Java SecureChannel類代碼示例

import com.digitalpetri.opcua.stack.core.channel.SecureChannel; //導入依賴的package包/類
@Override
public Object validateAnonymousToken(AnonymousIdentityToken token, UserTokenPolicy tokenPolicy,
                                     SecureChannel channel, Session session) throws UaException {

    if (allowAnonymous) {
        return String.format("anonymous_%s_%s",
            session.getSessionName(), session.getSessionId().toParseableString());
    } else {
        throw new UaException(StatusCodes.Bad_UserAccessDenied);
    }
}
 

import com.digitalpetri.opcua.stack.core.channel.SecureChannel; //導入依賴的package包/類
@Override
public Object validateUsernameToken(UserNameIdentityToken token,
                                    UserTokenPolicy tokenPolicy,
                                    SecureChannel channel,
                                    Session session) throws UaException {

    return validateUserNameIdentityToken(token, channel, session);
}
 

import com.digitalpetri.opcua.stack.core.channel.SecureChannel; //導入依賴的package包/類
/**
 * Decrypt the data contained in a {@link UserNameIdentityToken} or {@link IssuedIdentityToken}.
 * <p>
 * See {@link UserNameIdentityToken#getPassword()} and {@link IssuedIdentityToken#getTokenData()}.
 *
 * @param secureChannel the {@link SecureChannel}.
 * @param dataBytes     the encrypted data.
 * @return the decrypted data.
 * @throws UaException if decryption fails.
 */
protected byte[] decryptTokenData(SecureChannel secureChannel,
                                  SecurityAlgorithm algorithm,
                                  byte[] dataBytes) throws UaException {

    int cipherTextBlockSize = secureChannel.getLocalAsymmetricCipherTextBlockSize();
    int blockCount = dataBytes.length / cipherTextBlockSize;

    int plainTextBufferSize = cipherTextBlockSize * blockCount;

    byte[] plainTextBytes = new byte[plainTextBufferSize];
    ByteBuffer plainTextNioBuffer = ByteBuffer.wrap(plainTextBytes);

    ByteBuffer passwordNioBuffer = ByteBuffer.wrap(dataBytes);

    try {
        Cipher cipher = getCipher(secureChannel, algorithm);

        for (int blockNumber = 0; blockNumber < blockCount; blockNumber++) {
            passwordNioBuffer.limit(passwordNioBuffer.position() + cipherTextBlockSize);

            cipher.doFinal(passwordNioBuffer, plainTextNioBuffer);
        }
    } catch (GeneralSecurityException e) {
        throw new UaException(StatusCodes.Bad_SecurityChecksFailed, e);
    }

    return plainTextBytes;
}
 

import com.digitalpetri.opcua.stack.core.channel.SecureChannel; //導入依賴的package包/類
private Cipher getCipher(SecureChannel channel, SecurityAlgorithm algorithm) throws UaException {
    try {
        String transformation = algorithm.getTransformation();
        Cipher cipher = Cipher.getInstance(transformation);
        cipher.init(Cipher.DECRYPT_MODE, channel.getKeyPair().getPrivate());
        return cipher;
    } catch (GeneralSecurityException e) {
        throw new UaException(StatusCodes.Bad_SecurityChecksFailed, e);
    }
}
 

import com.digitalpetri.opcua.stack.core.channel.SecureChannel; //導入依賴的package包/類
@Override
public Object validateAnonymousToken(
    AnonymousIdentityToken token,
    UserTokenPolicy tokenPolicy,
    SecureChannel channel,
    Session session) throws UaException {

    return String.format("anonymous_%s_%s",
        session.getSessionName(), session.getSessionId().toParseableString());
}
 

import com.digitalpetri.opcua.stack.core.channel.SecureChannel; //導入依賴的package包/類
protected SecureChannel[] generateChannels(SecurityPolicy securityPolicy, MessageSecurityMode messageSecurity) throws Exception {
    super.setUp();

    ByteString clientNonce = generateNonce(getNonceLength(securityPolicy.getSymmetricEncryptionAlgorithm()));
    ByteString serverNonce = generateNonce(getNonceLength(securityPolicy.getSymmetricEncryptionAlgorithm()));

    ClientSecureChannel clientChannel = new ClientSecureChannel(
            securityPolicy == SecurityPolicy.None ? null : clientKeyPair,
            securityPolicy == SecurityPolicy.None ? null : clientCertificate,
            securityPolicy == SecurityPolicy.None ? null : serverCertificate,
            securityPolicy == SecurityPolicy.None ? null : Lists.newArrayList(serverCertificate),
            securityPolicy,
            messageSecurity
    );

    clientChannel.setLocalNonce(clientNonce);
    clientChannel.setRemoteNonce(serverNonce);

