ua_server_binary.c 33 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755
  1. /* This Source Code Form is subject to the terms of the Mozilla Public
  2. * License, v. 2.0. If a copy of the MPL was not distributed with this
  3. * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
  4. #include "ua_util.h"
  5. #include "ua_server_internal.h"
  6. #include "ua_services.h"
  7. #include "ua_securechannel_manager.h"
  8. #include "ua_session_manager.h"
  9. #include "ua_types_generated_encoding_binary.h"
  10. #include "ua_transport_generated.h"
  11. #include "ua_transport_generated_handling.h"
  12. #include "ua_transport_generated_encoding_binary.h"
  13. #include "ua_types_generated_handling.h"
  14. #include "ua_securitypolicy_none.h"
  15. #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
  16. // store the authentication token and session ID so we can help fuzzing by setting
  17. // these values in the next request automatically
  18. UA_NodeId unsafe_fuzz_authenticationToken = {
  19. 0, UA_NODEIDTYPE_NUMERIC, {0}
  20. };
  21. #endif
  22. #ifdef UA_DEBUG_DUMP_PKGS_FILE
  23. void UA_debug_dumpCompleteChunk(UA_Server *const server, UA_Connection *const connection, UA_ByteString *messageBuffer);
  24. #endif
  25. /********************/
  26. /* Helper Functions */
  27. /********************/
  28. /* This is not an ERR message, the connection is not closed afterwards */
  29. static UA_StatusCode
  30. sendServiceFault(UA_SecureChannel *channel, const UA_ByteString *msg,
  31. size_t offset, const UA_DataType *responseType,
  32. UA_UInt32 requestId, UA_StatusCode error) {
  33. UA_RequestHeader requestHeader;
  34. UA_StatusCode retval = UA_RequestHeader_decodeBinary(msg, &offset, &requestHeader);
  35. if(retval != UA_STATUSCODE_GOOD)
  36. return retval;
  37. void *response = UA_alloca(responseType->memSize);
  38. UA_init(response, responseType);
  39. UA_ResponseHeader *responseHeader = (UA_ResponseHeader*)response;
  40. responseHeader->requestHandle = requestHeader.requestHandle;
  41. responseHeader->timestamp = UA_DateTime_now();
  42. responseHeader->serviceResult = error;
  43. // Send error message. Message type is MSG and not ERR, since we are on a securechannel!
  44. retval = UA_SecureChannel_sendSymmetricMessage(channel, requestId, UA_MESSAGETYPE_MSG,
  45. response, responseType);
  46. UA_RequestHeader_deleteMembers(&requestHeader);
  47. UA_LOG_DEBUG(channel->securityPolicy->logger, UA_LOGCATEGORY_SERVER,
  48. "Sent ServiceFault with error code %s", UA_StatusCode_name(error));
  49. return retval;
  50. }
  51. static void
  52. getServicePointers(UA_UInt32 requestTypeId, const UA_DataType **requestType,
  53. const UA_DataType **responseType, UA_Service *service,
  54. UA_Boolean *requiresSession) {
  55. switch(requestTypeId) {
  56. case UA_NS0ID_GETENDPOINTSREQUEST_ENCODING_DEFAULTBINARY:
  57. *service = (UA_Service)Service_GetEndpoints;
  58. *requestType = &UA_TYPES[UA_TYPES_GETENDPOINTSREQUEST];
  59. *responseType = &UA_TYPES[UA_TYPES_GETENDPOINTSRESPONSE];
  60. *requiresSession = false;
  61. break;
  62. case UA_NS0ID_FINDSERVERSREQUEST_ENCODING_DEFAULTBINARY:
  63. *service = (UA_Service)Service_FindServers;
  64. *requestType = &UA_TYPES[UA_TYPES_FINDSERVERSREQUEST];
  65. *responseType = &UA_TYPES[UA_TYPES_FINDSERVERSRESPONSE];
  66. *requiresSession = false;
  67. break;
  68. #ifdef UA_ENABLE_DISCOVERY
  69. # ifdef UA_ENABLE_DISCOVERY_MULTICAST
  70. case UA_NS0ID_FINDSERVERSONNETWORKREQUEST_ENCODING_DEFAULTBINARY:
  71. *service = (UA_Service)Service_FindServersOnNetwork;
  72. *requestType = &UA_TYPES[UA_TYPES_FINDSERVERSONNETWORKREQUEST];
  73. *responseType = &UA_TYPES[UA_TYPES_FINDSERVERSONNETWORKRESPONSE];
  74. *requiresSession = false;
  75. break;
  76. # endif
  77. case UA_NS0ID_REGISTERSERVERREQUEST_ENCODING_DEFAULTBINARY:
  78. *service = (UA_Service)Service_RegisterServer;
  79. *requestType = &UA_TYPES[UA_TYPES_REGISTERSERVERREQUEST];
  80. *responseType = &UA_TYPES[UA_TYPES_REGISTERSERVERRESPONSE];
