|
@@ -30,7 +30,7 @@
|
|
UA_SYMMETRIC_ALG_SECURITY_HEADER_LENGTH)
|
|
UA_SYMMETRIC_ALG_SECURITY_HEADER_LENGTH)
|
|
|
|
|
|
const UA_ByteString
|
|
const UA_ByteString
|
|
- UA_SECURITY_POLICY_NONE_URI = {47, (UA_Byte *) "http://opcfoundation.org/UA/SecurityPolicy#None"};
|
|
|
|
|
|
+ UA_SECURITY_POLICY_NONE_URI = {47, (UA_Byte *)"http://opcfoundation.org/UA/SecurityPolicy#None"};
|
|
|
|
|
|
#ifdef UA_ENABLE_UNIT_TEST_FAILURE_HOOKS
|
|
#ifdef UA_ENABLE_UNIT_TEST_FAILURE_HOOKS
|
|
UA_THREAD_LOCAL UA_StatusCode decrypt_verifySignatureFailure;
|
|
UA_THREAD_LOCAL UA_StatusCode decrypt_verifySignatureFailure;
|
|
@@ -50,7 +50,19 @@ UA_SecureChannel_init(UA_SecureChannel *channel,
|
|
channel->state = UA_SECURECHANNELSTATE_FRESH;
|
|
channel->state = UA_SECURECHANNELSTATE_FRESH;
|
|
channel->securityPolicy = securityPolicy;
|
|
channel->securityPolicy = securityPolicy;
|
|
|
|
|
|
- UA_StatusCode retval = securityPolicy->channelModule.
|
|
|
|
|
|
+ UA_StatusCode retval;
|
|
|
|
+ if(channel->securityPolicy->certificateVerification != NULL) {
|
|
|
|
+ retval = channel->securityPolicy->certificateVerification->
|
|
|
|
+ verifyCertificate(channel->securityPolicy->certificateVerification->context, remoteCertificate);
|
|
|
|
+
|
|
|
|
+ if(retval != UA_STATUSCODE_GOOD)
|
|
|
|
+ return retval;
|
|
|
|
+ } else {
|
|
|
|
+ UA_LOG_WARNING(channel->securityPolicy->logger, UA_LOGCATEGORY_SECURITYPOLICY, "No PKI plugin set. "
|
|
|
|
+ "Accepting all certificates");
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ retval = securityPolicy->channelModule.
|
|
newContext(securityPolicy, remoteCertificate, &channel->channelContext);
|
|
newContext(securityPolicy, remoteCertificate, &channel->channelContext);
|
|
if(retval != UA_STATUSCODE_GOOD)
|
|
if(retval != UA_STATUSCODE_GOOD)
|
|
return retval;
|
|
return retval;
|
|
@@ -130,7 +142,7 @@ UA_SecureChannel_generateNewKeys(UA_SecureChannel *channel) {
|
|
getLocalEncryptionKeyLength(securityPolicy, channel->channelContext);
|
|
getLocalEncryptionKeyLength(securityPolicy, channel->channelContext);
|
|
const size_t buffSize = symmetricModule->encryptionBlockSize +
|
|
const size_t buffSize = symmetricModule->encryptionBlockSize +
|
|
symmetricModule->signingKeyLength + encryptionKeyLength;
|
|
symmetricModule->signingKeyLength + encryptionKeyLength;
|
|
- UA_ByteString buffer = {buffSize, (UA_Byte *) UA_alloca(buffSize)};
|
|
|
|
|
|
+ UA_ByteString buffer = {buffSize, (UA_Byte *)UA_alloca(buffSize)};
