ua_config_default.c 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477
  1. /* This work is licensed under a Creative Commons CCZero 1.0 Universal License.
  2. * See http://creativecommons.org/publicdomain/zero/1.0/ for more information.
  3. *
  4. * Copyright 2017 (c) Julius Pfrommer, Fraunhofer IOSB
  5. * Copyright 2017 (c) Julian Grothoff
  6. * Copyright 2017-2018 (c) Mark Giraud, Fraunhofer IOSB
  7. * Copyright 2017 (c) Stefan Profanter, fortiss GmbH
  8. * Copyright 2017 (c) Thomas Stalder, Blue Time Concept SA
  9. */
  10. #include "ua_plugin_securitypolicy.h"
  11. #include "ua_config_default.h"
  12. #include "ua_log_stdout.h"
  13. #include "ua_network_tcp.h"
  14. #include "ua_accesscontrol_default.h"
  15. #include "ua_pki_certificate.h"
  16. #include "ua_nodestore_default.h"
  17. #include "ua_types_generated.h"
  18. #include "ua_securitypolicy_none.h"
  19. #ifdef UA_ENABLE_ENCRYPTION
  20. #include "ua_securitypolicy_basic128rsa15.h"
  21. #endif
  22. #include "ua_types.h"
  23. #include "ua_types_generated_handling.h"
  24. #include "ua_client_subscriptions.h"
  25. #define ANONYMOUS_POLICY "open62541-anonymous-policy"
  26. #define USERNAME_POLICY "open62541-username-policy"
  27. /* Struct initialization works across ANSI C/C99/C++ if it is done when the
  28. * variable is first declared. Assigning values to existing structs is
  29. * heterogeneous across the three. */
  30. static UA_INLINE UA_UInt32Range
  31. UA_UINT32RANGE(UA_UInt32 min, UA_UInt32 max) {
  32. UA_UInt32Range range = {min, max};
  33. return range;
  34. }
  35. static UA_INLINE UA_DurationRange
  36. UA_DURATIONRANGE(UA_Duration min, UA_Duration max) {
  37. UA_DurationRange range = {min, max};
  38. return range;
  39. }
  40. /*******************************/
  41. /* Default Connection Settings */
  42. /*******************************/
  43. const UA_ConnectionConfig UA_ConnectionConfig_default = {
  44. 0, /* .protocolVersion */
  45. 65535, /* .sendBufferSize, 64k per chunk */
  46. 65535, /* .recvBufferSize, 64k per chunk */
  47. 0, /* .maxMessageSize, 0 -> unlimited */
  48. 0 /* .maxChunkCount, 0 -> unlimited */
  49. };
  50. /***************************/
  51. /* Default Server Settings */
  52. /***************************/
  53. #define MANUFACTURER_NAME "open62541"
  54. #define PRODUCT_NAME "open62541 OPC UA Server"
  55. #define PRODUCT_URI "http://open62541.org"
  56. #define APPLICATION_NAME "open62541-based OPC UA Application"
  57. #define APPLICATION_URI "urn:unconfigured:application"
  58. #define STRINGIFY(arg) #arg
  59. #define VERSION(MAJOR, MINOR, PATCH, LABEL) \
  60. STRINGIFY(MAJOR) "." STRINGIFY(MINOR) "." STRINGIFY(PATCH) LABEL
  61. static UA_StatusCode
  62. createSecurityPolicyNoneEndpoint(UA_ServerConfig *conf, UA_Endpoint *endpoint,
  63. const UA_ByteString localCertificate) {
  64. UA_EndpointDescription_init(&endpoint->endpointDescription);
  65. UA_SecurityPolicy_None(&endpoint->securityPolicy, NULL, localCertificate, conf->logger);
  66. endpoint->endpointDescription.securityMode = UA_MESSAGESECURITYMODE_NONE;
  67. endpoint->endpointDescription.securityPolicyUri =
  68. UA_STRING_ALLOC("http://opcfoundation.org/UA/SecurityPolicy#None");
  69. endpoint->endpointDescription.transportProfileUri =
  70. UA_STRING_ALLOC("http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary");
  71. /* enable anonymous and username/password */
  72. size_t policies = 2;
  73. endpoint->endpointDescription.userIdentityTokens = (UA_UserTokenPolicy *)
  74. UA_Array_new(policies, &UA_TYPES[UA_TYPES_USERTOKENPOLICY]);
