Files
Marc Schier e8afa4237b Security hardening: 25-finding pass against SFI / SDL / OPC UA Part 2 baseline
Addresses 25 of 39 findings from a branch security review (assessment 5).

CRITICAL: F1 gate MCP key-disclosure tools, F2 0600 keylog/pcap files, F3 per-user BaseFolder, F16 ChannelKeyMaterial IDisposable + ZeroMemory, F17 PcapFileReader MaxPacketBytes (64MB) bound, F18 FlowBuffer MaxBufferBytes (256MB) cap, F19 NodeSet export path validation, F20 ReplaySession listenPort range.

HIGH: F4 IPcapAuditSink + LoggerPcapAuditSink + rate-limited frame-capture audit, F5 AES-256-GCM EncryptedKeyLogStream + SessionKeyManager (sibling .key file 0600), F14 IKeyEscrowProvider abstraction + DiskKeyEscrowProvider default (DI TryAddSingleton so consumers can route to KMS), F21 ChannelManagerOptions.MaxChannels (256) cap, F22 CaptureSessionManager.SessionFolder path-traversal guard, F23 PacketDecodeTools pcapPath/keyLogPath validation, F24 replay_pcap speed validation (NaN/Inf/<=0), F25 explicit permissions blocks on .github/workflows.

MEDIUM: F6 OnTokenActivated [EditorBrowsable(Never)] + key-disclosure doc, F7 IDiagnosticsChannelMutation accessor + stack-walk caller guard (replaces internal OfflineLoadTokens), F8 PcapOptions.AllowMockClientReplay + AllowedReplayEndpoints, F9 PcapFileWriter / UaKeyLog*Writer rotation (.NNN suffix) with MaxBytes / MaxArtifactsPerSession, F13 keylog-isolation gap acknowledgment doc, F15 HashChainedAuditFileSink (HMAC-chained JSONL ledger, VerifyChain), F11 replay URL scheme allow-list (opc.tcp/opc.tcps/opc.https).

LOW/INFO: F10 SBOM/CVE governance comments on PacketDotNet/SharpPcap + Docs/PacketCapture.md, F12 Security model section at top of PacketCapture.md.

Tests: 100+ new NUnit tests across Audit/, Capture/, Frame/, KeyLog/, McpServerTools/, Replay/, Stack/Tcp/, DependencyInjection/. All file-mode/HMAC-chain/encryption tests are [Platform(Linux,MacOSX)]-gated where Unix-specific.

Build: 0 warnings / 0 errors on Stack/Opc.Ua.Bindings.Pcap for net8.0 and net9.0. net10.0 build is environmentally blocked by a corrupted local SDK 10.0.300 workload manifest (microsoft.net.workload.mono.toolchain.net6 10.0.108 requires Emscripten.net6 >=10.0.108, only 9.0.17 installed); requires 'dotnet workload repair' from an elevated shell to validate the third TFM. No tests were run pending the SDK fix. 5 CA1508/CA2000 false positives suppressed with documented #pragma blocks (ownership transfer in escrow factory / IAsyncEnumerable iterator / unreachable catch path).

Deferred to follow-up GitHub issues: 9 MEDIUM (M-SEC-07/09/10/11/12/13/16/22/31 — exception sanitization, reconnect defaults, cert-rotation races, nonce-suppress deprecation, parser hardening) and 10 LOW/INFO (L-SEC-14/15/17/23/24/33/34/35/36/37 — handler cleanup, EventSource endpoint masking, key-log schema validation, EOL deps, SAST). Full reasoning in session plan.md Round 10.
2026-06-11 13:10:09 +02:00

