mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-19 15:22:15 +08:00
Marc Schier
70b4498db8
* New certificate and secrete abstraction with certificate infrastructure and certificate/secret stores. * leak testing for certificate resources to validate new ref counting in every test assembly * Migration guide updated and documentation added for all * Remove IDisposable from Nodestate and UserIdentity. * UserCertificateTokenHandler now just points into certificate registry/stores, no dispose required * Fix CA2000 warnings and cleanup of other diagnostics, increase warning levels in .editorconfig
867 lines
37 KiB
C#
867 lines
37 KiB
C#
/* ========================================================================
|
|
* Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
|
|
*
|
|
* OPC Foundation MIT License 1.00
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person
|
|
* obtaining a copy of this software and associated documentation
|
|
* files (the "Software"), to deal in the Software without
|
|
* restriction, including without limitation the rights to use,
|
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the
|
|
* Software is furnished to do so, subject to the following
|
|
* conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be
|
|
* included in all copies or substantial portions of the Software.
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
|
|
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
|
|
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
|
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
|
* OTHER DEALINGS IN THE SOFTWARE.
|
|
*
|
|
* The complete license agreement can be found here:
|
|
* http://opcfoundation.org/License/MIT/1.00/
|
|
* ======================================================================*/
|
|
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Linq;
|
|
using NUnit.Framework;
|
|
using Opc.Ua.Tests;
|
|
|
|
namespace Opc.Ua.Core.Tests.Stack.Server
|
|
{
|
|
/// <summary>
|
|
/// Tests for the protected methods in the ServerBase class.
|
|
/// </summary>
|
|
[TestFixture]
|
|
[Category("Server")]
|
|
[SetCulture("en-us")]
|
|
[SetUICulture("en-us")]
|
|
[Parallelizable]
|
|
[TestFixtureSource(nameof(FixtureArgs))]
|
|
public class ServerBaseTests : ServerBase
|
|
{
|
|
/// <summary>
|
|
/// Various server base/alternate address configurations.
|
|
/// </summary>
|
|
public enum TestConfigurations
|
|
{
|
|
SingleBaseAdresses,
|
|
SingleBaseAdressesWithAlternateHost,
|
|
SingleBaseAdressesWithAlternatePort,
|
|
SingleBaseAddressesWithAlternateHostAndPort,
|
|
DualBaseAddresses,
|
|
DualBaseAddressesWithAlternateHost,
|
|
DualBaseAdressesWithAlternatePort,
|
|
DualBaseAddressesWithAlternateHostAndPort,
|
|
MultipleIPsSamePort
|
|
}
|
|
|
|
public const int BaseAddressCount = 6;
|
|
public const int EndpointCount = 12;
|
|
|
|
private ApplicationDescription m_serverDescription;
|
|
private ArrayOf<EndpointDescription> m_endpoints;
|
|
private readonly TestConfigurations m_testConfiguration;
|
|
|
|
public static readonly object[] FixtureArgs =
|
|
[
|
|
new object[] { TestConfigurations.SingleBaseAdresses },
|
|
new object[] { TestConfigurations.SingleBaseAdressesWithAlternateHost },
|
|
new object[] { TestConfigurations.SingleBaseAdressesWithAlternatePort },
|
|
new object[] { TestConfigurations.SingleBaseAddressesWithAlternateHostAndPort },
|
|
new object[] { TestConfigurations.DualBaseAddresses },
|
|
new object[] { TestConfigurations.DualBaseAddressesWithAlternateHost },
|
|
new object[] { TestConfigurations.DualBaseAdressesWithAlternatePort },
|
|
new object[] { TestConfigurations.DualBaseAddressesWithAlternateHostAndPort },
|
|
new object[] { TestConfigurations.MultipleIPsSamePort }
|
|
];
|
|
|
|
public ServerBaseTests()
|
|
: this(TestConfigurations.SingleBaseAdresses)
|
|
{
|
|
}
|
|
|
|
public ServerBaseTests(TestConfigurations configType)
|
|
: base(NUnitTelemetryContext.Create(true))
|
|
{
|
|
m_testConfiguration = configType;
|
|
}
|
|
|
|
/// <summary>
|
|
/// An array of Client Urls.