  81. *requiresSession = false;
  82. break;
  83. case UA_NS0ID_REGISTERSERVER2REQUEST_ENCODING_DEFAULTBINARY:
  84. *service = (UA_Service)Service_RegisterServer2;
  85. *requestType = &UA_TYPES[UA_TYPES_REGISTERSERVER2REQUEST];
  86. *responseType = &UA_TYPES[UA_TYPES_REGISTERSERVER2RESPONSE];
  87. *requiresSession = false;
  88. break;
  89. #endif
  90. case UA_NS0ID_CREATESESSIONREQUEST_ENCODING_DEFAULTBINARY:
  91. *service = (UA_Service)Service_CreateSession;
  92. *requestType = &UA_TYPES[UA_TYPES_CREATESESSIONREQUEST];
  93. *responseType = &UA_TYPES[UA_TYPES_CREATESESSIONRESPONSE];
  94. *requiresSession = false;
  95. break;
  96. case UA_NS0ID_ACTIVATESESSIONREQUEST_ENCODING_DEFAULTBINARY:
  97. *service = (UA_Service)Service_ActivateSession;
  98. *requestType = &UA_TYPES[UA_TYPES_ACTIVATESESSIONREQUEST];
  99. *responseType = &UA_TYPES[UA_TYPES_ACTIVATESESSIONRESPONSE];
  100. break;
  101. case UA_NS0ID_CLOSESESSIONREQUEST_ENCODING_DEFAULTBINARY:
  102. *service = (UA_Service)Service_CloseSession;
  103. *requestType = &UA_TYPES[UA_TYPES_CLOSESESSIONREQUEST];
  104. *responseType = &UA_TYPES[UA_TYPES_CLOSESESSIONRESPONSE];
  105. break;
  106. case UA_NS0ID_READREQUEST_ENCODING_DEFAULTBINARY:
  107. *service = (UA_Service)Service_Read;
  108. *requestType = &UA_TYPES[UA_TYPES_READREQUEST];
  109. *responseType = &UA_TYPES[UA_TYPES_READRESPONSE];
  110. break;
  111. case UA_NS0ID_WRITEREQUEST_ENCODING_DEFAULTBINARY:
  112. *service = (UA_Service)Service_Write;
  113. *requestType = &UA_TYPES[UA_TYPES_WRITEREQUEST];
  114. *responseType = &UA_TYPES[UA_TYPES_WRITERESPONSE];
  115. break;
  116. case UA_NS0ID_BROWSEREQUEST_ENCODING_DEFAULTBINARY:
  117. *service = (UA_Service)Service_Browse;
  118. *requestType = &UA_TYPES[UA_TYPES_BROWSEREQUEST];
  119. *responseType = &UA_TYPES[UA_TYPES_BROWSERESPONSE];
  120. break;
  121. case UA_NS0ID_BROWSENEXTREQUEST_ENCODING_DEFAULTBINARY:
  122. *service = (UA_Service)Service_BrowseNext;
  123. *requestType = &UA_TYPES[UA_TYPES_BROWSENEXTREQUEST];
  124. *responseType = &UA_TYPES[UA_TYPES_BROWSENEXTRESPONSE];
  125. break;
  126. case UA_NS0ID_REGISTERNODESREQUEST_ENCODING_DEFAULTBINARY:
  127. *service = (UA_Service)Service_RegisterNodes;
  128. *requestType = &UA_TYPES[UA_TYPES_REGISTERNODESREQUEST];
  129. *responseType = &UA_TYPES[UA_TYPES_REGISTERNODESRESPONSE];
  130. break;
  131. case UA_NS0ID_UNREGISTERNODESREQUEST_ENCODING_DEFAULTBINARY:
  132. *service = (UA_Service)Service_UnregisterNodes;
  133. *requestType = &UA_TYPES[UA_TYPES_UNREGISTERNODESREQUEST];
  134. *responseType = &UA_TYPES[UA_TYPES_UNREGISTERNODESRESPONSE];
  135. break;
  136. case UA_NS0ID_TRANSLATEBROWSEPATHSTONODEIDSREQUEST_ENCODING_DEFAULTBINARY:
  137. *service = (UA_Service)Service_TranslateBrowsePathsToNodeIds;
  138. *requestType = &UA_TYPES[UA_TYPES_TRANSLATEBROWSEPATHSTONODEIDSREQUEST];
  139. *responseType = &UA_TYPES[UA_TYPES_TRANSLATEBROWSEPATHSTONODEIDSRESPONSE];
  140. break;
  141. #ifdef UA_ENABLE_SUBSCRIPTIONS
  142. case UA_NS0ID_CREATESUBSCRIPTIONREQUEST_ENCODING_DEFAULTBINARY:
  143. *service = (UA_Service)Service_CreateSubscription;
  144. *requestType = &UA_TYPES[UA_TYPES_CREATESUBSCRIPTIONREQUEST];
  145. *responseType = &UA_TYPES[UA_TYPES_CREATESUBSCRIPTIONRESPONSE];
  146. break;
  147. case UA_NS0ID_PUBLISHREQUEST_ENCODING_DEFAULTBINARY:
  148. *requestType = &UA_TYPES[UA_TYPES_PUBLISHREQUEST];
  149. *responseType = &UA_TYPES[UA_TYPES_PUBLISHRESPONSE];
  150. break;
  151. case UA_NS0ID_REPUBLISHREQUEST_ENCODING_DEFAULTBINARY:
  152. *service = (UA_Service)Service_Republish;
  153. *requestType = &UA_TYPES[UA_TYPES_REPUBLISHREQUEST];
  154. *responseType = &UA_TYPES[UA_TYPES_REPUBLISHRESPONSE];
  155. break;
  156. case UA_NS0ID_MODIFYSUBSCRIPTIONREQUEST_ENCODING_DEFAULTBINARY:
  157. *service = (UA_Service)Service_ModifySubscription;
  158. *requestType = &UA_TYPES[UA_TYPES_MODIFYSUBSCRIPTIONREQUEST];
  159. *responseType = &UA_TYPES[UA_TYPES_MODIFYSUBSCRIPTIONRESPONSE];
  160. break;
  161. case UA_NS0ID_SETPUBLISHINGMODEREQUEST_ENCODING_DEFAULTBINARY:
