diff options
Diffstat (limited to 'src/common.h')
| -rw-r--r-- | src/common.h | 206 |
1 files changed, 140 insertions, 66 deletions
diff --git a/src/common.h b/src/common.h index aff6ff4..b8643d7 100644 --- a/src/common.h +++ b/src/common.h @@ -17,6 +17,66 @@ #include "config.h" +/* ======================================================================== + * Aggregate Types + * ======================================================================== */ + +/** + * @brief Session-level authentication mode. + */ +typedef enum +{ + AUTH_ANONYMOUS, + AUTH_USER, + AUTH_CERT +} AuthMode; + +/** + * @brief Session-level authentication configuration (tagged union). + * + * AUTH_ANONYMOUS carries no payload. AUTH_USER carries borrowed pointers + * to username/password strings (owned by the Config that was parsed). + * AUTH_CERT carries no payload — the application certificate is reused + * as the X509 identity token. + */ +typedef struct +{ + AuthMode mode; + union + { + struct + { + const char *username; + const char *password; + } user; + }; +} AuthConfig; + +/** + * @brief Transport-level security configuration. + * + * Groups the certificate, private key, trust list, security mode, and + * security policy URI. All pointers are borrowed (owned by Config or + * returned by loadTrustStore / resolveSecurityPolicyUri). The caller + * must free trustPaths with freeTrustStore() when done. + * + * securityMode and securityPolicyUri are only meaningful for client + * configs; server-side callers may leave them zeroed. + */ +typedef struct +{ + const char *certPath; + const char *keyPath; + char **trustPaths; + size_t trustSize; + UA_MessageSecurityMode securityMode; + const char *securityPolicyUri; +} SecurityConfig; + +/* ======================================================================== + * File Loading + * ======================================================================== */ + /** * @brief Loads a DER-encoded certificate or key file into a UA_ByteString. * @@ -48,34 +108,9 @@ int loadTrustStore (const char *dirPath, char ***outPaths, size_t *outSize); */ void freeTrustStore (char **paths, size_t size); -/** - * @brief Creates a UA_Server, optionally configured with security policies. - * - * When @p certPath is non-NULL the server is initialized with encryption - * (certificate, private key, trustlist). When @p discovery is true the - * server additionally offers SecurityPolicy#None restricted to discovery - * services (FindServers, GetEndpoints) so that unencrypted clients can - * still discover the server. When @p discovery is false the server is - * purely secure — no None security policy, no None endpoint. When - * @p certPath is NULL the server runs with SecurityPolicy#None only - * (keyPath, trustPaths and discovery are ignored). The applicationUri - * is set in both cases. - * - * @param port Server port number. - * @param applicationUri OPC UA application URI. - * @param certPath Path to server certificate (.der), or NULL for unsecure. - * @param keyPath Path to private key (.der), or NULL when certPath is NULL. - * @param trustPaths Array of trustlist file paths (may be NULL). - * @param trustSize Number of entries in trustPaths. - * @param discovery When true and certPath is non-NULL, add a None - * endpoint restricted to discovery services. - * @param retval Output parameter set to the status code on failure. - * @return A configured UA_Server, or NULL on error. - */ -UA_Server *createServer (UA_UInt16 port, const char *applicationUri, - const char *certPath, const char *keyPath, - char **trustPaths, size_t trustSize, - UA_Boolean discovery, UA_StatusCode *retval); +/* ======================================================================== + * Parsing Helpers + * ======================================================================== */ /** * @brief Parses a log-level name into the corresponding UA_LogLevel value. @@ -91,25 +126,37 @@ int parseLogLevel (const char *name); /** * @brief Parses the authMode key from a configuration file. * - * When authMode is "anonymous", sets *allowAnonymous to true and leaves - * *username / *password as NULL. When authMode is "user", sets - * *allowAnonymous to false and loads the username/password keys. When - * authMode is "cert", sets *allowAnonymous to false and *certAuth to true. + * Populates an AuthConfig struct. When authMode is "anonymous", sets + * mode to AUTH_ANONYMOUS. When "user", sets mode to AUTH_USER and reads + * the username/password keys. When "cert", sets mode to AUTH_CERT. * Logs errors internally. * - * @param cfg Parsed configuration. - * @param program Program name (for error messages). - * @param allowAnonymous Output: true for anonymous, false otherwise. - * May be NULL (ignored — useful for client callers). - * @param username Output: username string (owned by cfg), or NULL. - * @param password Output: password string (owned by cfg), or NULL. - * @param certAuth Output: true when authMode is "cert", false otherwise. - * May be NULL (ignored — useful for server callers). + * @param cfg Parsed configuration. + * @param program Program name (for error messages). + * @param auth Output: populated AuthConfig. + * @return 0 on success, -1 on error. + */ +int parseAuthConfig (const Config *cfg, const char *program, AuthConfig *auth); + +/** + * @brief Parses security configuration from a config file. + * + * Reads certificate, privateKey, and trustStore keys. When all three + * are omitted, zeroes @p sec and returns 0 (unsecure). When any of the + * three is present, all three are required. When @p needsModePolicy