|
|
/// </summary>
|
|
[DatapointSource]
|
|
public static readonly string[] ClientUrls =
|
|
[
|
|
"opc.tcp://localhost:51210/UA/SampleServer",
|
|
"opc.tcp://externalhostname.com:50001/UA/SampleServer",
|
|
"opc.tcp://externalhostname.com:52541/UA/SampleServer",
|
|
//"opc.tcp://[fe80:1234::8]:51210/UA/SampleServer",
|
|
//"opc.tcp://[fe80:1234::8%3]:51210/UA/SampleServer",
|
|
"opc.tcp://[2003:d9:1f0c:5e00:4139:ee31:6cc3:313e]:62541/UA/SampleServer",
|
|
"opc.tcp://myhostname.com:51210/UA/SampleServer",
|
|
"opc.tcp://UNKNOWNHOSTNAME.COM:51210/UA/SampleServer",
|
|
"opc.tcp://EXTERNALHOSTNAME.COM:51210/UA/SampleServer",
|
|
"opc.tcp://localhost:51210/UA/SampleServer",
|
|
"opc.tcp://someserver:62541/UA/SampleServer",
|
|
"opc.tcp://192.168.1.100:62541/UA/SampleServer",
|
|
"opc.tcp:someserver:62541:UA:SampleServer",
|
|
"opc.https://externalhostname.com:50000/UA/SampleServer",
|
|
"opc.https://localhost:51210/UA/SampleServer",
|
|
"opc.https://someserver:62541/UA/SampleServer",
|
|
"opc.https://someserver:62540/UA/SampleServer",
|
|
"opc.https://UNKNOWNHOSTNAME.COM:51210/UA/SampleServer",
|
|
"urn:someserver:62541:UA:SampleServer",
|
|
"tcp://localhost:62541/UA/SampleServer",
|
|
"https://someserver:62541/UA/SampleServer",
|
|
"https://localhost:51210/UA/SampleServer",
|
|
"https://UNKNOWNHOSTNAME.COM:51210/UA/SampleServer"
|
|
];
|
|
|
|
[OneTimeSetUp]
|
|
protected void OneTimeSetUp()
|
|
{
|
|
ITelemetryContext telemetry = NUnitTelemetryContext.Create();
|
|
var configuration = new ApplicationConfiguration(telemetry)
|
|
{
|
|
ApplicationName = "Test",
|
|
ApplicationType = ApplicationType.Server,
|
|
ApplicationUri = "urn:localhost:UA:Test",
|
|
ProductUri = "http://opcfoundation.org/UA/TestServer",
|
|
SecurityConfiguration = new SecurityConfiguration(),
|
|
ServerConfiguration = new ServerConfiguration()
|
|
};
|
|
|
|
// base addresses, uses localhost. specify multiple endpoints per protocol as per config.
|
|
configuration.ServerConfiguration.BaseAddresses =
|
|
configuration.ServerConfiguration.BaseAddresses +=
|
|
Utils.ReplaceLocalhost("opc.https://localhost:62540/UA/SampleServer");
|
|
configuration.ServerConfiguration.BaseAddresses =
|
|
configuration.ServerConfiguration.BaseAddresses +=
|
|
Utils.ReplaceLocalhost("opc.tcp://localhost:62541/UA/SampleServer");
|
|
configuration.ServerConfiguration.BaseAddresses =
|
|
configuration.ServerConfiguration.BaseAddresses +=
|
|
Utils.ReplaceLocalhost("https://localhost:62542/UA/SampleServer");
|
|
if (m_testConfiguration
|
|
is TestConfigurations.DualBaseAddresses
|
|
or TestConfigurations.DualBaseAddressesWithAlternateHost
|
|
or TestConfigurations.DualBaseAddressesWithAlternateHostAndPort
|
|
or TestConfigurations.DualBaseAdressesWithAlternatePort)
|
|
{
|
|
configuration.ServerConfiguration.BaseAddresses +=
|
|
Utils.ReplaceLocalhost("opc.https://localhost:52640/UA/SampleServer");
|
|
configuration.ServerConfiguration.BaseAddresses +=
|
|
Utils.ReplaceLocalhost("opc.tcp://localhost:52641/UA/SampleServer");
|
|
configuration.ServerConfiguration.BaseAddresses +=
|
|
Utils.ReplaceLocalhost("https://localhost:52642/UA/SampleServer");
|
|
Assert.That(
|
|
configuration.ServerConfiguration.BaseAddresses.Count,
|
|
Is.EqualTo(BaseAddressCount));
|
|
}
|
|
else if (m_testConfiguration == TestConfigurations.MultipleIPsSamePort)
|
|
{
|
|
// Multiple IP addresses configured on the same ports as the primary base addresses.
|
|
// This tests the scenario where a server listens on multiple network interfaces
|
|
// using the same port number (e.g. 192.168.1.100:62541 and localhost:62541).
