certificate is self-signed or has a valid issuer.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertHasNonEmptyCommonNameAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
Assert.That(cert!.GetNameInfo(X509NameType.SimpleName, false),
|
|
Is.Not.Null.And.Not.Empty,
|
|
"Certificate CN must not be empty.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertSerialNumberIsNonEmptyAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
Assert.That(cert!.SerialNumber, Is.Not.Null.And.Not.Empty,
|
|
"Certificate serial number must not be empty.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertSignatureAlgorithmIsSha256OrBetterAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
string oid = cert!.SignatureAlgorithm.Value!;
|
|
// SHA256withRSA = 1.2.840.113549.1.1.11
|
|
// SHA384withRSA = 1.2.840.113549.1.1.12
|
|
// SHA512withRSA = 1.2.840.113549.1.1.13
|
|
// ECDSA-SHA256 = 1.2.840.10045.4.3.2
|
|
// ECDSA-SHA384 = 1.2.840.10045.4.3.3
|
|
var allowed = new HashSet<string>
|
|
{
|
|
"1.2.840.113549.1.1.11",
|
|
"1.2.840.113549.1.1.12",
|
|
"1.2.840.113549.1.1.13",
|
|
"1.2.840.10045.4.3.2",
|
|
"1.2.840.10045.4.3.3"
|
|
};
|
|
Assert.That(allowed, Does.Contain(oid),
|
|
$"Signature algorithm OID {oid} should be SHA-256 or better.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertBasicConstraintsIsNotCaAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
foreach (X509Extension ext in cert!.Extensions)
|
|
{
|
|
if (ext is X509BasicConstraintsExtension bc)
|
|
{
|
|
Assert.That(bc.CertificateAuthority, Is.False,
|
|
"End-entity cert must not be a CA.");
|
|
return;
|
|
}
|
|
}
|
|
|
|
// No basic constraints extension is acceptable for an end-entity cert
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertBasicConstraintsPathLengthIsZeroOrAbsentAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
foreach (X509Extension ext in cert!.Extensions)
|
|
{
|
|
if (ext is X509BasicConstraintsExtension bc && bc.HasPathLengthConstraint)
|
|
{
|
|
Assert.That(bc.PathLengthConstraint, Is.Zero,
|
|
"Path length constraint should be 0 for end-entity.");
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertIssuerEqualsSubjectForSelfSignedAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
if (cert!.Subject != cert.Issuer)
|
|
{
|
|
Assert.Fail("Certificate is not self-signed.");
|
|
}
|
|
|
|
Assert.That(cert.Issuer, Is.EqualTo(cert.Subject));
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertThumbprintIsNonEmptyAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
Assert.That(cert!.Thumbprint, Is.Not.Null.And.Not.Empty,
|
|
"Certificate thumbprint must not be empty.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertHasRsaPublicKeyAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
using RSA? rsa = cert!.GetRSAPublicKey();
|
|
if (rsa == null)
|
|
{
|
|
Assert.Fail("Certificate does not use RSA.");
|
|
}
|
|
|
|
Assert.That(rsa!.KeySize, Is.GreaterThanOrEqualTo(2048));
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertPublicKeyIsAccessibleAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
byte[] pubKey = cert!.GetPublicKey();
|
|
Assert.That(pubKey, Is.Not.Null);
|
|
Assert.That(pubKey, Is.Not.Empty,
|
|
"Public key bytes must not be empty.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertValiditySpanIsPositiveAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
TimeSpan span = cert!.NotAfter - cert.NotBefore;
|
|
Assert.That(span.TotalDays, Is.GreaterThan(0),
|
|
"Certificate validity span must be positive.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task CertKeyUsageFlagsArePresentAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
foreach (X509Extension ext in cert!.Extensions)
|
|
{
|
|
if (ext is X509KeyUsageExtension ku)
|
|
{
|
|
Assert.That(
|
|
(int)ku.KeyUsages, Is.Not.Zero,
|
|
"Key usage flags must not be empty.");
|
|
return;
|
|
}
|
|
}
|
|
|
|
Assert.Fail("Certificate does not have KeyUsage extension.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task EndpointCertThumbprintMatchesParsedCertAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
