UA-.NETStandard/tests/Opc.Ua.Gds.Tests/GlobalDiscoveryTestClient.cs

/* ========================================================================
 * Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
 *
 * OPC Foundation MIT License 1.00
 *
 * Permission is hereby granted, free of charge, to any person
 * obtaining a copy of this software and associated documentation
 * files (the "Software"), to deal in the Software without
 * restriction, including without limitation the rights to use,
 * copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following
 * conditions:
 *
 * The above copyright notice and this permission notice shall be
 * included in all copies or substantial portions of the Software.
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
 * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
 * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
 * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 * OTHER DEALINGS IN THE SOFTWARE.
 *
 * The complete license agreement can be found here:
 * http://opcfoundation.org/License/MIT/1.00/
 * ======================================================================*/

using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Extensions.Logging;
using Opc.Ua.Configuration;
using Opc.Ua.Gds.Client;
using Opc.Ua.Security.Certificates;

namespace Opc.Ua.Gds.Tests
{
    public sealed class GlobalDiscoveryTestClient : IDisposable
    {
        public GlobalDiscoveryServerClient GDSClient { get; private set; } = null!;
        public string EndpointUrl { get; private set; } = null!;
        public static bool AutoAccept { get; set; }

        public GlobalDiscoveryTestClient(
            bool autoAccept,
            ITelemetryContext telemetry,
            string storeType = CertificateStoreType.Directory)
        {
            m_telemetry = telemetry;
            m_logger = telemetry.CreateLogger<GlobalDiscoveryTestClient>();
            AutoAccept = autoAccept;
            m_storeType = storeType;
        }

        public IUserIdentity AppUser { get; private set; } = null!;
        public IUserIdentity AdminUser { get; private set; } = null!;
        public IUserIdentity Anonymous { get; private set; } = null!;
        public ApplicationTestData OwnApplicationTestData { get; private set; } = null!;
        public ApplicationConfiguration Configuration { get; private set; } = null!;

        public void Dispose()
        {
            GDSClient?.Dispose();
            m_application?.DisposeAsync().AsTask().GetAwaiter().GetResult();
            m_application = null!;
        }

        public async Task LoadClientConfigurationAsync(int port = -1, bool clean = true)
        {
            ApplicationInstance.MessageDlg = new ApplicationMessageDlg(m_logger);

            string configSectionName = "Opc.Ua.GlobalDiscoveryTestClient";
            if (m_storeType == CertificateStoreType.X509Store)
            {
                if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
                {
                    throw new PlatformNotSupportedException(
                        "X509 Store with crls is only supported on Windows");
                }
                configSectionName = "Opc.Ua.GlobalDiscoveryTestClientX509Stores";
            }

            if (m_application != null)
            {
                await m_application.DisposeAsync().ConfigureAwait(false);
                m_application = null!;
            }
            m_application = new ApplicationInstance(m_telemetry)
            {
                ApplicationName = "Global Discovery Client",
                ApplicationType = ApplicationType.Client,
                ConfigSectionName = configSectionName
            };

#if USE_FILE_CONFIG
            // load the application configuration.
            Configuration = await m_application.LoadApplicationConfigurationAsync(false)
                .ConfigureAwait(false);
#else
            string root = Path.Combine(Path.GetTempPath(), "OPC");
            string pkiRoot = Path.Combine(root, "pki");
            var clientConfig = new GlobalDiscoveryTestClientConfiguration
            {
                GlobalDiscoveryServerUrl = "opc.tcp://localhost:58810/GlobalDiscoveryTestServer",
                AppUserName = "appuser",
                AppPassword = "demo",
                AdminUserName = "appadmin",
                AdminPassword = "demo"
            };

            ArrayOf<CertificateIdentifier> applicationCerts =
                ApplicationConfigurationBuilder.CreateDefaultApplicationCertificates(
                    "CN=Global Discovery Test Client, O=OPC Foundation, DC=localhost",
                    CertificateStoreType.Directory,
                    pkiRoot);