|
|
configuration.ServerConfiguration.BaseAddresses +=
|
|
"opc.https://192.168.1.100:62540/UA/SampleServer";
|
|
configuration.ServerConfiguration.BaseAddresses +=
|
|
"opc.tcp://192.168.1.100:62541/UA/SampleServer";
|
|
configuration.ServerConfiguration.BaseAddresses +=
|
|
"https://192.168.1.100:62542/UA/SampleServer";
|
|
Assert.That(
|
|
configuration.ServerConfiguration.BaseAddresses.Count,
|
|
Is.EqualTo(BaseAddressCount));
|
|
}
|
|
else
|
|
{
|
|
Assert.That(
|
|
configuration.ServerConfiguration.BaseAddresses.Count,
|
|
Is.EqualTo(BaseAddressCount / 2));
|
|
}
|
|
|
|
if (m_testConfiguration
|
|
is TestConfigurations.SingleBaseAdressesWithAlternateHost
|
|
or TestConfigurations.SingleBaseAddressesWithAlternateHostAndPort
|
|
or TestConfigurations.DualBaseAddressesWithAlternateHost
|
|
or TestConfigurations.DualBaseAddressesWithAlternateHostAndPort)
|
|
{
|
|
// alternate base addresses, FQDN and IP address
|
|
configuration.ServerConfiguration.AlternateBaseAddresses +=
|
|
"opc.https://myhostname.com:62540/UA/SampleServer";
|
|
configuration.ServerConfiguration.AlternateBaseAddresses +=
|
|
"opc.tcp://myhostname.com:62541/UA/SampleServer";
|
|
configuration.ServerConfiguration.AlternateBaseAddresses +=
|
|
"https://myhostname.com:62542/UA/SampleServer";
|
|
configuration.ServerConfiguration.AlternateBaseAddresses +=
|
|
"opc.https://192.168.1.100:62540/UA/SampleServer";
|
|
configuration.ServerConfiguration.AlternateBaseAddresses +=
|
|
"opc.tcp://192.168.1.100:62541/UA/SampleServer";
|
|
configuration.ServerConfiguration.AlternateBaseAddresses +=
|
|
"https://192.168.1.100:62542/UA/SampleServer";
|
|
configuration.ServerConfiguration.AlternateBaseAddresses +=
|
|
"opc.https://[2003:d9:1f0c:5e00:4139:ee31:6cc3:313e]:62540/UA/SampleServer";
|
|
configuration.ServerConfiguration.AlternateBaseAddresses +=
|
|
"opc.tcp://[2003:d9:1f0c:5e00:4139:ee31:6cc3:313e]:62541/UA/SampleServer";
|
|
configuration.ServerConfiguration.AlternateBaseAddresses +=
|
|
"https://[2003:d9:1f0c:5e00:4139:ee31:6cc3:313e]:62542/UA/SampleServer";
|
|
}
|
|
|
|
if (m_testConfiguration
|
|
is TestConfigurations.SingleBaseAdressesWithAlternatePort
|
|
or TestConfigurations.SingleBaseAddressesWithAlternateHostAndPort
|
|
or TestConfigurations.DualBaseAdressesWithAlternatePort
|
|
or TestConfigurations.DualBaseAddressesWithAlternateHostAndPort)
|
|
{
|
|
// port forwarded to external address, different port and hostname
|
|
configuration.ServerConfiguration.AlternateBaseAddresses +=
|
|
"opc.https://externalhostname.com:50000/UA/SampleServer";
|
|
configuration.ServerConfiguration.AlternateBaseAddresses +=
|
|
"opc.tcp://externalhostname.com:50001/UA/SampleServer";
|
|
configuration.ServerConfiguration.AlternateBaseAddresses +=
|
|
"https://externalhostname.com:50002/UA/SampleServer";
|
|
}
|
|
|
|
InitializeBaseAddresses(configuration);
|
|
|
|
// add security policies.
|
|
configuration.ServerConfiguration.SecurityPolicies =
|
|
[
|
|
new ServerSecurityPolicy(),
|
|
new ServerSecurityPolicy
|
|
{
|
|
SecurityMode = MessageSecurityMode.None,
|
|
SecurityPolicyUri = SecurityPolicies.None
|
|
},
|
|
new ServerSecurityPolicy
|
|
{
|
|
SecurityMode = MessageSecurityMode.Sign,
|
|
SecurityPolicyUri = SecurityPolicies.Aes128_Sha256_RsaOaep
|
|
},
|
|
new ServerSecurityPolicy
|
|
{
|
|
SecurityMode = MessageSecurityMode.SignAndEncrypt,
|
|
SecurityPolicyUri = SecurityPolicies.Aes256_Sha256_RsaPss
|
|
}
|
|
];
|
|
|
|
// ensure at least one user token policy exists.
|
|
var userTokenPolicyAnonymous = new UserTokenPolicy
|
|
{
|
|
TokenType = UserTokenType.Anonymous
|
|
};
|
|
configuration.ServerConfiguration.UserTokenPolicies += userTokenPolicyAnonymous;
|
|
var userTokenPolicyUserName = new UserTokenPolicy
|
|
{
|
|
TokenType = UserTokenType.UserName
|
|
};
|
|
configuration.ServerConfiguration.UserTokenPolicies += userTokenPolicyUserName;
|
|
var userTokenPolicyCertificate = new UserTokenPolicy
|
|
{
|
|
TokenType = UserTokenType.Certificate
|
|
};
|
|
configuration.ServerConfiguration.UserTokenPolicies += userTokenPolicyCertificate;
|
|
|
|
// set server description.