  162. *service = (UA_Service)Service_SetPublishingMode;
  163. *requestType = &UA_TYPES[UA_TYPES_SETPUBLISHINGMODEREQUEST];
  164. *responseType = &UA_TYPES[UA_TYPES_SETPUBLISHINGMODERESPONSE];
  165. break;
  166. case UA_NS0ID_DELETESUBSCRIPTIONSREQUEST_ENCODING_DEFAULTBINARY:
  167. *service = (UA_Service)Service_DeleteSubscriptions;
  168. *requestType = &UA_TYPES[UA_TYPES_DELETESUBSCRIPTIONSREQUEST];
  169. *responseType = &UA_TYPES[UA_TYPES_DELETESUBSCRIPTIONSRESPONSE];
  170. break;
  171. case UA_NS0ID_CREATEMONITOREDITEMSREQUEST_ENCODING_DEFAULTBINARY:
  172. *service = (UA_Service)Service_CreateMonitoredItems;
  173. *requestType = &UA_TYPES[UA_TYPES_CREATEMONITOREDITEMSREQUEST];
  174. *responseType = &UA_TYPES[UA_TYPES_CREATEMONITOREDITEMSRESPONSE];
  175. break;
  176. case UA_NS0ID_DELETEMONITOREDITEMSREQUEST_ENCODING_DEFAULTBINARY:
  177. *service = (UA_Service)Service_DeleteMonitoredItems;
  178. *requestType = &UA_TYPES[UA_TYPES_DELETEMONITOREDITEMSREQUEST];
  179. *responseType = &UA_TYPES[UA_TYPES_DELETEMONITOREDITEMSRESPONSE];
  180. break;
  181. case UA_NS0ID_MODIFYMONITOREDITEMSREQUEST_ENCODING_DEFAULTBINARY:
  182. *service = (UA_Service)Service_ModifyMonitoredItems;
  183. *requestType = &UA_TYPES[UA_TYPES_MODIFYMONITOREDITEMSREQUEST];
  184. *responseType = &UA_TYPES[UA_TYPES_MODIFYMONITOREDITEMSRESPONSE];
  185. break;
  186. case UA_NS0ID_SETMONITORINGMODEREQUEST_ENCODING_DEFAULTBINARY:
  187. *service = (UA_Service)Service_SetMonitoringMode;
  188. *requestType = &UA_TYPES[UA_TYPES_SETMONITORINGMODEREQUEST];
  189. *responseType = &UA_TYPES[UA_TYPES_SETMONITORINGMODERESPONSE];
  190. break;
  191. #endif
  192. #ifdef UA_ENABLE_METHODCALLS
  193. case UA_NS0ID_CALLREQUEST_ENCODING_DEFAULTBINARY:
  194. *service = (UA_Service)Service_Call;
  195. *requestType = &UA_TYPES[UA_TYPES_CALLREQUEST];
  196. *responseType = &UA_TYPES[UA_TYPES_CALLRESPONSE];
  197. break;
  198. #endif
  199. #ifdef UA_ENABLE_NODEMANAGEMENT
  200. case UA_NS0ID_ADDNODESREQUEST_ENCODING_DEFAULTBINARY:
  201. *service = (UA_Service)Service_AddNodes;
  202. *requestType = &UA_TYPES[UA_TYPES_ADDNODESREQUEST];
  203. *responseType = &UA_TYPES[UA_TYPES_ADDNODESRESPONSE];
  204. break;
  205. case UA_NS0ID_ADDREFERENCESREQUEST_ENCODING_DEFAULTBINARY:
  206. *service = (UA_Service)Service_AddReferences;
  207. *requestType = &UA_TYPES[UA_TYPES_ADDREFERENCESREQUEST];
  208. *responseType = &UA_TYPES[UA_TYPES_ADDREFERENCESRESPONSE];
  209. break;
  210. case UA_NS0ID_DELETENODESREQUEST_ENCODING_DEFAULTBINARY:
  211. *service = (UA_Service)Service_DeleteNodes;
  212. *requestType = &UA_TYPES[UA_TYPES_DELETENODESREQUEST];
  213. *responseType = &UA_TYPES[UA_TYPES_DELETENODESRESPONSE];
  214. break;
  215. case UA_NS0ID_DELETEREFERENCESREQUEST_ENCODING_DEFAULTBINARY:
  216. *service = (UA_Service)Service_DeleteReferences;
  217. *requestType = &UA_TYPES[UA_TYPES_DELETEREFERENCESREQUEST];
  218. *responseType = &UA_TYPES[UA_TYPES_DELETEREFERENCESRESPONSE];
  219. break;
  220. #endif
  221. default:
  222. break;
  223. }
  224. }
  225. /*************************/
  226. /* Process Message Types */
  227. /*************************/
  228. /* HEL -> Open up the connection */
  229. static UA_StatusCode
  230. processHEL(UA_Server *server, UA_Connection *connection,
  231. const UA_ByteString *msg, size_t *offset) {
  232. UA_TcpHelloMessage helloMessage;
  233. UA_StatusCode retval = UA_TcpHelloMessage_decodeBinary(msg, offset, &helloMessage);
  234. if(retval != UA_STATUSCODE_GOOD)
  235. return retval;
  236. /* Parameterize the connection */
  237. connection->remoteConf.maxChunkCount = helloMessage.maxChunkCount; /* zero -> unlimited */
  238. connection->remoteConf.maxMessageSize = helloMessage.maxMessageSize; /* zero -> unlimited */
  239. connection->remoteConf.protocolVersion = helloMessage.protocolVersion;
  240. connection->remoteConf.recvBufferSize = helloMessage.receiveBufferSize;
  241. if(connection->localConf.sendBufferSize > helloMessage.receiveBufferSize)