    ServerSecureChannel serverChannel = new ServerSecureChannel();
    serverChannel.setSecurityPolicy(securityPolicy);
    serverChannel.setMessageSecurityMode(messageSecurity);
    serverChannel.setLocalNonce(serverNonce);
    serverChannel.setRemoteNonce(clientNonce);

    switch (securityPolicy) {
        case None:
            break;

        case Basic128Rsa15:
        case Basic256:
        case Basic256Sha256:
        default:
            if (messageSecurity != MessageSecurityMode.None) {
                ChannelSecurity.SecuritySecrets clientSecrets = ChannelSecurity.generateKeyPair(
                        clientChannel,
                        clientChannel.getLocalNonce(),
                        clientChannel.getRemoteNonce()
                );

                ChannelSecurityToken clientToken = new ChannelSecurityToken(
                        uint(0), uint(1), DateTime.now(), uint(60000));

                clientChannel.setChannelSecurity(new ChannelSecurity(clientSecrets, clientToken));
            }


            serverChannel.setKeyPair(serverKeyPair);
            serverChannel.setLocalCertificate(serverCertificate);
            serverChannel.setRemoteCertificate(clientCertificateBytes);

            if (messageSecurity != MessageSecurityMode.None) {
                ChannelSecurity.SecuritySecrets serverSecrets = ChannelSecurity.generateKeyPair(
                        serverChannel,
                        serverChannel.getRemoteNonce(),
                        serverChannel.getLocalNonce()
                );

                ChannelSecurityToken serverToken = new ChannelSecurityToken(
                        uint(0), uint(1), DateTime.now(), uint(60000));

                serverChannel.setChannelSecurity(new ChannelSecurity(serverSecrets, serverToken));
            }

            break;
    }

    return new SecureChannel[]{clientChannel, serverChannel};
}
 

import com.digitalpetri.opcua.stack.core.channel.SecureChannel; //導入依賴的package包/類
@Test(dataProvider = "getAsymmetricSecurityParameters")
public void testAsymmetricMessage(SecurityPolicy securityPolicy,
                                  MessageSecurityMode messageSecurity,
                                  int messageSize) throws Exception {

    logger.info("Asymmetric chunk serialization, securityPolicy={}, messageSecurityMode={}, messageSize={}",
            securityPolicy, messageSecurity, messageSize);

    ChunkEncoder encoder = new ChunkEncoder(parameters);
    ChunkDecoder decoder = new ChunkDecoder(parameters);

    SecureChannel[] channels = generateChannels(securityPolicy, messageSecurity);
    ClientSecureChannel clientChannel = (ClientSecureChannel) channels[0];
    ServerSecureChannel serverChannel = (ServerSecureChannel) channels[1];

    clientChannel
            .attr(ClientSecureChannel.KEY_REQUEST_ID_SEQUENCE)
            .setIfAbsent(new LongSequence(1L, UInteger.MAX_VALUE));

    LongSequence requestId = clientChannel
            .attr(ClientSecureChannel.KEY_REQUEST_ID_SEQUENCE).get();

    byte[] messageBytes = new byte[messageSize];
    for (int i = 0; i < messageBytes.length; i++) {
        messageBytes[i] = (byte) i;
    }

    ByteBuf messageBuffer = BufferUtil.buffer().writeBytes(messageBytes);

    List<ByteBuf> chunkBuffers = encoder.encodeAsymmetric(
            clientChannel,
            MessageType.OpenSecureChannel,
            messageBuffer,
            requestId.getAndIncrement()
    );

    ByteBuf decodedBuffer = decoder.decodeAsymmetric(
            serverChannel,
            chunkBuffers
    );

    ReferenceCountUtil.releaseLater(messageBuffer);
    ReferenceCountUtil.releaseLater(decodedBuffer);

    messageBuffer.readerIndex(0);
    assertEquals(decodedBuffer, messageBuffer);
}
 

import com.digitalpetri.opcua.stack.core.channel.SecureChannel; //導入依賴的package包/類
@Test(dataProvider = "getSymmetricSecurityParameters")
public void testSymmetricMessage(SecurityPolicy securityPolicy,
                                 MessageSecurityMode messageSecurity,
                                 int messageSize) throws Exception {

    logger.info("Symmetric chunk serialization, securityPolicy={}, messageSecurityMode={}, messageSize={}",
            securityPolicy, messageSecurity, messageSize);

    ChunkEncoder encoder = new ChunkEncoder(parameters);
    ChunkDecoder decoder = new ChunkDecoder(parameters);

    SecureChannel[] channels = generateChannels(securityPolicy, messageSecurity);
    ClientSecureChannel clientChannel = (ClientSecureChannel) channels[0];
    ServerSecureChannel serverChannel = (ServerSecureChannel) channels[1];

    clientChannel
            .attr(ClientSecureChannel.KEY_REQUEST_ID_SEQUENCE)
            .setIfAbsent(new LongSequence(1L, UInteger.MAX_VALUE));