214 lines
7.6 KiB
C#

/* ========================================================================
* Copyright (c) 2005-2026 The OPC Foundation, Inc. All rights reserved.
*
* OPC Foundation MIT License 1.00
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use,
* copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following
* conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*
* The complete license agreement can be found here:
* http://opcfoundation.org/License/MIT/1.00/
* ======================================================================*/
using System;
using System.Collections.Generic;
using System.Globalization;
using System.IO;
using System.Runtime.CompilerServices;
using System.Threading;
using System.Threading.Tasks;
using Opc.Ua.Bindings.Pcap.Capture;
namespace Opc.Ua.Bindings.Pcap.KeyLog
{
/// <summary>
/// Reads OPC UA channel key material from Wireshark-style text key logs.
/// </summary>
public sealed class UaKeyLogTextReader : IKeyLogReader
{
/// <summary>
/// Constructs a key-log reader.
/// </summary>
public UaKeyLogTextReader()
{
}
/// <summary>
/// Constructs a key-log reader bound to the supplied file path.
/// </summary>
public UaKeyLogTextReader(string filePath)
: this(filePath, sessionKey: null)
{
}
/// <summary>
/// Constructs a key-log reader bound to the supplied file path.
/// </summary>
public UaKeyLogTextReader(string filePath, byte[]? sessionKey)
{
ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
FilePath = filePath;
m_sessionKey = sessionKey;
}
/// <summary>
/// Gets the bound file path, if the reader was constructed with one.
/// </summary>
public string? FilePath { get; }
/// <summary>
/// Reads all key material from the bound file path.
/// </summary>
public IAsyncEnumerable<ChannelKeyMaterial> ReadAllAsync(CancellationToken ct)
{
if (FilePath is null)
{
throw new InvalidOperationException("The reader is not bound to a file path.");
}
return ReadAllAsync(FilePath, ct);
}
/// <inheritdoc/>
public IAsyncEnumerable<ChannelKeyMaterial> ReadAllAsync(
string filePath,
CancellationToken ct)
{
ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
return ReadAllFromFileAsync(filePath, ct);
}
/// <inheritdoc/>
public IAsyncEnumerable<ChannelKeyMaterial> ReadAllAsync(Stream stream, CancellationToken ct)
{
ArgumentNullException.ThrowIfNull(stream);
Stream readStream = CreateReadStream(stream, leaveOpen: true);
return ReadAllFromStreamAsync(readStream, disposeStream: !ReferenceEquals(readStream, stream), ct);
}
private async IAsyncEnumerable<ChannelKeyMaterial> ReadAllFromFileAsync(
string filePath,
[EnumeratorCancellation] CancellationToken ct)
{
FileStream fileStream = new(
filePath,
FileMode.Open,
FileAccess.Read,
FileShare.ReadWrite,
bufferSize: 4096,
FileOptions.Asynchronous | FileOptions.SequentialScan);
using Stream stream = CreateReadStream(fileStream, leaveOpen: false);
// CA2000: ReadAllFromStreamAsync returns IAsyncEnumerable; the iterator is
// async-disposed by `await foreach`. The stream above is disposed by `using`.
#pragma warning disable CA2000
await foreach (ChannelKeyMaterial material in ReadAllFromStreamAsync(
stream,
disposeStream: false,
ct).ConfigureAwait(false))
{
yield return material;
}
#pragma warning restore CA2000
}
private Stream CreateReadStream(Stream stream, bool leaveOpen)
{
return m_sessionKey is null ? stream : new EncryptedKeyLogStream(stream, m_sessionKey, leaveOpen);
}
private static async IAsyncEnumerable<ChannelKeyMaterial> ReadAllFromStreamAsync(
Stream stream,
bool disposeStream,
[EnumeratorCancellation] CancellationToken ct)
{
try
{
using StreamReader reader = new(stream, leaveOpen: true);
while (true)
{
string? line = await reader.ReadLineAsync(ct).ConfigureAwait(false);
if (line is null)
{
yield break;
}
if (string.IsNullOrWhiteSpace(line) || line.StartsWith('#'))
{
continue;
}
yield return ParseLine(line);
}
}
finally
{
if (disposeStream)
{
await stream.DisposeAsync().ConfigureAwait(false);
}
}
}
private static ChannelKeyMaterial ParseLine(string line)
{
string[] parts = line.Split(' ', StringSplitOptions.RemoveEmptyEntries);
if (parts.Length != 11 || !string.Equals(parts[0], "OPCUA_CHANNEL", StringComparison.Ordinal))
{
throw new PcapDiagnosticsException("Invalid OPC UA text key-log record.");
}
if (!Enum.TryParse(parts[4], ignoreCase: false, out MessageSecurityMode mode))
{
throw new PcapDiagnosticsException($"Invalid OPC UA key-log security mode '{parts[4]}'.");
}
return new ChannelKeyMaterial(
ParseUInt32(parts[1]),
ParseUInt32(parts[2]),
parts[3],
mode,
DateTime.UtcNow,
0,
null,
null,
ParseHex(parts[5]),
ParseHex(parts[6]),
ParseHex(parts[7]),
ParseHex(parts[8]),
ParseHex(parts[9]),
ParseHex(parts[10]));
}
private static uint ParseUInt32(string value)
{
if (!value.StartsWith("0x", StringComparison.Ordinal))
{
throw new PcapDiagnosticsException($"Invalid OPC UA key-log integer '{value}'.");
}
return uint.Parse(value[2..], NumberStyles.HexNumber, CultureInfo.InvariantCulture);
}
private static byte[]? ParseHex(string value)
{
return value == "-" ? null : Convert.FromHexString(value);
}
private readonly byte[]? m_sessionKey;
}
}