foreach (EndpointDescription ep in eps)
|
|
{
|
|
if (ep.SecurityMode == MessageSecurityMode.None ||
|
|
ep.ServerCertificate.IsEmpty)
|
|
{
|
|
continue;
|
|
}
|
|
|
|
using X509Certificate2 cert = X509CertificateLoader.LoadCertificate(
|
|
ep.ServerCertificate.ToArray());
|
|
Assert.That(cert.Thumbprint, Is.Not.Null.And.Not.Empty);
|
|
return;
|
|
}
|
|
|
|
Assert.Fail("No secure endpoint found.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task EndpointCertByteRoundtripAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
foreach (EndpointDescription ep in eps)
|
|
{
|
|
if (ep.SecurityMode == MessageSecurityMode.None ||
|
|
ep.ServerCertificate.IsEmpty)
|
|
{
|
|
continue;
|
|
}
|
|
|
|
byte[] raw = ep.ServerCertificate.ToArray();
|
|
using X509Certificate2 cert = X509CertificateLoader.LoadCertificate(raw);
|
|
byte[] exported = cert.RawData;
|
|
Assert.That(exported, Is.EqualTo(raw),
|
|
"Certificate bytes should round-trip.");
|
|
return;
|
|
}
|
|
|
|
Assert.Fail("No secure endpoint found.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task AllSecurePoliciesHaveEndpointsAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
var policies = new HashSet<string>();
|
|
foreach (EndpointDescription ep in eps)
|
|
{
|
|
if (ep.SecurityMode != MessageSecurityMode.None)
|
|
{
|
|
policies.Add(ep.SecurityPolicyUri!);
|
|
}
|
|
}
|
|
|
|
Assert.That(policies, Is.Not.Empty,
|
|
"At least one secure policy should be advertised.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task NoneEndpointHasNoRequiredCertAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription noneEp = FindEp(
|
|
eps, MessageSecurityMode.None);
|
|
if (noneEp == null)
|
|
{
|
|
Assert.Fail("No None endpoint available.");
|
|
}
|
|
|
|
Assert.That(
|
|
noneEp!.ServerCertificate.IsEmpty ||
|
|
noneEp.ServerCertificate.Length > 0,
|
|
Is.True,
|
|
"None endpoint may or may not have a certificate.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task SecureEndpointCertIsPemExportableAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
using X509Certificate2 cert = GetSecureCert(eps);
|
|
if (cert == null)
|
|
{
|
|
Assert.Fail("No secure endpoint with certificate found.");
|
|
}
|
|
|
|
byte[] raw = cert!.RawData;
|
|
Assert.That(raw, Is.Not.Null);
|
|
Assert.That(raw, Is.Not.Empty,
|
|
"Certificate raw data should be exportable.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task NonceIsValidOnSignAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription ep = FindEp(
|
|
eps, MessageSecurityMode.Sign);
|
|
if (ep == null)
|
|
{
|
|
Assert.Fail("No Sign endpoint available.");
|
|
}
|
|
|
|
// Session creation validates a 32-byte nonce internally.
|
|
// A successful connection confirms compliance.
|
|
ISession session = await ConnectToPolicyAsync(
|
|
ep!.SecurityPolicyUri!).ConfigureAwait(false);
|
|
try
|
|
{
|
|
Assert.That(session.Connected, Is.True,
|
|
"Secure Sign session implies valid 32-byte nonce.");
|
|
}
|
|
finally
|
|
{
|
|
await session.CloseAsync(5000, true).ConfigureAwait(false);
|
|
session.Dispose();
|
|
}
|
|
}
|
|
|
|
[Test]
|
|
public async Task NonceIsValidOnSignAndEncryptAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription ep = FindEp(
|
|
eps, MessageSecurityMode.SignAndEncrypt);
|
|
if (ep == null)
|
|
{
|
|
Assert.Fail("No SignAndEncrypt endpoint available.");
|
|
}
|
|
|
|
ISession session = await ConnectToPolicyAsync(
|
|
ep!.SecurityPolicyUri!).ConfigureAwait(false);
|
|
try
|
|
{
|
|
Assert.That(session.Connected, Is.True,
|
|
"Secure S&E session implies valid 32-byte nonce.");
|
|
}
|
|
finally
|
|
{
|
|
await session.CloseAsync(5000, true).ConfigureAwait(false);
|
|
session.Dispose();
|
|
}
|
|
}
|
|
|
|
[Test]
|
|
public async Task NoncesAreUniqueAcrossFiveSessionsAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription ep = FindEp(
|
|
eps, MessageSecurityMode.Sign)
|
|
?? FindEp(eps, MessageSecurityMode.SignAndEncrypt);
|
|
if (ep == null)
|
|
{
|
|
Assert.Fail("No secure endpoint available.");
|
|
}
|
|
|
|
// Session creation validates nonce uniqueness internally.
