You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@plc4x.apache.org by ld...@apache.org on 2024/02/12 12:32:12 UTC

(plc4x) branch pg/security-policy updated (18dbfde57a -> 3d30d90fd8)

This is an automated email from the ASF dual-hosted git repository.

ldywicki pushed a change to branch pg/security-policy
in repository https://gitbox.apache.org/repos/asf/plc4x.git


 discard 18dbfde57a test(plc4go): fix configuration test
 discard 601d3c54b7 fix(plc4go): options should now correctly be applied
 discard 362a99adb5 Fix golang compile errors.
 discard 228f8f5e9e Update golang opcua structs.
 discard a6048768e8 Fix mspec.
 discard 83ed178135 feat(plc4j/opcua): Chunking and encryption of request/response calls.
 discard b1b667c516 feat: OPC-UA mspec updates.
 discard bd05f1223d fix: Fix remaining unit tests.
 discard ff382cf586 feat: Implementation of opc ua client security.
     add c9cee044b3 fix(plc4go): options should now correctly be applied
     add 2067167db1 test(plc4go): fix configuration test
     add 0dac6c6a5f feat: Implementation of opc ua client security.
     add 47806f07ce fix: Fix remaining unit tests.
     add fdced3eacf feat: OPC-UA mspec updates.
     add 1c441b15d0 feat(plc4j/opcua): Chunking and encryption of request/response calls.
     add df46c95490 fix(plc4go): Update golang opcua structs.
     new 3d30d90fd8 fix(plc4go): Fix golang compile errors.

This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version.  This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:

 * -- * -- B -- O -- O -- O   (18dbfde57a)
            \
             N -- N -- N   refs/heads/pg/security-policy (3d30d90fd8)

You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.

Any revisions marked "omit" are not gone; other references still
refer to them.  Any revisions marked "discard" are gone forever.

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 plc4go/internal/opcua/SecureChannel.go             | 21 ++++++++-----------
 .../opcua/readwrite/model/OpcuaCloseRequest.go     |  2 +-
 .../java/opcua/readwrite/OpcuaCloseRequest.java    |  3 +--
 .../opcua/src/test/resources/log4j.properties      | 24 ----------------------
 .../opcua/src/test/resources/logback-test.xml      |  2 +-
 .../generated/protocols/opcua/opc-manual.mspec     |  4 ++--
 protocols/opcua/src/main/xslt/opc-manual.xsl       |  4 ++--
 7 files changed, 16 insertions(+), 44 deletions(-)
 delete mode 100644 plc4j/drivers/opcua/src/test/resources/log4j.properties


(plc4x) 01/01: fix(plc4go): Fix golang compile errors.

Posted by ld...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

ldywicki pushed a commit to branch pg/security-policy
in repository https://gitbox.apache.org/repos/asf/plc4x.git

commit 3d30d90fd853b66ef783c91185026dde680c557a
Author: Łukasz Dywicki <lu...@code-house.org>
AuthorDate: Sun Feb 11 23:32:46 2024 +0100

    fix(plc4go): Fix golang compile errors.
    
    Signed-off-by: Łukasz Dywicki <lu...@code-house.org>
---
 plc4go/internal/opcua/EncryptionHandler.go      |   4 +-
 plc4go/internal/opcua/SecureChannel.go          | 221 +++++++++++++-----------
 plc4go/internal/opcua/SecureChannel_plc4xgen.go |   4 +-
 3 files changed, 124 insertions(+), 105 deletions(-)

diff --git a/plc4go/internal/opcua/EncryptionHandler.go b/plc4go/internal/opcua/EncryptionHandler.go
index fb897da09a..71d86aee06 100644
--- a/plc4go/internal/opcua/EncryptionHandler.go
+++ b/plc4go/internal/opcua/EncryptionHandler.go
@@ -131,9 +131,9 @@ func (h *EncryptionHandler) decodeMessage(ctx context.Context, pdu readWriteMode
 		var message []byte
 		switch pduMessage := pdu.GetMessage().(type) {
 		case readWriteModel.OpcuaOpenResponseExactly:
-			message = pduMessage.GetMessage()
+			message = pduMessage.(readWriteModel.BinaryPayloadExactly).GetPayload()
 		case readWriteModel.OpcuaMessageResponseExactly:
-			message = pduMessage.GetMessage()
+			message = pduMessage.(readWriteModel.BinaryPayloadExactly).GetPayload()
 		default:
 			h.log.Trace().Type("pdu", pdu).Msg("unhandled type")
 			return pdu, nil
diff --git a/plc4go/internal/opcua/SecureChannel.go b/plc4go/internal/opcua/SecureChannel.go
index eed6a455c0..0a0258b3a7 100644
--- a/plc4go/internal/opcua/SecureChannel.go
+++ b/plc4go/internal/opcua/SecureChannel.go
@@ -46,14 +46,11 @@ import (
 )
 