|
|
m_serverDescription = new ApplicationDescription
|
|
{
|
|
ApplicationUri = configuration.ApplicationUri,
|
|
ApplicationName = new LocalizedText("en-US", configuration.ApplicationName),
|
|
ApplicationType = configuration.ApplicationType,
|
|
ProductUri = configuration.ProductUri,
|
|
DiscoveryUrls = GetDiscoveryUrls()
|
|
};
|
|
|
|
var endpoints = new List<EndpointDescription>();
|
|
|
|
// add endpoints.
|
|
foreach (string baseAddress in configuration.ServerConfiguration.BaseAddresses)
|
|
{
|
|
bool isUaTcp = false;
|
|
string transportProfileUri = Profiles.UaTcpTransport;
|
|
if (baseAddress.StartsWith(Utils.UriSchemeHttps, StringComparison.Ordinal))
|
|
{
|
|
transportProfileUri = Profiles.HttpsBinaryTransport;
|
|
}
|
|
else if (baseAddress.StartsWith(Utils.UriSchemeOpcHttps, StringComparison.Ordinal))
|
|
{
|
|
transportProfileUri = Profiles.HttpsBinaryTransport;
|
|
}
|
|
else if (baseAddress.StartsWith(Utils.UriSchemeOpcWss, StringComparison.Ordinal))
|
|
{
|
|
transportProfileUri = Profiles.UaWssTransport;
|
|
}
|
|
else
|
|
{
|
|
isUaTcp = true;
|
|
}
|
|
|
|
foreach (ServerSecurityPolicy securityConfiguration in configuration.ServerConfiguration.SecurityPolicies)
|
|
{
|
|
// Only one secure endpoint for non opc.tcp protocols
|
|
if (!isUaTcp &&
|
|
securityConfiguration.SecurityMode != MessageSecurityMode.SignAndEncrypt)
|
|
{
|
|
continue;
|
|
}
|
|
|
|
var endpoint = new EndpointDescription
|
|
{
|
|
EndpointUrl = baseAddress,
|
|
Server = m_serverDescription,
|
|
TransportProfileUri = transportProfileUri,
|
|
SecurityMode = securityConfiguration.SecurityMode,
|
|
SecurityPolicyUri = securityConfiguration.SecurityPolicyUri,
|
|
SecurityLevel = ServerSecurityPolicy.CalculateSecurityLevel(
|
|
securityConfiguration.SecurityMode,
|
|
securityConfiguration.SecurityPolicyUri,
|
|
LoggerUtils.Null.Logger)
|
|
};
|
|
endpoint.UserIdentityTokens = GetUserTokenPolicies(configuration, endpoint);
|
|
endpoints.Add(endpoint);
|
|
|
|
if (!isUaTcp)
|
|
{
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
m_endpoints = endpoints.ToArrayOf();
|
|
}
|
|
|
|
[OneTimeTearDown]
|
|
protected void OneTimeTearDown()
|
|
{
|
|
}
|
|
|
|
[SetUp]
|
|
protected void SetUp()
|
|
{
|
|
}
|
|
|
|
[TearDown]
|
|
protected void TearDown()
|
|
{
|
|
}
|
|
|
|
/// <summary>
|
|
/// Ensure .
|
|
/// </summary>
|
|
[Test]
|
|
[TestCase(
|
|
"opc.tcp://localhost:51210/UA/SampleServer",
|
|
"opc.tcp://LOCALHOST:51210/UA/SampleServer")]
|
|
public void NormalizeEndpoints(string clientUrl1, string clientUrl2)
|
|
{
|
|
var clientUri1 = new Uri(clientUrl1);
|
|
var clientUri2 = new Uri(clientUrl2);
|
|
|
|
Assert.That(clientUri2, Is.EqualTo(clientUri1));
|
|
Assert.That(clientUri2.IdnHost, Is.EqualTo(clientUri1.IdnHost));
|
|
Assert.That(clientUri2.IdnHost, Is.EqualTo(clientUri1.IdnHost));
|
|
|
|
Assert.That(
|
|
Utils.NormalizedIPAddress(clientUri2.IdnHost),
|
|
Is.EqualTo(Utils.NormalizedIPAddress(clientUri1.IdnHost)));
|
|
}
|
|
|
|
/// <summary>
|
|
/// For any filter applied, ensure there is at least one endpoint returned.
