You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@plc4x.apache.org by ld...@apache.org on 2024/02/12 09:25:57 UTC
(plc4x) 08/12: Create client signature in ActivateSessionRequest
This is an automated email from the ASF dual-hosted git repository.
ldywicki pushed a commit to branch pg/security-policy
in repository https://gitbox.apache.org/repos/asf/plc4x.git
commit 2472008d2aad789e10d950d01f541a56a531774d
Author: PatrykGala <pa...@gmail.com>
AuthorDate: Wed Jul 26 13:24:16 2023 +0200
Create client signature in ActivateSessionRequest
---
.../plc4x/java/opcua/context/EncryptionHandler.java | 19 ++++++++++++++-----
.../plc4x/java/opcua/context/SecureChannel.java | 4 ++--
2 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/plc4j/drivers/opcua/src/main/java/org/apache/plc4x/java/opcua/context/EncryptionHandler.java b/plc4j/drivers/opcua/src/main/java/org/apache/plc4x/java/opcua/context/EncryptionHandler.java
index e8718c43d0..ad3b7b64a2 100644
--- a/plc4j/drivers/opcua/src/main/java/org/apache/plc4x/java/opcua/context/EncryptionHandler.java
+++ b/plc4j/drivers/opcua/src/main/java/org/apache/plc4x/java/opcua/context/EncryptionHandler.java
@@ -18,11 +18,10 @@
*/
package org.apache.plc4x.java.opcua.context;
+import com.google.common.primitives.Bytes;
+import io.vavr.control.Try;
import org.apache.plc4x.java.opcua.protocol.OpcuaProtocolLogic;
-import org.apache.plc4x.java.opcua.readwrite.MessagePDU;
-import org.apache.plc4x.java.opcua.readwrite.OpcuaAPU;
-import org.apache.plc4x.java.opcua.readwrite.OpcuaMessageResponse;
-import org.apache.plc4x.java.opcua.readwrite.OpcuaOpenResponse;
+import org.apache.plc4x.java.opcua.readwrite.*;
import org.apache.plc4x.java.spi.generation.*;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.slf4j.Logger;
@@ -55,7 +54,7 @@ public class EncryptionHandler {
private byte[] clientNonce = null;
private byte[] serverNonce = null;
- private SymmetricEncryptionHandler symmetricEncryptionHandler= new SymmetricEncryptionHandler();
+ private SymmetricEncryptionHandler symmetricEncryptionHandler = new SymmetricEncryptionHandler();
public EncryptionHandler(CertificateKeyPair ckp, byte[] senderCertificate, String securityPolicy) {
@@ -89,6 +88,16 @@ public class EncryptionHandler {
}
+
+ public SignatureData createClientSignature(byte[] lastServerNonce) {
+ AsymmetricEncryptionHandler handler = new AsymmetricEncryptionHandler(serverCertificate, clientCertificate, clientPrivateKey, clientPublicKey);
+
+ byte[] cert = Try.of(() -> serverCertificate.getEncoded()).getOrElse(new byte[0]);
+ byte[] bytes = Bytes.concat(cert, lastServerNonce);
+ byte[] signed = handler.sign(bytes);
+ return new SignatureData(new PascalString("http://www.w3.org/2000/09/xmldsig#rsa-sha1"), new PascalByteString(signed.length, signed));
+ }
+
public OpcuaAPU decodeMessage(OpcuaAPU pdu) {//TODo patrykg
LOGGER.info("Decoding Message with Security policy {}", securitypolicy);
diff --git a/plc4j/drivers/opcua/src/main/java/org/apache/plc4x/java/opcua/context/SecureChannel.java b/plc4j/drivers/opcua/src/main/java/org/apache/plc4x/java/opcua/context/SecureChannel.java
index 7c529c3ce7..0ca1e21e30 100644
--- a/plc4j/drivers/opcua/src/main/java/org/apache/plc4x/java/opcua/context/SecureChannel.java
+++ b/plc4j/drivers/opcua/src/main/java/org/apache/plc4x/java/opcua/context/SecureChannel.java
@@ -504,11 +504,11 @@ public class SecureChannel {
REQUEST_TIMEOUT_LONG,
NULL_EXTENSION_OBJECT);
- SignatureData clientSignature = new SignatureData(NULL_STRING, NULL_BYTE_STRING);//todo patrykg add signature - temporary disabled in Milo, sign request
+ SignatureData clientSignature = new SignatureData(NULL_STRING, NULL_BYTE_STRING);
ActivateSessionRequest activateSessionRequest = new ActivateSessionRequest(
requestHeader,
- clientSignature,
+ encryptionHandler.createClientSignature(this.senderNonce),
0,
null,
0,