mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-20 00:31:32 +08:00
e8afa4237b
Addresses 25 of 39 findings from a branch security review (assessment 5). CRITICAL: F1 gate MCP key-disclosure tools, F2 0600 keylog/pcap files, F3 per-user BaseFolder, F16 ChannelKeyMaterial IDisposable + ZeroMemory, F17 PcapFileReader MaxPacketBytes (64MB) bound, F18 FlowBuffer MaxBufferBytes (256MB) cap, F19 NodeSet export path validation, F20 ReplaySession listenPort range. HIGH: F4 IPcapAuditSink + LoggerPcapAuditSink + rate-limited frame-capture audit, F5 AES-256-GCM EncryptedKeyLogStream + SessionKeyManager (sibling .key file 0600), F14 IKeyEscrowProvider abstraction + DiskKeyEscrowProvider default (DI TryAddSingleton so consumers can route to KMS), F21 ChannelManagerOptions.MaxChannels (256) cap, F22 CaptureSessionManager.SessionFolder path-traversal guard, F23 PacketDecodeTools pcapPath/keyLogPath validation, F24 replay_pcap speed validation (NaN/Inf/<=0), F25 explicit permissions blocks on .github/workflows. MEDIUM: F6 OnTokenActivated [EditorBrowsable(Never)] + key-disclosure doc, F7 IDiagnosticsChannelMutation accessor + stack-walk caller guard (replaces internal OfflineLoadTokens), F8 PcapOptions.AllowMockClientReplay + AllowedReplayEndpoints, F9 PcapFileWriter / UaKeyLog*Writer rotation (.NNN suffix) with MaxBytes / MaxArtifactsPerSession, F13 keylog-isolation gap acknowledgment doc, F15 HashChainedAuditFileSink (HMAC-chained JSONL ledger, VerifyChain), F11 replay URL scheme allow-list (opc.tcp/opc.tcps/opc.https). LOW/INFO: F10 SBOM/CVE governance comments on PacketDotNet/SharpPcap + Docs/PacketCapture.md, F12 Security model section at top of PacketCapture.md. Tests: 100+ new NUnit tests across Audit/, Capture/, Frame/, KeyLog/, McpServerTools/, Replay/, Stack/Tcp/, DependencyInjection/. All file-mode/HMAC-chain/encryption tests are [Platform(Linux,MacOSX)]-gated where Unix-specific. Build: 0 warnings / 0 errors on Stack/Opc.Ua.Bindings.Pcap for net8.0 and net9.0. net10.0 build is environmentally blocked by a corrupted local SDK 10.0.300 workload manifest (microsoft.net.workload.mono.toolchain.net6 10.0.108 requires Emscripten.net6 >=10.0.108, only 9.0.17 installed); requires 'dotnet workload repair' from an elevated shell to validate the third TFM. No tests were run pending the SDK fix. 5 CA1508/CA2000 false positives suppressed with documented #pragma blocks (ownership transfer in escrow factory / IAsyncEnumerable iterator / unreachable catch path). Deferred to follow-up GitHub issues: 9 MEDIUM (M-SEC-07/09/10/11/12/13/16/22/31 — exception sanitization, reconnect defaults, cert-rotation races, nonce-suppress deprecation, parser hardening) and 10 LOW/INFO (L-SEC-14/15/17/23/24/33/34/35/36/37 — handler cleanup, EventSource endpoint masking, key-log schema validation, EOL deps, SAST). Full reasoning in session plan.md Round 10.
214 lines
7.6 KiB
C#
214 lines
7.6 KiB
C#
/* ========================================================================
|
|
* Copyright (c) 2005-2026 The OPC Foundation, Inc. All rights reserved.
|
|
*
|
|
* OPC Foundation MIT License 1.00
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person
|
|
* obtaining a copy of this software and associated documentation
|
|
* files (the "Software"), to deal in the Software without
|
|
* restriction, including without limitation the rights to use,
|
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the
|
|
* Software is furnished to do so, subject to the following
|
|
* conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be
|
|
* included in all copies or substantial portions of the Software.
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
|
|
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
|
|
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
|
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
|
* OTHER DEALINGS IN THE SOFTWARE.
|
|
*
|
|
* The complete license agreement can be found here:
|
|
* http://opcfoundation.org/License/MIT/1.00/
|
|
* ======================================================================*/
|
|
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Globalization;
|
|
using System.IO;
|
|
using System.Runtime.CompilerServices;
|
|
using System.Threading;
|
|
using System.Threading.Tasks;
|
|
using Opc.Ua.Bindings.Pcap.Capture;
|
|
|
|
namespace Opc.Ua.Bindings.Pcap.KeyLog
|
|
{
|
|
/// <summary>
|
|
/// Reads OPC UA channel key material from Wireshark-style text key logs.
|
|
/// </summary>
|
|
public sealed class UaKeyLogTextReader : IKeyLogReader
|
|
{
|
|
/// <summary>
|
|
/// Constructs a key-log reader.
|
|
/// </summary>
|
|
public UaKeyLogTextReader()
|
|
{
|
|
}
|
|
|
|
/// <summary>
|
|
/// Constructs a key-log reader bound to the supplied file path.
|
|
/// </summary>
|
|
public UaKeyLogTextReader(string filePath)
|
|
: this(filePath, sessionKey: null)
|
|
{
|
|
}
|
|
|
|
/// <summary>
|
|
/// Constructs a key-log reader bound to the supplied file path.
|
|
/// </summary>
|
|
public UaKeyLogTextReader(string filePath, byte[]? sessionKey)
|
|
{
|
|
ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
|
|
FilePath = filePath;
|
|
m_sessionKey = sessionKey;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Gets the bound file path, if the reader was constructed with one.
