open62541/tools/corpus_generator/corpus_generator.c

/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

/**
 * This code is used to generate a binary file for every request type
 * which can be sent from a client to the server.
 * These files form the basic corpus for fuzzing the server.
 * This script is intended to be executed manually and then commit the new
 * corpus to the repository.
 */

#ifndef UA_DEBUG_DUMP_PKGS_FILE
#error UA_DEBUG_DUMP_PKGS_FILE must be defined
#endif

#include <stdio.h>
#include <stdlib.h>
#include <pthread.h>
#include <ua_types.h>
#include <sys/stat.h>
#include <server/ua_server_internal.h>
#include <dirent.h>
#include <src_generated/ua_types_generated.h>
#include <fcntl.h>
#include <unistd.h>
#include <ua_client_highlevel.h>

#include "ua_server.h"
#include "ua_client.h"
#include "ua_config_default.h"
#include "ua_client_highlevel.h"
#include "ua_network_tcp.h"
#include "ua_transport_generated.h"
#include "ua_transport_generated_encoding_binary.h"
#include "ua_securechannel.h"
#include "ua_types_generated_encoding_binary.h"
#include "server/ua_services.h"

unsigned int chunkCount = 0;

char dumpOutputFile[255];

char *messageTypes[] = {"ack", "hel", "msg", "opn", "clo", "err", "unk"};
char *messageTypePrefix = NULL;
char requestServiceName[200];

void UA_debug_dumpCompleteChunk(UA_Server *const server, UA_Connection *const connection, UA_ByteString *messageBuffer);

static void setMessageTypePrefix(UA_UInt32 messageType) {
    switch(messageType & 0x00ffffff) {
        case UA_MESSAGETYPE_ACK:
            messageTypePrefix = messageTypes[0];
            break;
        case UA_MESSAGETYPE_HEL:
            messageTypePrefix = messageTypes[1];
            break;
        case UA_MESSAGETYPE_MSG:
            messageTypePrefix = messageTypes[2];
            break;
        case UA_MESSAGETYPE_OPN:
            messageTypePrefix = messageTypes[3];
            break;
        case UA_MESSAGETYPE_CLO:
            messageTypePrefix = messageTypes[4];
            break;
        case UA_MESSAGETYPE_ERR:
            messageTypePrefix = messageTypes[5];
            break;
        default:
            messageTypePrefix = messageTypes[6];
    }
}


static UA_StatusCode setRequestedServiceName(const UA_ByteString *msg) {
    /* At 0, the nodeid starts... */
    size_t offset = 0;

    /* Decode the nodeid */
    UA_NodeId requestTypeId;
    UA_StatusCode retval = UA_NodeId_decodeBinary(msg, &offset, &requestTypeId);
    if(retval != UA_STATUSCODE_GOOD)
        return retval;
    if(requestTypeId.identifierType != UA_NODEIDTYPE_NUMERIC || requestTypeId.namespaceIndex != 0) {
        snprintf(requestServiceName, 200, "invalid_request_id");
        return UA_STATUSCODE_BADUNEXPECTEDERROR;
    }

    const UA_DataType *requestType = NULL;

    for (size_t i=0; i<UA_TYPES_COUNT; i++) {
        if (UA_TYPES[i].binaryEncodingId == requestTypeId.identifier.numeric) {
            requestType = &UA_TYPES[i];
            break;
        }
    }
    if (requestType == NULL) {
        snprintf(requestServiceName, 200, "invalid_request_no_type");
        return UA_STATUSCODE_BADUNEXPECTEDERROR;
    }

    snprintf(requestServiceName, 200, "_%s", requestType->typeName);
    return UA_STATUSCODE_GOOD;
}

static UA_StatusCode
processCompleteChunkWithoutChannel(UA_Server *server, UA_Connection *connection,
                                   UA_ByteString *message) {
    size_t offset = 0;
    UA_TcpMessageHeader tcpMessageHeader;
    UA_StatusCode retval =
            UA_TcpMessageHeader_decodeBinary(message, &offset, &tcpMessageHeader);
    if(retval != UA_STATUSCODE_GOOD)
        return retval;

    setMessageTypePrefix(tcpMessageHeader.messageTypeAndChunkType & 0x00ffffff);

    if ((tcpMessageHeader.messageTypeAndChunkType & 0x00ffffff) == UA_MESSAGETYPE_MSG) {
        // this should not happen in normal operation
        UA_LOG_ERROR(server->config.logger, UA_LOGCATEGORY_SERVER, "Got MSG package without channel.");
        return UA_STATUSCODE_BADUNEXPECTEDERROR;
    }
    return UA_STATUSCODE_GOOD;
}