|
|
|
|
|
|
/* Remote keys */
|
|
/* Remote keys */
|
|
UA_StatusCode retval = symmetricModule->generateKey(securityPolicy, &channel->localNonce,
|
|
UA_StatusCode retval = symmetricModule->generateKey(securityPolicy, &channel->localNonce,
|
|
@@ -205,9 +217,9 @@ calculatePaddingAsym(const UA_SecurityPolicy *securityPolicy, const void *channe
|
|
++paddingBytes;
|
|
++paddingBytes;
|
|
size_t padding = (plainTextBlockSize - ((bytesToWrite + signatureSize + paddingBytes) %
|
|
size_t padding = (plainTextBlockSize - ((bytesToWrite + signatureSize + paddingBytes) %
|
|
plainTextBlockSize));
|
|
plainTextBlockSize));
|
|
- *paddingSize = (UA_Byte) (padding & 0xff);
|
|
|
|
- *extraPaddingSize = (UA_Byte) (padding >> 8);
|
|
|
|
- return (UA_UInt16) padding;
|
|
|
|
|
|
+ *paddingSize = (UA_Byte)(padding & 0xff);
|
|
|
|
+ *extraPaddingSize = (UA_Byte)(padding >> 8);
|
|
|
|
+ return (UA_UInt16)padding;
|
|
}
|
|
}
|
|
|
|
|
|
static size_t
|
|
static size_t
|
|
@@ -230,7 +242,7 @@ hideBytesAsym(const UA_SecureChannel *channel, UA_Byte **buf_start, const UA_Byt
|
|
|
|
|
|
/* Add the SecurityHeaderLength */
|
|
/* Add the SecurityHeaderLength */
|
|
*buf_start += calculateAsymAlgSecurityHeaderLength(channel);
|
|
*buf_start += calculateAsymAlgSecurityHeaderLength(channel);
|
|
- size_t potentialEncryptionMaxSize = (size_t) (*buf_end - *buf_start) + UA_SEQUENCE_HEADER_LENGTH;
|
|
|
|
|
|
+ size_t potentialEncryptionMaxSize = (size_t)(*buf_end - *buf_start) + UA_SEQUENCE_HEADER_LENGTH;
|
|
|
|
|
|
/* Hide bytes for signature and padding */
|
|
/* Hide bytes for signature and padding */
|
|
if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGN ||
|
|
if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGN ||
|
|
@@ -290,7 +302,7 @@ UA_SecureChannel_sendAsymmetricOPNMessage(UA_SecureChannel *channel, UA_UInt32 r
|
|
&buf.data[UA_SECURE_CONVERSATION_MESSAGE_HEADER_LENGTH +
|
|
&buf.data[UA_SECURE_CONVERSATION_MESSAGE_HEADER_LENGTH +
|
|
UA_SEQUENCE_HEADER_LENGTH + securityHeaderLength];
|
|
UA_SEQUENCE_HEADER_LENGTH + securityHeaderLength];
|
|
const size_t bytesToWrite =
|
|
const size_t bytesToWrite =
|
|
- (uintptr_t) buf_pos - (uintptr_t) buf_body_start + UA_SEQUENCE_HEADER_LENGTH;
|
|
|
|
|
|
+ (uintptr_t)buf_pos - (uintptr_t)buf_body_start + UA_SEQUENCE_HEADER_LENGTH;
|
|
UA_Byte paddingSize = 0;
|
|
UA_Byte paddingSize = 0;
|
|
UA_Byte extraPaddingSize = 0;
|
|
UA_Byte extraPaddingSize = 0;
|
|
UA_UInt16 totalPaddingSize =
|
|
