mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-20 00:31:32 +08:00
Marc Schier
d1883832e1
* merged security changes
* Tailor SecurityPolicyUri for format expected in s_securityPolicyUriToInfo
* Enhance security policy handling and key computation logic
* Merge SecurityEnhancements.
* Add support for SessionTransferToken. Removed obsolete SoftwareCertificate code.
* Fix NonceLength for None.
* Add support for RSA_DH, more fixes from IOP testings.
* Finish implementation of SecureChannelEnhancements.
* Rename EccUtils.cs to CryptoUtils.cs
* Address feedback from reviewers.
* Fix CoPilot flagged spelling errors.
* Rename EccUtils to CryptoUtils
* Update version from 1.5.378-preview to 1.5.378
* Fix unit tests.
* Allow SignatureData.Algorithm to be NULL or Empty.
* Fix issue with BrainPool_p256r1_ChaChaPoly
* Fix RSA_DH_AesGcm
* Fix OSC/padding by deriving HMAC keys, tightening symmetric size math, and correcting ECC_brainpoolP384r1/Basic128Rsa15 IV, signature, padding, and nonce parameters.
* Policies without asymmetric encryption (ECC) return the plaintext when encrypting user tokens; this prevents null payloads from causing BadIdentityTokenInvalid.
* Reserve outer CBC padding for avoiding SymetricEncryptAndSign->AddPadding to overwrite next fields (signature)
* Nonce stored as byte array in SessionConfiguration; Sesion snapshot restores ServerNonce and reconstructs ECC ephemeral key Nonce from bytes and policy
* Added _AesGcm and _ChaChaPoly variants to BuildSupportedSecurityPolicies() for all six ECC certificate types (nistP256, nistP384, brainpoolP256r1, brainpoolP384r1, curve25519, curve448) to SecurityConfiguration. Added Sign and SignAndEncrypt endpoints for the four ECC AesGcm/ChaChaPoly policy pairs (nistP256, nistP384, brainpoolP256r1, brainpoolP384r1) to ServerFixture.
* make ephemeralKeyPolicyUri nullable
* GenerateSecret also for NET7 and NET8
* Adjust Basic128Rsa15 policy properties for backword compatibility
* Exclude unsuported AEAD policies from .NET Framework client tests
* Addapt to new changes (still build fail)
* Addapt code to make it compile
* Fixed failing build on net48 (by ignoring potential null ref which is not reported on other newer targets)
* Preserve the certificate reference in Clone() so copied handlers can still sign
* Remove extra code and addapt to existing master configuration settings
* Filter *_AesGcm and *_ChaChaPoly security policies based on actual runtime support, so unsupported AEAD policies are not advertised or selected on older frameworks
* Expand ECC/RSA policy test coverage and keep Basic128Rsa15 nonce length backward-compatible
* Fix ReconnectSessionOnAlternateChannel _AES and _ChaCha policies
* Fixed IgnoreIfPolicyNotAdvertised so it now fetches endpoints on-demand (instead of relying on Endpoints being preloaded by earlier tests), which avoids false ignores when running tests directlyy
* Merge with commit 5e627f2ca1 from secure-channel-enhancements-2025-11 branch
* minor log mesatge formating
* Fix ClientLockoutTests
* Add ServerFixture policies upfront only if framework and runtime capability supports them
* A few cosmetic/config changes as review sugested
* Moved the session/security handling from StandardServer into a dedicated helper
* use X509IdentityTokenHandler from secure-channel-enhancements-2025-11
* Removed unused Opc.Ua.Types.UnitTests.csproj
* test(client): fix Basic128Rsa15 reconnect token-policy coverage
Advertise an explicit Basic128Rsa15 user token policy in the test fixture and tighten the reconnect test preconditions for non-advertised policies.
* test(client): fix session nonce persistence test helpers
Replace the generic reflection helpers in SessionTests with explicit client/server nonce accessors that match the actual field types.
Add a short Session comment to explain why client and server nonces currently use different representations.
* Merge branch 'master' into secure-channel-enhancements-2025-11-merge5
Merge with latest master and fix conflicts.
* Removed unused Opc.Ua.Types.UnitTests.csproj
* test(client): fix Basic128Rsa15 reconnect token-policy coverage
Advertise an explicit Basic128Rsa15 user token policy in the test fixture and tighten the reconnect test preconditions for non-advertised policies.
* test(client): fix session nonce persistence test helpers
Replace the generic reflection helpers in SessionTests with explicit client/server nonce accessors that match the actual field types.