  242. connection->localConf.sendBufferSize = helloMessage.receiveBufferSize;
  243. connection->remoteConf.sendBufferSize = helloMessage.sendBufferSize;
  244. if(connection->localConf.recvBufferSize > helloMessage.sendBufferSize)
  245. connection->localConf.recvBufferSize = helloMessage.sendBufferSize;
  246. UA_String_deleteMembers(&helloMessage.endpointUrl);
  247. if(connection->remoteConf.recvBufferSize == 0) {
  248. UA_LOG_INFO(server->config.logger, UA_LOGCATEGORY_NETWORK,
  249. "Connection %i | Remote end indicated a receive buffer size of 0. "
  250. "Not able to send any messages.",
  251. connection->sockfd);
  252. return UA_STATUSCODE_BADINTERNALERROR;
  253. }
  254. connection->state = UA_CONNECTION_ESTABLISHED;
  255. /* Build acknowledge response */
  256. UA_TcpAcknowledgeMessage ackMessage;
  257. ackMessage.protocolVersion = connection->localConf.protocolVersion;
  258. ackMessage.receiveBufferSize = connection->localConf.recvBufferSize;
  259. ackMessage.sendBufferSize = connection->localConf.sendBufferSize;
  260. ackMessage.maxMessageSize = connection->localConf.maxMessageSize;
  261. ackMessage.maxChunkCount = connection->localConf.maxChunkCount;
  262. UA_TcpMessageHeader ackHeader;
  263. ackHeader.messageTypeAndChunkType = UA_MESSAGETYPE_ACK + UA_CHUNKTYPE_FINAL;
  264. ackHeader.messageSize = 8 + 20; /* ackHeader + ackMessage */
  265. /* Get the send buffer from the network layer */
  266. UA_ByteString ack_msg;
  267. UA_ByteString_init(&ack_msg);
  268. retval = connection->getSendBuffer(connection, connection->localConf.sendBufferSize,
  269. &ack_msg);
  270. if(retval != UA_STATUSCODE_GOOD)
  271. return retval;
  272. /* Encode and send the response */
  273. UA_Byte *bufPos = ack_msg.data;
  274. const UA_Byte *bufEnd = &ack_msg.data[ack_msg.length];
  275. retval = UA_TcpMessageHeader_encodeBinary(&ackHeader, &bufPos, &bufEnd);
  276. if(retval != UA_STATUSCODE_GOOD) {
  277. connection->releaseSendBuffer(connection, &ack_msg);
  278. return retval;
  279. }
  280. retval = UA_TcpAcknowledgeMessage_encodeBinary(&ackMessage, &bufPos, &bufEnd);
  281. if(retval != UA_STATUSCODE_GOOD) {
  282. connection->releaseSendBuffer(connection, &ack_msg);
  283. return retval;
  284. }
  285. ack_msg.length = ackHeader.messageSize;
  286. return connection->send(connection, &ack_msg);
  287. }
  288. /* OPN -> Open up/renew the securechannel */
  289. static UA_StatusCode
  290. processOPN(UA_Server *server, UA_SecureChannel *channel,
  291. const UA_UInt32 requestId, const UA_ByteString *msg) {
  292. /* Decode the request */
  293. size_t offset = 0;
  294. UA_NodeId requestType;
  295. UA_StatusCode retval = UA_STATUSCODE_GOOD;
  296. UA_OpenSecureChannelRequest openSecureChannelRequest;
  297. retval |= UA_NodeId_decodeBinary(msg, &offset, &requestType);
  298. retval |= UA_OpenSecureChannelRequest_decodeBinary(msg, &offset, &openSecureChannelRequest);
  299. /* Error occurred */
  300. if(retval != UA_STATUSCODE_GOOD ||
  301. requestType.identifier.numeric != UA_TYPES[UA_TYPES_OPENSECURECHANNELREQUEST].binaryEncodingId) {
  302. UA_NodeId_deleteMembers(&requestType);
  303. UA_OpenSecureChannelRequest_deleteMembers(&openSecureChannelRequest);
  304. UA_LOG_INFO_CHANNEL(server->config.logger, channel,
  305. "Could not decode the OPN message. Closing the connection.");
  306. UA_SecureChannelManager_close(&server->secureChannelManager, channel->securityToken.channelId);
  307. return retval;
  308. }
  309. UA_NodeId_deleteMembers(&requestType);
  310. /* Call the service */
  311. UA_OpenSecureChannelResponse openScResponse;
  312. UA_OpenSecureChannelResponse_init(&openScResponse);
  313. Service_OpenSecureChannel(server, channel, &openSecureChannelRequest, &openScResponse);
  314. UA_OpenSecureChannelRequest_deleteMembers(&openSecureChannelRequest);
  315. if(openScResponse.responseHeader.serviceResult != UA_STATUSCODE_GOOD) {
  316. UA_LOG_INFO_CHANNEL(server->config.logger, channel, "Could not open a SecureChannel. "
  317. "Closing the connection.");