UA_UInt16 totalPaddingSize =
|
|
@@ -310,7 +322,7 @@ UA_SecureChannel_sendAsymmetricOPNMessage(UA_SecureChannel *channel, UA_UInt32 r
|
|
}
|
|
}
|
|
|
|
|
|
/* The total message length */
|
|
/* The total message length */
|
|
- size_t pre_sig_length = (uintptr_t) buf_pos - (uintptr_t) buf.data;
|
|
|
|
|
|
+ size_t pre_sig_length = (uintptr_t)buf_pos - (uintptr_t)buf.data;
|
|
size_t total_length = pre_sig_length;
|
|
size_t total_length = pre_sig_length;
|
|
if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGN ||
|
|
if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGN ||
|
|
channel->securityMode == UA_MESSAGESECURITYMODE_SIGNANDENCRYPT)
|
|
channel->securityMode == UA_MESSAGESECURITYMODE_SIGNANDENCRYPT)
|
|
@@ -344,7 +356,7 @@ UA_SecureChannel_sendAsymmetricOPNMessage(UA_SecureChannel *channel, UA_UInt32 r
|
|
|
|
|
|
UA_SequenceHeader seqHeader;
|
|
UA_SequenceHeader seqHeader;
|
|
seqHeader.requestId = requestId;
|
|
seqHeader.requestId = requestId;
|
|
- seqHeader.sequenceNumber = UA_atomic_add(&channel->sendSequenceNumber, 1);
|
|
|
|
|
|
+ seqHeader.sequenceNumber = UA_atomic_addUInt32(&channel->sendSequenceNumber, 1);
|
|
retval |= UA_encodeBinary(&seqHeader, &UA_TRANSPORT[UA_TRANSPORT_SEQUENCEHEADER],
|
|
retval |= UA_encodeBinary(&seqHeader, &UA_TRANSPORT[UA_TRANSPORT_SEQUENCEHEADER],
|
|
&header_pos, &buf_end, NULL, NULL);
|
|
&header_pos, &buf_end, NULL, NULL);
|
|
|
|
|
|
@@ -399,12 +411,12 @@ UA_SecureChannel_sendAsymmetricOPNMessage(UA_SecureChannel *channel, UA_UInt32 r
|
|
static UA_UInt16
|
|
static UA_UInt16
|
|
calculatePaddingSym(const UA_SecurityPolicy *securityPolicy, const void *channelContext,
|
|
calculatePaddingSym(const UA_SecurityPolicy *securityPolicy, const void *channelContext,
|
|
size_t bytesToWrite, UA_Byte *paddingSize, UA_Byte *extraPaddingSize) {
|
|
size_t bytesToWrite, UA_Byte *paddingSize, UA_Byte *extraPaddingSize) {
|
|
- UA_UInt16 padding = (UA_UInt16) (securityPolicy->symmetricModule.encryptionBlockSize -
|
|
|
|
- ((bytesToWrite + securityPolicy->symmetricModule.cryptoModule.
|
|
|
|
- getLocalSignatureSize(securityPolicy, channelContext) + 1) %
|
|
|
|
- securityPolicy->symmetricModule.encryptionBlockSize));
|
|
|
|
- *paddingSize = (UA_Byte) padding;
|
|
|
|
- *extraPaddingSize = (UA_Byte) (padding >> 8);
|
|
|
|
|
|
+ UA_UInt16 padding = (UA_UInt16)(securityPolicy->symmetricModule.encryptionBlockSize -
|
|
|
|
+ ((bytesToWrite + securityPolicy->symmetricModule.cryptoModule.
