mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-18 14:43:08 +08:00
Marc Schier
0612a43fe4
Makes the stack's cryptographic operations replaceable - by another library, an offboard service, or hardware (TPM 2.0 / HSM / PKCS#11 token / cloud KMS) - with no performance cost in the default configuration, and extends this to certificates so a private key need never exist in process memory. Also fixes three pre-existing defects found while validating: STACKGEN001 erroring for every compilation the stack generator was merely loaded into, certificates failing to load from paths past MAX_PATH on Windows, and the MonitoredNode2 tests starving the thread pool. Fixes #4190
101 lines
3.8 KiB
C#
101 lines
3.8 KiB
C#
/* ========================================================================
|
|
* Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
|
|
*
|
|
* OPC Foundation MIT License 1.00
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person
|
|
* obtaining a copy of this software and associated documentation
|
|
* files (the "Software"), to deal in the Software without
|
|
* restriction, including without limitation the rights to use,
|
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the
|
|
* Software is furnished to do so, subject to the following
|
|
* conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be
|
|
* included in all copies or substantial portions of the Software.
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
|
|
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
|
|
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
|
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
|
* OTHER DEALINGS IN THE SOFTWARE.
|
|
*
|
|
* The complete license agreement can be found here:
|
|
* http://opcfoundation.org/License/MIT/1.00/
|
|
* ======================================================================*/
|
|
|
|
using System;
|
|
using System.IO;
|
|
using System.Security.Cryptography;
|
|
|
|
namespace Opc.Ua.Core.TestFramework
|
|
{
|
|
/// <summary>
|
|
/// Hashing helper shared by the non exportable key test doubles.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// The base implementations of <c>RSA.HashData</c> and <c>ECDsa.HashData</c>
|
|
/// are not guaranteed to be usable on every target framework the stack
|
|
/// supports, so the test doubles override them and route here instead.
|
|
/// </remarks>
|
|
internal static class NonExportableKeyHash
|
|
{
|
|
/// <summary>
|
|
/// Hashes a region of a buffer with the requested algorithm.
|
|
/// </summary>
|
|
public static byte[] Compute(
|
|
byte[] data,
|
|
int offset,
|
|
int count,
|
|
HashAlgorithmName hashAlgorithm)
|
|
{
|
|
using HashAlgorithm algorithm = Create(hashAlgorithm);
|
|
return algorithm.ComputeHash(data, offset, count);
|
|
}
|
|
|
|
/// <summary>
|
|
/// Hashes a stream with the requested algorithm.
|
|
/// </summary>
|
|
public static byte[] Compute(Stream data, HashAlgorithmName hashAlgorithm)
|
|
{
|
|
using HashAlgorithm algorithm = Create(hashAlgorithm);
|
|
return algorithm.ComputeHash(data);
|
|
}
|
|
|
|
private static HashAlgorithm Create(HashAlgorithmName hashAlgorithm)
|
|
{
|
|
if (hashAlgorithm == HashAlgorithmName.SHA256)
|
|
{
|
|
return SHA256.Create();
|
|
}
|
|
|
|
if (hashAlgorithm == HashAlgorithmName.SHA384)
|
|
{
|
|
return SHA384.Create();
|
|
}
|
|
|
|
if (hashAlgorithm == HashAlgorithmName.SHA512)
|
|
{
|
|
return SHA512.Create();
|
|
}
|
|
|
|
if (hashAlgorithm == HashAlgorithmName.SHA1)
|
|
{
|
|
// CA5350: SHA-1 is required here because the OPC UA specification's
|
|
// deprecated Basic128Rsa15 and Basic256 security policies use it. This
|
|
// is a test double that must be able to mirror every algorithm the
|
|
// stack supports; it never selects SHA-1 on its own.
|
|
#pragma warning disable CA5350
|
|
return SHA1.Create();
|
|
#pragma warning restore CA5350
|
|
}
|
|
|
|
throw new CryptographicException(
|
|
$"The hash algorithm '{hashAlgorithm.Name}' is not supported by the test double.");
|
|
}
|
|
}
|
|
}
|