/* Takes decoded messages starting at the nodeid of the content type. */
static UA_StatusCode
processSecureChannelMessage(void *application, UA_SecureChannel *channel,
                            UA_MessageType messagetype, UA_UInt32 requestId,
                            const UA_ByteString *message) {
    //UA_Server *server = (UA_Server*)application;
    UA_StatusCode retval = UA_STATUSCODE_GOOD;
    setMessageTypePrefix(messagetype);
    if (messagetype == UA_MESSAGETYPE_MSG) {
        setRequestedServiceName(message);
    }
    return retval;
}


void UA_debug_dumpCompleteChunk(UA_Server *const server, UA_Connection *const connection, UA_ByteString *messageBuffer) {

    messageTypePrefix = NULL;
    requestServiceName[0] = 0;

    UA_StatusCode retval;
    if(!connection->channel)
        retval = processCompleteChunkWithoutChannel(server, connection, messageBuffer);
    else {
        // make a backup of the sequence number and reset it, because processChunk increases it
        UA_UInt32 seqBackup = connection->channel->receiveSequenceNumber;
        retval = UA_SecureChannel_processChunk(connection->channel, messageBuffer,
                                               processSecureChannelMessage,
                                               server);
        connection->channel->receiveSequenceNumber = seqBackup;
    }

    snprintf(dumpOutputFile, 255, "%s/%05d_%s%s.bin", UA_CORPUS_OUTPUT_DIR, ++chunkCount, messageTypePrefix ? messageTypePrefix : "", requestServiceName);
    UA_LOG_INFO(server->config.logger, UA_LOGCATEGORY_SERVER, "Dumping package %s", dumpOutputFile);

    FILE *write_ptr;

    write_ptr = fopen(dumpOutputFile, "ab");

    fwrite(messageBuffer->data, messageBuffer->length, 1, write_ptr); // write 10 bytes from our buffer
    fclose(write_ptr);
}


UA_Server *server;
UA_ServerConfig *config;
UA_Boolean *running;
pthread_t server_thread;

static void * serverloop(void *_) {
    while(*running)
        UA_Server_run_iterate(server, true);
    return NULL;
}

static void start_server(void) {
    running = UA_Boolean_new();
    *running = true;
    config = UA_ServerConfig_new_default();
    server = UA_Server_new(config);
    UA_Server_run_startup(server);
    pthread_create(&server_thread, NULL, serverloop, NULL);
}

static void teardown_server(void) {
    *running = false;
    pthread_join(server_thread, NULL);
    UA_Server_run_shutdown(server);
    UA_Boolean_delete(running);
    UA_Server_delete(server);
    UA_ServerConfig_delete(config);
}

static void emptyCorpusDir() {
    DIR *theFolder = opendir(UA_CORPUS_OUTPUT_DIR);
    struct dirent *next_file;
    char filepath[256];

    while ( (next_file = readdir(theFolder)) != NULL )
    {
        // build the path for each file in the folder
        sprintf(filepath, "%s/%s", UA_CORPUS_OUTPUT_DIR, next_file->d_name);
        remove(filepath);
    }
    closedir(theFolder);
}


#define ASSERT_GOOD(X) if (X != UA_STATUSCODE_GOOD) return X;

/*************************************************
 * The following list of client requests is based
 * on ua_server_binary.c:getServicePointers to
 * cover all possible services and their inputs
 ************************************************/

static UA_StatusCode findServersRequest(UA_Client *client) {
    UA_ApplicationDescription* applicationDescriptionArray = NULL;
    size_t applicationDescriptionArraySize = 0;

    size_t serverUrisSize = 1;
    UA_String *serverUris = UA_String_new();
    serverUris[0] = UA_String_fromChars("urn:some:server:uri");

    size_t localeIdsSize = 1;
    UA_String *localeIds = UA_String_new();
    localeIds[0] = UA_String_fromChars("en");

    ASSERT_GOOD(UA_Client_findServers(client, "opc.tcp://localhost:4840",
                                  serverUrisSize, serverUris, localeIdsSize, localeIds,
                                  &applicationDescriptionArraySize, &applicationDescriptionArray));