is + * true, also reads and resolves securityMode and securityPolicy keys. + * Calls loadTrustStore() internally; the caller must free + * sec->trustPaths with freeTrustStore(). + * + * @param cfg Parsed configuration. + * @param program Program name (for error messages). + * @param needsModePolicy When true, require securityMode and + * securityPolicy keys (client configs). + * @param sec Output: populated SecurityConfig. * @return 0 on success, -1 on error. */ -int parseAuthConfig (const Config *cfg, const char *program, - UA_Boolean *allowAnonymous, const char **username, - const char **password, UA_Boolean *certAuth); +int parseSecurityConfig (const Config *cfg, const char *program, + UA_Boolean needsModePolicy, SecurityConfig *sec); /** * @brief Parses a security mode name into the corresponding enum value. @@ -133,49 +180,76 @@ UA_MessageSecurityMode parseSecurityMode (const char *name); */ const char *resolveSecurityPolicyUri (const char *shortName); +/* ======================================================================== + * Factory Functions + * ======================================================================== */ + +/** + * @brief Creates a UA_Server, optionally configured with security policies. + * + * When @p sec is non-NULL the server is initialized with encryption + * (certificate, private key, trustlist). When @p discovery is true the + * server additionally offers SecurityPolicy#None restricted to discovery + * services (FindServers, GetEndpoints) so that unencrypted clients can + * still discover the server. When @p discovery is false the server is + * purely secure — no None security policy, no None endpoint. When + * @p sec is NULL the server runs with SecurityPolicy#None only + * (discovery is ignored). The applicationUri is set in both cases. + * + * @param port Server port number. + * @param applicationUri OPC UA application URI. + * @param sec Security configuration, or NULL for unsecure. + * @param discovery When true and sec is non-NULL, add a None + * endpoint restricted to discovery services. + * @param retval Output parameter set to the status code on failure. + * @return A configured UA_Server, or NULL on error. + */ +UA_Server *createServer (UA_UInt16 port, const char *applicationUri, + const SecurityConfig *sec, UA_Boolean discovery, + UA_StatusCode *retval); + /** * @brief Initializes a UA_ClientConfig without encryption. * * Sets up a default client config with SecurityPolicy#None and the given * application URI. Explicitly sets securityMode and securityPolicyUri so - * that internal endpoint negotiation matches None endpoints. + * that internal endpoint negotiation matches None endpoints. When @p auth + * is non-NULL and mode is AUTH_USER, configures username/password + * authentication. AUTH_CERT returns an error (requires encryption). * * @param cc Pointer to a zero-initialized UA_ClientConfig. * @param applicationUri OPC UA application URI. + * @param auth Authentication config, or NULL for anonymous. * @return UA_STATUSCODE_GOOD on success, error code otherwise. */ UA_StatusCode createUnsecureClientConfig (UA_ClientConfig *cc, - const char *applicationUri); + const char *applicationUri, + const AuthConfig *auth); /** - * @brief Initializes a UA_ClientConfig with encryption from file paths. + * @brief Initializes a UA_ClientConfig with encryption. * * The config must be zero-initialized by the caller before calling this - * function. Loads the certificate, private key, and trustlist, then applies - * default encryption settings. When @p certAuth is true, also configures - * X509 certificate identity-token authentication using the same application - * certificate (mutually exclusive with username/password authentication). + * function. Loads the certificate, private key, and trustlist, then + * applies default encryption settings. When @p auth is non-NULL: + * AUTH_CERT configures X509 certificate identity-token authentication + * using the same application certificate; AUTH_USER configures + * username/password authentication. Both are mutually exclusive. * * @param cc Pointer to a zero-initialized UA_ClientConfig. * @param applicationUri OPC UA application URI. - * @param certPath Path to client certificate (.der). - * @param keyPath Path to private key (.der). - * @param trustPaths Array of trustlist file paths (may be NULL if trustSize is - * 0). - * @param trustSize Number of entries in trustPaths. - * @param securityMode Requested message security mode. - * @param securityPolicyUri Security policy URI string (e.g. - * "http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256"). - * @param certAuth When true, use the application certificate as X509 identity - * token. + * @param sec Security configuration (cert, key, trust, mode, policy). + * @param auth Authentication config, or NULL for anonymous. * @return UA_STATUSCODE_GOOD on success, error code otherwise. */ -UA_StatusCode -createSecureClientConfig (UA_ClientConfig *cc, const char *applicationUri, - const char *certPath, const char *keyPath, - char **trustPaths, size_t trustSize, - UA_MessageSecurityMode securityMode, - const char *securityPolicyUri, UA_Boolean certAuth); +UA_StatusCode createSecureClientConfig (UA_ClientConfig *cc, + const char *applicationUri, + const SecurityConfig *sec, + const AuthConfig *auth); + +/* ======================================================================== + * Output Formatting + * ======================================================================== */ /** * @brief Logs a UA_ApplicationDescription (server info from FindServers). |