  75. if(!endpoint->endpointDescription.userIdentityTokens)
  76. return UA_STATUSCODE_BADOUTOFMEMORY;
  77. endpoint->endpointDescription.userIdentityTokensSize = policies;
  78. endpoint->endpointDescription.userIdentityTokens[0].tokenType =
  79. UA_USERTOKENTYPE_ANONYMOUS;
  80. endpoint->endpointDescription.userIdentityTokens[0].policyId =
  81. UA_STRING_ALLOC(ANONYMOUS_POLICY);
  82. endpoint->endpointDescription.userIdentityTokens[1].tokenType =
  83. UA_USERTOKENTYPE_USERNAME;
  84. endpoint->endpointDescription.userIdentityTokens[1].policyId =
  85. UA_STRING_ALLOC(USERNAME_POLICY);
  86. UA_String_copy(&localCertificate, &endpoint->endpointDescription.serverCertificate);
  87. UA_ApplicationDescription_copy(&conf->applicationDescription,
  88. &endpoint->endpointDescription.server);
  89. return UA_STATUSCODE_GOOD;
  90. }
  91. void
  92. UA_ServerConfig_set_customHostname(UA_ServerConfig *config, const UA_String customHostname) {
  93. if(!config)
  94. return;
  95. UA_String_deleteMembers(&config->customHostname);
  96. UA_String_copy(&customHostname, &config->customHostname);
  97. }
  98. #ifdef UA_ENABLE_ENCRYPTION
  99. static UA_StatusCode
  100. createSecurityPolicyBasic128Rsa15Endpoint(UA_ServerConfig *const conf,
  101. UA_Endpoint *endpoint,
  102. UA_MessageSecurityMode securityMode,
  103. const UA_ByteString localCertificate,
  104. const UA_ByteString localPrivateKey) {
  105. UA_EndpointDescription_init(&endpoint->endpointDescription);
  106. UA_StatusCode retval =
  107. UA_SecurityPolicy_Basic128Rsa15(&endpoint->securityPolicy, &conf->certificateVerification, localCertificate,
  108. localPrivateKey, conf->logger);
  109. if(retval != UA_STATUSCODE_GOOD) {
  110. endpoint->securityPolicy.deleteMembers(&endpoint->securityPolicy);
  111. return retval;
  112. }
  113. endpoint->endpointDescription.securityMode = securityMode;
  114. endpoint->endpointDescription.securityPolicyUri =
  115. UA_STRING_ALLOC("http://opcfoundation.org/UA/SecurityPolicy#Basic128Rsa15");
  116. endpoint->endpointDescription.transportProfileUri =
  117. UA_STRING_ALLOC("http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary");
  118. /* enable anonymous and username/password */
  119. size_t policies = 1;
  120. endpoint->endpointDescription.userIdentityTokens = (UA_UserTokenPolicy *)
  121. UA_Array_new(policies, &UA_TYPES[UA_TYPES_USERTOKENPOLICY]);
  122. if(!endpoint->endpointDescription.userIdentityTokens)
  123. return UA_STATUSCODE_BADOUTOFMEMORY;
  124. endpoint->endpointDescription.userIdentityTokensSize = policies;
  125. endpoint->endpointDescription.userIdentityTokens[0].tokenType =
  126. UA_USERTOKENTYPE_ANONYMOUS;
  127. endpoint->endpointDescription.userIdentityTokens[0].policyId =
  128. UA_STRING_ALLOC(ANONYMOUS_POLICY);
  129. /*
  130. endpoint->endpointDescription.userIdentityTokens[1].tokenType =
  131. UA_USERTOKENTYPE_USERNAME;
  132. endpoint->endpointDescription.userIdentityTokens[1].policyId =
  133. UA_STRING_ALLOC(USERNAME_POLICY);*/
  134. UA_String_copy(&localCertificate, &endpoint->endpointDescription.serverCertificate);
  135. UA_ApplicationDescription_copy(&conf->applicationDescription,
  136. &endpoint->endpointDescription.server);
  137. return UA_STATUSCODE_GOOD;
  138. }
  139. #endif
  140. static UA_ServerConfig *
  141. createDefaultConfig(void) {
  142. UA_ServerConfig *conf = (UA_ServerConfig *) UA_malloc(sizeof(UA_ServerConfig));
  143. if(!conf)
  144. return NULL;
  145. /* Zero out.. All members have a valid initial value */
  146. memset(conf, 0, sizeof(UA_ServerConfig));