    UA_Array_delete(serverUris, serverUrisSize, &UA_TYPES[UA_TYPES_STRING]);
    UA_Array_delete(localeIds, localeIdsSize, &UA_TYPES[UA_TYPES_STRING]);
    UA_Array_delete(applicationDescriptionArray, applicationDescriptionArraySize,
                    &UA_TYPES[UA_TYPES_APPLICATIONDESCRIPTION]);

    return UA_STATUSCODE_GOOD;

}

static UA_StatusCode findServersOnNetworkRequest(UA_Client *client) {
    UA_ServerOnNetwork* serverOnNetwork = NULL;
    size_t serverOnNetworkSize = 0;


    size_t  serverCapabilityFilterSize = 2;
    UA_String *serverCapabilityFilter = (UA_String*)UA_malloc(sizeof(UA_String) * serverCapabilityFilterSize);
    serverCapabilityFilter[0] = UA_String_fromChars("LDS");
    serverCapabilityFilter[1] = UA_String_fromChars("NA");


    ASSERT_GOOD(UA_Client_findServersOnNetwork(client, "opc.tcp://localhost:4840", 0, 0,
                                           serverCapabilityFilterSize, serverCapabilityFilter,
                                           &serverOnNetworkSize, &serverOnNetwork));

    UA_Array_delete(serverCapabilityFilter, serverCapabilityFilterSize,
                        &UA_TYPES[UA_TYPES_STRING]);
    UA_Array_delete(serverOnNetwork, serverOnNetworkSize, &UA_TYPES[UA_TYPES_SERVERONNETWORK]);
    return UA_STATUSCODE_GOOD;
}

static void initUaRegisterServer(UA_RegisteredServer *requestServer) {
    requestServer->isOnline = UA_TRUE;
    requestServer->serverUri = server->config.applicationDescription.applicationUri;
    requestServer->productUri = server->config.applicationDescription.productUri;
    requestServer->serverType = server->config.applicationDescription.applicationType;
    requestServer->gatewayServerUri = server->config.applicationDescription.gatewayServerUri;

    // create the semaphore
    int fd = open("/tmp/open62541-corpus-semaphore", O_RDWR|O_CREAT, S_IRWXU | S_IRWXG | S_IRWXO);
    close(fd);
    requestServer->semaphoreFilePath = UA_STRING_ALLOC("/tmp/open62541-corpus-semaphore");

    requestServer->serverNames = &server->config.applicationDescription.applicationName;
    requestServer->serverNamesSize = 1;

    size_t nl_discurls = server->config.networkLayersSize;
    requestServer->discoveryUrls = (UA_String*)UA_malloc(sizeof(UA_String) * nl_discurls);
    requestServer->discoveryUrlsSize = nl_discurls;
    for(size_t i = 0; i < nl_discurls; ++i) {
        UA_ServerNetworkLayer *nl = &server->config.networkLayers[i];
        requestServer->discoveryUrls[i] = nl->discoveryUrl;
    }

}

static UA_StatusCode registerServerRequest(UA_Client *client) {

    /* Prepare the request. Do not cleanup the request after the service call,
     * as the members are stack-allocated or point into the server config. */
    UA_RegisterServerRequest request;
    UA_RegisterServerRequest_init(&request);
    /* Copy from RegisterServer2 request */
    request.requestHeader.timestamp = UA_DateTime_now();
    request.requestHeader.timeoutHint = 10000;

    initUaRegisterServer(&request.server);


    UA_RegisterServerResponse response;
    UA_RegisterServerResponse_init(&response);

    __UA_Client_Service(client, &request,
                        &UA_TYPES[UA_TYPES_REGISTERSERVERREQUEST],
                        &response,
                        &UA_TYPES[UA_TYPES_REGISTERSERVERRESPONSE]);

    UA_free(request.server.discoveryUrls);
    ASSERT_GOOD(response.responseHeader.serviceResult);

    return UA_STATUSCODE_GOOD;
}

static UA_StatusCode registerServer2Request(UA_Client *client) {
    /* Prepare the request. Do not cleanup the request after the service call,
     * as the members are stack-allocated or point into the server config. */
    UA_RegisterServer2Request request;
    UA_RegisterServer2Request_init(&request);
    request.requestHeader.timestamp = UA_DateTime_now();
    request.requestHeader.timeoutHint = 10000;

    initUaRegisterServer(&request.server);