  318. UA_SecureChannelManager_close(&server->secureChannelManager,
  319. channel->securityToken.channelId);
  320. return openScResponse.responseHeader.serviceResult;
  321. }
  322. /* Send the response */
  323. retval = UA_SecureChannel_sendAsymmetricOPNMessage(channel, requestId, &openScResponse,
  324. &UA_TYPES[UA_TYPES_OPENSECURECHANNELRESPONSE]);
  325. UA_OpenSecureChannelResponse_deleteMembers(&openScResponse);
  326. if(retval != UA_STATUSCODE_GOOD) {
  327. UA_LOG_INFO_CHANNEL(server->config.logger, channel,
  328. "Could not send the OPN answer with error code %s",
  329. UA_StatusCode_name(retval));
  330. UA_SecureChannelManager_close(&server->secureChannelManager,
  331. channel->securityToken.channelId);
  332. }
  333. return retval;
  334. }
  335. static UA_StatusCode
  336. processMSG(UA_Server *server, UA_SecureChannel *channel,
  337. UA_UInt32 requestId, const UA_ByteString *msg) {
  338. /* At 0, the nodeid starts... */
  339. size_t offset = 0;
  340. /* Decode the nodeid */
  341. UA_NodeId requestTypeId;
  342. UA_StatusCode retval = UA_NodeId_decodeBinary(msg, &offset, &requestTypeId);
  343. if(retval != UA_STATUSCODE_GOOD)
  344. return retval;
  345. if(requestTypeId.identifierType != UA_NODEIDTYPE_NUMERIC)
  346. UA_NodeId_deleteMembers(&requestTypeId); /* leads to badserviceunsupported */
  347. /* Store the start-position of the request */
  348. size_t requestPos = offset;
  349. /* Get the service pointers */
  350. UA_Service service = NULL;
  351. const UA_DataType *requestType = NULL;
  352. const UA_DataType *responseType = NULL;
  353. UA_Boolean sessionRequired = true;
  354. getServicePointers(requestTypeId.identifier.numeric, &requestType,
  355. &responseType, &service, &sessionRequired);
  356. if(!requestType) {
  357. if(requestTypeId.identifier.numeric == 787) {
  358. UA_LOG_INFO_CHANNEL(server->config.logger, channel,
  359. "Client requested a subscription, " \
  360. "but those are not enabled in the build");
  361. } else {
  362. UA_LOG_INFO_CHANNEL(server->config.logger, channel,
  363. "Unknown request with type identifier %i",
  364. requestTypeId.identifier.numeric);
  365. }
  366. return sendServiceFault(channel, msg, requestPos, &UA_TYPES[UA_TYPES_SERVICEFAULT],
  367. requestId, UA_STATUSCODE_BADSERVICEUNSUPPORTED);
  368. }
  369. UA_assert(responseType);
  370. /* Decode the request */
  371. void *request = UA_alloca(requestType->memSize);
  372. UA_RequestHeader *requestHeader = (UA_RequestHeader*)request;
  373. retval = UA_decodeBinary(msg, &offset, request, requestType,
  374. server->config.customDataTypesSize,
  375. server->config.customDataTypes);
  376. if(retval != UA_STATUSCODE_GOOD) {
  377. UA_LOG_DEBUG_CHANNEL(server->config.logger, channel,
  378. "Could not decode the request");
  379. return sendServiceFault(channel, msg, requestPos, responseType, requestId, retval);
  380. }
  381. /* Prepare the respone */
  382. void *response = UA_alloca(responseType->memSize);
  383. UA_init(response, responseType);
  384. UA_Session *session = NULL; /* must be initialized before goto send_response */
  385. /* CreateSession doesn't need a session */
  386. if(requestType == &UA_TYPES[UA_TYPES_CREATESESSIONREQUEST]) {
  387. Service_CreateSession(server, channel,
  388. (const UA_CreateSessionRequest *)request,
  389. (UA_CreateSessionResponse *)response);
  390. #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
  391. // store the authentication token and session ID so we can help fuzzing by setting
  392. // these values in the next request automatically
  393. UA_CreateSessionResponse *res = (UA_CreateSessionResponse *)response;
  394. UA_NodeId_copy(&res->authenticationToken, &unsafe_fuzz_authenticationToken);
  395. #endif
  396. goto send_response;
  397. }
  398. #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
  399. // set the authenticationToken from the create session request to help fuzzing cover more lines
  400. if (!UA_NodeId_isNull(&unsafe_fuzz_authenticationToken))