            // build the application configuration.
            Configuration = await m_application
                .Build(
                    "urn:localhost:opcfoundation.org:GlobalDiscoveryTestClient",
                    "http://opcfoundation.org/UA/GlobalDiscoveryTestClient")
                .AsClient()
                .SetDefaultSessionTimeout(600000)
                .SetMinSubscriptionLifetime(10000)
                .AddSecurityConfiguration(applicationCerts, pkiRoot)
                .SetAutoAcceptUntrustedCertificates(true)
                .SetRejectSHA1SignedCertificates(false)
                .SetRejectUnknownRevocationStatus(true)
                .SetMinimumCertificateKeySize(1024)
                .AddExtension(null, clientConfig)
                .CreateAsync()
                .ConfigureAwait(false);
#endif

            if (clean)
            {
                string thumbprint = Configuration.SecurityConfiguration.ApplicationCertificate!.Thumbprint!;
                if (thumbprint != null)
                {
                    using ICertificateStore store = CertificateIdentifierResolver
                        .OpenStore(
                            Configuration.SecurityConfiguration.ApplicationCertificate,
                            m_telemetry)!;
                    if (store != null)
                    {
                        await store.DeleteAsync(thumbprint).ConfigureAwait(false);
                    }
                }

                // always start with clean cert store
                await TestUtils
                    .CleanupTrustListAsync(
                        Configuration.SecurityConfiguration.ApplicationCertificate, m_telemetry)
                    .ConfigureAwait(false);
                await TestUtils
                    .CleanupTrustListAsync(
                        Configuration.SecurityConfiguration.TrustedIssuerCertificates, m_telemetry)
                    .ConfigureAwait(false);
                await TestUtils
                    .CleanupTrustListAsync(
                        Configuration.SecurityConfiguration.TrustedPeerCertificates, m_telemetry)
                    .ConfigureAwait(false);
                await TestUtils
                    .CleanupTrustListAsync(
                        Configuration.SecurityConfiguration.RejectedCertificateStore!, m_telemetry)
                    .ConfigureAwait(false);
            }

            // check the application certificate.
            bool haveAppCertificate = await m_application
                .CheckApplicationInstanceCertificatesAsync(true)
                .ConfigureAwait(false);
            if (!haveAppCertificate)
            {
                throw new InvalidOperationException("Application instance certificate invalid!");
            }

            Configuration.CertificateManager.AcceptError = AcceptCertificate;

            GlobalDiscoveryTestClientConfiguration gdsClientConfiguration =
                Configuration.ParseExtension<GlobalDiscoveryTestClientConfiguration>()!;
            GDSClient = new GlobalDiscoveryServerClient(Configuration);
            EndpointUrl = TestUtils.PatchOnlyGDSEndpointUrlPort(
                gdsClientConfiguration!.GlobalDiscoveryServerUrl,
                port);
            await SetEndpointAsync(SecurityPolicies.Aes256_Sha256_RsaPss)
                .ConfigureAwait(false);

            if (string.IsNullOrEmpty(gdsClientConfiguration.AppUserName))
            {
                AppUser = new UserIdentity();
            }
            else
            {
                AppUser = new UserIdentity(
                    gdsClientConfiguration.AppUserName,
                    Encoding.UTF8.GetBytes(gdsClientConfiguration.AppPassword));
            }
            AdminUser = new UserIdentity(
                gdsClientConfiguration.AdminUserName,
                Encoding.UTF8.GetBytes(gdsClientConfiguration.AdminPassword));
            Anonymous = new UserIdentity();
        }

        /// <summary>
        /// Register the Test Client at the used GDS, needed to test the ApplicationSelfAdminPrivilege
        /// </summary>
        public async Task<bool> RegisterTestClientAtGdsAsync()
        {
            try
            {
                OwnApplicationTestData = GetOwnApplicationData();

                GDSClient.AdminCredentials = AdminUser;
                //register
                NodeId id = await RegisterAsync(OwnApplicationTestData).ConfigureAwait(false);
                if (id.IsNull)
                {
                    return false;
                }
                OwnApplicationTestData.ApplicationRecord.ApplicationId = id;
                //start Key Pair Request
                NodeId req_id = await StartNewKeyPairAsync(OwnApplicationTestData).ConfigureAwait(
                    false);
                if (req_id.IsNull)
                {
                    return false;
                }

