handling of securechannels restored

examples/src/opcuaServerACPLT.c

@@ -49,6 +49,7 @@ Server server;
 UA_Int32 server_writer(TL_Connection* connection, UA_ByteString** gather_buf, UA_UInt32 gather_len) {
 	UA_UInt32 total_len = 0;
 	for(UA_UInt32 i=0;i<gather_len;i++) {
+	fflush(stdout);
 		total_len += gather_buf[i]->length;
 	}
     UA_ByteString msg;
@@ -59,6 +60,8 @@ UA_Int32 server_writer(TL_Connection* connection, UA_ByteString** gather_buf, UA
 		memcpy(msg.data+pos, gather_buf[i]->data, gather_buf[i]->length);
 		pos += gather_buf[i]->length;
 	}
+	UA_ByteString_printf("new msg: ", &msg);
+	fflush(stdout);
 	server.writeData.data = msg.data;
 	server.writeData.length = msg.length;
 	server.newDataToWrite = 1;

src/ua_services_securechannel.c

@@ -1,6 +1,8 @@
 #include "ua_services.h"
+#include "ua_transport_binary_secure.h"
 
 UA_Int32 Service_OpenSecureChannel(SL_Channel *channel, const UA_OpenSecureChannelRequest* request, UA_OpenSecureChannelResponse* response) {
+	
 	if (request->clientProtocolVersion != channel->tlConnection->remoteConf.protocolVersion) {
 		printf("SL_processMessage - error protocol version \n");
 		//TODO ERROR_Bad_ProtocolVersionUnsupported
@@ -62,8 +64,7 @@ UA_Int32 Service_OpenSecureChannel(SL_Channel *channel, const UA_OpenSecureChann
 	response->securityToken.channelId = channel->securityToken.secureChannelId;
 	response->securityToken.tokenId = channel->securityToken.tokenId;
 	response->securityToken.revisedLifetime = channel->securityToken.revisedLifetime;
-
-	UA_ByteString_copy(&(channel->localNonce), &(response->serverNonce));
+	UA_ByteString_copy(&channel->localNonce, &response->serverNonce);
 	return retval;
 }
 

src/ua_transport.h

@@ -31,8 +31,7 @@ typedef enum {
 
 /* MessageType */
 typedef UA_Int32 UA_MessageType;
-enum UA_MessageType
-{
+enum UA_MessageType {
 	UA_MESSAGETYPE_HEL = 0x48454C, // H E L
 	UA_MESSAGETYPE_ACK = 0x41434B, // A C k
 	UA_MESSAGETYPE_ERR = 0x455151, // E R R

src/ua_transport_binary.c

@@ -11,13 +11,11 @@ static UA_Int32 TL_check(TL_Connection* connection, UA_ByteString* msg) {
 	return UA_SUCCESS;
 }
 
-static UA_Int32 TL_handleHello(TL_Connection* connection, UA_ByteString* msg, UA_Int32* pos) {
+static UA_Int32 TL_handleHello(TL_Connection* connection, const UA_ByteString* msg, UA_Int32* pos) {
 	UA_Int32 retval = UA_SUCCESS;
 	UA_Int32 tmpPos = 0;
 	UA_OPCUATcpHelloMessage helloMessage;
 
-	printf("\nstate: %i", connection->connectionState);
-	printf("\nwanted state: %i", CONNECTIONSTATE_CLOSED);
 	if (connection->connectionState == CONNECTIONSTATE_CLOSED) {
 		DBG_VERBOSE(printf("TL_process - extracting header information \n"));
 		UA_OPCUATcpHelloMessage_decodeBinary(msg,pos,&helloMessage);
@@ -60,9 +58,7 @@ static UA_Int32 TL_handleHello(TL_Connection* connection, UA_ByteString* msg, UA
 		UA_OPCUATcpAcknowledgeMessage_encodeBinary(&ackMessage,&tmpPos,ack_msg);
 