    UA_MdnsDiscoveryConfiguration mdnsConfig;
    UA_MdnsDiscoveryConfiguration_init(&mdnsConfig);

    request.discoveryConfigurationSize = 1;
    request.discoveryConfiguration = UA_ExtensionObject_new();
    UA_ExtensionObject_init(&request.discoveryConfiguration[0]);
    request.discoveryConfiguration[0].encoding = UA_EXTENSIONOBJECT_DECODED_NODELETE;
    request.discoveryConfiguration[0].content.decoded.type = &UA_TYPES[UA_TYPES_MDNSDISCOVERYCONFIGURATION];
    request.discoveryConfiguration[0].content.decoded.data = &mdnsConfig;

    mdnsConfig.mdnsServerName = server->config.mdnsServerName;
    mdnsConfig.serverCapabilities = server->config.serverCapabilities;
    mdnsConfig.serverCapabilitiesSize = server->config.serverCapabilitiesSize;

    // First try with RegisterServer2, if that isn't implemented, use RegisterServer
    UA_RegisterServer2Response response;
    UA_RegisterServer2Response_init(&response);
    __UA_Client_Service(client, &request, &UA_TYPES[UA_TYPES_REGISTERSERVER2REQUEST],
                        &response, &UA_TYPES[UA_TYPES_REGISTERSERVER2RESPONSE]);

    ASSERT_GOOD(response.responseHeader.serviceResult);
    UA_free(request.server.discoveryUrls);
    UA_ExtensionObject_delete(request.discoveryConfiguration);

    return UA_STATUSCODE_GOOD;
}

static UA_StatusCode readValueRequest(UA_Client *client) {
    UA_ReadValueId rvi;
    UA_ReadValueId_init(&rvi);
    rvi.nodeId = UA_NODEID_NUMERIC(0, UA_NS0ID_SERVER_SERVERSTATUS_STARTTIME);
    rvi.attributeId = UA_ATTRIBUTEID_VALUE;

    UA_DataValue resp = UA_Server_read(server, &rvi, UA_TIMESTAMPSTORETURN_BOTH);
    ASSERT_GOOD(resp.status);

    UA_DataValue_deleteMembers(&resp);

    return UA_STATUSCODE_GOOD;
}


static UA_StatusCode writeValueRequest(UA_Client *client) {
    UA_WriteValue wValue;
    UA_WriteValue_init(&wValue);
    UA_LocalizedText testValue = UA_LOCALIZEDTEXT("en-EN", "MyServer");
    UA_Variant_setScalar(&wValue.value.value, &testValue, &UA_TYPES[UA_TYPES_LOCALIZEDTEXT]);
    wValue.value.hasValue = true;
    wValue.nodeId = UA_NODEID_NUMERIC(0, UA_NS0ID_SERVER);
    wValue.attributeId = UA_ATTRIBUTEID_DISPLAYNAME;
    ASSERT_GOOD(UA_Server_write(server, &wValue));

    return UA_STATUSCODE_GOOD;
}

static UA_StatusCode browseAndBrowseNextRequest(UA_Client *client) {
    // Browse node in server folder
    UA_BrowseRequest bReq;
    UA_BrowseRequest_init(&bReq);
    // normally is set to 0, to get all the nodes, but we want to test browse next
    bReq.requestedMaxReferencesPerNode = 1;
    bReq.nodesToBrowse = UA_BrowseDescription_new();
    bReq.nodesToBrowseSize = 1;
    bReq.nodesToBrowse[0].nodeId = UA_NODEID_NUMERIC(0, UA_NS0ID_SERVER);
    bReq.nodesToBrowse[0].resultMask = UA_BROWSERESULTMASK_ALL;

    UA_BrowseResponse bResp = UA_Client_Service_browse(client, bReq);
    ASSERT_GOOD(bResp.responseHeader.serviceResult);

    // browse next
    UA_BrowseNextRequest bNextReq;
    UA_BrowseNextRequest_init(&bNextReq);
    // normally is set to 0, to get all the nodes, but we want to test browse next
    bNextReq.releaseContinuationPoints = UA_FALSE;
    bNextReq.continuationPoints = &bResp.results[0].continuationPoint;
    bNextReq.continuationPointsSize = 1;

