Files
Marc Schier e8afa4237b Security hardening: 25-finding pass against SFI / SDL / OPC UA Part 2 baseline
Addresses 25 of 39 findings from a branch security review (assessment 5).

CRITICAL: F1 gate MCP key-disclosure tools, F2 0600 keylog/pcap files, F3 per-user BaseFolder, F16 ChannelKeyMaterial IDisposable + ZeroMemory, F17 PcapFileReader MaxPacketBytes (64MB) bound, F18 FlowBuffer MaxBufferBytes (256MB) cap, F19 NodeSet export path validation, F20 ReplaySession listenPort range.

HIGH: F4 IPcapAuditSink + LoggerPcapAuditSink + rate-limited frame-capture audit, F5 AES-256-GCM EncryptedKeyLogStream + SessionKeyManager (sibling .key file 0600), F14 IKeyEscrowProvider abstraction + DiskKeyEscrowProvider default (DI TryAddSingleton so consumers can route to KMS), F21 ChannelManagerOptions.MaxChannels (256) cap, F22 CaptureSessionManager.SessionFolder path-traversal guard, F23 PacketDecodeTools pcapPath/keyLogPath validation, F24 replay_pcap speed validation (NaN/Inf/<=0), F25 explicit permissions blocks on .github/workflows.

MEDIUM: F6 OnTokenActivated [EditorBrowsable(Never)] + key-disclosure doc, F7 IDiagnosticsChannelMutation accessor + stack-walk caller guard (replaces internal OfflineLoadTokens), F8 PcapOptions.AllowMockClientReplay + AllowedReplayEndpoints, F9 PcapFileWriter / UaKeyLog*Writer rotation (.NNN suffix) with MaxBytes / MaxArtifactsPerSession, F13 keylog-isolation gap acknowledgment doc, F15 HashChainedAuditFileSink (HMAC-chained JSONL ledger, VerifyChain), F11 replay URL scheme allow-list (opc.tcp/opc.tcps/opc.https).

LOW/INFO: F10 SBOM/CVE governance comments on PacketDotNet/SharpPcap + Docs/PacketCapture.md, F12 Security model section at top of PacketCapture.md.

Tests: 100+ new NUnit tests across Audit/, Capture/, Frame/, KeyLog/, McpServerTools/, Replay/, Stack/Tcp/, DependencyInjection/. All file-mode/HMAC-chain/encryption tests are [Platform(Linux,MacOSX)]-gated where Unix-specific.

Build: 0 warnings / 0 errors on Stack/Opc.Ua.Bindings.Pcap for net8.0 and net9.0. net10.0 build is environmentally blocked by a corrupted local SDK 10.0.300 workload manifest (microsoft.net.workload.mono.toolchain.net6 10.0.108 requires Emscripten.net6 >=10.0.108, only 9.0.17 installed); requires 'dotnet workload repair' from an elevated shell to validate the third TFM. No tests were run pending the SDK fix. 5 CA1508/CA2000 false positives suppressed with documented #pragma blocks (ownership transfer in escrow factory / IAsyncEnumerable iterator / unreachable catch path).

Deferred to follow-up GitHub issues: 9 MEDIUM (M-SEC-07/09/10/11/12/13/16/22/31 — exception sanitization, reconnect defaults, cert-rotation races, nonce-suppress deprecation, parser hardening) and 10 LOW/INFO (L-SEC-14/15/17/23/24/33/34/35/36/37 — handler cleanup, EventSource endpoint masking, key-log schema validation, EOL deps, SAST). Full reasoning in session plan.md Round 10.
2026-06-11 13:10:09 +02:00