|
|
/// </summary>
|
|
[Theory]
|
|
public void FilterByClientUrlTest(
|
|
[ValueSource(nameof(ClientUrls))] string endpointUrl,
|
|
bool noUrlExtension)
|
|
{
|
|
TestContext.Out.WriteLine("Endpoint Url: {0}", endpointUrl);
|
|
Uri parsedEndpointUrl = Utils.ParseUri(endpointUrl);
|
|
if (noUrlExtension)
|
|
{
|
|
try
|
|
{
|
|
parsedEndpointUrl = new Uri(
|
|
parsedEndpointUrl.GetLeftPart(UriPartial.Authority));
|
|
TestContext.Out.WriteLine($"Using left part of Url: {parsedEndpointUrl}");
|
|
}
|
|
catch (UriFormatException e)
|
|
{
|
|
TestContext.Out.WriteLine($"Exception: {e.Message}");
|
|
Assert.Ignore("Invalid Left Part of URL");
|
|
}
|
|
}
|
|
IList<BaseAddress> filteredBaseAddresses
|
|
= FilterByEndpointUrl(
|
|
parsedEndpointUrl,
|
|
BaseAddresses);
|
|
Assert.That(filteredBaseAddresses, Is.Not.Null);
|
|
Assert.That(filteredBaseAddresses, Is.Not.Empty);
|
|
TestContext.Out.WriteLine($"Filtered endpoints: {filteredBaseAddresses.Count}");
|
|
foreach (BaseAddress baseaddress in filteredBaseAddresses)
|
|
{
|
|
TestContext.Out.WriteLine($"Endpoint: {baseaddress.Url}");
|
|
}
|
|
Assert.That(filteredBaseAddresses, Is.Not.Empty);
|
|
for (int i = 0; i < filteredBaseAddresses.Count; i++)
|
|
{
|
|
for (int v = i + 1; v < filteredBaseAddresses.Count; v++)
|
|
{
|
|
Assert.That(filteredBaseAddresses[v].Url, Is.Not.EqualTo(filteredBaseAddresses[i].Url));
|
|
}
|
|
}
|
|
}
|
|
|
|
/// <summary>
|
|
/// For any filter and translation applied, ensure there is at least one endpoint returned.
|
|
/// </summary>
|
|
[Theory]
|
|
public void TranslateEndpointDescriptionsTest(
|
|
[ValueSource(nameof(ClientUrls))] string endpointUrl,
|
|
bool noUrlExtension)
|
|
{
|
|
IList<BaseAddress> baseAddresses = BaseAddresses;
|
|
Uri parsedEndpointUrl = Utils.ParseUri(endpointUrl);
|
|
if (noUrlExtension)
|
|
{
|
|
try
|
|
{
|
|
parsedEndpointUrl = new Uri(
|
|
parsedEndpointUrl.GetLeftPart(UriPartial.Authority));
|
|
}
|
|
catch (UriFormatException e)
|
|
{
|
|
TestContext.Out.WriteLine($"Exception: {e.Message}");
|
|
Assert.Ignore("Invalid Left Part of URL");
|
|
}
|
|
parsedEndpointUrl = new Uri(parsedEndpointUrl.GetLeftPart(UriPartial.Authority));
|
|
}
|
|
if (parsedEndpointUrl != null)
|
|
{
|
|
baseAddresses = FilterByEndpointUrl(parsedEndpointUrl, BaseAddresses);
|
|
}
|
|
Assert.That(BaseAddressCount, Is.GreaterThan(0));
|
|
ArrayOf<EndpointDescription> translatedEndpoints = TranslateEndpointDescriptions(
|
|
parsedEndpointUrl,
|
|
baseAddresses,
|
|
m_endpoints,
|
|
m_serverDescription);
|
|
Assert.That(translatedEndpoints.IsNull, Is.False);
|
|
Assert.That(translatedEndpoints.Count, Is.GreaterThan(0));
|
|
foreach (EndpointDescription endpoint in translatedEndpoints)
|
|
{
|
|
TestContext.Out.WriteLine(
|
|
$"Endpoint: {endpoint.EndpointUrl} {endpoint.SecurityMode} {endpoint.SecurityPolicyUri}");
|
|
}
|
|
|
|
// validate results do not contain duplicates.
|
|
foreach (EndpointDescription endpoint in translatedEndpoints)
|
|
{
|
|
ArrayOf<EndpointDescription> matches = translatedEndpoints.Filter(e => e.EndpointUrl == endpoint.EndpointUrl);
|
|
Assert.That(matches.Count, Is.GreaterThanOrEqualTo(1));
|
|
}
|
|
|
|
// validate results have matching UserTokenPolicies in baseaddresses
|
|
foreach (EndpointDescription translatedEndpoint in translatedEndpoints)
|
|
{
|
|
var translatedUri = new Uri(translatedEndpoint.EndpointUrl);
|
|
|
|
ArrayOf<EndpointDescription> matches = m_endpoints
|
|
.Filter(endpoint =>
|
|
{
|
|
var endpointUri = new Uri(endpoint.EndpointUrl);
|
|
return endpoint.TransportProfileUri == translatedEndpoint.TransportProfileUri &&
|
|
endpoint.SecurityMode == translatedEndpoint.SecurityMode &&
|
|
endpoint.SecurityPolicyUri == translatedEndpoint.SecurityPolicyUri &&
|
|
endpoint.BinaryEncodingId == translatedEndpoint.BinaryEncodingId &&
|
|
endpointUri.Scheme == translatedUri.Scheme &&
|
|
(m_testConfiguration
|
|
is not TestConfigurations.SingleBaseAddressesWithAlternateHostAndPort
|
|
and not TestConfigurations.SingleBaseAdressesWithAlternatePort
|
|
and not TestConfigurations.DualBaseAddressesWithAlternateHostAndPort
|
|
and not TestConfigurations.DualBaseAdressesWithAlternatePort ?