    UA_BrowseNextResponse bNextResp = UA_Client_Service_browseNext(client, bNextReq);
    ASSERT_GOOD(bNextResp.responseHeader.serviceResult);

    UA_BrowseNextResponse_deleteMembers(&bNextResp);

    bNextResp = UA_Client_Service_browseNext(client, bNextReq);
    ASSERT_GOOD(bNextResp.responseHeader.serviceResult);

    UA_BrowseNextResponse_deleteMembers(&bNextResp);

    // release continuation point. Result is then empty
    bNextReq.releaseContinuationPoints = UA_TRUE;
    bNextResp = UA_Client_Service_browseNext(client, bNextReq);
    UA_BrowseNextResponse_deleteMembers(&bNextResp);
    ASSERT_GOOD(bNextResp.responseHeader.serviceResult);

    UA_BrowseRequest_deleteMembers(&bReq);
    UA_BrowseResponse_deleteMembers(&bResp);
    // already deleted by browse request
    bNextReq.continuationPoints = NULL;
    bNextReq.continuationPointsSize = 0;
    UA_BrowseNextRequest_deleteMembers(&bNextReq);

    return UA_STATUSCODE_GOOD;
}

static UA_StatusCode registerUnregisterNodesRequest(UA_Client *client) {
    UA_RegisterNodesRequest req;
    UA_RegisterNodesRequest_init(&req);

    req.nodesToRegister = UA_NodeId_new();
    req.nodesToRegister[0] = UA_NODEID_NUMERIC(0, UA_NS0ID_SERVER_SERVERSTATUS_CURRENTTIME);
    req.nodesToRegisterSize = 1;

    UA_RegisterNodesResponse res = UA_Client_Service_registerNodes(client, req);
    ASSERT_GOOD(res.responseHeader.serviceResult);

    UA_UnregisterNodesRequest reqUn;
    UA_UnregisterNodesRequest_init(&reqUn);

    reqUn.nodesToUnregister = UA_NodeId_new();
    reqUn.nodesToUnregister[0] = res.registeredNodeIds[0];
    reqUn.nodesToUnregisterSize = 1;

    UA_UnregisterNodesResponse resUn = UA_Client_Service_unregisterNodes(client, reqUn);
    ASSERT_GOOD(resUn.responseHeader.serviceResult);

    UA_UnregisterNodesRequest_deleteMembers(&reqUn);
    UA_UnregisterNodesResponse_deleteMembers(&resUn);
    UA_RegisterNodesRequest_deleteMembers(&req);
    UA_RegisterNodesResponse_deleteMembers(&res);
    return UA_STATUSCODE_GOOD;
}

static UA_StatusCode translateBrowsePathsToNodeIdsRequest(UA_Client *client) {
    // Just for testing we want to translate the following path to its corresponding node id
    // /Objects/Server/ServerStatus/State
    // Equals the following node IDs:
    // /85/2253/2256/2259

    #define BROWSE_PATHS_SIZE 3
    char *paths[BROWSE_PATHS_SIZE] = {"Server", "ServerStatus", "State"};
    UA_UInt32 ids[BROWSE_PATHS_SIZE] = {UA_NS0ID_ORGANIZES, UA_NS0ID_HASCOMPONENT, UA_NS0ID_HASCOMPONENT};
    UA_BrowsePath browsePath;
    UA_BrowsePath_init(&browsePath);
    browsePath.startingNode = UA_NODEID_NUMERIC(0, UA_NS0ID_OBJECTSFOLDER);
    browsePath.relativePath.elements = (UA_RelativePathElement*)UA_Array_new(BROWSE_PATHS_SIZE, &UA_TYPES[UA_TYPES_RELATIVEPATHELEMENT]);
    browsePath.relativePath.elementsSize = BROWSE_PATHS_SIZE;

    for(size_t i = 0; i < BROWSE_PATHS_SIZE; i++) {
        UA_RelativePathElement *elem = &browsePath.relativePath.elements[i];
        elem->referenceTypeId = UA_NODEID_NUMERIC(0, ids[i]);
        elem->targetName = UA_QUALIFIEDNAME_ALLOC(0, paths[i]);
    }

    UA_TranslateBrowsePathsToNodeIdsRequest request;
    UA_TranslateBrowsePathsToNodeIdsRequest_init(&request);
    request.browsePaths = &browsePath;
    request.browsePathsSize = 1;