                OwnApplicationTestData.CertificateRequestId = req_id;
                //Finish KeyPairRequest
                (ByteString certificate, ByteString privateKey) = await FinishKeyPairAsync(
                    OwnApplicationTestData).ConfigureAwait(false);
                if (certificate.IsEmpty || privateKey.IsEmpty)
                {
                    return false;
                }
                //apply cert
                await ApplyNewApplicationInstanceCertificateAsync(certificate, privateKey)
                    .ConfigureAwait(false);
                OwnApplicationTestData.Certificate = certificate.ToArray();
                OwnApplicationTestData.PrivateKey = privateKey.ToArray();
                OwnApplicationTestData.CertificateRequestId = default;
            }
            catch (ArgumentException e)
            {
                m_logger.LogError(e, "RegisterTestClientAtGds at GDS failed");
                return false;
            }

            return true;
        }

        public async Task DisconnectClientAsync()
        {
            m_logger.LogInformation("Disconnect Session. Waiting for exit...");

            if (GDSClient != null)
            {
                GlobalDiscoveryServerClient gdsClient = GDSClient;
                GDSClient = null!;
                try
                {
                    await gdsClient.DisconnectAsync().ConfigureAwait(false);
                }
                finally
                {
                    await gdsClient.DisposeAsync().ConfigureAwait(false);
                }
            }
        }

        private async Task ApplyNewApplicationInstanceCertificateAsync(
            ByteString certificate,
            ByteString privateKey)
        {
            using var x509 = Certificate.FromRawData(certificate.ToArray());
            using Certificate certWithPrivateKey = DefaultCertificateFactory.Instance.CreateWithPEMPrivateKey(
                x509,
                privateKey.ToArray());
            CertificateIdentifier oldId = GDSClient.Configuration.SecurityConfiguration.ApplicationCertificate!;
            var newId = new CertificateIdentifier
            {
                Thumbprint = certWithPrivateKey.Thumbprint,
                SubjectName = certWithPrivateKey.Subject,
                StoreType = oldId?.StoreType,
                StorePath = oldId?.StorePath,
                CertificateType = oldId?.CertificateType ?? CertificateIdentifier.GetCertificateType(certWithPrivateKey)
            };
            GDSClient.Configuration.SecurityConfiguration.ApplicationCertificate = newId;
            using ICertificateStore store = CertificateIdentifierResolver.OpenStore(newId, m_telemetry)!;
            await store!.AddAsync(certWithPrivateKey).ConfigureAwait(false);
        }

        private async Task<(ByteString certificate, ByteString privateKey)> FinishKeyPairAsync(
            ApplicationTestData ownApplicationTestData)
        {
            await GDSClient.ConnectAsync().ConfigureAwait(false);
            //get cert
            (ByteString certificate, ByteString privateKey, _) = await GDSClient.FinishRequestAsync(
                ownApplicationTestData.ApplicationRecord.ApplicationId,
                ownApplicationTestData.CertificateRequestId).ConfigureAwait(false);
            await GDSClient.DisconnectAsync().ConfigureAwait(false);

            return (certificate, privateKey);
        }

        private async Task<NodeId> StartNewKeyPairAsync(ApplicationTestData ownApplicationTestData)
        {
            await GDSClient.ConnectAsync().ConfigureAwait(false);
            //request new Cert
            NodeId req_id = await GDSClient.StartNewKeyPairRequestAsync(
                ownApplicationTestData.ApplicationRecord.ApplicationId,
                ownApplicationTestData.CertificateGroupId,
                ownApplicationTestData.CertificateTypeId,
                ownApplicationTestData.Subject,
                ownApplicationTestData.DomainNames,
                ownApplicationTestData.PrivateKeyFormat,
                ownApplicationTestData.PrivateKeyPassword).ConfigureAwait(false);

            await GDSClient.DisconnectAsync().ConfigureAwait(false);
            return req_id;
        }

