mirror of
https://github.com/open62541/open62541.git
synced 2026-10-28 04:29:55 +08:00
Niels Beier
bc59fa83a4
Regression test for #6943: connect with the default config, then call UA_ClientConfig_setDefaultEncryption while still connected -- it now succeeds since the array is pre-sized and never reallocated -- and confirm both the existing channel and a fresh reconnect using the newly configured encryption keep working.
225 lines
8.3 KiB
C
225 lines
8.3 KiB
C
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
*
|
|
* Copyright 2019 (c) Kalycito Infotech Private Limited
|
|
*
|
|
*/
|
|
|
|
#include <open62541/client.h>
|
|
#include <open62541/client_config_default.h>
|
|
#include <open62541/client_highlevel.h>
|
|
#include <open62541/plugin/securitypolicy.h>
|
|
#include <open62541/plugin/pki_default.h>
|
|
#include <open62541/server.h>
|
|
#include <open62541/server_config_default.h>
|
|
|
|
#include "client/ua_client_internal.h"
|
|
#include "ua_server_internal.h"
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
|
|
#include "../encryption/certificates.h"
|
|
#include "check.h"
|
|
#include "testing_clock.h"
|
|
#include "testing_networklayers.h"
|
|
#include "thread_wrapper.h"
|
|
|
|
UA_Server *server;
|
|
UA_Boolean running;
|
|
THREAD_HANDLE server_thread;
|
|
|
|
THREAD_CALLBACK(serverloop) {
|
|
while(running)
|
|
UA_Server_run_iterate(server, true);
|
|
return 0;
|
|
}
|
|
|
|
static void setup(void) {
|
|
running = true;
|
|
|
|
/* Load certificate and private key */
|
|
UA_ByteString certificate;
|
|
certificate.length = CERT_DER_LENGTH;
|
|
certificate.data = CERT_DER_DATA;
|
|
|
|
UA_ByteString privateKey;
|
|
privateKey.length = KEY_DER_LENGTH;
|
|
privateKey.data = KEY_DER_DATA;
|
|
|
|
size_t trustListSize = 0;
|
|
UA_ByteString *trustList = NULL;
|
|
size_t issuerListSize = 0;
|
|
UA_ByteString *issuerList = NULL;
|
|
UA_ByteString *revocationList = NULL;
|
|
size_t revocationListSize = 0;
|
|
|
|
server = UA_Server_new();
|
|
ck_assert(server != NULL);
|
|
UA_ServerConfig *config = UA_Server_getConfig(server);
|
|
UA_ServerConfig_setDefaultWithSecurityPolicies(config, 4840, &certificate, &privateKey,
|
|
trustList, trustListSize,
|
|
issuerList, issuerListSize,
|
|
revocationList, revocationListSize);
|
|
|
|
UA_CertificateVerification_AcceptAll(&config->secureChannelPKI);
|
|
UA_CertificateVerification_AcceptAll(&config->sessionPKI);
|
|
|
|
/* Set the ApplicationUri used in the certificate */
|
|
UA_String_clear(&config->applicationDescription.applicationUri);
|
|
config->applicationDescription.applicationUri =
|
|
UA_STRING_ALLOC("urn:unconfigured:application");
|
|
|
|
UA_Server_run_startup(server);
|
|
THREAD_CREATE(server_thread, serverloop);
|
|
}
|
|
|
|
static void teardown(void) {
|
|
running = false;
|
|
THREAD_JOIN(server_thread);
|
|
UA_Server_run_shutdown(server);
|
|
UA_Server_delete(server);
|
|
}
|
|
|
|
/* Test re-activating a Session on a new SecureChannel */
|
|
START_TEST(encryption_reconnect_session) {
|
|
UA_Client *client = NULL;
|
|
UA_ByteString *trustList = NULL;
|
|
size_t trustListSize = 0;
|
|
UA_ByteString *revocationList = NULL;
|
|
size_t revocationListSize = 0;
|
|
|
|
/* Load certificate and private key */
|
|
UA_ByteString certificate;
|
|
certificate.length = CERT_DER_LENGTH;
|
|
certificate.data = CERT_DER_DATA;
|
|
ck_assert_uint_ne(certificate.length, 0);
|
|
|
|
UA_ByteString privateKey;
|
|
privateKey.length = KEY_DER_LENGTH;
|
|
privateKey.data = KEY_DER_DATA;
|
|
ck_assert_uint_ne(privateKey.length, 0);
|
|
|
|
/* Secure client initialization */
|
|
client = UA_Client_new();
|
|
UA_ClientConfig *cc = UA_Client_getConfig(client);
|
|
UA_ClientConfig_setDefaultEncryption(cc, certificate, privateKey,
|
|
trustList, trustListSize,
|
|
revocationList, revocationListSize);
|
|
UA_CertificateVerification_AcceptAll(&cc->certificateVerification);
|
|
cc->securityPolicyUri =
|
|
UA_STRING_ALLOC("http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256");
|
|
ck_assert(client != NULL);
|
|
|
|
/* Secure client connect */
|
|
UA_StatusCode retval = UA_Client_connect(client, "opc.tcp://localhost:4840");
|
|
ck_assert_uint_eq(retval, UA_STATUSCODE_GOOD);
|
|
|
|
UA_Variant val;
|
|
UA_Variant_init(&val);
|
|
UA_NodeId nodeId = UA_NODEID_NUMERIC(0, UA_NS0ID_SERVER_SERVERSTATUS_STATE);
|
|
retval = UA_Client_readValueAttribute(client, nodeId, &val);
|
|