Add a short Session comment to explain why client and server nonces currently use different representations.
* Build fixes
* Fix build
* update
* Minor updates
* Fix tests
* Add code to check all Endpoints.
* Update Design files to 1.05.7
* Run code fixers, add missing docs
* Fix build
* Revert removal of using
* Increase build timeout
---------
Co-authored-by: mrsuciu <Mircea-Adrian.Suciu@Softing.com>
Co-authored-by: Randy Armstrong <randy@sparhawksoftware.com>
139 lines
7.2 KiB
XML
139 lines
7.2 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<ApplicationConfiguration
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xmlns:ua="http://opcfoundation.org/UA/2008/02/Types.xsd"
|
|
xmlns="http://opcfoundation.org/UA/SDK/Configuration.xsd"
|
|
>
|
|
<ApplicationName>Quickstart Console Reference Client</ApplicationName>
|
|
<ApplicationUri>urn:localhost:UA:Quickstarts:ReferenceClient</ApplicationUri>
|
|
<ProductUri>uri:opcfoundation.org:Quickstarts:ReferenceClient</ProductUri>
|
|
<ApplicationType>Client_1</ApplicationType>
|
|
<SecurityConfiguration>
|
|
<!-- Where the application instance certificate is stored (MachineDefault) -->
|
|
<ApplicationCertificates>
|
|
<CertificateIdentifier>
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
|
|
<SubjectName>CN=Quickstart Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
|
|
<CertificateTypeString>RsaSha256</CertificateTypeString>
|
|
</CertificateIdentifier>
|
|
<CertificateIdentifier>
|
|
<!-- <TypeId>NistP256</TypeId> -->
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
|
|
<SubjectName>CN=Quickstart Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
|
|
<CertificateTypeString>NistP256</CertificateTypeString>
|
|
</CertificateIdentifier>
|
|
<CertificateIdentifier>
|
|
<!-- <TypeId>NistP384</TypeId> -->
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
|
|
<SubjectName>CN=Quickstart Reference client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
|
|
<CertificateTypeString>NistP384</CertificateTypeString>
|
|
</CertificateIdentifier>
|
|
<CertificateIdentifier>
|
|
<!-- <TypeId>BrainpoolP256r1</TypeId> -->
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
|
|
<SubjectName>CN=Quickstart Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
|
|
<CertificateTypeString>BrainpoolP256r1</CertificateTypeString>
|
|
</CertificateIdentifier>
|
|
<CertificateIdentifier>
|
|
<!-- <TypeId>BrainpoolP384r1</TypeId> -->
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/own</StorePath>
|
|
<SubjectName>CN=Quickstart Reference Client, C=US, S=Arizona, O=OPC Foundation, DC=localhost</SubjectName>
|
|
<CertificateTypeString>BrainpoolP384r1</CertificateTypeString>
|
|
</CertificateIdentifier>
|
|
</ApplicationCertificates>
|
|
<!-- Where the issuer certificate are stored (certificate authorities) -->
|
|
<TrustedIssuerCertificates>
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/issuer</StorePath>
|
|
</TrustedIssuerCertificates>
|
|
<!-- Where the trust list is stored -->
|
|
<TrustedPeerCertificates>
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/trusted</StorePath>
|
|
</TrustedPeerCertificates>
|
|
<!-- The directory used to store invalid certificates for later review by the administrator. -->
|
|
<RejectedCertificateStore>
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/rejected</StorePath>
|
|
</RejectedCertificateStore>
|
|
<MaxRejectedCertificates>5</MaxRejectedCertificates>
|
|
<!-- WARNING: The following setting (to automatically accept untrusted certificates) should be used
|
|
for easy debugging purposes ONLY and turned off for production deployments! -->
|
|
<AutoAcceptUntrustedCertificates>false</AutoAcceptUntrustedCertificates>
|
|
<!-- WARNING: SHA1 signed certificates are by default rejected and should be phased out.