 		DBG_VERBOSE(printf("TL_process - Size messageToSend = %d, pos=%d\n",ackHeader.messageSize, tmpPos));
-		UA_ByteString_printx("ack: ", ack_msg);
-		TL_Send(connection, &ack_msg, 1);
-		printf("finished wiritng");
+		TL_Send(connection, (const UA_ByteString **) &ack_msg, 1);
 		UA_ByteString_delete(ack_msg);
 	} else {
 		DBG_ERR(printf("TL_process - wrong connection state \n"));
@@ -71,33 +67,33 @@ static UA_Int32 TL_handleHello(TL_Connection* connection, UA_ByteString* msg, UA
 	return retval;
 }
 
-static UA_Int32 TL_handleOpen(TL_Connection* connection, UA_ByteString* msg, UA_Int32* pos) {
+static UA_Int32 TL_handleOpen(TL_Connection* connection, const UA_ByteString* msg, UA_Int32* pos) {
 	if (connection->connectionState == CONNECTIONSTATE_ESTABLISHED) {
-		return SL_Channel_new(connection,msg,pos); // create new secure channel and associate with this TL connection
+		return SL_Channel_new(connection, msg, pos);
 	}
 	return UA_ERR_INVALID_VALUE;
 }
 
-static UA_Int32 TL_handleMsg(TL_Connection* connection, UA_ByteString* msg, UA_Int32* pos) {
+static UA_Int32 TL_handleMsg(TL_Connection* connection, const UA_ByteString* msg, UA_Int32* pos) {
 	SL_Channel* slc = connection->secureChannel;
-	return SL_process(slc,msg,pos);
+	return SL_Process(slc,msg,pos);
 }
 
-static UA_Int32 TL_handleClo(TL_Connection* connection, UA_ByteString* msg, UA_Int32* pos) {
+static UA_Int32 TL_handleClo(TL_Connection* connection, const UA_ByteString* msg, UA_Int32* pos) {
 	SL_Channel* slc = connection->secureChannel;
 	connection->connectionState = CONNECTIONSTATE_CLOSE;
-	return SL_process(slc,msg,pos);
+	return UA_SUCCESS;
 }
 
-UA_Int32 TL_Process(TL_Connection* connection, UA_ByteString* msg) {
+UA_Int32 TL_Process(TL_Connection* connection, const UA_ByteString* msg) {
 	UA_Int32 retval = UA_SUCCESS;
 	UA_Int32 pos = 0;
 	UA_OPCUATcpMessageHeader tcpMessageHeader;
 
-	DBG_VERBOSE(printf("TL_process - entered \n"));
+	DBG_VERBOSE(printf("TL_Process - entered \n"));
 
 	if ((retval = UA_OPCUATcpMessageHeader_decodeBinary(msg, &pos, &tcpMessageHeader)) == UA_SUCCESS) {
-		printf("TL_process - messageType=%.*s\n",3,msg->data);
+		printf("TL_Process - messageType=%.*s\n",3,msg->data);
 		switch(tcpMessageHeader.messageType) {
 		case UA_MESSAGETYPE_HEL:
 			retval = TL_handleHello(connection, msg, &pos);
@@ -116,20 +112,20 @@ UA_Int32 TL_Process(TL_Connection* connection, UA_ByteString* msg) {
 			break;
 		}
 	}
-	if (retval != UA_SUCCESS) {
-		// FIXME: compose real error message
-		UA_ByteString errorMsg;
-		UA_ByteString *errorMsg_ptr = &errorMsg;
-		UA_ByteString_newMembers(&errorMsg,10);
-		TL_Send(connection,&errorMsg_ptr, 1);
-		UA_ByteString_deleteMembers(&errorMsg);
-	}
+	/* if (retval != UA_SUCCESS) { */
+	/* 	// FIXME: compose real error message */
+	/* 	UA_ByteString errorMsg; */
+	/* 	UA_ByteString *errorMsg_ptr = &errorMsg; */
+	/* 	UA_ByteString_newMembers(&errorMsg,10); */
+	/* 	TL_Send(connection,(const UA_ByteString **)&errorMsg_ptr, 1); */
+	/* 	UA_ByteString_deleteMembers(&errorMsg); */
+	/* } */
 	UA_OPCUATcpMessageHeader_deleteMembers(&tcpMessageHeader);
 	return retval;
 }
 