|
|
// Creating 5 separate sessions confirms the server generates
|
|
// distinct nonces each time.
|
|
var sessionIds = new HashSet<NodeId>();
|
|
for (int i = 0; i < 5; i++)
|
|
{
|
|
ISession session = await ConnectToPolicyAsync(
|
|
ep!.SecurityPolicyUri!).ConfigureAwait(false);
|
|
try
|
|
{
|
|
sessionIds.Add(session.SessionId);
|
|
}
|
|
finally
|
|
{
|
|
await session.CloseAsync(5000, true)
|
|
.ConfigureAwait(false);
|
|
session.Dispose();
|
|
}
|
|
}
|
|
|
|
Assert.That(sessionIds, Has.Count.EqualTo(5),
|
|
"All 5 sessions should have unique IDs, confirming " +
|
|
"distinct nonces.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task NonceIsNotAllZerosOnSecureSessionAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription ep = FindEp(
|
|
eps, MessageSecurityMode.Sign)
|
|
?? FindEp(eps, MessageSecurityMode.SignAndEncrypt);
|
|
if (ep == null)
|
|
{
|
|
Assert.Fail("No secure endpoint available.");
|
|
}
|
|
|
|
// The Session class rejects all-zero nonces internally.
|
|
// A successful connection proves the nonce is non-trivial.
|
|
ISession session = await ConnectToPolicyAsync(
|
|
ep!.SecurityPolicyUri!).ConfigureAwait(false);
|
|
try
|
|
{
|
|
Assert.That(session.Connected, Is.True,
|
|
"Successful secure session implies non-zero nonce.");
|
|
}
|
|
finally
|
|
{
|
|
await session.CloseAsync(5000, true).ConfigureAwait(false);
|
|
session.Dispose();
|
|
}
|
|
}
|
|
|
|
[Test]
|
|
public async Task NoneEndpointNonceMayBeEmptyAsync()
|
|
{
|
|
await Task.CompletedTask.ConfigureAwait(false);
|
|
Assert.That(Session.Connected, Is.True);
|
|
// None-security session does not require a nonce
|
|
Assert.That(Session.Endpoint.SecurityMode,
|
|
Is.EqualTo(MessageSecurityMode.None),
|
|
"Baseline session uses None security.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task Basic256Sha256PolicyExistsAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription ep = FindEp(
|
|
eps, MessageSecurityMode.Sign,
|
|
SecurityPolicies.Basic256Sha256)
|
|
?? FindEp(eps, MessageSecurityMode.SignAndEncrypt,
|
|
SecurityPolicies.Basic256Sha256);
|
|
|
|
Assert.That(ep, Is.Not.Null,
|
|
"Basic256Sha256 policy should be available.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task Aes128Sha256RsaOaepPolicyExistsOrFailAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription ep = FindEp(
|
|
eps, MessageSecurityMode.Sign,
|
|
SecurityPolicies.Aes128_Sha256_RsaOaep)
|
|
?? FindEp(eps, MessageSecurityMode.SignAndEncrypt,
|
|
SecurityPolicies.Aes128_Sha256_RsaOaep);
|
|
|
|
if (ep == null)
|
|
{
|
|
Assert.Fail(
|
|
"Aes128_Sha256_RsaOaep policy not available.");
|
|
}
|
|
|
|
Assert.That(ep!.SecurityPolicyUri,
|
|
Is.EqualTo(SecurityPolicies.Aes128_Sha256_RsaOaep));
|
|
}
|
|
|
|
[Test]
|
|
public async Task Aes256Sha256RsaPssPolicyExistsOrFailAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription ep = FindEp(
|
|
eps, MessageSecurityMode.Sign,
|
|
SecurityPolicies.Aes256_Sha256_RsaPss)
|
|
?? FindEp(eps, MessageSecurityMode.SignAndEncrypt,
|
|
SecurityPolicies.Aes256_Sha256_RsaPss);
|
|
|
|