  401. UA_NodeId_copy(&unsafe_fuzz_authenticationToken, &requestHeader->authenticationToken);
  402. #endif
  403. /* Find the matching session */
  404. session = UA_SecureChannel_getSession(channel, &requestHeader->authenticationToken);
  405. if(!session && !UA_NodeId_isNull(&requestHeader->authenticationToken))
  406. session = UA_SessionManager_getSessionByToken(&server->sessionManager,
  407. &requestHeader->authenticationToken);
  408. if(requestType == &UA_TYPES[UA_TYPES_ACTIVATESESSIONREQUEST]) {
  409. if(!session) {
  410. UA_LOG_DEBUG_CHANNEL(server->config.logger, channel,
  411. "Trying to activate a session that is " \
  412. "not known in the server");
  413. UA_deleteMembers(request, requestType);
  414. return sendServiceFault(channel, msg, requestPos, responseType,
  415. requestId, UA_STATUSCODE_BADSESSIONIDINVALID);
  416. }
  417. Service_ActivateSession(server, channel, session,
  418. (const UA_ActivateSessionRequest*)request,
  419. (UA_ActivateSessionResponse*)response);
  420. goto send_response;
  421. }
  422. /* Set an anonymous, inactive session for services that need no session */
  423. UA_Session anonymousSession;
  424. if(!session) {
  425. if(sessionRequired) {
  426. UA_LOG_WARNING_CHANNEL(server->config.logger, channel,
  427. "Service request %i without a valid session",
  428. requestType->binaryEncodingId);
  429. UA_deleteMembers(request, requestType);
  430. return sendServiceFault(channel, msg, requestPos, responseType,
  431. requestId, UA_STATUSCODE_BADSESSIONIDINVALID);
  432. }
  433. UA_Session_init(&anonymousSession);
  434. anonymousSession.sessionId = UA_NODEID_GUID(0, UA_GUID_NULL);
  435. anonymousSession.channel = channel;
  436. session = &anonymousSession;
  437. }
  438. /* Trying to use a non-activated session? */
  439. if(sessionRequired && !session->activated) {
  440. UA_LOG_WARNING_SESSION(server->config.logger, session,
  441. "Calling service %i on a non-activated session",
  442. requestType->binaryEncodingId);
  443. UA_SessionManager_removeSession(&server->sessionManager,
  444. &session->authenticationToken);
  445. UA_deleteMembers(request, requestType);
  446. return sendServiceFault(channel, msg, requestPos, responseType,
  447. requestId, UA_STATUSCODE_BADSESSIONNOTACTIVATED);
  448. }
  449. /* The session is bound to another channel */
  450. if(session != &anonymousSession && session->channel != channel) {
  451. UA_LOG_WARNING_CHANNEL(server->config.logger, channel,
  452. "Client tries to use a Session that is not "
  453. "bound to this SecureChannel");
  454. UA_deleteMembers(request, requestType);
  455. return sendServiceFault(channel, msg, requestPos, responseType,
  456. requestId, UA_STATUSCODE_BADSESSIONNOTACTIVATED);
  457. }
  458. /* Update the session lifetime */
  459. UA_Session_updateLifetime(session);
  460. #ifdef UA_ENABLE_SUBSCRIPTIONS
  461. /* The publish request is not answered immediately */
  462. if(requestType == &UA_TYPES[UA_TYPES_PUBLISHREQUEST]) {
  463. Service_Publish(server, session,
  464. (const UA_PublishRequest*)request, requestId);
  465. UA_deleteMembers(request, requestType);
  466. return UA_STATUSCODE_GOOD;
  467. }
  468. #endif
  469. /* Call the service */
  470. UA_assert(service); /* For all services besides publish, the service pointer is non-NULL*/
  471. service(server, session, request, response);
  472. send_response:
  473. /* Send the response */
  474. ((UA_ResponseHeader*)response)->requestHandle = requestHeader->requestHandle;
  475. ((UA_ResponseHeader*)response)->timestamp = UA_DateTime_now();
  476. retval = UA_SecureChannel_sendSymmetricMessage(channel, requestId, UA_MESSAGETYPE_MSG,
  477. response, responseType);
  478. if(retval != UA_STATUSCODE_GOOD)
  479. UA_LOG_INFO_CHANNEL(server->config.logger, channel,
  480. "Could not send the message over the SecureChannel "
  481. "with StatusCode %s", UA_StatusCode_name(retval));
  482. /* Clean up */
  483. UA_deleteMembers(request, requestType);
  484. UA_deleteMembers(response, responseType);