ck_assert_uint_eq(retval, UA_STATUSCODE_GOOD);
|
|
UA_Variant_clear(&val);
|
|
|
|
UA_NodeId oldAuthToken = client->authenticationToken;
|
|
|
|
/* Close the SecureChannel without closing the session */
|
|
UA_Client_disconnectSecureChannel(client);
|
|
|
|
/* Reconnect. This reuses the previous session. */
|
|
retval = UA_Client_connect(client, "opc.tcp://localhost:4840");
|
|
ck_assert_uint_eq(retval, UA_STATUSCODE_GOOD);
|
|
|
|
/* Read the variable. That reactivates the session first. */
|
|
retval = UA_Client_readValueAttribute(client, nodeId, &val);
|
|
ck_assert_uint_eq(retval, UA_STATUSCODE_GOOD);
|
|
UA_Variant_clear(&val);
|
|
|
|
ck_assert(UA_NodeId_equal(&oldAuthToken, &client->authenticationToken));
|
|
|
|
UA_Client_disconnect(client);
|
|
UA_Client_delete(client);
|
|
}
|
|
END_TEST
|
|
|
|
/* Regression test for a heap-use-after-free: UA_ClientConfig_setDefaultEncryption
|
|
* reallocates config->securityPolicies. The SecureChannel used to keep a raw
|
|
* pointer into that array, so reallocating it while the channel was still
|
|
* open left a dangling pointer that crashed on the next use. The channel now
|
|
* keeps its own private copy of the SecurityPolicy instead, so reconfiguring
|
|
* encryption on a still-connected client no longer affects it at all -- this
|
|
* test confirms the reconfiguration succeeds and the client keeps working
|
|
* normally afterwards, both on the still-open channel and after a fresh
|
|
* reconnect that actually uses the newly configured encryption. */
|
|
START_TEST(encryption_setDefaultEncryption_whileConnected_doesNotCrash) {
|
|
UA_Client *client = UA_Client_new();
|
|
ck_assert(client != NULL);
|
|
|
|
/* Connect first with the default (unencrypted) configuration */
|
|
UA_StatusCode retval = UA_Client_connect(client, "opc.tcp://localhost:4840");
|
|
ck_assert_uint_eq(retval, UA_STATUSCODE_GOOD);
|
|
|
|
/* Load certificate and private key */
|
|
UA_ByteString certificate;
|
|
certificate.length = CERT_DER_LENGTH;
|
|
certificate.data = CERT_DER_DATA;
|
|
|
|
UA_ByteString privateKey;
|
|
privateKey.length = KEY_DER_LENGTH;
|
|
privateKey.data = KEY_DER_DATA;
|
|
|
|
/* Reconfiguring encryption while the SecureChannel is still open and in
|
|
* use must not crash -- and, since the channel no longer references
|
|
* config->securityPolicies directly, it now succeeds outright. */
|
|
UA_ClientConfig *cc = UA_Client_getConfig(client);
|
|
retval = UA_ClientConfig_setDefaultEncryption(cc, certificate, privateKey,
|
|
NULL, 0, NULL, 0);
|
|
ck_assert_uint_eq(retval, UA_STATUSCODE_GOOD);
|
|
UA_CertificateVerification_AcceptAll(&cc->certificateVerification);
|
|
|
|
/* The still-open (unencrypted) channel must remain fully usable */
|
|
UA_Variant val;
|
|
UA_Variant_init(&val);
|
|
UA_NodeId nodeId = UA_NODEID_NUMERIC(0, UA_NS0ID_SERVER_SERVERSTATUS_STATE);
|
|
retval = UA_Client_readValueAttribute(client, nodeId, &val);
|
|
ck_assert_uint_eq(retval, UA_STATUSCODE_GOOD);
|
|
UA_Variant_clear(&val);
|
|
|
|
/* A fresh channel using the newly configured encryption must also work */
|
|
UA_String_clear(&cc->securityPolicyUri);
|
|
cc->securityPolicyUri =
|
|
UA_STRING_ALLOC("http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256");
|
|
UA_Client_disconnectSecureChannel(client);
|
|
retval = UA_Client_connect(client, "opc.tcp://localhost:4840");
|
|
ck_assert_uint_eq(retval, UA_STATUSCODE_GOOD);
|
|
retval = UA_Client_readValueAttribute(client, nodeId, &val);
|
|
ck_assert_uint_eq(retval, UA_STATUSCODE_GOOD);
|
|
UA_Variant_clear(&val);
|
|
|
|
UA_Client_disconnect(client);
|
|
UA_Client_delete(client);
|
|
}
|
|
END_TEST
|
|
|
|
static Suite* testSuite_encryption(void) {
|
|
Suite *s = suite_create("Encryption");
|
|
TCase *tc_encryption = tcase_create("Encryption basic256sha256");
|
|
tcase_add_checked_fixture(tc_encryption, setup, teardown);
|
|
tcase_add_test(tc_encryption, encryption_reconnect_session);
|
|
tcase_add_test(tc_encryption, encryption_setDefaultEncryption_whileConnected_doesNotCrash);
|
|
suite_add_tcase(s,tc_encryption);
|
|
return s;
|
|
}
|
|
|
|
int main(void) {
|
|
Suite *s = testSuite_encryption();
|
|
SRunner *sr = srunner_create(s);
|
|
srunner_set_fork_status(sr, CK_NOFORK);
|
|
srunner_run_all(sr,CK_NORMAL);
|
|
int number_failed = srunner_ntests_failed(sr);
|
|
srunner_free(sr);
|
|
return (number_failed == 0) ? EXIT_SUCCESS : EXIT_FAILURE;
|
|
}
|