 const (
-	FINAL_CHUNK                   = "F"
-	CONTINUATION_CHUNK            = "C"
-	ABORT_CHUNK                   = "A"
-	VERSION                       = 0
+	VERSION                       = uint32(0)
 	DEFAULT_MAX_CHUNK_COUNT       = 64
-	DEFAULT_MAX_MESSAGE_SIZE      = 2097152
-	DEFAULT_RECEIVE_BUFFER_SIZE   = 65535
-	DEFAULT_SEND_BUFFER_SIZE      = 65535
+	DEFAULT_MAX_MESSAGE_SIZE      = uint32(2097152)
+	DEFAULT_RECEIVE_BUFFER_SIZE   = uint32(65535)
+	DEFAULT_SEND_BUFFER_SIZE      = uint32(65535)
 	REQUEST_TIMEOUT               = 10 * time.Second
 	REQUEST_TIMEOUT_LONG          = 10000
 	PASSWORD_ENCRYPTION_ALGORITHM = "http://www.w3.org/2001/04/xmlenc#rsa-oaep"
@@ -108,8 +105,8 @@ type SecureChannel struct {
 	checkedEndpoints          bool
 	encryptionHandler         *EncryptionHandler
 	configuration             Configuration `stringer:"true"`
-	channelId                 atomic.Int32
-	tokenId                   atomic.Int32
+	channelId                 atomic.Uint32
+	tokenId                   atomic.Uint32
 	authenticationToken       readWriteModel.NodeIdTypeDefinition
 	codec                     *MessageCodec
 	channelTransactionManager *SecureChannelTransactionManager
@@ -189,12 +186,11 @@ func (s *SecureChannel) submit(ctx context.Context, codec *MessageCodec, errorDi
 	//TODO: We need to split large messages up into chunks if it is larger than the sendBufferSize
 	//      This value is negotiated when opening a channel
 
-	messageRequest := readWriteModel.NewOpcuaMessageRequest(FINAL_CHUNK,
+	messageRequest := readWriteModel.NewOpcuaMessageRequest(readWriteModel.NewSecurityHeader(
 		s.channelId.Load(),
-		s.tokenId.Load(),
-		transactionId,
-		transactionId,
-		buffer.GetBytes())
+		s.tokenId.Load()),
+		readWriteModel.NewBinaryPayload(buffer.GetBytes(), readWriteModel.NewSequenceHeader(transactionId, transactionId), uint32(len(buffer.GetBytes()))),
+		readWriteModel.ChunkType_FINAL, uint32(len(buffer.GetBytes())))
 
 	var apu readWriteModel.OpcuaAPU
 	if s.isEncrypted {
@@ -234,15 +230,15 @@ func (s *SecureChannel) submit(ctx context.Context, codec *MessageCodec, errorDi
 					s.log.Debug().Type("type", message).Msg("Not relevant")
 					return false
 				}
-				if requestId := opcuaResponse.GetRequestId(); requestId != transactionId {
+				if requestId := opcuaResponse.GetMessage().GetSequenceHeader().GetRequestId(); requestId != transactionId {
 					s.log.Debug().Int32("requestId", requestId).Int32("transactionId", transactionId).Msg("Not relevant")
 					return false
 				} else {
-					messageBuffer = opcuaResponse.GetMessage()
-					if !(s.senderSequenceNumber.Add(1) == (opcuaResponse.GetSequenceNumber())) {
+					messageBuffer = opcuaResponse.(readWriteModel.BinaryPayload).GetPayload()
+					if !(s.senderSequenceNumber.Add(1) == (opcuaResponse.GetMessage().GetSequenceHeader().GetSequenceNumber())) {
 						s.log.Error().
 							Int32("senderSequenceNumber", s.senderSequenceNumber.Load()).
-							Int32("responseSequenceNumber", opcuaResponse.GetSequenceNumber()).
+							Int32("responseSequenceNumber", opcuaResponse.GetMessage().GetSequenceHeader().GetSequenceNumber()).
 							Msg("Sequence number isn't as expected, we might have missed a packet. - senderSequenceNumber != responseSequenceNumber")
 						errorDispatcher(errors.New("unexpected sequence number"))
 					}
@@ -255,13 +251,13 @@ func (s *SecureChannel) submit(ctx context.Context, codec *MessageCodec, errorDi
 				messagePDU := opcuaAPU.GetMessage()
 				s.log.Trace().Stringer("messagePDU", messagePDU).Msg("looking at messagePDU")
 				opcuaResponse := messagePDU.(readWriteModel.OpcuaMessageResponse)
-				if opcuaResponse.GetChunk() == (FINAL_CHUNK) {
-					s.tokenId.Store(opcuaResponse.GetSecureTokenId())
-					s.channelId.Store(opcuaResponse.GetSecureChannelId())
+				if opcuaResponse.GetChunk() == (readWriteModel.ChunkType_FINAL) {
+					s.tokenId.Store(opcuaResponse.GetSecurityHeader().GetSecureTokenId())
+					s.channelId.Store(opcuaResponse.GetSecurityHeader().GetSecureChannelId())
 