|
|
|
|
+ getLocalSignatureSize(securityPolicy, channelContext) + 1) %
|
|
|
|
+ securityPolicy->symmetricModule.encryptionBlockSize));
|
|
|
|
+ *paddingSize = (UA_Byte)padding;
|
|
|
|
+ *extraPaddingSize = (UA_Byte)(padding >> 8);
|
|
return padding;
|
|
return padding;
|
|
}
|
|
}
|
|
|
|
|
|
@@ -440,7 +452,7 @@ sendSymmetricChunk(UA_MessageContext *mc) {
|
|
/* Will this chunk surpass the capacity of the SecureChannel for the message? */
|
|
/* Will this chunk surpass the capacity of the SecureChannel for the message? */
|
|
UA_Byte *buf_body_start = mc->messageBuffer.data + UA_SECURE_MESSAGE_HEADER_LENGTH;
|
|
UA_Byte *buf_body_start = mc->messageBuffer.data + UA_SECURE_MESSAGE_HEADER_LENGTH;
|
|
const UA_Byte *buf_body_end = mc->buf_pos;
|
|
const UA_Byte *buf_body_end = mc->buf_pos;
|
|
- size_t bodyLength = (uintptr_t) buf_body_end - (uintptr_t) buf_body_start;
|
|
|
|
|
|
+ size_t bodyLength = (uintptr_t)buf_body_end - (uintptr_t)buf_body_start;
|
|
mc->messageSizeSoFar += bodyLength;
|
|
mc->messageSizeSoFar += bodyLength;
|
|
mc->chunksSoFar++;
|
|
mc->chunksSoFar++;
|
|
if(mc->messageSizeSoFar > connection->remoteConf.maxMessageSize &&
|
|
if(mc->messageSizeSoFar > connection->remoteConf.maxMessageSize &&
|
|
@@ -476,7 +488,7 @@ sendSymmetricChunk(UA_MessageContext *mc) {
|
|
}
|
|
}
|
|
|
|
|
|
/* The total message length */
|
|
/* The total message length */
|
|
- size_t pre_sig_length = (uintptr_t) (mc->buf_pos) - (uintptr_t) mc->messageBuffer.data;
|
|
|
|
|
|
+ size_t pre_sig_length = (uintptr_t)(mc->buf_pos) - (uintptr_t)mc->messageBuffer.data;
|
|
size_t total_length = pre_sig_length;
|
|
size_t total_length = pre_sig_length;
|
|
if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGN ||
|
|
if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGN ||
|
|
channel->securityMode == UA_MESSAGESECURITYMODE_SIGNANDENCRYPT)
|
|
channel->securityMode == UA_MESSAGESECURITYMODE_SIGNANDENCRYPT)
|
|
@@ -490,7 +502,7 @@ sendSymmetricChunk(UA_MessageContext *mc) {
|
|
UA_SecureConversationMessageHeader respHeader;
|
|
UA_SecureConversationMessageHeader respHeader;
|
|
respHeader.secureChannelId = channel->securityToken.channelId;
|
|
respHeader.secureChannelId = channel->securityToken.channelId;
|
|
respHeader.messageHeader.messageTypeAndChunkType = mc->messageType;
|
|
respHeader.messageHeader.messageTypeAndChunkType = mc->messageType;
|
|
- respHeader.messageHeader.messageSize = (UA_UInt32) total_length;
|
|
|
|
|
|
+ respHeader.messageHeader.messageSize = (UA_UInt32)total_length;
|
|
if(mc->final)
|
|
if(mc->final)
|
|
respHeader.messageHeader.messageTypeAndChunkType += UA_CHUNKTYPE_FINAL;
|
|
respHeader.messageHeader.messageTypeAndChunkType += UA_CHUNKTYPE_FINAL;
|
|
else
|
|
else
|
|
@@ -506,7 +518,7 @@ sendSymmetricChunk(UA_MessageContext *mc) {
|
|
|
|
|
|
UA_SequenceHeader seqHeader;
|
|
UA_SequenceHeader seqHeader;
|
|
seqHeader.requestId = mc->requestId;
|
|
seqHeader.requestId = mc->requestId;
|
|