if (ep == null)
|
|
{
|
|
Assert.Fail(
|
|
"Aes256_Sha256_RsaPss policy not available.");
|
|
}
|
|
|
|
Assert.That(ep!.SecurityPolicyUri,
|
|
Is.EqualTo(SecurityPolicies.Aes256_Sha256_RsaPss));
|
|
}
|
|
|
|
[Test]
|
|
public async Task NonePolicyExistsAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription ep = FindEp(
|
|
eps, MessageSecurityMode.None);
|
|
Assert.That(ep, Is.Not.Null,
|
|
"None security policy endpoint should exist.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task NoneSecurityLevelIsZeroAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription ep = FindEp(
|
|
eps, MessageSecurityMode.None);
|
|
if (ep == null)
|
|
{
|
|
Assert.Fail("No None endpoint available.");
|
|
}
|
|
|
|
Assert.That(ep!.SecurityLevel, Is.Zero,
|
|
"None endpoint security level should be 0.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task SecureEndpointSecurityLevelIsPositiveAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
foreach (EndpointDescription ep in eps)
|
|
{
|
|
if (ep.SecurityMode != MessageSecurityMode.None)
|
|
{
|
|
Assert.That(ep.SecurityLevel, Is.GreaterThan((byte)0),
|
|
"Secure endpoint security level should be positive.");
|
|
return;
|
|
}
|
|
}
|
|
|
|
Assert.Fail("No secure endpoint available.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task SecureEndpointUrlIsNotEmptyAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
foreach (EndpointDescription ep in eps)
|
|
{
|
|
if (ep.SecurityMode != MessageSecurityMode.None)
|
|
{
|
|
Assert.That(ep.EndpointUrl,
|
|
Is.Not.Null.And.Not.Empty,
|
|
"Secure endpoint URL must not be empty.");
|
|
return;
|
|
}
|
|
}
|
|
|
|
Assert.Fail("No secure endpoint available.");
|
|
}
|
|
|
|
[Test]
|
|
public async Task AllEndpointUrlsAreNotEmptyAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
foreach (EndpointDescription ep in eps)
|
|
{
|
|
Assert.That(ep.EndpointUrl,
|
|
Is.Not.Null.And.Not.Empty,
|
|
$"Endpoint URL for {ep.SecurityPolicyUri} must not be empty.");
|
|
}
|
|
}
|
|
|
|
[Test]
|
|
public Task SessionEndpointMatchesConnected()
|
|
{
|
|
Assert.That(Session.Connected, Is.True);
|
|
Assert.That(Session.Endpoint, Is.Not.Null);
|
|
Assert.That(Session.Endpoint.EndpointUrl,
|
|
Is.Not.Null.And.Not.Empty);
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
[Test]
|
|
public Task SessionSecurityModeIsNone()
|
|
{
|
|
Assert.That(Session.Connected, Is.True);
|
|
Assert.That(Session.Endpoint.SecurityMode,
|
|
Is.EqualTo(MessageSecurityMode.None));
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
[Test]
|
|
public Task SessionIdentityIsNotNull()
|
|
{
|
|
Assert.That(Session.Connected, Is.True);
|
|
Assert.That(Session.Identity, Is.Not.Null,
|
|
"Session identity must not be null.");
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
[Test]
|
|
public Task SessionTimeoutIsPositive()
|
|
{
|
|
Assert.That(Session.Connected, Is.True);
|
|
Assert.That(Session.SessionTimeout,
|
|
Is.GreaterThan(0),
|
|
"Session timeout must be positive.");
|
|
return Task.CompletedTask;
|
|
}
|
|
|
|
[Test]
|
|
public async Task ReconnectYieldsNewSessionIdAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription ep = FindEp(
|
|
eps, MessageSecurityMode.Sign)
|
|
?? FindEp(eps, MessageSecurityMode.SignAndEncrypt);
|
|
if (ep == null)
|
|
{
|
|
Assert.Fail("No secure endpoint available.");
|
|
}
|
|
|
|
ISession s1 = await ConnectToPolicyAsync(
|
|
ep!.SecurityPolicyUri!).ConfigureAwait(false);
|
|
NodeId id1 = s1.SessionId;
|
|
await s1.CloseAsync(5000, true).ConfigureAwait(false);
|
|
s1.Dispose();
|
|
|
|
ISession s2 = await ConnectToPolicyAsync(
|
|
ep.SecurityPolicyUri!).ConfigureAwait(false);
|
|
try
|
|
{
|
|
Assert.That(s2.SessionId, Is.Not.EqualTo(id1),
|
|
"New connection should have a different session ID.");
|
|
}
|
|
finally
|
|
{
|
|
await s2.CloseAsync(5000, true).ConfigureAwait(false);
|
|
s2.Dispose();
|
|
}
|
|
}
|
|
|
|
[Test]
|
|
public async Task InvalidSecurityPolicyFailsAsync()
|
|
{
|
|
try
|
|
{
|
|
ISession session = await ConnectToPolicyAsync(
|
|
"http://opcfoundation.org/UA/SecurityPolicy#Invalid")
|
|
.ConfigureAwait(false);
|
|
await session.CloseAsync(5000, true).ConfigureAwait(false);
|
|
session.Dispose();
|
|
Assert.Fail("Connection with invalid security policy " +
|
|
"should have thrown.");
|
|
}
|
|
catch (ServiceResultException)
|
|
{
|
|
// Expected
|
|
}
|
|
catch (IgnoreException)
|
|
{
|
|
// Endpoint not available for invalid policy
|
|
Assert.Ignore("Invalid security policy endpoint not " +
|
|
"offered by server.");
|
|
}
|
|
}
|
|
|
|
[Test]
|
|
public async Task SecureConnectionCanReadServerStatusAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription ep = FindEp(
|
|
eps, MessageSecurityMode.Sign)
|
|
?? FindEp(eps, MessageSecurityMode.SignAndEncrypt);
|
|
if (ep == null)
|
|
{
|
|
Assert.Fail("No secure endpoint available.");
|
|
}
|
|
|
|
ISession session = await ConnectToPolicyAsync(
|
|
ep!.SecurityPolicyUri!).ConfigureAwait(false);
|
|
try
|
|
{
|
|
ReadResponse response = await session.ReadAsync(
|
|
null, 0, TimestampsToReturn.Both,
|
|
new ReadValueId[]
|
|
{
|
|
new() {
|
|
NodeId = VariableIds.Server_ServerStatus_State,
|
|
AttributeId = Attributes.Value
|
|
}
|
|
}.ToArrayOf(),
|
|
CancellationToken.None).ConfigureAwait(false);
|
|
|
|
Assert.That(response.Results.Count, Is.EqualTo(1));
|
|
Assert.That(
|
|
StatusCode.IsGood(response.Results[0].StatusCode),
|
|
Is.True);
|
|
}
|
|
finally
|
|
{
|
|
await session.CloseAsync(5000, true).ConfigureAwait(false);
|
|
session.Dispose();
|
|
}
|
|
}
|
|
|
|
[Test]
|
|
public async Task CrossModeSessionIdsAreDifferentAsync()
|
|
{
|
|
ArrayOf<EndpointDescription> eps = await GetEpsAsync().ConfigureAwait(false);
|
|
EndpointDescription signEp = FindEp(
|
|
eps, MessageSecurityMode.Sign);
|
|
EndpointDescription encryptEp = FindEp(
|
|
eps, MessageSecurityMode.SignAndEncrypt);
|
|
|
|
if (signEp == null || encryptEp == null)
|
|
{
|
|
Assert.Fail(
|
|
"Both Sign and SignAndEncrypt endpoints are required.");
|
|
}
|
|
|
|
ISession s1 = await ConnectToPolicyAsync(
|
|
signEp!.SecurityPolicyUri!).ConfigureAwait(false);
|
|
