Skip to content

Commit

Permalink
WIP
Browse files Browse the repository at this point in the history
  • Loading branch information
@kevinherron
kevinherron committed Sep 1, 2023
1 parent de6449b commit 0adf9be
Show file tree
Hide file tree
Showing 14 changed files with 446 additions and 597 deletions.
9 changes: 6 additions & 3 deletions ...s/client-examples/src/main/java/org/eclipse/milo/examples/client/ClientExampleRunner.java
View file
Expand Up @@ -119,9 +119,12 @@ public void run() {
);

// Make the example client trust the example server certificate by default.
exampleServer.getServer().getConfig().getCertificateManager().getCertificates().forEach(
certificate ->
trustListManager.addTrustedCertificate(certificate)
exampleServer.getServer().getConfig().getCertificateManager().getCertificateGroups().forEach(
certificateGroup ->
certificateGroup.getCertificateRecords().forEach(
record ->
trustListManager.addTrustedCertificate(record.certificateChain[0])
)
);
}

Expand Down
30 changes: 17 additions & 13 deletions ...xamples/server-examples/src/main/java/org/eclipse/milo/examples/server/ExampleServer.java
View file
Expand Up @@ -14,6 +14,7 @@
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.KeyPair;
import java.security.Security;
import java.security.cert.X509Certificate;
import java.util.LinkedHashSet;
Expand All @@ -34,13 +35,15 @@
import org.eclipse.milo.opcua.sdk.server.util.HostnameUtil;
import org.eclipse.milo.opcua.stack.core.StatusCodes;
import org.eclipse.milo.opcua.stack.core.UaRuntimeException;
import org.eclipse.milo.opcua.stack.core.security.CertificateManager;
import org.eclipse.milo.opcua.stack.core.security.DefaultCertificateManager;
import org.eclipse.milo.opcua.stack.core.security.DefaultServerCertificateValidator;
import org.eclipse.milo.opcua.stack.core.security.DefaultTrustListManager;
import org.eclipse.milo.opcua.stack.core.security.SecurityPolicy;
import org.eclipse.milo.opcua.stack.core.transport.TransportProfile;
import org.eclipse.milo.opcua.stack.core.types.builtin.DateTime;
import org.eclipse.milo.opcua.stack.core.types.builtin.LocalizedText;
import org.eclipse.milo.opcua.stack.core.types.builtin.NodeId;
import org.eclipse.milo.opcua.stack.core.types.enumerated.MessageSecurityMode;
import org.eclipse.milo.opcua.stack.core.types.structured.BuildInfo;
import org.eclipse.milo.opcua.stack.core.util.CertificateUtil;
Expand Down Expand Up @@ -100,9 +103,19 @@ public ExampleServer() throws Exception {

KeyStoreLoader loader = new KeyStoreLoader().load(securityTempDir);

var certificateManager = new DefaultCertificateManager(
loader.getServerKeyPair(),
loader.getServerCertificateChain()
var certificateManager = DefaultCertificateManager.createWithDefaultApplicationGroup(
pkiDir.toPath(),
new CertificateManager.CertificateFactory() {
@Override
public KeyPair createKeyPair(NodeId certificateTypeId) {
return loader.getServerKeyPair();
}

@Override
public X509Certificate[] createCertificateChain(NodeId certificateTypeId, KeyPair keyPair) {
return loader.getServerCertificateChain();
}
}
);

var trustListManager = new DefaultTrustListManager(pkiDir);
Expand All @@ -123,16 +136,7 @@ public ExampleServer() throws Exception {

var x509IdentityValidator = new X509IdentityValidator(c -> true);

// If you need to use multiple certificates you'll have to be smarter than this.
X509Certificate certificate = certificateManager.getCertificates()
.stream()
.findFirst()
.orElseThrow(
() -> new UaRuntimeException(
StatusCodes.Bad_ConfigurationError,
"no certificate found"
)
);
X509Certificate certificate = loader.getServerCertificate();

// The configured application URI must match the one in the certificate(s)
String applicationUri = CertificateUtil
Expand Down
31 changes: 20 additions & 11 deletions opc-ua-sdk/integration-tests/src/test/java/org/eclipse/milo/opcua/sdk/test/TestServer.java
View file
Expand Up @@ -30,13 +30,15 @@
import org.eclipse.milo.opcua.sdk.server.util.HostnameUtil;
import org.eclipse.milo.opcua.stack.core.StatusCodes;
import org.eclipse.milo.opcua.stack.core.UaRuntimeException;
import org.eclipse.milo.opcua.stack.core.security.CertificateManager;
import org.eclipse.milo.opcua.stack.core.security.DefaultCertificateManager;
import org.eclipse.milo.opcua.stack.core.security.DefaultServerCertificateValidator;
import org.eclipse.milo.opcua.stack.core.security.DefaultTrustListManager;
import org.eclipse.milo.opcua.stack.core.security.SecurityPolicy;
import org.eclipse.milo.opcua.stack.core.transport.TransportProfile;
import org.eclipse.milo.opcua.stack.core.types.builtin.DateTime;
import org.eclipse.milo.opcua.stack.core.types.builtin.LocalizedText;
import org.eclipse.milo.opcua.stack.core.types.builtin.NodeId;
import org.eclipse.milo.opcua.stack.core.types.enumerated.MessageSecurityMode;
import org.eclipse.milo.opcua.stack.core.types.structured.BuildInfo;
import org.eclipse.milo.opcua.stack.core.util.CertificateUtil;
Expand Down Expand Up @@ -85,17 +87,28 @@ public static OpcUaServer create(int port) throws Exception {
LoggerFactory.getLogger(TestServer.class)
.info("security temp dir: {}", securityTempDir.getAbsolutePath());