  485. return retval;
  486. }
  487. /* Takes decoded messages starting at the nodeid of the content type. */
  488. static UA_StatusCode
  489. processSecureChannelMessage(void *application, UA_SecureChannel *channel,
  490. UA_MessageType messagetype, UA_UInt32 requestId,
  491. const UA_ByteString *message) {
  492. UA_Server *server = (UA_Server*)application;
  493. UA_StatusCode retval = UA_STATUSCODE_GOOD;
  494. switch(messagetype) {
  495. case UA_MESSAGETYPE_OPN:
  496. UA_LOG_TRACE_CHANNEL(server->config.logger, channel,
  497. "Process an OPN on an open channel");
  498. retval = processOPN(server, channel, requestId, message);
  499. break;
  500. case UA_MESSAGETYPE_MSG:
  501. UA_LOG_TRACE_CHANNEL(server->config.logger, channel, "Process a MSG");
  502. retval = processMSG(server, channel, requestId, message);
  503. break;
  504. case UA_MESSAGETYPE_CLO:
  505. UA_LOG_TRACE_CHANNEL(server->config.logger, channel, "Process a CLO");
  506. Service_CloseSecureChannel(server, channel);
  507. break;
  508. default:
  509. UA_LOG_TRACE_CHANNEL(server->config.logger, channel, "Invalid message type");
  510. retval = UA_STATUSCODE_BADTCPMESSAGETYPEINVALID;
  511. break;
  512. }
  513. return retval;
  514. }
  515. static UA_StatusCode
  516. createSecureChannel(void *application, UA_Connection *connection,
  517. UA_AsymmetricAlgorithmSecurityHeader *asymHeader) {
  518. UA_Server *server = (UA_Server*)application;
  519. /* Iterate over available endpoints and choose the correct one */
  520. UA_Endpoint *endpoint = NULL;
  521. UA_StatusCode retval = UA_STATUSCODE_GOOD;
  522. for(size_t i = 0; i < server->config.endpointsSize; ++i) {
  523. UA_Endpoint *endpointCandidate = &server->config.endpoints[i];
  524. if(!UA_ByteString_equal(&asymHeader->securityPolicyUri,
  525. &endpointCandidate->securityPolicy.policyUri))
  526. continue;
  527. retval = endpointCandidate->securityPolicy.asymmetricModule.
  528. compareCertificateThumbprint(&endpointCandidate->securityPolicy,
  529. &asymHeader->receiverCertificateThumbprint);
  530. if(retval != UA_STATUSCODE_GOOD)
  531. continue;
  532. /* We found the correct endpoint (except for security mode) The endpoint
  533. * needs to be changed by the client / server to match the security
  534. * mode. The server does this in the securechannel manager */
  535. endpoint = endpointCandidate;
  536. break;
  537. }
  538. if(!endpoint)
  539. return UA_STATUSCODE_BADSECURITYPOLICYREJECTED;
  540. /* Create a new channel */
  541. return UA_SecureChannelManager_create(&server->secureChannelManager, connection,
  542. &endpoint->securityPolicy, asymHeader);
  543. }
  544. static UA_StatusCode
  545. processCompleteChunkWithoutChannel(UA_Server *server, UA_Connection *connection,
  546. UA_ByteString *message) {
  547. /* Process chunk without a channel; must be OPN */
  548. UA_LOG_TRACE(server->config.logger, UA_LOGCATEGORY_NETWORK,
  549. "Connection %i | No channel attached to the connection. "
  550. "Process the chunk directly", connection->sockfd);
  551. size_t offset = 0;
  552. UA_TcpMessageHeader tcpMessageHeader;
  553. UA_StatusCode retval =
  554. UA_TcpMessageHeader_decodeBinary(message, &offset, &tcpMessageHeader);
  555. if(retval != UA_STATUSCODE_GOOD)
  556. return retval;
  557. // Only HEL and OPN messages possible without a channel (on the server side)
  558. switch(tcpMessageHeader.messageTypeAndChunkType & 0x00ffffff) {
  559. case UA_MESSAGETYPE_HEL:
  560. retval = processHEL(server, connection, message, &offset);
  561. break;
  562. case UA_MESSAGETYPE_OPN:
  563. {
  564. UA_LOG_TRACE(server->config.logger, UA_LOGCATEGORY_NETWORK,
  565. "Connection %i | Process OPN message", connection->sockfd);
  566. /* Called before HEL */
  567. if(connection->state != UA_CONNECTION_ESTABLISHED) {
  568. retval = UA_STATUSCODE_BADCOMMUNICATIONERROR;
  569. break;
  570. }
  571. // Decode the asymmetric algorithm security header since it is not encrypted and
  572. // needed to decide what security policy to use.