|
|
endpointUri.Port == translatedUri.Port :
|
|
endpointUri.Port % 10 == translatedUri.Port % 10) &&
|
|
Utils.IsEqual(
|
|
endpoint.UserIdentityTokens,
|
|
translatedEndpoint.UserIdentityTokens);
|
|
});
|
|
|
|
Assert.That(matches.Count, Is.GreaterThan(0));
|
|
EndpointDescription firstMatch = matches[0];
|
|
Assert.That(
|
|
translatedEndpoint.UserIdentityTokens.Count,
|
|
Is.EqualTo(firstMatch.UserIdentityTokens.Count));
|
|
for (int i = 0; i < firstMatch.UserIdentityTokens.Count; i++)
|
|
{
|
|
Assert.That(
|
|
translatedEndpoint.UserIdentityTokens[i].TokenType,
|
|
Is.EqualTo(firstMatch.UserIdentityTokens[i].TokenType));
|
|
Assert.That(
|
|
translatedEndpoint.UserIdentityTokens[i].PolicyId,
|
|
Is.EqualTo(firstMatch.UserIdentityTokens[i].PolicyId));
|
|
}
|
|
Assert.That(translatedEndpoint.BinaryEncodingId, Is.EqualTo(firstMatch.BinaryEncodingId));
|
|
Assert.That(translatedEndpoint.SecurityMode, Is.EqualTo(firstMatch.SecurityMode));
|
|
Assert.That(translatedEndpoint.SecurityPolicyUri, Is.EqualTo(firstMatch.SecurityPolicyUri));
|
|
var firstMatchEndpointUrl = new Uri(firstMatch.EndpointUrl);
|
|
var translatedEndpointUrl = new Uri(translatedEndpoint.EndpointUrl);
|
|
if (m_testConfiguration
|
|
is not TestConfigurations.SingleBaseAddressesWithAlternateHostAndPort
|
|
and not TestConfigurations.SingleBaseAdressesWithAlternatePort
|
|
and not TestConfigurations.DualBaseAddressesWithAlternateHostAndPort
|
|
and not TestConfigurations.DualBaseAdressesWithAlternatePort)
|
|
{
|
|
Assert.That(translatedEndpointUrl.Port, Is.EqualTo(firstMatchEndpointUrl.Port));
|
|
Assert.That(
|
|
translatedEndpointUrl.LocalPath,
|
|
Is.EqualTo(firstMatchEndpointUrl.LocalPath));
|
|
}
|
|
else if (firstMatchEndpointUrl.Port != translatedEndpointUrl.Port)
|
|
{
|
|
// ensure port is translated and mapped to the first base address with the same scheme.
|
|
Assert.That(
|
|
translatedEndpointUrl.Port % 10,
|
|
Is.EqualTo(firstMatchEndpointUrl.Port % 10));
|
|
|
|
ArrayOf<EndpointDescription> theSchemes = m_endpoints
|
|
.Filter(endpoint =>
|
|
endpoint.EndpointUrl
|
|
.StartsWith(translatedEndpointUrl.Scheme, StringComparison.Ordinal));
|
|
Assert.That(firstMatch.EndpointUrl, Is.EqualTo(theSchemes[0].EndpointUrl));
|
|
}
|
|
Assert.That(translatedEndpointUrl.Scheme, Is.EqualTo(firstMatchEndpointUrl.Scheme));
|
|
|
|
// validate results have matching scheme with a port index.
|
|
if (translatedEndpointUrl.Scheme == Utils.UriSchemeHttps)
|
|
{
|
|
Assert.That(translatedEndpointUrl.Port % 10, Is.EqualTo(2));
|
|
}
|
|
if (translatedEndpointUrl.Scheme == Utils.UriSchemeOpcHttps)
|
|
{
|
|
Assert.That(translatedEndpointUrl.Port % 10, Is.Zero);
|
|
}
|
|
else if (translatedEndpointUrl.Scheme == Utils.UriSchemeOpcTcp)
|
|
{
|
|
Assert.That(translatedEndpointUrl.Port % 10, Is.EqualTo(1));
|
|
}
|
|
}
|
|
}
|
|
|
|
/// <summary>
|
|
/// Verifies that a server configured with multiple IP addresses on the same port
|
|
/// correctly filters and translates endpoints based on the IP address used by the client.
|
|
/// </summary>
|
|
[Test]
|
|
public void MultipleIPsSamePortTest()
|
|
{
|
|
if (m_testConfiguration != TestConfigurations.MultipleIPsSamePort)
|
|
{
|
|
Assert.Ignore("Not applicable for this configuration.");
|
|
}
|
|
|
|
// Verify that the base addresses include same-port entries for different IPs.