 /** respond to client request */
-UA_Int32 TL_Send(TL_Connection* connection, UA_ByteString** gather_buf, UA_UInt32 gather_len) {
+UA_Int32 TL_Send(TL_Connection* connection, const UA_ByteString** gather_buf, UA_UInt32 gather_len) {
 	UA_Int32 retval = UA_SUCCESS;
 	DBG_VERBOSE(printf("TL_send - entered \n"));
 	//	if (TL_check(connection,msg,TL_CHECK_REMOTE) == UA_SUCCESS) {

src/ua_transport_binary.h

@@ -24,7 +24,7 @@ typedef struct {
 
 /* Transport Layer Connection */
 struct TL_Connection_T; // forward declaration
-typedef UA_Int32 (*TL_Writer)(struct TL_Connection_T* connection, UA_ByteString** gather_bufs, UA_Int32 gather_len); // send mutiple buffer concatenated into one msg (zero copy)
+typedef UA_Int32 (*TL_Writer)(struct TL_Connection_T* connection, const UA_ByteString** gather_bufs, UA_Int32 gather_len); // send mutiple buffer concatenated into one msg (zero copy)
 
 typedef struct TL_Connection_T {
 	UA_Int32 connectionHandle;
@@ -37,7 +37,7 @@ typedef struct TL_Connection_T {
 	struct SL_Channel_T* secureChannel;
 } TL_Connection;
 
-UA_Int32 TL_Send(TL_Connection* connection, UA_ByteString** gather_buf, UA_UInt32 gather_len);
-UA_Int32 TL_Process(TL_Connection *connection, UA_ByteString *packet);
+UA_Int32 TL_Send(TL_Connection* connection, const UA_ByteString** gather_buf, UA_UInt32 gather_len);
+UA_Int32 TL_Process(TL_Connection *connection, const UA_ByteString *packet);
 
 #endif /* OPCUA_TRANSPORT_BINARY_H_ */

src/ua_transport_binary_secure.c

@@ -12,18 +12,25 @@
 
 SL_Channel slc;
 
-static UA_Int32 SL_send(SL_Channel* channel, UA_ByteString const * responseMessage, UA_Int32 type) {
+static UA_Int32 SL_Send(SL_Channel* channel, const UA_ByteString * responseMessage, UA_Int32 type) {
 	UA_Int32 pos = 0;
-	UA_Int32 isAsym = (type == 449); // FIXME: this is a to dumb method to determine asymmetric algorithm setting
-
-	UA_ByteString response_gather[2]; // securechannel_header, seq_header, security_encryption_header, message_length (eventually + padding + size_signature);
-	UA_ByteString_newMembers(&response_gather[0], SIZE_SECURECHANNEL_HEADER + SIZE_SEQHEADER_HEADER +
-							 + (isAsym ? UA_AsymmetricAlgorithmSecurityHeader_calcSize(&(channel->localAsymAlgSettings)) :
-								UA_AsymmetricAlgorithmSecurityHeader_calcSize(&(channel->localAsymAlgSettings))));
+	UA_Int32 isAsym = (type == UA_OPENSECURECHANNELRESPONSE_NS0); // FIXME: this is a to dumb method to determine asymmetric algorithm setting
+
+	UA_NodeId resp_nodeid;
+	resp_nodeid.encodingByte = UA_NODEIDTYPE_FOURBYTE;
+	resp_nodeid.namespace = 0;
+	resp_nodeid.identifier.numeric = type+2; // binary encoding
+
+	const UA_ByteString *response_gather[2]; // securechannel_header, seq_header, security_encryption_header, message_length (eventually + padding + size_signature);
+	UA_alloc((void **)&response_gather[0], sizeof(UA_ByteString));
+	UA_ByteString_newMembers((UA_ByteString *)response_gather[0], SIZE_SECURECHANNEL_HEADER + SIZE_SEQHEADER_HEADER +
+							 (isAsym ? UA_AsymmetricAlgorithmSecurityHeader_calcSize(&(channel->localAsymAlgSettings)) :
+							  UA_AsymmetricAlgorithmSecurityHeader_calcSize(&(channel->localAsymAlgSettings))) +
+							 UA_NodeId_calcSize(&resp_nodeid));
 	