    LongSequence requestId = clientChannel
            .attr(ClientSecureChannel.KEY_REQUEST_ID_SEQUENCE).get();

    byte[] messageBytes = new byte[messageSize];
    for (int i = 0; i < messageBytes.length; i++) {
        messageBytes[i] = (byte) i;
    }

    ByteBuf messageBuffer = BufferUtil.buffer().writeBytes(messageBytes);

    List<ByteBuf> chunkBuffers = encoder.encodeSymmetric(
            clientChannel,
            MessageType.SecureMessage,
            messageBuffer,
            requestId.getAndIncrement()
    );

    ByteBuf decodedBuffer = decoder.decodeSymmetric(
            serverChannel,
            chunkBuffers
    );

    ReferenceCountUtil.releaseLater(messageBuffer);
    ReferenceCountUtil.releaseLater(decodedBuffer);

    messageBuffer.readerIndex(0);
    assertEquals(decodedBuffer, messageBuffer);
}
 

import com.digitalpetri.opcua.stack.core.channel.SecureChannel; //導入依賴的package包/類
/**
 * Validate an {@link AnonymousIdentityToken} and return an identity Object that represents the user.
 * <p>
 * This Object should implement equality in such a way that a subsequent identity validation for the same user
 * yields a comparable Object.
 *
 * @param token       the {@link AnonymousIdentityToken}.
 * @param tokenPolicy the {@link UserTokenPolicy} specified by the policyId in {@code token}.
 * @param channel     the {@link SecureChannel} the request is arriving on.
 * @param session     the {@link Session} the request is arriving on.
 * @return an identity Object that represents the user.
 * @throws UaException if the token is invalid, rejected, or user access is denied.
 */
public Object validateAnonymousToken(AnonymousIdentityToken token, UserTokenPolicy tokenPolicy,
                                     SecureChannel channel, Session session) throws UaException {
    throw new UaException(StatusCodes.Bad_IdentityTokenInvalid);
}
 

import com.digitalpetri.opcua.stack.core.channel.SecureChannel; //導入依賴的package包/類
/**
 * Validate a {@link UserNameIdentityToken} and return an identity Object that represents the user.
 * <p>
 * This Object should implement equality in such a way that a subsequent identity validation for the same user
 * yields a comparable Object.
 *
 * @param token       the {@link UserNameIdentityToken}.
 * @param tokenPolicy the {@link UserTokenPolicy} specified by the policyId in {@code token}.
 * @param channel     the {@link SecureChannel} the request is arriving on.
 * @param session     the {@link Session} the request is arriving on.
 * @return an identity Object that represents the user.
 * @throws UaException if the token is invalid, rejected, or user access is denied.
 */
public Object validateUsernameToken(UserNameIdentityToken token, UserTokenPolicy tokenPolicy,
                                    SecureChannel channel, Session session) throws UaException {
    throw new UaException(StatusCodes.Bad_IdentityTokenInvalid);
}
 

import com.digitalpetri.opcua.stack.core.channel.SecureChannel; //導入依賴的package包/類
/**
 * Validate an {@link X509IdentityToken} and return an identity Object that represents the user.
 * <p>
 * This Object should implement equality in such a way that a subsequent identity validation for the same user
 * yields a comparable Object.
 *
 * @param token       the {@link X509IdentityToken}.
 * @param tokenPolicy the {@link UserTokenPolicy} specified by the policyId in {@code token}.
 * @param channel     the {@link SecureChannel} the request is arriving on.
 * @param session     the {@link Session} the request is arriving on.
 * @return an identity Object that represents the user.
 * @throws UaException if the token is invalid, rejected, or user access is denied.
 */
public Object validateX509Token(X509IdentityToken token, UserTokenPolicy tokenPolicy,
                                SecureChannel channel, Session session) throws UaException {
    throw new UaException(StatusCodes.Bad_IdentityTokenInvalid);
}
 

import com.digitalpetri.opcua.stack.core.channel.SecureChannel; //導入依賴的package包/類
/**
 * Validate an {@link IssuedIdentityToken} and return an identity Object that represents the user.
 * <p>
 * This Object should implement equality in such a way that a subsequent identity validation for the same user
 * yields a comparable Object.
 *
 * @param token       the {@link IssuedIdentityToken}.
 * @param tokenPolicy the {@link UserTokenPolicy} specified by the policyId in {@code token}.
 * @param channel     the {@link SecureChannel} the request is arriving on.
 * @param session     the {@link Session} the request is arriving on.
 * @return an identity Object that represents the user.
 * @throws UaException if the token is invalid, rejected, or user access is denied.
 */
public Object validateIssuedIdentityToken(IssuedIdentityToken token, UserTokenPolicy tokenPolicy,
                                          SecureChannel channel, Session session) throws UaException {
    throw new UaException(StatusCodes.Bad_IdentityTokenInvalid);
}