node-opcua-client 2.164.2 → 2.165.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/verify.d.ts +3 -3
  2. package/dist/verify.js +11 -21
  3. package/dist/verify.js.map +1 -1
  4. package/package.json +42 -42
  5. package/source/verify.ts +15 -28
package/dist/verify.d.ts CHANGED
@@ -1,5 +1,5 @@
1
- import { OPCUACertificateManager } from "node-opcua-certificate-manager";
2
- import { OPCUASecureObject } from "node-opcua-common";
3
- import { Certificate } from "node-opcua-crypto/web";
1
+ import type { OPCUACertificateManager } from "node-opcua-certificate-manager";
2
+ import type { OPCUASecureObject } from "node-opcua-common";
3
+ import { type Certificate } from "node-opcua-crypto/web";
4
4
  export declare function verifyIsOPCUAValidCertificate(certificate: Certificate, certificateFile: string, type: "client" | "server", applicationUri: string): void;
5
5
  export declare function performCertificateSanityCheck(secureObject: OPCUASecureObject, serverOrClient: "server" | "client", certificateManager: OPCUACertificateManager, applicationUri: string): Promise<void>;
package/dist/verify.js CHANGED
@@ -4,8 +4,8 @@ exports.verifyIsOPCUAValidCertificate = verifyIsOPCUAValidCertificate;
4
4
  exports.performCertificateSanityCheck = performCertificateSanityCheck;
5
5
  const web_1 = require("node-opcua-crypto/web");
6
6
  const node_opcua_debug_1 = require("node-opcua-debug");
7
- const doDebug = (0, node_opcua_debug_1.checkDebugFlag)(__filename);
8
- const debugLog = (0, node_opcua_debug_1.make_debugLog)(__filename);
7
+ const _doDebug = (0, node_opcua_debug_1.checkDebugFlag)(__filename);
8
+ const _debugLog = (0, node_opcua_debug_1.make_debugLog)(__filename);
9
9
  const errorLog = (0, node_opcua_debug_1.make_errorLog)(__filename);
10
10
  const warningLog = (0, node_opcua_debug_1.make_warningLog)(__filename);
11
11
  function verifyIsOPCUAValidCertificate(certificate, certificateFile, type, applicationUri) {
@@ -54,7 +54,7 @@ function verifyIsOPCUAValidCertificate(certificate, certificateFile, type, appli
54
54
  }
55
55
  const keyUsage = certificateInfo.tbsCertificate.extensions?.keyUsage;
56
56
  if (!keyUsage) {
57
- warningLog(`[NODE-OPCUA-W15] The certificate keyUsage is missing\n` + `certificateFile = ${certificateFile}`);
57
+ warningLog(`[NODE-OPCUA-W15] The certificate keyUsage is missing\ncertificateFile = ${certificateFile}`);
58
58
  }
59
59
  else {
60
60
  // spec says that certificate shall include digitalSignature, nonRepudiation, keyEncipherment and dataEncipherment.
@@ -68,7 +68,7 @@ function verifyIsOPCUAValidCertificate(certificate, certificateFile, type, appli
68
68
  }
69
69
  const extKeyUsage = certificateInfo.tbsCertificate.extensions?.extKeyUsage;
70
70
  if (!extKeyUsage) {
71
- warningLog(`[NODE-OPCUA-W17] The certificate extKeyUsage is missing\n` + `certificateFile = ${certificateFile}`);
71
+ warningLog(`[NODE-OPCUA-W17] The certificate extKeyUsage is missing\ncertificateFile = ${certificateFile}`);
72
72
  }
73
73
  else {
74
74
  // spec says that certificate shall include digitalSignature, nonRepudiation, keyEncipherment and dataEncipherment.
@@ -112,28 +112,18 @@ async function performCertificateSanityCheck(secureObject, serverOrClient, certi
112
112
  `OPCUA version 1.04 requires that security key length are greater or equal to 2048 bits.\n` +
113
113
  `The ${serverOrClient} is operating at risk. `);
114
114
  }
115
- try {
116
- const _status1 = await certificateManager.trustCertificate(certificate);
117
- }
118
- catch (err) {
119
- if (err.code === "ENOENT" && err.syscall === "rename") {
120
- // Under heavily concurrent circumstances (e.g. 50 clients sharing the same CertificateManager connecting simultaneously),
121
- // a benign race condition occurs in node-opcua-pki's CertificateManager.trustCertificate where a client tries to rename
122
- // the missing (already trusted and thus renamed) rejected certificate. We can safely ignore this!
123
- debugLog("Swallowing benign ENOENT on concurrent trustCertificate");
124
- }
125
- else {
126
- throw err;
127
- }
128
- }
129
115
  const options = {
130
116
  acceptOutdatedCertificate: false,
131
117
  acceptOutDatedIssuerCertificate: false,
132
- acceptPendingCertificate: false,
118
+ acceptPendingCertificate: false
133
119
  };
134
120
  const status = await certificateManager.verifyCertificate(certificate, options);
135
- if (status !== "Good") {
136
- warningLog("[NODE-OPCUA-W04] Warning: the certificate status is = ", status, " file = ", secureObject.certificateFile);
121
+ // BadCertificateUntrusted is expected for the application's own
122
+ // certificate — it does not need to be in its own trust list.