178 lines
6.4 KiB
C#

/* ========================================================================
* Copyright (c) 2005-2026 The OPC Foundation, Inc. All rights reserved.
*
* OPC Foundation MIT License 1.00
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use,
* copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following
* conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*
* The complete license agreement can be found here:
* http://opcfoundation.org/License/MIT/1.00/
* ======================================================================*/
using System;
using System.Collections.Generic;
using System.IO;
using System.Runtime.CompilerServices;
using System.Text.Json;
using System.Threading;
using System.Threading.Tasks;
using Opc.Ua.Bindings.Pcap.Capture;
namespace Opc.Ua.Bindings.Pcap.KeyLog
{
/// <summary>
/// Reads OPC UA channel key material from JSON-lines key-log files.
/// </summary>
public sealed class UaKeyLogJsonReader : IKeyLogReader
{
/// <summary>
/// Constructs a key-log reader.
/// </summary>
public UaKeyLogJsonReader()
{
}
/// <summary>
/// Constructs a key-log reader bound to the supplied file path.
/// </summary>
public UaKeyLogJsonReader(string filePath)
: this(filePath, sessionKey: null)
{
}
/// <summary>
/// Constructs a key-log reader bound to the supplied file path.
/// </summary>
public UaKeyLogJsonReader(string filePath, byte[]? sessionKey)
{
ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
FilePath = filePath;
m_sessionKey = sessionKey;
}
/// <summary>
/// Gets the bound file path, if the reader was constructed with one.
/// </summary>
public string? FilePath { get; }
/// <summary>
/// Reads all key material from the bound file path.
/// </summary>
public IAsyncEnumerable<ChannelKeyMaterial> ReadAllAsync(CancellationToken ct)
{
if (FilePath is null)
{
throw new InvalidOperationException("The reader is not bound to a file path.");
}
return ReadAllAsync(FilePath, ct);
}
/// <inheritdoc/>
public IAsyncEnumerable<ChannelKeyMaterial> ReadAllAsync(
string filePath,
CancellationToken ct)
{
ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
return ReadAllFromFileAsync(filePath, ct);
}
/// <inheritdoc/>
public IAsyncEnumerable<ChannelKeyMaterial> ReadAllAsync(Stream stream, CancellationToken ct)
{
ArgumentNullException.ThrowIfNull(stream);
Stream readStream = CreateReadStream(stream, leaveOpen: true);
return ReadAllFromStreamAsync(readStream, disposeStream: !ReferenceEquals(readStream, stream), ct);
}
private async IAsyncEnumerable<ChannelKeyMaterial> ReadAllFromFileAsync(
string filePath,
[EnumeratorCancellation] CancellationToken ct)
{
FileStream fileStream = new(
filePath,
FileMode.Open,
FileAccess.Read,
FileShare.ReadWrite,
bufferSize: 4096,
FileOptions.Asynchronous | FileOptions.SequentialScan);
using Stream stream = CreateReadStream(fileStream, leaveOpen: false);
// CA2000: ReadAllFromStreamAsync returns IAsyncEnumerable; the iterator is
// async-disposed by `await foreach`. The stream above is disposed by `using`.
#pragma warning disable CA2000
await foreach (ChannelKeyMaterial material in ReadAllFromStreamAsync(
stream,
disposeStream: false,
ct).ConfigureAwait(false))
{
yield return material;
}
#pragma warning restore CA2000
}
private Stream CreateReadStream(Stream stream, bool leaveOpen)
{
return m_sessionKey is null ? stream : new EncryptedKeyLogStream(stream, m_sessionKey, leaveOpen);
}
private static async IAsyncEnumerable<ChannelKeyMaterial> ReadAllFromStreamAsync(
Stream stream,
bool disposeStream,
[EnumeratorCancellation] CancellationToken ct)
{
try
{
using StreamReader reader = new(stream, leaveOpen: true);
while (true)
{
string? line = await reader.ReadLineAsync(ct).ConfigureAwait(false);
if (line is null)
{
yield break;
}
if (string.IsNullOrWhiteSpace(line))
{
continue;
}
KeyLogRecord? record = JsonSerializer.Deserialize(
line,
UaKeyLogJsonContext.Default.KeyLogRecord);
if (record is null)
{
throw new PcapDiagnosticsException("Invalid OPC UA JSON key-log record.");
}
yield return record.ToMaterial();
}
}
finally
{
if (disposeStream)
{
await stream.DisposeAsync().ConfigureAwait(false);
}
}
}
private readonly byte[]? m_sessionKey;
}
}