    UA_TranslateBrowsePathsToNodeIdsResponse response = UA_Client_Service_translateBrowsePathsToNodeIds(client, request);
    ASSERT_GOOD(response.responseHeader.serviceResult);

    UA_BrowsePath_deleteMembers(&browsePath);
    UA_TranslateBrowsePathsToNodeIdsResponse_deleteMembers(&response);

    return UA_STATUSCODE_GOOD;
}


static void monitoredItemHandler(UA_UInt32 monId, UA_DataValue *value, void *context) {

}

static UA_StatusCode subscriptionRequests(UA_Client *client) {
    UA_UInt32 subId;
    // createSubscriptionRequest
    ASSERT_GOOD(UA_Client_Subscriptions_new(client, UA_SubscriptionSettings_default, &subId));


    // modifySubscription
    UA_ModifySubscriptionRequest modifySubscriptionRequest;
    UA_ModifySubscriptionRequest_init(&modifySubscriptionRequest);
    modifySubscriptionRequest.subscriptionId = subId;
    modifySubscriptionRequest.maxNotificationsPerPublish = UA_SubscriptionSettings_default.maxNotificationsPerPublish;
    modifySubscriptionRequest.priority = UA_SubscriptionSettings_default.priority;
    modifySubscriptionRequest.requestedLifetimeCount = UA_SubscriptionSettings_default.requestedLifetimeCount;
    modifySubscriptionRequest.requestedMaxKeepAliveCount = UA_SubscriptionSettings_default.requestedMaxKeepAliveCount;
    modifySubscriptionRequest.requestedPublishingInterval = UA_SubscriptionSettings_default.requestedPublishingInterval;
    UA_ModifySubscriptionResponse modifySubscriptionResponse;
    __UA_Client_Service(client, &modifySubscriptionRequest, &UA_TYPES[UA_TYPES_MODIFYSUBSCRIPTIONREQUEST],
                        &modifySubscriptionResponse, &UA_TYPES[UA_TYPES_MODIFYSUBSCRIPTIONRESPONSE]);
    ASSERT_GOOD(modifySubscriptionResponse.responseHeader.serviceResult);
    UA_ModifySubscriptionRequest_deleteMembers(&modifySubscriptionRequest);
    UA_ModifySubscriptionResponse_deleteMembers(&modifySubscriptionResponse);

    // setPublishingMode
    UA_SetPublishingModeRequest setPublishingModeRequest;
    UA_SetPublishingModeRequest_init(&setPublishingModeRequest);
    setPublishingModeRequest.subscriptionIdsSize = 1;
    setPublishingModeRequest.subscriptionIds = UA_malloc(sizeof(UA_UInt32));
    setPublishingModeRequest.subscriptionIds[0] = subId;
    setPublishingModeRequest.publishingEnabled = UA_TRUE;
    UA_SetPublishingModeResponse setPublishingModeResponse;
    __UA_Client_Service(client, &setPublishingModeRequest, &UA_TYPES[UA_TYPES_SETPUBLISHINGMODEREQUEST],
                        &setPublishingModeResponse, &UA_TYPES[UA_TYPES_SETPUBLISHINGMODERESPONSE]);
    ASSERT_GOOD(setPublishingModeResponse.responseHeader.serviceResult);
    UA_SetPublishingModeRequest_deleteMembers(&setPublishingModeRequest);
    UA_SetPublishingModeResponse_deleteMembers(&setPublishingModeResponse);
    

    // createMonitoredItemsRequest
    UA_UInt32 monId;
    ASSERT_GOOD(UA_Client_Subscriptions_addMonitoredItem(client, subId, UA_NODEID_NUMERIC(0, 2259),
                                                      UA_ATTRIBUTEID_VALUE, monitoredItemHandler,
                                                      NULL, &monId));

    // publishRequest
    ASSERT_GOOD(UA_Client_Subscriptions_manuallySendPublishRequest(client));