  147. /* --> Start setting the default static config <-- */
  148. conf->nThreads = 1;
  149. conf->logger = UA_Log_Stdout;
  150. /* Server Description */
  151. conf->buildInfo.productUri = UA_STRING_ALLOC(PRODUCT_URI);
  152. conf->buildInfo.manufacturerName = UA_STRING_ALLOC(MANUFACTURER_NAME);
  153. conf->buildInfo.productName = UA_STRING_ALLOC(PRODUCT_NAME);
  154. conf->buildInfo.softwareVersion =
  155. UA_STRING_ALLOC(VERSION(UA_OPEN62541_VER_MAJOR, UA_OPEN62541_VER_MINOR,
  156. UA_OPEN62541_VER_PATCH, UA_OPEN62541_VER_LABEL));
  157. conf->buildInfo.buildNumber = UA_STRING_ALLOC(__DATE__ " " __TIME__);
  158. conf->buildInfo.buildDate = 0;
  159. conf->applicationDescription.applicationUri = UA_STRING_ALLOC(APPLICATION_URI);
  160. conf->applicationDescription.productUri = UA_STRING_ALLOC(PRODUCT_URI);
  161. conf->applicationDescription.applicationName =
  162. UA_LOCALIZEDTEXT_ALLOC("en", APPLICATION_NAME);
  163. conf->applicationDescription.applicationType = UA_APPLICATIONTYPE_SERVER;
  164. /* conf->applicationDescription.gatewayServerUri = UA_STRING_NULL; */
  165. /* conf->applicationDescription.discoveryProfileUri = UA_STRING_NULL; */
  166. /* conf->applicationDescription.discoveryUrlsSize = 0; */
  167. /* conf->applicationDescription.discoveryUrls = NULL; */
  168. #ifdef UA_ENABLE_DISCOVERY
  169. /* conf->mdnsServerName = UA_STRING_NULL; */
  170. /* conf->serverCapabilitiesSize = 0; */
  171. /* conf->serverCapabilities = NULL; */
  172. #endif
  173. /* Custom DataTypes */
  174. /* conf->customDataTypesSize = 0; */
  175. /* conf->customDataTypes = NULL; */
  176. /* Networking */
  177. /* conf->networkLayersSize = 0; */
  178. /* conf->networkLayers = NULL; */
  179. /* conf->customHostname = UA_STRING_NULL; */
  180. /* Endpoints */
  181. /* conf->endpoints = {0, NULL}; */
  182. /* Certificate Verification that accepts every certificate. Can be
  183. * overwritten when the policy is specialized. */
  184. UA_CertificateVerification_AcceptAll(&conf->certificateVerification);
  185. /* Global Node Lifecycle */
  186. conf->nodeLifecycle.constructor = NULL;
  187. conf->nodeLifecycle.destructor = NULL;
  188. /* Access Control */
  189. conf->accessControl.enableAnonymousLogin = true;
  190. conf->accessControl.enableUsernamePasswordLogin = true;
  191. conf->accessControl.activateSession = activateSession_default;
  192. conf->accessControl.closeSession = closeSession_default;
  193. conf->accessControl.getUserRightsMask = getUserRightsMask_default;
  194. conf->accessControl.getUserAccessLevel = getUserAccessLevel_default;
  195. conf->accessControl.getUserExecutable = getUserExecutable_default;
  196. conf->accessControl.getUserExecutableOnObject = getUserExecutableOnObject_default;
  197. conf->accessControl.allowAddNode = allowAddNode_default;
  198. conf->accessControl.allowAddReference = allowAddReference_default;
  199. conf->accessControl.allowDeleteNode = allowDeleteNode_default;
  200. conf->accessControl.allowDeleteReference = allowDeleteReference_default;
  201. /* Limits for SecureChannels */
  202. conf->maxSecureChannels = 40;
  203. conf->maxSecurityTokenLifetime = 10 * 60 * 1000; /* 10 minutes */
  204. /* Limits for Sessions */
  205. conf->maxSessions = 100;
  206. conf->maxSessionTimeout = 60.0 * 60.0 * 1000.0; /* 1h */
  207. /* Limits for Subscriptions */
  208. conf->publishingIntervalLimits = UA_DURATIONRANGE(100.0, 3600.0 * 1000.0);
  209. conf->lifeTimeCountLimits = UA_UINT32RANGE(3, 15000);
  210. conf->keepAliveCountLimits = UA_UINT32RANGE(1, 100);