|
|
Assert.That(BaseAddresses, Has.Count.EqualTo(BaseAddressCount));
|
|
|
|
// Verify that opc.tcp has exactly 2 base addresses (localhost and 192.168.1.100)
|
|
// both on the same port - this is the core scenario under test.
|
|
var tcpAddresses = BaseAddresses
|
|
.Where(a => a.Url.Scheme == Utils.UriSchemeOpcTcp)
|
|
.ToList();
|
|
Assert.That(tcpAddresses, Has.Count.EqualTo(2),
|
|
"There should be 2 opc.tcp base addresses for the MultipleIPsSamePort configuration.");
|
|
Assert.That(tcpAddresses[0].Url.Port, Is.EqualTo(tcpAddresses[1].Url.Port),
|
|
"Both opc.tcp base addresses should use the same port number.");
|
|
Assert.That(tcpAddresses[0].Url.Host, Is.Not.EqualTo(tcpAddresses[1].Url.Host),
|
|
"The two opc.tcp base addresses should have different host names/IP addresses.");
|
|
|
|
// When a client connects using the specific IP address, FilterByEndpointUrl
|
|
// should return only the base addresses for that IP (one per scheme).
|
|
var ipClientUri = new Uri("opc.tcp://192.168.1.100:62541/UA/SampleServer");
|
|
IList<BaseAddress> filteredByIp = FilterByEndpointUrl(ipClientUri, BaseAddresses);
|
|
|
|
Assert.That(filteredByIp, Is.Not.Null);
|
|
Assert.That(filteredByIp, Is.Not.Empty);
|
|
|
|
foreach (BaseAddress addr in filteredByIp)
|
|
{
|
|
Assert.That(addr.Url.Host, Is.EqualTo("192.168.1.100"),
|
|
"A client connecting via a specific IP should only receive endpoints for that IP.");
|
|
}
|
|
|
|
// Translate the endpoints for the IP-based client and verify the translated
|
|
// endpoint URLs use the client's IP address, not the server's hostname.
|
|
ArrayOf<EndpointDescription> translatedForIp = TranslateEndpointDescriptions(
|
|
ipClientUri, filteredByIp, m_endpoints, m_serverDescription);
|
|
|
|
Assert.That(translatedForIp.IsNull, Is.False);
|
|
Assert.That(translatedForIp.Count, Is.GreaterThan(0));
|
|
|
|
foreach (EndpointDescription ep in translatedForIp)
|
|
{
|
|
var epUri = new Uri(ep.EndpointUrl);
|
|
Assert.That(epUri.Host, Is.EqualTo("192.168.1.100"),
|
|
"Translated endpoint URLs should use the IP address that the client connected with.");
|
|
}
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionNullDescriptionReturnsFalse()
|
|
{
|
|
bool result = RequireEncryption(null);
|
|
Assert.That(result, Is.False);
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionNonePolicyReturnsFalse()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
SecurityPolicyUri = SecurityPolicies.None,
|
|
UserIdentityTokens =
|
|
[
|
|
new UserTokenPolicy
|
|
{
|
|
TokenType = UserTokenType.Anonymous,
|
|
SecurityPolicyUri = SecurityPolicies.None
|
|
}
|
|
]
|
|
};
|
|
bool result = RequireEncryption(desc);
|
|
Assert.That(result, Is.False);
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionBasic256Sha256ReturnsTrue()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
SecurityPolicyUri = SecurityPolicies.Basic256Sha256
|
|
};
|
|
bool result = RequireEncryption(desc);
|
|
Assert.That(result, Is.True);
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionAes128ReturnsTrue()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
SecurityPolicyUri = SecurityPolicies.Aes128_Sha256_RsaOaep
|
|
};
|
|
bool result = RequireEncryption(desc);
|
|
Assert.That(result, Is.True);
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionAes256ReturnsTrue()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
SecurityPolicyUri = SecurityPolicies.Aes256_Sha256_RsaPss
|
|
};
|
|
bool result = RequireEncryption(desc);
|
|
Assert.That(result, Is.True);
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionNonePolicyWithSecuredTokenReturnsTrue()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
SecurityPolicyUri = SecurityPolicies.None,
|
|
UserIdentityTokens =
|
|
[
|
|
new UserTokenPolicy
|
|
{
|
|
TokenType = UserTokenType.UserName,
|
|
SecurityPolicyUri = SecurityPolicies.Basic256Sha256
|
|
}
|
|
]
|
|
};
|
|
bool result = RequireEncryption(desc);
|
|
Assert.That(result, Is.True);
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionNonePolicyWithMultipleTokens()
|
|
{
|
|
// One anonymous (None) and one username with encryption
|
|
var desc = new EndpointDescription