123
+ // Only warn about genuinely problematic statuses (expired,
124
+ // revoked, invalid signature, etc.).
125
+ if (status !== "Good" && status !== "BadCertificateUntrusted") {
126
+ warningLog("[NODE-OPCUA-W35] Warning: the certificate status is = ", status, " file = ", secureObject.certificateFile);
137
127
  }
138
128
  verifyIsOPCUAValidCertificate(certificate, secureObject.certificateFile, serverOrClient, applicationUri);
139
129
  }
package/dist/verify.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"verify.js","sourceRoot":"","sources":["../source/verify.ts"],"names":[],"mappings":";;AAiBA,sEAsGC;AAED,sEAwDC;AA9KD,+CAK+B;AAC/B,uDAAiG;AAGjG,MAAM,OAAO,GAAG,IAAA,iCAAc,EAAC,UAAU,CAAC,CAAC;AAC3C,MAAM,QAAQ,GAAG,IAAA,gCAAa,EAAC,UAAU,CAAC,CAAC;AAC3C,MAAM,QAAQ,GAAG,IAAA,gCAAa,EAAC,UAAU,CAAC,CAAC;AAC3C,MAAM,UAAU,GAAG,IAAA,kCAAe,EAAC,UAAU,CAAC,CAAC;AAE/C,SAAgB,6BAA6B,CACzC,WAAwB,EACxB,eAAuB,EACvB,IAAyB,EACzB,cAAsB;IAEtB,MAAM,eAAe,GAAG,IAAA,wBAAkB,EAAC,WAAW,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,IAAI,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9E,mCAAmC;QACnC,gCAAgC;QAChC,UAAU,CACN,sDAAsD;YACtD,mBAAmB,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI;YACtF,mBAAmB,eAAe,EAAE,CACvC,CAAC;IACN,CAAC;IACD,0CAA0C;IAC1C,IAAI,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9E,0BAA0B;QAC1B,UAAU,CACN,gDAAgD;YAChD,yCAAyC;YACzC,oBAAoB,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI;YACtF,oBAAoB,eAAe,EAAE,CACxC,CAAC;IACN,CAAC;SAAM,CAAC;QACJ,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACzC,IAAI,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;YACxF,4CAA4C;YAC5C,UAAU,CACN,6EAA6E;gBAC7E,6DAA6D;gBAC7D,oBAAoB,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI;gBACtF,oBAAoB,eAAe,IAAI,CAC1C,CAAC;QACN,CAAC;IACL,CAAC;IACD,wDAAwD;IACxD,MAAM,yBAAyB,GAAG,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,yBAAyB,CAAC;IACzH,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC7B,UAAU,CACN,yFAAyF;YACzF,+FAA+F,IAAI,mBAAmB;YACtH,qBAAqB,cAAc,IAAI;YACvC,qBAAqB,eAAe,IAAI,CAC3C,CAAC;QACF,OAAO;IACX,CAAC;SAAM,IAAI,yBAAyB,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;QACzD,UAAU,CACN,sEAAsE,IAAI,mBAAmB;YAC7F,8DAA8D,IAAI,mBAAmB;YACrF,iCAAiC,yBAAyB,CAAC,CAAC,CAAC,IAAI;YACjE,GAAG,IAAI,sBAAsB,cAAc,IAAI;YAC/C,6BAA6B,eAAe,IAAI,CACnD,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC;IACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,UAAU,CAAC,wDAAwD,GAAG,qBAAqB,eAAe,EAAE,CAAC,CAAC;IAClH,CAAC;SAAM,CAAC;QACJ,mHAAmH;QACnH,8BAA8B;QAC9B,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACpH,UAAU,CACN,kIAAkI;gBAClI,uEAAuE;gBACvE,qBAAqB,eAAe,EAAE,CACzC,CAAC;YACF,UAAU,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,cAAc,CAAC,UAAU,EAAE,WAAW,CAAC;IAC3E,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,UAAU,CAAC,2DAA2D,GAAG,qBAAqB,eAAe,EAAE,CAAC,CAAC;IACrH,CAAC;SAAM,CAAC;QACJ,mHAAmH;QACnH,8BAA8B;QAC9B,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YACrD,UAAU,CACN,2FAA2F;gBAC3F,uEAAuE;gBACvE,qBAAqB,eAAe,EAAE,CACzC,CAAC;QACN,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,eAAe,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,GAAG,CAAC,CAAC;IAC1F,IAAI,eAAe,GAAG,IAAI,EAAE,CAAC;QACzB,QAAQ,CACJ,qGAAqG,eAAe,KAAK;YACzH,gEAAgE;YAChE,qBAAqB,eAAe,EAAE,CACzC,CAAC;IACN,CAAC;SAAM,IAAI,eAAe,GAAG,IAAI,EAAE,CAAC;QAChC,UAAU,CACN,sFAAsF,eAAe,IAAI;YACzG,qEAAqE;YACrE,qBAAqB,eAAe,EAAE,CACzC,CAAC;IACN,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