  211. conf->maxNotificationsPerPublish = 1000;
  212. conf->maxRetransmissionQueueSize = 0; /* unlimited */
  213. /* Limits for MonitoredItems */
  214. conf->samplingIntervalLimits = UA_DURATIONRANGE(50.0, 24.0 * 3600.0 * 1000.0);
  215. conf->queueSizeLimits = UA_UINT32RANGE(1, 100);
  216. #ifdef UA_ENABLE_DISCOVERY
  217. conf->discoveryCleanupTimeout = 60 * 60;
  218. #endif
  219. /* --> Finish setting the default static config <-- */
  220. return conf;
  221. }
  222. static UA_StatusCode
  223. addDefaultNetworkLayers(UA_ServerConfig *conf, UA_UInt16 portNumber) {
  224. /* Add a network layer */
  225. conf->networkLayers = (UA_ServerNetworkLayer *)
  226. UA_malloc(sizeof(UA_ServerNetworkLayer));
  227. if(!conf->networkLayers)
  228. return UA_STATUSCODE_BADOUTOFMEMORY;
  229. conf->networkLayers[0] =
  230. UA_ServerNetworkLayerTCP(UA_ConnectionConfig_default, portNumber, conf->logger);
  231. conf->networkLayersSize = 1;
  232. return UA_STATUSCODE_GOOD;
  233. }
  234. UA_ServerConfig *
  235. UA_ServerConfig_new_minimal(UA_UInt16 portNumber,
  236. const UA_ByteString *certificate) {
  237. UA_ServerConfig *conf = createDefaultConfig();
  238. UA_StatusCode retval = UA_Nodestore_default_new(&conf->nodestore);
  239. if(retval != UA_STATUSCODE_GOOD) {
  240. UA_ServerConfig_delete(conf);
  241. return NULL;
  242. }
  243. if(addDefaultNetworkLayers(conf, portNumber) != UA_STATUSCODE_GOOD) {
  244. UA_ServerConfig_delete(conf);
  245. return NULL;
  246. }
  247. /* Allocate the endpoint */
  248. conf->endpointsSize = 1;
  249. conf->endpoints = (UA_Endpoint *) UA_malloc(sizeof(UA_Endpoint));
  250. if(!conf->endpoints) {
  251. UA_ServerConfig_delete(conf);
  252. return NULL;
  253. }
  254. /* Populate the endpoint */
  255. UA_ByteString localCertificate = UA_BYTESTRING_NULL;
  256. if(certificate)
  257. localCertificate = *certificate;
  258. retval =
  259. createSecurityPolicyNoneEndpoint(conf, &conf->endpoints[0], localCertificate);
  260. if(retval != UA_STATUSCODE_GOOD) {
  261. UA_ServerConfig_delete(conf);
  262. return NULL;
  263. }
  264. return conf;
  265. }
  266. #ifdef UA_ENABLE_ENCRYPTION
  267. UA_ServerConfig *
  268. UA_ServerConfig_new_basic128rsa15(UA_UInt16 portNumber,
  269. const UA_ByteString *certificate,
  270. const UA_ByteString *privateKey,
  271. const UA_ByteString *trustList,
  272. size_t trustListSize,
  273. const UA_ByteString *revocationList,
  274. size_t revocationListSize) {
  275. UA_ServerConfig *conf = createDefaultConfig();
  276. UA_StatusCode retval = UA_CertificateVerification_Trustlist(&conf->certificateVerification,
  277. trustList, trustListSize,
  278. revocationList, revocationListSize);
  279. if(retval != UA_STATUSCODE_GOOD) {
  280. UA_ServerConfig_delete(conf);
  281. return NULL;
  282. }
  283. retval = UA_Nodestore_default_new(&conf->nodestore);
  284. if(retval != UA_STATUSCODE_GOOD) {
  285. UA_ServerConfig_delete(conf);
  286. return NULL;
  287. }
  288. if(addDefaultNetworkLayers(conf, portNumber) != UA_STATUSCODE_GOOD) {
  289. UA_ServerConfig_delete(conf);
  290. return NULL;
  291. }
  292. if(trustListSize == 0)
  293. UA_LOG_WARNING(UA_Log_Stdout, UA_LOGCATEGORY_USERLAND,
  294. "No CA trust-list provided. Any remote certificate will be accepted.");
  295. /* Allocate the endpoints */
  296. conf->endpointsSize = 0;
  297. conf->endpoints = (UA_Endpoint *) UA_malloc(sizeof(UA_Endpoint) * 3);
  298. if(!conf->endpoints) {
  299. UA_ServerConfig_delete(conf);
  300. return NULL;
  301. }
  302. /* Populate the endpoints */
  303. ++conf->endpointsSize;