 	// sizePadding = 0;
 	// sizeSignature = 0;
-    UA_ByteString *header = &response_gather[0];
+    UA_ByteString *header = (UA_ByteString *)response_gather[0];
 
 	/*---encode Secure Conversation Message Header ---*/
 	if (isAsym) {
@@ -39,7 +46,7 @@ static UA_Int32 SL_send(SL_Channel* channel, UA_ByteString const * responseMessa
 	header->data[pos] = 'F';
 	pos += 1;
 
-    UA_Int32 packetSize = response_gather[0].length + responseMessage->length;
+    UA_Int32 packetSize = response_gather[0]->length + responseMessage->length;
 	UA_Int32_encodeBinary(&packetSize, &pos, header);
 	UA_UInt32_encodeBinary(&channel->securityToken.secureChannelId, &pos, header);
 
@@ -54,21 +61,25 @@ static UA_Int32 SL_send(SL_Channel* channel, UA_ByteString const * responseMessa
 	UA_UInt32_encodeBinary(&channel->sequenceHeader.sequenceNumber, &pos, header);
 	UA_UInt32_encodeBinary(&channel->sequenceHeader.requestId, &pos, header);
 
+	/*---add payload type---*/
+	UA_NodeId_encodeBinary(&resp_nodeid, &pos, header);
+	
 	/*---add encoded Message ---*/
-    response_gather[1] = *responseMessage;
+    response_gather[1] = responseMessage; // is deleted in the calling function
 
 	/* sign Data*/
 
 	/* encrypt Data*/
 
 	/* send Data */
-    TL_Send(channel->tlConnection, (UA_ByteString **) &response_gather, 2);
+    TL_Send(channel->tlConnection, response_gather, 2);
 
-	UA_ByteString_deleteMembers(&response_gather[0]);
+	UA_ByteString_delete((UA_ByteString *)response_gather[0]);
 	return UA_SUCCESS;
 }
 
 static void init_response_header(UA_RequestHeader const * p, UA_ResponseHeader * r) {
+	memset((void*) r, 0, sizeof(UA_ResponseHeader));
 	r->requestHandle = p->requestHandle;
 	r->serviceResult = UA_STATUSCODE_GOOD;
 	r->stringTableSize = 0;
@@ -78,139 +89,98 @@ static void init_response_header(UA_RequestHeader const * p, UA_ResponseHeader *
 #define INVOKE_SERVICE(TYPE) \
 	UA_##TYPE##Request p; \
 	UA_##TYPE##Response r; \
-	UA_##TYPE##Request_decodeBinary(msg, &pos, &p); \
+	UA_##TYPE##Request_decodeBinary(msg, pos, &p); \
 	init_response_header((UA_RequestHeader*)&p, (UA_ResponseHeader*)&r); \
+	DBG_VERBOSE(printf("Invoke Service: %s\n", #TYPE)); \
 	Service_##TYPE(channel, &p, &r); \
-	UA_ByteString_newMembers(&response_msg, UA_##TYPE##Response_calcSize(&r)+pos); \
-	UA_##TYPE##Response_encodeBinary(&r, &pos, &response_msg); \
+	DBG_VERBOSE(printf("Finished Service: %s\n", #TYPE)); \
+    *pos = 0; \
+	UA_ByteString_newMembers(&response_msg, UA_##TYPE##Response_calcSize(&r)); \
+	UA_##TYPE##Response_encodeBinary(&r, pos, &response_msg); \
 
 /** this function manages all the generic stuff for the request-response game */
-UA_Int32 SL_handleRequest(SL_Channel *channel, UA_ByteString* msg) {
+UA_Int32 SL_handleRequest(SL_Channel *channel, const UA_ByteString* msg, UA_Int32 *pos) {
 	UA_Int32 retval = UA_SUCCESS;
-	UA_Int32 pos = 0;
 