 					consumer(messageBuffer)
 				} else {
-					s.log.Warn().Str("chunk", opcuaResponse.GetChunk()).Msg("Message discarded")
+					s.log.Warn().Stringer("chunk", opcuaResponse.GetChunk()).Msg("Message discarded")
 				}
 				return nil
 			},
@@ -287,13 +283,15 @@ func (s *SecureChannel) onConnect(ctx context.Context, connection *Connection, c
 	s.codec = connection.messageCodec // TODO: why would we need to set that?
 
 	hello := readWriteModel.NewOpcuaHelloRequest(
-		FINAL_CHUNK,
 		VERSION,
-		DEFAULT_RECEIVE_BUFFER_SIZE,
-		DEFAULT_SEND_BUFFER_SIZE,
-		DEFAULT_MAX_MESSAGE_SIZE,
-		DEFAULT_MAX_CHUNK_COUNT,
+		readWriteModel.NewOpcuaProtocolLimits(
+			DEFAULT_RECEIVE_BUFFER_SIZE,
+			DEFAULT_SEND_BUFFER_SIZE,
+			DEFAULT_MAX_MESSAGE_SIZE,
+			DEFAULT_MAX_CHUNK_COUNT,
+		),
 		s.endpoint,
+		readWriteModel.ChunkType_FINAL,
 	)
 
 	requestConsumer := func(transactionId int32) {
@@ -395,15 +393,16 @@ func (s *SecureChannel) onConnectOpenSecureChannel(ctx context.Context, connecti
 		return
 	}
 
-	openRequest := readWriteModel.NewOpcuaOpenRequest(
-		FINAL_CHUNK,
+	openRequest := readWriteModel.NewOpcuaOpenRequest(readWriteModel.NewOpenChannelMessageRequest(
 		0,
 		readWriteModel.NewPascalString(s.securityPolicy),
 		s.publicCertificate,
-		s.thumbprint,
-		transactionId,
-		transactionId,
-		buffer.GetBytes(),
+		s.thumbprint),
+		readWriteModel.NewBinaryPayload(
+			buffer.GetBytes(),
+			readWriteModel.NewSequenceHeader(transactionId, transactionId),
+			uint32(len(buffer.GetBytes())),
+		), readWriteModel.ChunkType_FINAL, uint32(len(buffer.GetBytes())),
 	)
 
 	var apu readWriteModel.OpcuaAPU
@@ -441,19 +440,19 @@ func (s *SecureChannel) onConnectOpenSecureChannel(ctx context.Context, connecti
 					s.log.Debug().Type("type", messagePDU).Msg("Not relevant")
 					return false
 				}
-				return openResponse.GetRequestId() == transactionId
+				return openResponse.GetMessage().GetSequenceHeader().GetRequestId() == transactionId
 			},
 			func(message spi.Message) error {
 				opcuaAPU := message.(readWriteModel.OpcuaAPU)
 				messagePDU := opcuaAPU.GetMessage()
 				opcuaOpenResponse := messagePDU.(readWriteModel.OpcuaOpenResponse)
-				readBuffer := utils.NewReadBufferByteBased(opcuaOpenResponse.GetMessage(), utils.WithByteOrderForReadBufferByteBased(binary.LittleEndian))
+				readBuffer := utils.NewReadBufferByteBased(opcuaOpenResponse.(readWriteModel.BinaryPayloadExactly).GetPayload(), utils.WithByteOrderForReadBufferByteBased(binary.LittleEndian))
 				extensionObject, err := readWriteModel.ExtensionObjectParseWithBuffer(ctx, readBuffer, false)
 				if err != nil {
 					return errors.Wrap(err, "error parsing")
 				}
 				//Store the initial sequence number from the server. there's no requirement for the server and client to use the same starting number.
-				s.senderSequenceNumber.Store(opcuaOpenResponse.GetSequenceNumber())
+				s.senderSequenceNumber.Store(opcuaOpenResponse.GetMessage().GetSequenceHeader().GetSequenceNumber())
 