|
|
/// </summary>
|
|
public string? FilePath { get; }
|
|
|
|
/// <summary>
|
|
/// Reads all key material from the bound file path.
|
|
/// </summary>
|
|
public IAsyncEnumerable<ChannelKeyMaterial> ReadAllAsync(CancellationToken ct)
|
|
{
|
|
if (FilePath is null)
|
|
{
|
|
throw new InvalidOperationException("The reader is not bound to a file path.");
|
|
}
|
|
|
|
return ReadAllAsync(FilePath, ct);
|
|
}
|
|
|
|
/// <inheritdoc/>
|
|
public IAsyncEnumerable<ChannelKeyMaterial> ReadAllAsync(
|
|
string filePath,
|
|
CancellationToken ct)
|
|
{
|
|
ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
|
|
return ReadAllFromFileAsync(filePath, ct);
|
|
}
|
|
|
|
/// <inheritdoc/>
|
|
public IAsyncEnumerable<ChannelKeyMaterial> ReadAllAsync(Stream stream, CancellationToken ct)
|
|
{
|
|
ArgumentNullException.ThrowIfNull(stream);
|
|
Stream readStream = CreateReadStream(stream, leaveOpen: true);
|
|
return ReadAllFromStreamAsync(readStream, disposeStream: !ReferenceEquals(readStream, stream), ct);
|
|
}
|
|
|
|
private async IAsyncEnumerable<ChannelKeyMaterial> ReadAllFromFileAsync(
|
|
string filePath,
|
|
[EnumeratorCancellation] CancellationToken ct)
|
|
{
|
|
FileStream fileStream = new(
|
|
filePath,
|
|
FileMode.Open,
|
|
FileAccess.Read,
|
|
FileShare.ReadWrite,
|
|
bufferSize: 4096,
|
|
FileOptions.Asynchronous | FileOptions.SequentialScan);
|
|
using Stream stream = CreateReadStream(fileStream, leaveOpen: false);
|
|
// CA2000: ReadAllFromStreamAsync returns IAsyncEnumerable; the iterator is
|
|
// async-disposed by `await foreach`. The stream above is disposed by `using`.
|
|
#pragma warning disable CA2000
|
|
await foreach (ChannelKeyMaterial material in ReadAllFromStreamAsync(
|
|
stream,
|
|
disposeStream: false,
|
|
ct).ConfigureAwait(false))
|
|
{
|
|
yield return material;
|
|
}
|
|
#pragma warning restore CA2000
|
|
}
|
|
|
|
private Stream CreateReadStream(Stream stream, bool leaveOpen)
|
|
{
|
|
return m_sessionKey is null ? stream : new EncryptedKeyLogStream(stream, m_sessionKey, leaveOpen);
|
|
}
|
|
|
|
private static async IAsyncEnumerable<ChannelKeyMaterial> ReadAllFromStreamAsync(
|
|
Stream stream,
|
|
bool disposeStream,
|
|
[EnumeratorCancellation] CancellationToken ct)
|
|
{
|
|
try
|
|
{
|
|
using StreamReader reader = new(stream, leaveOpen: true);
|
|
while (true)
|
|
{
|
|
string? line = await reader.ReadLineAsync(ct).ConfigureAwait(false);
|
|
if (line is null)
|
|
{
|
|
yield break;
|
|
}
|
|
if (string.IsNullOrWhiteSpace(line) || line.StartsWith('#'))
|
|
{
|
|
continue;
|
|
}
|
|
|
|
yield return ParseLine(line);
|
|
}
|
|
}
|
|
finally
|
|
{
|
|
if (disposeStream)
|
|
{
|
|
await stream.DisposeAsync().ConfigureAwait(false);
|
|
}
|
|
}
|
|
}
|
|
|
|
private static ChannelKeyMaterial ParseLine(string line)
|
|
{
|
|
string[] parts = line.Split(' ', StringSplitOptions.RemoveEmptyEntries);
|
|
if (parts.Length != 11 || !string.Equals(parts[0], "OPCUA_CHANNEL", StringComparison.Ordinal))
|
|
{
|
|
throw new PcapDiagnosticsException("Invalid OPC UA text key-log record.");
|
|
}
|
|
if (!Enum.TryParse(parts[4], ignoreCase: false, out MessageSecurityMode mode))
|
|
{
|
|
throw new PcapDiagnosticsException($"Invalid OPC UA key-log security mode '{parts[4]}'.");
|
|
}
|
|
|
|
return new ChannelKeyMaterial(
|
|
ParseUInt32(parts[1]),
|
|
ParseUInt32(parts[2]),
|
|
parts[3],
|
|
mode,
|
|
DateTime.UtcNow,
|
|
0,
|
|
null,
|
|
null,
|
|
ParseHex(parts[5]),
|
|
ParseHex(parts[6]),
|
|
ParseHex(parts[7]),
|
|
ParseHex(parts[8]),
|
|
ParseHex(parts[9]),
|
|
ParseHex(parts[10]));
|
|
}
|
|
|
|
private static uint ParseUInt32(string value)
|
|
{
|
|
if (!value.StartsWith("0x", StringComparison.Ordinal))
|
|
{
|
|
throw new PcapDiagnosticsException($"Invalid OPC UA key-log integer '{value}'.");
|
|
}
|
|
return uint.Parse(value[2..], NumberStyles.HexNumber, CultureInfo.InvariantCulture);
|
|
}
|
|
|
|
private static byte[]? ParseHex(string value)
|
|
{
|
|
return value == "-" ? null : Convert.FromHexString(value);
|
|
}
|
|
|
|
private readonly byte[]? m_sessionKey;
|
|
}
|
|
}
|