 	// Every Message starts with a NodeID which names the serviceRequestType
 	UA_NodeId serviceRequestType;
-	UA_NodeId_decodeBinary(msg, &pos, &serviceRequestType);
+	UA_NodeId_decodeBinary(msg, pos, &serviceRequestType);
 	UA_NodeId_printf("SL_processMessage - serviceRequestType=", &serviceRequestType);
 
 	UA_ByteString response_msg;
-	UA_NodeId responseType;
-	responseType.encodingByte = UA_NODEIDTYPE_FOURBYTE;
-	responseType.namespace = 0;
-
-    pos = UA_NodeId_calcSize(&responseType); // skip nodeid
 	int serviceid = serviceRequestType.identifier.numeric-2; // binary encoding has 2 added to the id
+    UA_Int32 responsetype;
 	if(serviceid == UA_GETENDPOINTSREQUEST_NS0) {
 		INVOKE_SERVICE(GetEndpoints);
-		responseType.identifier.numeric = UA_GETENDPOINTSRESPONSE_NS0;
+		responsetype = UA_GETENDPOINTSRESPONSE_NS0;
 	}
 	else if(serviceid == UA_OPENSECURECHANNELREQUEST_NS0) {
 		INVOKE_SERVICE(OpenSecureChannel);
-		responseType.identifier.numeric = UA_OPENSECURECHANNELRESPONSE_NS0;
+		responsetype = UA_OPENSECURECHANNELRESPONSE_NS0;
 	}
 	else if(serviceid == UA_CLOSESECURECHANNELREQUEST_NS0) {
 		INVOKE_SERVICE(CloseSecureChannel);
-		responseType.identifier.numeric = UA_CLOSESECURECHANNELRESPONSE_NS0;
+		responsetype = UA_CLOSESECURECHANNELRESPONSE_NS0;
 	}
 	else if(serviceid == UA_CREATESESSIONREQUEST_NS0) {
 		INVOKE_SERVICE(CreateSession);
-		responseType.identifier.numeric = UA_CREATESESSIONRESPONSE_NS0;
+		responsetype = UA_CREATESESSIONRESPONSE_NS0;
 	}
 	else if(serviceid == UA_ACTIVATESESSIONREQUEST_NS0) {
 		INVOKE_SERVICE(ActivateSession);
-		responseType.identifier.numeric = UA_ACTIVATESESSIONRESPONSE_NS0;
+		responsetype = UA_ACTIVATESESSIONRESPONSE_NS0;
 	}
 	else if(serviceid == UA_CLOSESESSIONREQUEST_NS0) {
 		INVOKE_SERVICE(CloseSession);
-		responseType.identifier.numeric = UA_CLOSESESSIONRESPONSE_NS0;
+		responsetype = UA_CLOSESESSIONRESPONSE_NS0;
 	}
 	else if(serviceid == UA_READREQUEST_NS0) {
 		INVOKE_SERVICE(Read);
-	    responseType.identifier.numeric = UA_READRESPONSE_NS0;
+	    responsetype = UA_READRESPONSE_NS0;
 	}
 	else {
 		printf("SL_processMessage - unknown request, namespace=%d, request=%d\n", serviceRequestType.namespace,serviceRequestType.identifier.numeric);
 		retval = UA_ERROR;
-		responseType.identifier.numeric = 0; //FIXME
+		responsetype = 0; //FIXME
 	}
 