|
|
{
|
|
SecurityPolicyUri = SecurityPolicies.None,
|
|
UserIdentityTokens =
|
|
[
|
|
new UserTokenPolicy
|
|
{
|
|
TokenType = UserTokenType.Anonymous,
|
|
SecurityPolicyUri = SecurityPolicies.None
|
|
},
|
|
new UserTokenPolicy
|
|
{
|
|
TokenType = UserTokenType.UserName,
|
|
SecurityPolicyUri = SecurityPolicies.Aes256_Sha256_RsaPss
|
|
}
|
|
]
|
|
};
|
|
bool result = RequireEncryption(desc);
|
|
Assert.That(result, Is.True);
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionNonePolicyAllTokensNone()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
SecurityPolicyUri = SecurityPolicies.None,
|
|
UserIdentityTokens =
|
|
[
|
|
new UserTokenPolicy
|
|
{
|
|
TokenType = UserTokenType.Anonymous,
|
|
SecurityPolicyUri = SecurityPolicies.None
|
|
}
|
|
]
|
|
};
|
|
bool result = RequireEncryption(desc);
|
|
Assert.That(result, Is.False);
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionEmptyUserTokens()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
SecurityPolicyUri = SecurityPolicies.None,
|
|
UserIdentityTokens = []
|
|
};
|
|
bool result = RequireEncryption(desc);
|
|
Assert.That(result, Is.False);
|
|
}
|
|
|
|
[Test]
|
|
public void EndpointDescriptionSecurityLevelDefaults()
|
|
{
|
|
var desc = new EndpointDescription();
|
|
Assert.That(desc.SecurityLevel, Is.Zero);
|
|
}
|
|
|
|
[Test]
|
|
public void EndpointDescriptionSecurityModeDefault()
|
|
{
|
|
var desc = new EndpointDescription();
|
|
Assert.That(
|
|
desc.SecurityMode,
|
|
Is.EqualTo(MessageSecurityMode.Invalid));
|
|
}
|
|
|
|
[Test]
|
|
public void UserTokenPolicyDefaultValues()
|
|
{
|
|
var policy = new UserTokenPolicy();
|
|
Assert.That(policy.PolicyId, Is.Null);
|
|
Assert.That(
|
|
policy.TokenType,
|
|
Is.EqualTo(UserTokenType.Anonymous));
|
|
}
|
|
|
|
[Test]
|
|
public void UserTokenPolicyWithTokenType()
|
|
{
|
|
var policy = new UserTokenPolicy(UserTokenType.Certificate);
|
|
Assert.That(policy.TokenType, Is.EqualTo(UserTokenType.Certificate));
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionEccNistP256ReturnsTrue()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
SecurityPolicyUri = SecurityPolicies.ECC_nistP256
|
|
};
|
|
bool result = RequireEncryption(desc);
|
|
Assert.That(result, Is.True);
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionEccBrainpoolReturnsTrue()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
SecurityPolicyUri = SecurityPolicies.ECC_brainpoolP256r1
|
|
};
|
|
bool result = RequireEncryption(desc);
|
|
Assert.That(result, Is.True);
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionNonePolicyX509TokenWithPolicy()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
SecurityPolicyUri = SecurityPolicies.None,
|
|
UserIdentityTokens =
|
|
[
|
|
new UserTokenPolicy
|
|
{
|
|
TokenType = UserTokenType.Certificate,
|
|
SecurityPolicyUri = SecurityPolicies.Aes128_Sha256_RsaOaep
|
|
}
|
|
]
|
|
};
|
|
bool result = RequireEncryption(desc);
|
|
Assert.That(result, Is.True);
|
|
}
|
|
|
|
[Test]
|
|
public void EndpointDescriptionServerCertificateDefault()
|
|
{
|
|
var desc = new EndpointDescription();
|
|
Assert.That(desc.ServerCertificate.IsEmpty, Is.True);
|
|
}
|
|
|
|
[Test]
|
|
public void EndpointDescriptionEndpointUrlCanBeSet()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
EndpointUrl = "opc.tcp://localhost:4840"
|
|
};
|
|
Assert.That(desc.EndpointUrl, Is.EqualTo("opc.tcp://localhost:4840"));
|
|
}
|
|
|
|
[Test]
|
|
public void EndpointDescriptionTransportProfileUriCanBeSet()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
TransportProfileUri = Profiles.UaTcpTransport
|
|
};
|
|
Assert.That(desc.TransportProfileUri, Is.EqualTo(Profiles.UaTcpTransport));
|
|
}
|
|
|
|
[Test]
|
|
public void RequireEncryptionNonePolicyIssuedTokenWithPolicy()
|
|
{
|
|
var desc = new EndpointDescription
|
|
{
|
|
SecurityPolicyUri = SecurityPolicies.None,
|
|
UserIdentityTokens =
|
|
[
|
|
new UserTokenPolicy
|
|
{
|
|
TokenType = UserTokenType.IssuedToken,
|
|
SecurityPolicyUri = SecurityPolicies.Basic256Sha256
|
|
}
|
|
]
|
|
};
|
|
bool result = RequireEncryption(desc);
|
|
Assert.That(result, Is.True);
|
|
}
|
|
}
|
|
}
|