        private async Task<NodeId> RegisterAsync(ApplicationTestData ownApplicationTestData)
        {
            await GDSClient.ConnectAsync().ConfigureAwait(false);
            NodeId id = await GDSClient.RegisterApplicationAsync(ownApplicationTestData.ApplicationRecord).ConfigureAwait(false);
            await GDSClient.DisconnectAsync().ConfigureAwait(false);
            return id;
        }

        private bool AcceptCertificate(Certificate certificate, ServiceResult error)
        {
            if (error.StatusCode == StatusCodes.BadCertificateUntrusted)
            {
                if (AutoAccept)
                {
                    if (m_logger.IsEnabled(LogLevel.Information))
                    {
                        m_logger.LogInformation("Accepted Certificate: {Subject}", certificate.Subject);
                    }
                    return true;
                }
                if (m_logger.IsEnabled(LogLevel.Information))
                {
                    m_logger.LogInformation("Rejected Certificate: {Subject}", certificate.Subject);
                }
            }
            return false;
        }

        private ApplicationTestData GetOwnApplicationData()
        {
            return new ApplicationTestData
            {
                ApplicationRecord = new ApplicationRecordDataType
                {
                    ApplicationUri = GDSClient.Configuration.ApplicationUri,
                    ApplicationType = GDSClient.Configuration.ApplicationType,
                    ProductUri = GDSClient.Configuration.ProductUri,
                    ApplicationNames = [new LocalizedText(GDSClient.Configuration.ApplicationName)],
                    ApplicationId = new NodeId(Guid.NewGuid())
                },
                PrivateKeyFormat = "PEM",
                Subject = $"CN={GDSClient.Configuration.ApplicationName},DC={Utils.GetHostName()},O=OPC Foundation"
            };
        }

        /// <summary>
        /// Sets the GDSClient's endpoint by SecurityPolicy URI.
        /// </summary>
        /// <exception cref="ArgumentException"></exception>
        /// <exception cref="InvalidOperationException"></exception>
        public async Task SetEndpointAsync(string securityPolicyUri, CancellationToken ct = default)
        {
            if (Configuration == null)
            {
                throw new InvalidOperationException("Client configuration must be loaded before setting endpoint.");
            }
            if (GDSClient == null)
            {
                throw new InvalidOperationException("GDSClient must be initialized before setting endpoint.");
            }
            var endpointConfiguration = EndpointConfiguration.Create(Configuration);
            using DiscoveryClient discoveryClient = await DiscoveryClient.CreateAsync(
                new Uri(EndpointUrl),
                endpointConfiguration,
                m_telemetry,
                ct: ct).ConfigureAwait(false);
            ArrayOf<EndpointDescription> endpoints =
                await discoveryClient.GetEndpointsAsync(default, ct).ConfigureAwait(false);
            await discoveryClient.CloseAsync(ct).ConfigureAwait(false);
            EndpointDescription? selectedEndpoint = null;
            foreach (EndpointDescription ep in endpoints)
            {
                if (ep.SecurityPolicyUri == securityPolicyUri)
                {
                    selectedEndpoint = ep;
                    break;
                }
            }
            if (selectedEndpoint == null)
            {
                throw new ArgumentException($"No endpoint found for SecurityPolicyUri '{securityPolicyUri}'.");
            }
            GDSClient.Endpoint = new ConfiguredEndpoint(null, selectedEndpoint, endpointConfiguration);
        }

        private ApplicationInstance m_application = null!;
        private readonly string m_storeType;
        private readonly ITelemetryContext m_telemetry;
        private readonly ILogger m_logger;
    }

    /// <summary>
    /// Stores the configuration the data access node manager.
    /// </summary>
    [DataType(Namespace = Namespaces.OpcUaGds + "Configuration.xsd")]
    public partial class GlobalDiscoveryTestClientConfiguration
    {
        [DataTypeField(Order = 1)]
        public string GlobalDiscoveryServerUrl { get; set; } = null!;

        [DataTypeField(Order = 2)]
        public string AppUserName { get; set; } = null!;

        [DataTypeField(Order = 3)]
        public string AppPassword { get; set; } = null!;

        [DataTypeField(Order = 4)]
        public string AdminUserName { get; set; } = null!;

        [DataTypeField(Order = 5)]
        public string AdminPassword { get; set; } = null!;
    }
}