  573. UA_AsymmetricAlgorithmSecurityHeader asymHeader;
  574. UA_AsymmetricAlgorithmSecurityHeader_init(&asymHeader);
  575. size_t messageHeaderOffset = UA_SECURE_CONVERSATION_MESSAGE_HEADER_LENGTH;
  576. retval = UA_AsymmetricAlgorithmSecurityHeader_decodeBinary(message,
  577. &messageHeaderOffset,
  578. &asymHeader);
  579. if(retval != UA_STATUSCODE_GOOD)
  580. break;
  581. retval = createSecureChannel(server, connection, &asymHeader);
  582. UA_AsymmetricAlgorithmSecurityHeader_deleteMembers(&asymHeader);
  583. if(retval != UA_STATUSCODE_GOOD)
  584. break;
  585. retval = UA_SecureChannel_processChunk(connection->channel, message,
  586. processSecureChannelMessage,
  587. server);
  588. if(retval != UA_STATUSCODE_GOOD)
  589. break;
  590. break;
  591. }
  592. default:
  593. UA_LOG_TRACE(server->config.logger, UA_LOGCATEGORY_NETWORK,
  594. "Connection %i | Expected OPN or HEL message on a connection "
  595. "without a SecureChannel", connection->sockfd);
  596. retval = UA_STATUSCODE_BADTCPMESSAGETYPEINVALID;
  597. break;
  598. }
  599. return retval;
  600. }
  601. static UA_StatusCode
  602. processCompleteChunk(void *const application,
  603. UA_Connection *const connection,
  604. UA_ByteString *const chunk) {
  605. UA_Server *const server = (UA_Server*)application;
  606. #ifdef UA_DEBUG_DUMP_PKGS_FILE
  607. UA_debug_dumpCompleteChunk(server, connection, chunk);
  608. #endif
  609. if(!connection->channel)
  610. return processCompleteChunkWithoutChannel(server, connection, chunk);
  611. return UA_SecureChannel_processChunk(connection->channel, chunk,
  612. processSecureChannelMessage,
  613. server);
  614. }
  615. static void
  616. processBinaryMessage(UA_Server *server, UA_Connection *connection,
  617. UA_ByteString *message) {
  618. UA_LOG_TRACE(server->config.logger, UA_LOGCATEGORY_NETWORK,
  619. "Connection %i | Received a packet.", connection->sockfd);
  620. #ifdef UA_DEBUG_DUMP_PKGS
  621. UA_dump_hex_pkg(message->data, message->length);
  622. #endif
  623. UA_StatusCode retval = UA_Connection_processChunks(connection, server,
  624. processCompleteChunk, message);
  625. if(retval != UA_STATUSCODE_GOOD) {
  626. UA_LOG_INFO(server->config.logger, UA_LOGCATEGORY_NETWORK,
  627. "Connection %i | Processing the message failed with "
  628. "error %s", connection->sockfd, UA_StatusCode_name(retval));
  629. /* Send an ERR message and close the connection */
  630. UA_TcpErrorMessage error;
  631. error.error = retval;
  632. error.reason = UA_STRING_NULL;
  633. UA_Connection_sendError(connection, &error);
  634. connection->close(connection);
  635. }
  636. }
  637. #ifndef UA_ENABLE_MULTITHREADING
  638. void
  639. UA_Server_processBinaryMessage(UA_Server *server, UA_Connection *connection,
  640. UA_ByteString *message) {
  641. processBinaryMessage(server, connection, message);
  642. }
  643. #else
  644. typedef struct {
  645. UA_Connection *connection;
  646. UA_ByteString message;
  647. } ConnectionMessage;
  648. static void
  649. workerProcessBinaryMessage(UA_Server *server, ConnectionMessage *cm) {
  650. processBinaryMessage(server, cm->connection, &cm->message);
  651. UA_free(cm);
  652. }
  653. void
  654. UA_Server_processBinaryMessage(UA_Server *server, UA_Connection *connection,
  655. UA_ByteString *message) {
  656. /* Allocate the memory for the callback data */
  657. ConnectionMessage *cm = (ConnectionMessage*)UA_malloc(sizeof(ConnectionMessage));
  658. /* If malloc failed, execute immediately */
  659. if(!cm) {
  660. processBinaryMessage(server, connection, message);
  661. return;
  662. }
  663. /* Dispatch to the workers */
  664. cm->connection = connection;
  665. cm->message = *message;
  666. UA_Server_workerCallback(server, (UA_ServerCallback)workerProcessBinaryMessage, cm);
  667. }
  668. static void
  669. deleteConnectionTrampoline(UA_Server *server, void *data) {
  670. UA_Connection *connection = (UA_Connection*)data;
  671. connection->free(connection);
  672. }
  673. #endif
  674. void
  675. UA_Server_removeConnection(UA_Server *server, UA_Connection *connection) {
  676. UA_Connection_detachSecureChannel(connection);
  677. #ifndef UA_ENABLE_MULTITHREADING
  678. connection->free(connection);
  679. #else
  680. UA_Server_delayedCallback(server, deleteConnectionTrampoline, connection);
  681. #endif
  682. }