  304. retval = createSecurityPolicyNoneEndpoint(conf, &conf->endpoints[0], *certificate);
  305. if(retval != UA_STATUSCODE_GOOD) {
  306. UA_ServerConfig_delete(conf);
  307. return NULL;
  308. }
  309. ++conf->endpointsSize;
  310. retval = createSecurityPolicyBasic128Rsa15Endpoint(conf, &conf->endpoints[1],
  311. UA_MESSAGESECURITYMODE_SIGN, *certificate,
  312. *privateKey);
  313. if(retval != UA_STATUSCODE_GOOD) {
  314. UA_ServerConfig_delete(conf);
  315. return NULL;
  316. }
  317. ++conf->endpointsSize;
  318. retval = createSecurityPolicyBasic128Rsa15Endpoint(conf, &conf->endpoints[2],
  319. UA_MESSAGESECURITYMODE_SIGNANDENCRYPT, *certificate,
  320. *privateKey);
  321. if(retval != UA_STATUSCODE_GOOD) {
  322. UA_ServerConfig_delete(conf);
  323. return NULL;
  324. }
  325. return conf;
  326. }
  327. #endif
  328. void
  329. UA_ServerConfig_delete(UA_ServerConfig *config) {
  330. if(!config)
  331. return;
  332. /* Server Description */
  333. UA_BuildInfo_deleteMembers(&config->buildInfo);
  334. UA_ApplicationDescription_deleteMembers(&config->applicationDescription);
  335. #ifdef UA_ENABLE_DISCOVERY
  336. UA_String_deleteMembers(&config->mdnsServerName);
  337. UA_Array_delete(config->serverCapabilities, config->serverCapabilitiesSize,
  338. &UA_TYPES[UA_TYPES_STRING]);
  339. config->serverCapabilities = NULL;
  340. config->serverCapabilitiesSize = 0;
  341. #endif
  342. /* Nodestore */
  343. if(config->nodestore.deleteNodestore)
  344. config->nodestore.deleteNodestore(config->nodestore.context);
  345. /* Custom DataTypes */
  346. for(size_t i = 0; i < config->customDataTypesSize; ++i)
  347. UA_free(config->customDataTypes[i].members);
  348. UA_free(config->customDataTypes);
  349. config->customDataTypes = NULL;
  350. config->customDataTypesSize = 0;
  351. /* Networking */
  352. for(size_t i = 0; i < config->networkLayersSize; ++i)
  353. config->networkLayers[i].deleteMembers(&config->networkLayers[i]);
  354. UA_free(config->networkLayers);
  355. config->networkLayers = NULL;
  356. config->networkLayersSize = 0;
  357. UA_String_deleteMembers(&config->customHostname);
  358. config->customHostname = UA_STRING_NULL;
  359. for(size_t i = 0; i < config->endpointsSize; ++i) {
  360. UA_SecurityPolicy *policy = &config->endpoints[i].securityPolicy;
  361. policy->deleteMembers(policy);
  362. UA_EndpointDescription_deleteMembers(&config->endpoints[i].endpointDescription);
  363. }
  364. UA_free(config->endpoints);
  365. config->endpoints = NULL;
  366. config->endpointsSize = 0;
  367. /* Certificate Validation */
  368. config->certificateVerification.deleteMembers(&config->certificateVerification);
  369. UA_free(config);
  370. }
  371. /***************************/
  372. /* Default Client Settings */
  373. /***************************/
  374. const UA_ClientConfig UA_ClientConfig_default = {
  375. 5000, /* .timeout, 5 seconds */
  376. 10 * 60 * 1000, /* .secureChannelLifeTime, 10 minutes */
  377. UA_Log_Stdout, /* .logger */
  378. { /* .localConnectionConfig */
  379. 0, /* .protocolVersion */
  380. 65535, /* .sendBufferSize, 64k per chunk */
  381. 65535, /* .recvBufferSize, 64k per chunk */
  382. 0, /* .maxMessageSize, 0 -> unlimited */
  383. 0 /* .maxChunkCount, 0 -> unlimited */
  384. },
  385. UA_ClientConnectionTCP, /* .connectionFunc */
  386. 0, /* .customDataTypesSize */
  387. NULL, /*.customDataTypes */
  388. NULL, /*.stateCallback */
  389. NULL, /*.subscriptionInactivityCallback */
  390. NULL, /*.clientContext */
  391. 10 /* .outStandingPublishRequests */
  392. };