 				if fault, ok := extensionObject.GetBody().(readWriteModel.ServiceFaultExactly); ok {
 					statusCode := fault.GetResponseHeader().(readWriteModel.ResponseHeader).GetServiceResult().GetStatusCode()
@@ -467,8 +466,8 @@ func (s *SecureChannel) onConnectOpenSecureChannel(ctx context.Context, connecti
 				}
 				s.log.Debug().Msg("Got Secure Response Connection Response")
 				openSecureChannelResponse := extensionObject.GetBody().(readWriteModel.OpenSecureChannelResponse)
-				s.tokenId.Store(int32(openSecureChannelResponse.GetSecurityToken().(readWriteModel.ChannelSecurityToken).GetTokenId())) // TODO: strange that int32 and uint32 missmatch
-				s.channelId.Store(int32(openSecureChannelResponse.GetSecurityToken().(readWriteModel.ChannelSecurityToken).GetChannelId()))
+				s.tokenId.Store(openSecureChannelResponse.GetSecurityToken().(readWriteModel.ChannelSecurityToken).GetTokenId())
+				s.channelId.Store(openSecureChannelResponse.GetSecurityToken().(readWriteModel.ChannelSecurityToken).GetChannelId())
 				go s.onConnectCreateSessionRequest(ctx, connection, ch)
 				return nil
 			},
@@ -846,17 +845,19 @@ func (s *SecureChannel) onDisconnectCloseSecureChannel(ctx context.Context, conn
 		nil,
 	)
 
-	closeRequest := readWriteModel.NewOpcuaCloseRequest(FINAL_CHUNK,
-		s.channelId.Load(),
-		s.tokenId.Load(),
-		transactionId,
-		transactionId,
-		readWriteModel.NewExtensionObject(
-			expandedNodeId,
-			nil,
-			closeSecureChannelRequest,
-			false,
+	closeRequest := readWriteModel.NewOpcuaCloseRequest(
+		readWriteModel.NewSecurityHeader(s.channelId.Load(), s.tokenId.Load()),
+		readWriteModel.NewExtensiblePayload(
+			readWriteModel.NewExtensionObject(
+				expandedNodeId,
+				nil,
+				closeSecureChannelRequest,
+				false,
+			),
+			readWriteModel.NewSequenceHeader(transactionId, transactionId),
+			0,
 		),
+		readWriteModel.ChunkType_FINAL,
 	)
 
 	apu := readWriteModel.NewOpcuaAPU(closeRequest, false)
@@ -877,7 +878,7 @@ func (s *SecureChannel) onDisconnectCloseSecureChannel(ctx context.Context, conn
 					s.log.Debug().Type("type", messagePDU).Msg("Not relevant")
 					return false
 				}
-				return openResponse.GetRequestId() == transactionId
+				return openResponse.GetMessage().GetSequenceHeader().GetRequestId() == transactionId
 			},
 			func(message spi.Message) error {
 				opcuaAPU := message.(readWriteModel.OpcuaAPU)
@@ -906,13 +907,16 @@ func (s *SecureChannel) onDiscover(ctx context.Context, codec *MessageCodec) {
 	// Only the TCP transport supports login.
 	s.log.Debug().Msg("Opcua Driver running in ACTIVE mode, discovering endpoints")
 