    // republishRequest
    UA_RepublishRequest republishRequest;
    UA_RepublishRequest_init(&republishRequest);
    republishRequest.retransmitSequenceNumber = 0;
    republishRequest.subscriptionId = subId;
    UA_RepublishResponse republishResponse;
    __UA_Client_Service(client, &republishRequest, &UA_TYPES[UA_TYPES_REPUBLISHREQUEST],
                        &republishResponse, &UA_TYPES[UA_TYPES_REPUBLISHRESPONSE]);
    // here we don't care about the return value since it may be UA_STATUSCODE_BADMESSAGENOTAVAILABLE
    // ASSERT_GOOD(republishResponse.responseHeader.serviceResult);
    UA_RepublishRequest_deleteMembers(&republishRequest);
    UA_RepublishResponse_deleteMembers(&republishResponse);

    // modifyMonitoredItems
    UA_ModifyMonitoredItemsRequest modifyMonitoredItemsRequest;
    UA_ModifyMonitoredItemsRequest_init(&modifyMonitoredItemsRequest);
    modifyMonitoredItemsRequest.subscriptionId = subId;
    modifyMonitoredItemsRequest.itemsToModifySize = 1;
    modifyMonitoredItemsRequest.itemsToModify = UA_malloc(sizeof(UA_MonitoredItemModifyRequest));
    modifyMonitoredItemsRequest.itemsToModify[0].monitoredItemId = monId;
    UA_MonitoringParameters_init(&modifyMonitoredItemsRequest.itemsToModify[0].requestedParameters);
    UA_ModifyMonitoredItemsResponse modifyMonitoredItemsResponse;
    __UA_Client_Service(client, &modifyMonitoredItemsRequest, &UA_TYPES[UA_TYPES_MODIFYMONITOREDITEMSREQUEST],
                        &modifyMonitoredItemsResponse, &UA_TYPES[UA_TYPES_MODIFYMONITOREDITEMSRESPONSE]);
    ASSERT_GOOD(modifyMonitoredItemsResponse.responseHeader.serviceResult);
    UA_ModifyMonitoredItemsRequest_deleteMembers(&modifyMonitoredItemsRequest);
    UA_ModifyMonitoredItemsResponse_deleteMembers(&modifyMonitoredItemsResponse);
    
    // setMonitoringMode
    UA_SetMonitoringModeRequest setMonitoringModeRequest;
    UA_SetMonitoringModeRequest_init(&setMonitoringModeRequest);
    setMonitoringModeRequest.subscriptionId = subId;
    setMonitoringModeRequest.monitoredItemIdsSize = 1;
    setMonitoringModeRequest.monitoredItemIds = UA_malloc(sizeof(UA_UInt32));
    setMonitoringModeRequest.monitoredItemIds[0] = monId;
    setMonitoringModeRequest.monitoringMode = UA_MONITORINGMODE_REPORTING;
    UA_SetMonitoringModeResponse setMonitoringModeResponse;
    __UA_Client_Service(client, &setMonitoringModeRequest, &UA_TYPES[UA_TYPES_SETMONITORINGMODEREQUEST],
                        &setMonitoringModeResponse, &UA_TYPES[UA_TYPES_SETMONITORINGMODERESPONSE]);
    ASSERT_GOOD(setMonitoringModeResponse.responseHeader.serviceResult);
    UA_SetMonitoringModeRequest_deleteMembers(&setMonitoringModeRequest);
    UA_SetMonitoringModeResponse_deleteMembers(&setMonitoringModeResponse);

    // deleteMonitoredItemsRequest
    ASSERT_GOOD(UA_Client_Subscriptions_removeMonitoredItem(client, subId, monId));


    // deleteSubscriptionRequest
    ASSERT_GOOD(UA_Client_Subscriptions_remove(client, subId));

    return UA_STATUSCODE_GOOD;
}

static UA_StatusCode callRequest(UA_Client *client) {
    /* Set up the request */
    UA_CallRequest request;
    UA_CallRequest_init(&request);
    UA_CallMethodRequest item;
    UA_CallMethodRequest_init(&item);
    item.methodId = UA_NODEID_NUMERIC(0, UA_NS0ID_SERVER_GETMONITOREDITEMS);
    item.objectId = UA_NODEID_NUMERIC(0, UA_NS0ID_SERVER);


    UA_Variant input;
    UA_UInt32 subId = 12345;
    UA_Variant_init(&input);
    UA_Variant_setScalarCopy(&input, &subId, &UA_TYPES[UA_TYPES_UINT32]);
    item.inputArgumentsSize = 1;
    item.inputArguments = &input;

    request.methodsToCall = &item;
    request.methodsToCallSize = 1;