ISession s2 = await ConnectToPolicyAsync(
|
|
encryptEp!.SecurityPolicyUri!).ConfigureAwait(false);
|
|
try
|
|
{
|
|
Assert.That(s1.SessionId, Is.Not.EqualTo(s2.SessionId),
|
|
"Sessions with different security modes should " +
|
|
"have different IDs.");
|
|
}
|
|
finally
|
|
{
|
|
await s1.CloseAsync(5000, true).ConfigureAwait(false);
|
|
s1.Dispose();
|
|
await s2.CloseAsync(5000, true).ConfigureAwait(false);
|
|
s2.Dispose();
|
|
}
|
|
}
|
|
|
|
private async Task<ArrayOf<EndpointDescription>> GetEpsAsync()
|
|
{
|
|
if (!m_cachedEndpoints.IsEmpty)
|
|
{
|
|
return m_cachedEndpoints;
|
|
}
|
|
|
|
var endpointConfiguration =
|
|
EndpointConfiguration.Create(ClientFixture.Config);
|
|
using DiscoveryClient client = await DiscoveryClient.CreateAsync(
|
|
ServerUrl,
|
|
endpointConfiguration,
|
|
Telemetry,
|
|
ct: CancellationToken.None).ConfigureAwait(false);
|
|
|
|
m_cachedEndpoints = await client.GetEndpointsAsync(
|
|
default, CancellationToken.None).ConfigureAwait(false);
|
|
return m_cachedEndpoints;
|
|
}
|
|
|
|
private static X509Certificate2 GetSecureCert(
|
|
ArrayOf<EndpointDescription> eps)
|
|
{
|
|
// Prefer an RSA-based secure endpoint; the tests in this
|
|
// fixture validate RSA cert properties (key length,
|
|
// GetRSAPublicKey() non-null, etc.). On macOS, ECC endpoints
|
|
// may appear before RSA endpoints in the descriptor list,
|
|
// which would cause the tests to read an ECC cert and fail.
|
|
return FindRsaSecureEndpointCert(eps) ?? FindAnySecureEndpointCert(eps);
|
|
}
|
|
|
|
private static X509Certificate2 FindRsaSecureEndpointCert(
|
|
ArrayOf<EndpointDescription> eps)
|
|
{
|
|
foreach (EndpointDescription ep in eps)
|
|
{
|
|
if (ep.SecurityMode != MessageSecurityMode.None &&
|
|
!ep.ServerCertificate.IsEmpty &&
|
|
!IsEccPolicy(ep.SecurityPolicyUri!))
|
|
{
|
|
return X509CertificateLoader.LoadCertificate(
|
|
ep.ServerCertificate.ToArray());
|
|
}
|
|
}
|
|
return null!;
|
|
}
|
|
|
|
private static X509Certificate2 FindAnySecureEndpointCert(
|
|
ArrayOf<EndpointDescription> eps)
|
|
{
|
|
foreach (EndpointDescription ep in eps)
|
|
{
|
|
if (ep.SecurityMode != MessageSecurityMode.None &&
|
|
!ep.ServerCertificate.IsEmpty)
|
|
{
|
|
return X509CertificateLoader.LoadCertificate(
|
|
ep.ServerCertificate.ToArray());
|
|
}
|
|
}
|
|
|
|
return null!;
|
|
}
|
|
|
|
private static bool IsEccPolicy(string policyUri)
|
|
{
|
|
return !string.IsNullOrEmpty(policyUri) &&
|
|
policyUri.Contains("#ECC_", StringComparison.Ordinal);
|
|
}
|
|
|
|
private EndpointDescription FindEp(
|
|
ArrayOf<EndpointDescription> eps,
|
|
MessageSecurityMode mode,
|
|
string? policy = null)
|
|
{
|
|
foreach (EndpointDescription ep in eps)
|
|
{
|
|
if (ep.SecurityMode == mode)
|
|
{
|
|
if (policy == null || ep.SecurityPolicyUri == policy)
|
|
{
|
|
return ep;
|
|
}
|
|
}
|
|
}
|
|
|
|
return null!;
|
|
}
|
|
|
|
private Task<ISession> ConnectToPolicyAsync(string policyUri)
|
|
{
|
|
return ClientFixture.ConnectAsync(
|
|
ServerUrl, policyUri);
|
|
}
|
|
|
|
private ArrayOf<EndpointDescription> m_cachedEndpoints;
|
|
}
|
|
}
|