-	pos = 0; // reset
-	UA_NodeId_encodeBinary(&responseType, &pos, &response_msg);
-	SL_send(channel, &response_msg, responseType.identifier.numeric);
+	SL_Send(channel, &response_msg, responsetype);
 
 	return retval;
 }
 
-/* inits a connection object for secure channel layer */
-UA_Int32 SL_Channel_init(SL_Channel *channel) {
+UA_Int32 SL_Channel_new(TL_Connection *connection, const UA_ByteString* msg, UA_Int32* pos) {
+	DBG_VERBOSE(printf("SL_Channel_new - entered\n"));
+	UA_Int32 retval = UA_SUCCESS;
+
+	/* Create New Channel*/
+	SL_Channel *channel = &slc; // FIXME: generate new secure channel
 	UA_AsymmetricAlgorithmSecurityHeader_init(&(channel->localAsymAlgSettings));
 	UA_ByteString_copy(&UA_ByteString_securityPoliceNone, &(channel->localAsymAlgSettings.securityPolicyUri));
-
 	UA_alloc((void**)&(channel->localNonce.data), sizeof(UA_Byte));
 	channel->localNonce.length = 1;
-
-	channel->connectionState = CONNECTIONSTATE_CLOSED;
-
+	channel->connectionState = CONNECTIONSTATE_CLOSED; // the state of the channel will be opened in the service
 	channel->sequenceHeader.requestId = 0;
 	channel->sequenceHeader.sequenceNumber = 1;
-
 	UA_String_init(&(channel->secureChannelId));
-
 	channel->securityMode = UA_SECURITYMODE_INVALID;
-	//TODO set a valid start secureChannelId number
-	channel->securityToken.secureChannelId = 25;
-
-	//TODO set a valid start TokenId
-	channel->securityToken.tokenId = 1;
-
-	return UA_SUCCESS;
-}
+	channel->securityToken.secureChannelId = 25; //TODO set a valid start secureChannelId number
+	channel->securityToken.tokenId = 1; //TODO set a valid start TokenId
 
-UA_Int32 SL_Channel_new(TL_Connection *connection, UA_ByteString* msg, UA_Int32* pos) {
-	UA_Int32 retval = UA_SUCCESS;
-
-	UA_SecureConversationMessageHeader secureConvHeader;
-	DBG_VERBOSE(printf("SL_Channel_new - entered\n"));
-
-	// FIXME: generate new secure channel
-	SL_Channel_init(&slc);
-	connection->secureChannel = &slc;
+	connection->secureChannel = channel;
 	connection->secureChannel->tlConnection = connection;
 
-	UA_SecureConversationMessageHeader_decodeBinary(msg, pos, &secureConvHeader);
-	// connection->secureChannel->secureChannelId = secureConvHeader.secureChannelId;
-	UA_AsymmetricAlgorithmSecurityHeader_decodeBinary(msg, pos, &(connection->secureChannel->remoteAsymAlgSettings));
+	/* Read the OPN message headers */
+	*pos += 4; // skip the securechannelid
+	UA_AsymmetricAlgorithmSecurityHeader_decodeBinary(msg, pos, &connection->secureChannel->remoteAsymAlgSettings);
+	UA_SequenceHeader_decodeBinary(msg, pos, &connection->secureChannel->sequenceHeader);
 	//TODO check that the sequence number is smaller than MaxUInt32 - 1024
-	UA_SequenceHeader_decodeBinary(msg, pos, &(connection->secureChannel->sequenceHeader));
-
-	connection->secureChannel->securityToken.tokenId = 4711;
-
-	UA_ByteString_printf("SL_receive - AAS_Header.ReceiverThumbprint=", &(connection->secureChannel->remoteAsymAlgSettings.receiverCertificateThumbprint));
-	UA_ByteString_printf("SL_receive - AAS_Header.SecurityPolicyUri=", &(connection->secureChannel->remoteAsymAlgSettings.securityPolicyUri));
-	UA_ByteString_printf("SL_receive - AAS_Header.SenderCertificate=", &(connection->secureChannel->remoteAsymAlgSettings.senderCertificate));
-	printf("SL_Channel_new - SequenceHeader.RequestId=%d\n",connection->secureChannel->sequenceHeader.requestId);
-	printf("SL_Channel_new - SequenceHeader.SequenceNr=%d\n",connection->secureChannel->sequenceHeader.sequenceNumber);
-	printf("SL_Channel_new - SecurityToken.tokenID=%d\n",connection->secureChannel->securityToken.tokenId);
-
-// FIXME: reject
-//	if (secureConvHeader.secureChannelId != 0) {
-//		UA_Int32 iTmp = UA_ByteString_compare(
-//								&(connection->secureLayer.remoteAsymAlgSettings.senderCertificate),
-//								&(asymAlgSecHeader.senderCertificate));
-//				if (iTmp != UA_EQUAL) {
-//					printf("SL_receive - UA_ERROR_BadSecureChannelUnknown \n");
-//					//TODO return UA_ERROR_BadSecureChannelUnknown
-//				}
-//			} else {
-//				//TODO invalid securechannelId
-//			}
-
-	UA_ByteString slMessage;
-	slMessage.data  = &(msg->data[*pos]);
-	slMessage.length = msg->length - *pos;
-	retval |= SL_handleRequest(connection->secureChannel, &slMessage);
+	//TODO check if a OpenSecureChannelRequest follows
+
+	retval |= SL_handleRequest(channel, msg, pos);
 	return retval;
+
+	// FIXME: reject
 }
 