-	hello := readWriteModel.NewOpcuaHelloRequest(FINAL_CHUNK,
+	hello := readWriteModel.NewOpcuaHelloRequest(
 		VERSION,
-		DEFAULT_RECEIVE_BUFFER_SIZE,
-		DEFAULT_SEND_BUFFER_SIZE,
-		DEFAULT_MAX_MESSAGE_SIZE,
-		DEFAULT_MAX_CHUNK_COUNT,
+		readWriteModel.NewOpcuaProtocolLimits(
+			DEFAULT_RECEIVE_BUFFER_SIZE,
+			DEFAULT_SEND_BUFFER_SIZE,
+			DEFAULT_MAX_MESSAGE_SIZE,
+			DEFAULT_MAX_CHUNK_COUNT,
+		),
 		s.endpoint,
+		readWriteModel.ChunkType_FINAL,
 	)
 
 	apu := readWriteModel.NewOpcuaAPU(hello, false)
@@ -1006,14 +1010,17 @@ func (s *SecureChannel) onDiscoverOpenSecureChannel(ctx context.Context, codec *
 	}
 
 	openRequest := readWriteModel.NewOpcuaOpenRequest(
-		FINAL_CHUNK,
-		0,
-		SECURITY_POLICY_NONE,
-		NULL_BYTE_STRING,
-		NULL_BYTE_STRING,
-		transactionId,
-		transactionId,
-		buffer.GetBytes(),
+		readWriteModel.NewOpenChannelMessageRequest(
+			0,
+			SECURITY_POLICY_NONE,
+			NULL_BYTE_STRING,
+			NULL_BYTE_STRING,
+		),
+		readWriteModel.NewBinaryPayload(
+			buffer.GetBytes(), readWriteModel.NewSequenceHeader(transactionId, transactionId), uint32(len(buffer.GetBytes())),
+		),
+		readWriteModel.ChunkType_FINAL,
+		uint32(len(buffer.GetBytes())),
 	)
 
 	apu := readWriteModel.NewOpcuaAPU(openRequest, false)
@@ -1034,13 +1041,13 @@ func (s *SecureChannel) onDiscoverOpenSecureChannel(ctx context.Context, codec *
 					s.log.Debug().Type("type", messagePDU).Msg("Not relevant")
 					return false
 				}
-				return openResponse.GetRequestId() == transactionId
+				return openResponse.GetMessage().GetSequenceHeader().GetRequestId() == transactionId
 			},
 			func(message spi.Message) error {
 				opcuaAPU := message.(readWriteModel.OpcuaAPU)
 				messagePDU := opcuaAPU.GetMessage()
 				opcuaOpenResponse := messagePDU.(readWriteModel.OpcuaOpenResponse)
-				readBuffer := utils.NewReadBufferByteBased(opcuaOpenResponse.GetMessage(), utils.WithByteOrderForReadBufferByteBased(binary.LittleEndian))
+				readBuffer := utils.NewReadBufferByteBased(opcuaOpenResponse.(readWriteModel.BinaryPayloadExactly).GetPayload(), utils.WithByteOrderForReadBufferByteBased(binary.LittleEndian))
 				extensionObject, err := readWriteModel.ExtensionObjectParseWithBuffer(ctx, readBuffer, false)
 				if err != nil {
 					return errors.Wrap(err, "error parsing")
@@ -1076,13 +1083,13 @@ func (s *SecureChannel) onDiscoverOpenSecureChannel(ctx context.Context, codec *
 
 func (s *SecureChannel) onDiscoverGetEndpointsRequest(ctx context.Context, codec *MessageCodec, opcuaOpenResponse readWriteModel.OpcuaOpenResponse, openSecureChannelResponse readWriteModel.OpenSecureChannelResponse) {
 	s.log.Trace().Msg("onDiscoverGetEndpointsRequest")
-	s.tokenId.Store(int32(openSecureChannelResponse.GetSecurityToken().(readWriteModel.ChannelSecurityToken).GetTokenId()))
-	s.channelId.Store(int32(openSecureChannelResponse.GetSecurityToken().(readWriteModel.ChannelSecurityToken).GetChannelId()))
+	s.tokenId.Store(openSecureChannelResponse.GetSecurityToken().(readWriteModel.ChannelSecurityToken).GetTokenId())
+	s.channelId.Store(openSecureChannelResponse.GetSecurityToken().(readWriteModel.ChannelSecurityToken).GetChannelId())
 
 	transactionId := s.channelTransactionManager.getTransactionIdentifier()
 