|
|
only nano and embedded profiles are allowed to use sha1 signed certificates. -->
|
|
<RejectSHA1SignedCertificates>true</RejectSHA1SignedCertificates>
|
|
<RejectUnknownRevocationStatus>true</RejectUnknownRevocationStatus>
|
|
<MinimumCertificateKeySize>2048</MinimumCertificateKeySize>
|
|
<AddAppCertToTrustedStore>false</AddAppCertToTrustedStore>
|
|
<SendCertificateChain>true</SendCertificateChain>
|
|
<!-- Where the User issers list is stored-->
|
|
<UserIssuerCertificates>
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/userIssuer</StorePath>
|
|
</UserIssuerCertificates>
|
|
<!-- Where the User trust list is stored-->
|
|
<TrustedUserCertificates>
|
|
<StoreType>Directory</StoreType>
|
|
<StorePath>%LocalApplicationData%/OPC Foundation/pki/trustedUser</StorePath>
|
|
</TrustedUserCertificates>
|
|
</SecurityConfiguration>
|
|
<TransportConfigurations></TransportConfigurations>
|
|
<TransportQuotas>
|
|
<OperationTimeout>120000</OperationTimeout>
|
|
<MaxStringLength>4194304</MaxStringLength>
|
|
<MaxByteStringLength>4194304</MaxByteStringLength>
|
|
<MaxArrayLength>65535</MaxArrayLength>
|
|
<MaxMessageSize>4194304</MaxMessageSize>
|
|
<MaxBufferSize>65535</MaxBufferSize>
|
|
<ChannelLifetime>300000</ChannelLifetime>
|
|
<SecurityTokenLifetime>3600000</SecurityTokenLifetime>
|
|
</TransportQuotas>
|
|
<ClientConfiguration>
|
|
<DefaultSessionTimeout>60000</DefaultSessionTimeout>
|
|
<WellKnownDiscoveryUrls>
|
|
<ua:String>opc.tcp://{0}:4840</ua:String>
|
|
<ua:String>http://{0}:52601/UADiscovery</ua:String>
|
|
<ua:String>http://{0}/UADiscovery/Default.svc</ua:String>
|
|
</WellKnownDiscoveryUrls>
|
|
<DiscoveryServers></DiscoveryServers>
|
|
<MinSubscriptionLifetime>10000</MinSubscriptionLifetime>
|
|
<OperationLimits>
|
|
<MaxNodesPerRead>2500</MaxNodesPerRead>
|
|
<MaxNodesPerHistoryReadData>1000</MaxNodesPerHistoryReadData>
|
|
<MaxNodesPerHistoryReadEvents>1000</MaxNodesPerHistoryReadEvents>
|
|
<MaxNodesPerWrite>2500</MaxNodesPerWrite>
|
|
<MaxNodesPerHistoryUpdateData>1000</MaxNodesPerHistoryUpdateData>
|
|
<MaxNodesPerHistoryUpdateEvents>1000</MaxNodesPerHistoryUpdateEvents>
|
|
<MaxNodesPerMethodCall>2500</MaxNodesPerMethodCall>
|
|
<MaxNodesPerBrowse>2500</MaxNodesPerBrowse>
|
|
<MaxNodesPerRegisterNodes>2500</MaxNodesPerRegisterNodes>
|
|
<MaxNodesPerTranslateBrowsePathsToNodeIds>2500</MaxNodesPerTranslateBrowsePathsToNodeIds>
|
|
<MaxNodesPerNodeManagement>2500</MaxNodesPerNodeManagement>
|
|
<MaxMonitoredItemsPerCall>2500</MaxMonitoredItemsPerCall>
|
|
</OperationLimits>
|
|
</ClientConfiguration>
|
|
<Extensions></Extensions>
|
|
<TraceConfiguration>
|
|
<OutputFilePath>%LocalApplicationData%/OPC Foundation/Logs/Quickstarts.ReferenceClient.log.txt</OutputFilePath>
|
|
<DeleteOnLoad>true</DeleteOnLoad>
|
|
<!-- Show Only Errors -->
|
|
<!-- <TraceMasks>1</TraceMasks> -->
|
|
<!-- Show Only Security and Errors -->
|
|
<!-- <TraceMasks>513</TraceMasks> -->
|
|
<!-- Show Only Security, Errors and Trace -->
|
|
<!-- <TraceMasks>515</TraceMasks> -->
|
|
<!-- Show Only Security, COM Calls, Errors and Trace -->
|
|
<!-- <TraceMasks>771</TraceMasks> -->
|
|
<!-- Show Only Security, Service Calls, Errors and Trace -->
|
|
<!-- <TraceMasks>523</TraceMasks> -->
|
|
<!-- Show Only Security, ServiceResultExceptions, Errors and Trace -->
|
|
<!-- <TraceMasks>519</TraceMasks> -->
|
|
</TraceConfiguration>
|
|
</ApplicationConfiguration>
|