 /**
@@ -218,7 +188,7 @@ UA_Int32 SL_Channel_new(TL_Connection *connection, UA_ByteString* msg, UA_Int32*
  * (OPN,MSG,...), isFinal and MessageSize. SL_process cares for
  * secureChannelId, XASHeader and sequenceHeader
  * */
-UA_Int32 SL_process(SL_Channel* connection, UA_ByteString* msg, UA_Int32* pos) {
+UA_Int32 SL_Process(SL_Channel* connection, const UA_ByteString* msg, UA_Int32* pos) {
 
 	DBG_VERBOSE(printf("SL_process - entered \n"));
 	UA_UInt32 secureChannelId;
@@ -228,20 +198,13 @@ UA_Int32 SL_process(SL_Channel* connection, UA_ByteString* msg, UA_Int32* pos) {
 
 		//FIXME: we assume SAS, need to check if AAS or SAS
 		UA_SymmetricAlgorithmSecurityHeader symAlgSecHeader;
-//		if (connection->securityMode == UA_MESSAGESECURITYMODE_NONE) {
-			UA_SymmetricAlgorithmSecurityHeader_decodeBinary(msg, pos, &symAlgSecHeader);
-//		} else {
-//			// FIXME:
-//		}
+		// if (connection->securityMode == UA_MESSAGESECURITYMODE_NONE) {
+		UA_SymmetricAlgorithmSecurityHeader_decodeBinary(msg, pos, &symAlgSecHeader);
 
 		printf("SL_process - securityToken received=%d, expected=%d\n",secureChannelId,connection->securityToken.secureChannelId);
 		if (secureChannelId == connection->securityToken.secureChannelId) {
 			UA_SequenceHeader_decodeBinary(msg, pos, &(connection->sequenceHeader));
-			// process message
-			UA_ByteString slMessage;
-			slMessage.data = &(msg->data[*pos]);
-			slMessage.length = msg->length - *pos;
-			SL_handleRequest(&slc, &slMessage);
+			SL_handleRequest(&slc, msg, pos);
 		} else {
 			//TODO generate ERROR_Bad_SecureChannelUnkown
 		}

src/ua_transport_binary_secure.h

@@ -26,8 +26,7 @@ typedef struct SL_Channel_T {
 	SL_ChannelSecurityToken securityToken;
 } SL_Channel;
 
-UA_Int32 SL_initConnectionObject(SL_Channel *connection);
-UA_Int32 SL_process(SL_Channel* channel, UA_ByteString* msg, UA_Int32* pos);
-UA_Int32 SL_Channel_new(TL_Connection *connection, UA_ByteString* msg, UA_Int32* pos);
+UA_Int32 SL_Process(SL_Channel* channel, const UA_ByteString* msg, UA_Int32* pos);
+UA_Int32 SL_Channel_new(TL_Connection *connection, const UA_ByteString* msg, UA_Int32* pos); // this function is called from the OpenSecureChannel service
 
 #endif /* OPCUA_TRANSPORT_BINARY_SECURE_H_ */