    /* Call the service */
    UA_CallResponse response = UA_Client_Service_call(client, request);
    ASSERT_GOOD(response.responseHeader.serviceResult);

    UA_CallResponse_deleteMembers(&response);

    return UA_STATUSCODE_GOOD;
}

static UA_StatusCode nodemanagementRequests(UA_Client *client) {
    UA_ObjectAttributes attr = UA_ObjectAttributes_default;
    attr.description = UA_LOCALIZEDTEXT("en-US", "Some Coordinates");
    attr.displayName = UA_LOCALIZEDTEXT("en-US", "Coordinates");

    UA_NodeId newObjectId;

    ASSERT_GOOD(UA_Client_addObjectNode(client, UA_NODEID_NULL,
                                     UA_NODEID_NUMERIC(0, UA_NS0ID_OBJECTSFOLDER),
                                     UA_NODEID_NUMERIC(0, UA_NS0ID_ORGANIZES),
                                     UA_QUALIFIEDNAME(1, "Coordinates"),
                                     UA_NODEID_NUMERIC(0, UA_NS0ID_FOLDERTYPE), attr, &newObjectId));


    UA_ExpandedNodeId target = UA_EXPANDEDNODEID_NULL;
    target.nodeId = newObjectId;
    ASSERT_GOOD(UA_Client_addReference(client, UA_NODEID_NUMERIC(0, UA_NS0ID_ROOTFOLDER), UA_NODEID_NUMERIC(0, UA_NS0ID_ORGANIZES),
                                    UA_TRUE, UA_STRING_NULL, target, UA_NODECLASS_OBJECT));

    ASSERT_GOOD(UA_Client_deleteReference(client, UA_NODEID_NUMERIC(0, UA_NS0ID_ROOTFOLDER),
                                       UA_NODEID_NUMERIC(0, UA_NS0ID_ORGANIZES),
                                       true, target, true));

    ASSERT_GOOD(UA_Client_deleteNode(client, newObjectId, UA_TRUE));

    return UA_STATUSCODE_GOOD;
}

static UA_StatusCode executeClientServices(UA_Client *client) {

    ASSERT_GOOD(findServersRequest(client));
    ASSERT_GOOD(findServersOnNetworkRequest(client));
    ASSERT_GOOD(registerServerRequest(client));
    ASSERT_GOOD(registerServer2Request(client));
    ASSERT_GOOD(readValueRequest(client));
    ASSERT_GOOD(writeValueRequest(client));
    ASSERT_GOOD(browseAndBrowseNextRequest(client));
    ASSERT_GOOD(registerUnregisterNodesRequest(client));
    ASSERT_GOOD(translateBrowsePathsToNodeIdsRequest(client));
    ASSERT_GOOD(subscriptionRequests(client));
    ASSERT_GOOD(callRequest(client));
    ASSERT_GOOD(nodemanagementRequests(client));


    return UA_STATUSCODE_GOOD;
}

int main(void) {
    emptyCorpusDir();
    start_server();
    UA_StatusCode retval;

    UA_Client *client = UA_Client_new(UA_ClientConfig_default);
    // this will also call getEndpointsRequest
    retval = UA_Client_connect(client, "opc.tcp://localhost:4840");
    if (retval == UA_STATUSCODE_GOOD)
        retval = executeClientServices(client);
    UA_Client_disconnect(client);
    UA_Client_delete(client);

    if (retval == UA_STATUSCODE_GOOD) {
        // now also connect with user/pass so that fuzzer also knows how to do that
        client = UA_Client_new(UA_ClientConfig_default);
        retval = UA_Client_connect_username(client, "opc.tcp://localhost:4840", "user", "password");
        retval = retval == UA_STATUSCODE_BADUSERACCESSDENIED ? UA_STATUSCODE_GOOD : retval;
        UA_Client_disconnect(client);
        UA_Client_delete(client);
    }

    teardown_server();

    if (retval != UA_STATUSCODE_GOOD) {
        printf("\n--------- AN ERROR OCCURED ----------\nStatus = %s\n", UA_StatusCode_name(retval));
    } else {
        printf("\n--------- SUCCESS -------\nThe corpus is stored in %s\nYou manually need to copy them into the direcotry tests/fuss/fuzz_binary_message_corpus/generated", UA_CORPUS_OUTPUT_DIR);
    }
    return (int) retval;
}