- seqHeader.sequenceNumber = UA_atomic_add(&channel->sendSequenceNumber, 1);
|
|
|
|
|
|
+ seqHeader.sequenceNumber = UA_atomic_addUInt32(&channel->sendSequenceNumber, 1);
|
|
res |= UA_encodeBinary(&seqHeader, &UA_TRANSPORT[UA_TRANSPORT_SEQUENCEHEADER],
|
|
res |= UA_encodeBinary(&seqHeader, &UA_TRANSPORT[UA_TRANSPORT_SEQUENCEHEADER],
|
|
&header_pos, &mc->buf_end, NULL, NULL);
|
|
&header_pos, &mc->buf_end, NULL, NULL);
|
|
|
|
|
|
@@ -545,7 +557,7 @@ sendSymmetricChunk(UA_MessageContext *mc) {
|
|
static UA_StatusCode
|
|
static UA_StatusCode
|
|
sendSymmetricEncodingCallback(void *data, UA_Byte **buf_pos, const UA_Byte **buf_end) {
|
|
sendSymmetricEncodingCallback(void *data, UA_Byte **buf_pos, const UA_Byte **buf_end) {
|
|
/* Set buf values from encoding in the messagecontext */
|
|
/* Set buf values from encoding in the messagecontext */
|
|
- UA_MessageContext *mc = (UA_MessageContext *) data;
|
|
|
|
|
|
+ UA_MessageContext *mc = (UA_MessageContext *)data;
|
|
mc->buf_pos = *buf_pos;
|
|
mc->buf_pos = *buf_pos;
|
|
mc->buf_end = *buf_end;
|
|
mc->buf_end = *buf_end;
|
|
|
|
|
|
@@ -695,7 +707,7 @@ UA_SecureChannel_appendChunk(UA_SecureChannel *channel, UA_UInt32 requestId,
|
|
|
|
|
|
/* No chunkentry on the channel, create one */
|
|
/* No chunkentry on the channel, create one */
|
|
if(!ch) {
|
|
if(!ch) {
|
|
- ch = (struct ChunkEntry *) UA_malloc(sizeof(struct ChunkEntry));
|
|
|
|
|
|
+ ch = (struct ChunkEntry *)UA_malloc(sizeof(struct ChunkEntry));
|
|
if(!ch)
|
|
if(!ch)
|
|
return UA_STATUSCODE_BADOUTOFMEMORY;
|
|
return UA_STATUSCODE_BADOUTOFMEMORY;
|
|
ch->requestId = requestId;
|
|
ch->requestId = requestId;
|
|
@@ -769,7 +781,7 @@ decryptChunk(UA_SecureChannel *channel, const UA_SecurityPolicyCryptoModule *cry
|
|
if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGNANDENCRYPT ||
|
|
if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGNANDENCRYPT ||
|
|
(messageType == UA_MESSAGETYPE_OPN &&
|
|
(messageType == UA_MESSAGETYPE_OPN &&
|
|
channel->securityMode > UA_MESSAGESECURITYMODE_NONE)) {
|
|
channel->securityMode > UA_MESSAGESECURITYMODE_NONE)) {
|
|
- paddingSize = (size_t) chunk->data[chunkSizeAfterDecryption - sigsize - 1];
|
|
|
|
|
|
+ paddingSize = (size_t)chunk->data[chunkSizeAfterDecryption - sigsize - 1];
|
|
|
|
|
|
size_t keyLength = cryptoModule->getRemoteEncryptionKeyLength(securityPolicy, channel->channelContext);
|
|
size_t keyLength = cryptoModule->getRemoteEncryptionKeyLength(securityPolicy, channel->channelContext);
|
|
if(keyLength > 2048) {
|
|
if(keyLength > 2048) {
|
|
@@ -967,8 +979,7 @@ UA_SecureChannel_processChunk(UA_SecureChannel *channel, UA_ByteString *chunk,
|
|
sequenceNumberCallback = processSequenceNumberAsym;
|
|
sequenceNumberCallback = processSequenceNumberAsym;
|
|
break;
|
|
break;
|
|
}
|
|
}
|
|
- default:
|
|
|
|
- return UA_STATUSCODE_BADTCPMESSAGETYPEINVALID;
|
|
|
|
|
|
+ default:return UA_STATUSCODE_BADTCPMESSAGETYPEINVALID;
|
|
}
|
|
}
|
|
|
|
|
|
/* Decrypt message */
|
|
/* Decrypt message */
|