-	nextSequenceNumber := opcuaOpenResponse.GetSequenceNumber() + 1
-	nextRequestId := opcuaOpenResponse.GetRequestId() + 1
+	nextSequenceNumber := opcuaOpenResponse.GetMessage().GetSequenceHeader().GetSequenceNumber() + 1
+	nextRequestId := opcuaOpenResponse.GetMessage().GetSequenceHeader().GetRequestId() + 1
 
 	if !(transactionId == nextSequenceNumber) {
 		s.log.Error().
@@ -1136,12 +1143,15 @@ func (s *SecureChannel) onDiscoverGetEndpointsRequest(ctx context.Context, codec
 	}
 
 	messageRequest := readWriteModel.NewOpcuaMessageRequest(
-		FINAL_CHUNK,
-		s.channelId.Load(),
-		s.tokenId.Load(),
-		nextSequenceNumber,
-		nextRequestId,
-		buffer.GetBytes(),
+		readWriteModel.NewSecurityHeader(
+			s.channelId.Load(),
+			s.tokenId.Load(),
+		),
+		readWriteModel.NewBinaryPayload(
+			buffer.GetBytes(), readWriteModel.NewSequenceHeader(nextSequenceNumber, nextRequestId), uint32(len(buffer.GetBytes())),
+		),
+		readWriteModel.ChunkType_FINAL,
+		uint32(len(buffer.GetBytes())),
 	)
 
 	apu := readWriteModel.NewOpcuaAPU(messageRequest, false)
@@ -1162,13 +1172,13 @@ func (s *SecureChannel) onDiscoverGetEndpointsRequest(ctx context.Context, codec
 					s.log.Debug().Type("type", messagePDU).Msg("Not relevant")
 					return false
 				}
-				return messageResponse.GetRequestId() == transactionId
+				return messageResponse.GetMessage().GetSequenceHeader().GetRequestId() == transactionId
 			},
 			func(message spi.Message) error {
 				opcuaAPU := message.(readWriteModel.OpcuaAPU)
 				messagePDU := opcuaAPU.GetMessage()
 				messageResponse := messagePDU.(readWriteModel.OpcuaMessageResponse)
-				readBuffer := utils.NewReadBufferByteBased(messageResponse.GetMessage(), utils.WithByteOrderForReadBufferByteBased(binary.LittleEndian))
+				readBuffer := utils.NewReadBufferByteBased(messageResponse.(readWriteModel.BinaryPayloadExactly).GetPayload(), utils.WithByteOrderForReadBufferByteBased(binary.LittleEndian))
 				extensionObject, err := readWriteModel.ExtensionObjectParseWithBuffer(ctx, readBuffer, false)
 				if err != nil {
 					return errors.Wrap(err, "error parsing")
@@ -1243,17 +1253,22 @@ func (s *SecureChannel) onDiscoverCloseSecureChannel(ctx context.Context, codec
 		nil,
 	)
 
-	closeRequest := readWriteModel.NewOpcuaCloseRequest(FINAL_CHUNK,
-		s.channelId.Load(),
-		s.tokenId.Load(),
-		transactionId,
-		transactionId,
-		readWriteModel.NewExtensionObject(
-			expandedNodeId,
-			nil,
-			closeSecureChannelRequest,
-			false,
+	closeRequest := readWriteModel.NewOpcuaCloseRequest(
+		readWriteModel.NewSecurityHeader(
+			s.channelId.Load(),
+			s.tokenId.Load(),
 		),
+		readWriteModel.NewExtensiblePayload(
+			readWriteModel.NewExtensionObject(
+				expandedNodeId,
+				nil,
+				closeSecureChannelRequest,
+				false,
+			),
+			readWriteModel.NewSequenceHeader(transactionId, transactionId),
+			uint32(0),
+		),
+		readWriteModel.ChunkType_FINAL,
 	)
 
 	apu := readWriteModel.NewOpcuaAPU(closeRequest, false)
@@ -1274,7 +1289,7 @@ func (s *SecureChannel) onDiscoverCloseSecureChannel(ctx context.Context, codec
 					s.log.Debug().Type("type", messagePDU).Msg("Not relevant")
 					return false
 				}
-				return openResponse.GetRequestId() == transactionId
+				return openResponse.GetMessage().GetSequenceHeader().GetRequestId() == transactionId
 			},
 			func(message spi.Message) error {
 				opcuaAPU := message.(readWriteModel.OpcuaAPU)
@@ -1373,14 +1388,18 @@ func (s *SecureChannel) keepAlive() {
 			}
 