File pkiDir = securityTempDir.toPath().resolve("pki").toFile();
LoggerFactory.getLogger(TestServer.class)
.info("pki dir: {}", pkiDir.getAbsolutePath());

KeyStoreLoader loader = new KeyStoreLoader().load(securityTempDir);

DefaultCertificateManager certificateManager = new DefaultCertificateManager(
loader.getServerKeyPair(),
loader.getServerCertificateChain()
DefaultCertificateManager certificateManager = DefaultCertificateManager.createWithDefaultApplicationGroup(
pkiDir.toPath(),
new CertificateManager.CertificateFactory() {
@Override
public KeyPair createKeyPair(NodeId certificateTypeId) {
return loader.getServerKeyPair();
}

@Override
public X509Certificate[] createCertificateChain(NodeId certificateTypeId, KeyPair keyPair) {
return loader.getServerCertificateChain();
}
}
);

File pkiDir = securityTempDir.toPath().resolve("pki").toFile();
DefaultTrustListManager trustListManager = new DefaultTrustListManager(pkiDir);
LoggerFactory.getLogger(TestServer.class)
.info("pki dir: {}", pkiDir.getAbsolutePath());

DefaultServerCertificateValidator certificateValidator =
new DefaultServerCertificateValidator(trustListManager);
Expand Down Expand Up @@ -123,11 +136,7 @@ public static OpcUaServer create(int port) throws Exception {
}
);

// If you need to use multiple certificates you'll have to be smarter than this.
X509Certificate certificate = certificateManager.getCertificates()
.stream()
.findFirst()
.orElseThrow(() -> new UaRuntimeException(StatusCodes.Bad_ConfigurationError, "no certificate found"));
X509Certificate certificate = loader.getServerCertificate();

// The configured application URI must match the one in the certificate(s)
String applicationUri = CertificateUtil
Expand Down
5 changes: 0 additions & 5 deletions opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/OpcUaServerConfig.java
View file
Expand Up @@ -22,7 +22,6 @@
import org.eclipse.milo.opcua.sdk.server.identity.X509IdentityValidator;
import org.eclipse.milo.opcua.stack.core.channel.EncodingLimits;
import org.eclipse.milo.opcua.stack.core.security.CertificateManager;
import org.eclipse.milo.opcua.stack.core.security.CertificateManager2;
import org.eclipse.milo.opcua.stack.core.security.SecurityPolicy;
import org.eclipse.milo.opcua.stack.core.security.ServerCertificateValidator;
import org.eclipse.milo.opcua.stack.core.security.TrustListManager;
Expand Down Expand Up @@ -129,10 +128,6 @@ public interface OpcUaServerConfig {
*/
CertificateManager getCertificateManager();

default CertificateManager2 getCertificateManager2() {
return null; // TODO
}

/**
* @return the {@link TrustListManager} for this server.
*/
Expand Down
12 changes: 7 additions & 5 deletions ...sdk/sdk-tests/src/test/java/org/eclipse/milo/opcua/sdk/client/TestCertificateManager.java
View file
Expand Up @@ -12,11 +12,13 @@

import java.security.KeyPair;
import java.security.cert.X509Certificate;
import java.util.Collections;
import java.util.List;
import java.util.Optional;
import java.util.Set;

import org.eclipse.milo.opcua.stack.core.security.CertificateManager;
import org.eclipse.milo.opcua.stack.core.types.builtin.ByteString;
import org.eclipse.milo.opcua.stack.core.types.builtin.NodeId;

public class TestCertificateManager implements CertificateManager {

Expand Down Expand Up @@ -44,13 +46,13 @@ public Optional<X509Certificate[]> getCertificateChain(ByteString thumbprint) {
}

@Override
public Set<KeyPair> getKeyPairs() {
return Set.of(keyPair);
public Optional<CertificateGroup> getCertificateGroup(NodeId certificateGroupId) {
return Optional.empty();
}

@Override
public Set<X509Certificate> getCertificates() {
return Set.of(certificate);
public List<CertificateGroup> getCertificateGroups() {
return Collections.emptyList();
}

}

0 comments on commit 0adf9be

Please sign in to comment.