We want to have the same default for client and server. So we get less
trouble with reusing certificates. Before we had to manually adjust the
client URI to say "server". That's not good...
* CI: Added support for arguments in the examples workflow
* Fixed memory leaks in examples. Add ApplicationUri
* Arguments and server/client for all examples. Small fixes
* outsource/blacklist some examples. Fix memory leak in example.
* Remove Shlex. Remove false UA_Client_delete
* Removed raw examples from ci. Fix leak in client.c and mqtt_publish
* Fix memory leak in mqtt subscriber
* feat(pubsub): Add PubSub example to use keys stored in TPM
- Need to encrypt the AES and HMAC keys using the key stored
in TPM, before running the PubSub application
- The PubSub application decrypts the keys available in the
filesystem using the TPM key
Change-Id: I41c7906675333fa46673dabae1bb6d6d1c3fbecc
* feat(tools): Support to encrypt the key file using TPM key
- Add cert_encrypt_tpm.c to read the key file present in the
file system, encrypt it using the key stored in TPM and
store the encrypted data in different file
- Delete the original key after creating encrypted key
Change-Id: I9fc77ebf0c76a990c70f4d228950fba09fc39c51
* docs(pubsub): Add README for PubSub TPM keystore application
- README includes environment setup
- Steps to generate encryption and signing keys for PubSub
- Steps to use TPM keys to encrypt the keys in filesystem
- Build and run Pubsub application
- Change CMake build flag
Change-Id: I025662bd36ed9f27c7c23b8eda6e2f52cad82021
Co-authored-by: andreasebner <andreas.ebner@iosb.fraunhofer.de>
- Encrypt the private key using the key stored in TPM
and remove the unencrypted private key from the filesystem
- Used the encrypted key intermittently for software-based
encryption/decryption
Change-Id: I46fc24102365292d9af6b51c582e3a3f74b2af5e
- At present issuer list is passed in trust list
- Add functionality to pass the issuer list separately
- Handle condition where a client is connected using
an (trusted) issued certificate of a CA that is not
trusted but available
- This resolves test case number 044.js and 045.js in
Security Certificate Validation to pass simultaneously
- usage : ./server_ctt <server-certificate.der> <private-key.der>
[--trustlist <tl1.ctl> <tl2.ctl> ... ]
[--issuerlist <il1.der> <il2.der> ... ]
[--revocationlist <rv1.crl> <rv2.crl> ...]
Change-Id: I4a25af9f4c2b771da9492fafb534f72dcc6fc17d
Signed-off-by: Asish Ganesh <asish.g@kalycito.com>
This commit drops the 'ua_' prefix and changes the public includes
to the form `#include <open62541/server.h>` instead of the old
`#include <ua_server.h>`
Make use of EXIT_SUCCESS and EXIT_FAILURE from stdlib.h.
The previous approach of returning a value from UA_StatusCode
was often broken as an exit code can (portably) only be between 0 and 125.
- Update UA_ByteString_allocBuffer() to UA_STACKARRAY() in the files
examples/encryption/client_basic128rsa15.c and examples/encryption/
client_basic256sha256.c.
- Handle return value for remote certificate verification in
ua_client.c file.
- Update create_self-signed.py to generate CA certificate in .der
format.
Change-Id: I6e84694c99c561d237ecbafb63b957d19c2e74c9
Signed-off-by: Sharavanan A R <sharavanan.ar@kalycito.com>
- The file examples/encryption/client_basic128rsa15.c provides a
secure communication between client and server by using
basic128rsa15 security policy.
- The secure client-server communication is implemented
based on the OPC UA specification Part 4, setion 6.
- Line number 176 in file src/client/ua_client.c is commented as
UA_SecureChannel_deleteMembers already done in
UA_client_disconnect function.
- Load revocation list is not supported in this commit.
Change-Id: I9aa06dce6ac000c290accc57f1147a919ec74f1e
Signed-off-by: Sharavanan A R <sharavanan.ar@kalycito.com>
Noel Graf