 			openRequest := readWriteModel.NewOpcuaOpenRequest(
-				FINAL_CHUNK,
-				0,
-				readWriteModel.NewPascalString(s.securityPolicy),
-				s.publicCertificate,
-				s.thumbprint,
-				transactionId,
-				transactionId,
-				buffer.GetBytes(),
+				readWriteModel.NewOpenChannelMessageRequest(0,
+					readWriteModel.NewPascalString(s.securityPolicy),
+					s.publicCertificate,
+					s.thumbprint,
+				),
+				readWriteModel.NewBinaryPayload(
+					buffer.GetBytes(),
+					readWriteModel.NewSequenceHeader(transactionId, transactionId),
+					uint32(len(buffer.GetBytes())),
+				),
+				readWriteModel.ChunkType_FINAL,
+				uint32(len(buffer.GetBytes())),
 			)
 
 			var apu readWriteModel.OpcuaAPU
@@ -1416,13 +1435,13 @@ func (s *SecureChannel) keepAlive() {
 							s.log.Debug().Type("type", messagePDU).Msg("Not relevant")
 							return false
 						}
-						return openResponse.GetRequestId() == transactionId
+						return openResponse.GetMessage().GetSequenceHeader().GetRequestId() == transactionId
 					},
 					func(message spi.Message) error {
 						opcuaAPU := message.(readWriteModel.OpcuaAPU)
 						messagePDU := opcuaAPU.GetMessage()
 						opcuaOpenResponse := messagePDU.(readWriteModel.OpcuaOpenResponse)
-						readBuffer := utils.NewReadBufferByteBased(opcuaOpenResponse.GetMessage(), utils.WithByteOrderForReadBufferByteBased(binary.LittleEndian))
+						readBuffer := utils.NewReadBufferByteBased(opcuaOpenResponse.(readWriteModel.BinaryPayloadExactly).GetPayload(), utils.WithByteOrderForReadBufferByteBased(binary.LittleEndian))
 						extensionObject, err := readWriteModel.ExtensionObjectParseWithBuffer(ctx, readBuffer, false)
 						if err != nil {
 							return errors.Wrap(err, "error parsing")
@@ -1439,8 +1458,8 @@ func (s *SecureChannel) keepAlive() {
 							s.log.Debug().Msg("Got Secure Response Connection Response")
 							openSecureChannelResponse := extensionObject.GetBody().(readWriteModel.OpenSecureChannelResponse)
 							token := openSecureChannelResponse.GetSecurityToken().(readWriteModel.ChannelSecurityToken)
-							s.tokenId.Store(int32(token.GetTokenId())) // TODO: strange that int32 and uint32 missmatch
-							s.channelId.Store(int32(token.GetChannelId()))
+							s.tokenId.Store(token.GetTokenId())
+							s.channelId.Store(token.GetChannelId())
 							s.lifetime = token.GetRevisedLifetime()
 						}
 						return nil
@@ -1477,12 +1496,12 @@ func (s *SecureChannel) getAuthenticationToken() readWriteModel.NodeId {
 }
 
 // getChannelId gets the Channel identifier for the current channel
-func (s *SecureChannel) getChannelId() int32 {
+func (s *SecureChannel) getChannelId() uint32 {
 	return s.channelId.Load()
 }
 
 // getTokenId gets the Token Identifier
-func (s *SecureChannel) getTokenId() int32 {
+func (s *SecureChannel) getTokenId() uint32 {
 	return s.tokenId.Load()
 }
 
diff --git a/plc4go/internal/opcua/SecureChannel_plc4xgen.go b/plc4go/internal/opcua/SecureChannel_plc4xgen.go
index 7c591f4f34..8f957d364b 100644
--- a/plc4go/internal/opcua/SecureChannel_plc4xgen.go
+++ b/plc4go/internal/opcua/SecureChannel_plc4xgen.go
@@ -209,11 +209,11 @@ func (d *SecureChannel) SerializeWithWriteBuffer(ctx context.Context, writeBuffe
 		return err
 	}
 
-	if err := writeBuffer.WriteInt32("channelId", 32, d.channelId.Load()); err != nil {
+	if err := writeBuffer.WriteUint32("channelId", 32, d.channelId.Load()); err != nil {
 		return err
 	}
 
-	if err := writeBuffer.WriteInt32("tokenId", 32, d.tokenId.Load()); err != nil {
+	if err := writeBuffer.WriteUint32("tokenId", 32, d.tokenId.Load()); err != nil {
 		return err
 	}