,6BAA6B,CAC/C,YAA+B,EAC/B,cAAmC,EACnC,kBAA2C,EAC3C,cAAsB;IAEtB,mFAAmF;IACnF,MAAM,WAAW,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,EAAE,CAAC;IAChD,EAAE;IACF,IAAI,CAAC,IAAA,mCAA6B,EAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,2FAA2F,CAAC,CAAC;QACtG,QAAQ,CAAC,sEAAsE,CAAC,CAAC;QACjF,QAAQ,CAAC,kCAAkC,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;QAC1E,QAAQ,CAAC,kCAAkC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC5E,QAAQ,CAAC,kCAAkC,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;QAC3E,MAAM,IAAI,KAAK,CACX,yHAAyH,CAC5H,CAAC;IACN,CAAC;IACD,iFAAiF;IACjF,MAAM,cAAc,GAAG,IAAA,uBAAiB,EAAC,UAAU,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1D,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC1B,UAAU,CACN,2HAA2H,eAAe,MAAM;YAChJ,2FAA2F;YAC3F,OAAO,cAAc,qEAAqE,CAC7F,CAAC;IACN,CAAC;IACD,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,0HAA0H;YAC1H,yHAAyH;YACzH,kGAAkG;YAClG,QAAQ,CAAC,yDAAyD,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAA6B;QACtC,yBAAyB,EAAE,KAAK;QAChC,+BAA+B,EAAE,KAAK;QACtC,wBAAwB,EAAE,KAAK;KAClC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEhF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACpB,UAAU,CAAC,wDAAwD,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;IAC3H,CAAC;IAED,6BAA6B,CAAC,WAAW,EAAE,YAAY,CAAC,eAAe,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAC7G,CAAC"}
1
+ {"version":3,"file":"verify.js","sourceRoot":"","sources":["../source/verify.ts"],"names":[],"mappings":";;AAYA,sEAsGC;AAED,sEAgDC;AAjKD,+CAA+H;AAC/H,uDAAiG;AAGjG,MAAM,QAAQ,GAAG,IAAA,iCAAc,EAAC,UAAU,CAAC,CAAC;AAC5C,MAAM,SAAS,GAAG,IAAA,gCAAa,EAAC,UAAU,CAAC,CAAC;AAC5C,MAAM,QAAQ,GAAG,IAAA,gCAAa,EAAC,UAAU,CAAC,CAAC;AAC3C,MAAM,UAAU,GAAG,IAAA,kCAAe,EAAC,UAAU,CAAC,CAAC;AAE/C,SAAgB,6BAA6B,CACzC,WAAwB,EACxB,eAAuB,EACvB,IAAyB,EACzB,cAAsB;IAEtB,MAAM,eAAe,GAAG,IAAA,wBAAkB,EAAC,WAAW,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,IAAI,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9E,mCAAmC;QACnC,gCAAgC;QAChC,UAAU,CACN,sDAAsD;YACtD,mBAAmB,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI;YACtF,mBAAmB,eAAe,EAAE,CACvC,CAAC;IACN,CAAC;IACD,0CAA0C;IAC1C,IAAI,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9E,0BAA0B;QAC1B,UAAU,CACN,gDAAgD;YAChD,yCAAyC;YACzC,oBAAoB,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI;YACtF,oBAAoB,eAAe,EAAE,CACxC,CAAC;IACN,CAAC;SAAM,CAAC;QACJ,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACzC,IAAI,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;YACxF,4CAA4C;YAC5C,UAAU,CACN,6EAA6E;gBAC7E,6DAA6D;gBAC7D,oBAAoB,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI;gBACtF,oBAAoB,eAAe,IAAI,CAC1C,CAAC;QACN,CAAC;IACL,CAAC;IACD,wDAAwD;IACxD,MAAM,yBAAyB,GAAG,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,yBAAyB,CAAC;IACzH,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC7B,UAAU,CACN,yFAAyF;YACzF,+FAA+F,IAAI,mBAAmB;YACtH,qBAAqB,cAAc,IAAI;YACvC,qBAAqB,eAAe,IAAI,CAC3C,CAAC;QACF,OAAO;IACX,CAAC;SAAM,IAAI,yBAAyB,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;QACzD,UAAU,CACN,sEAAsE,IAAI,mBAAmB;YAC7F,8DAA8D,IAAI,mBAAmB;YACrF,iCAAiC,yBAAyB,CAAC,CAAC,CAAC,IAAI;YACjE,GAAG,IAAI,sBAAsB,cAAc,IAAI;YAC/C,6BAA6B,eAAe,IAAI,CACnD,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC;IACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,UAAU,CAAC,2EAA2E,eAAe,EAAE,CAAC,CAAC;IAC7G,CAAC;SAAM,CAAC;QACJ,mHAAmH;QACnH,8BAA8B;QAC9B,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACpH,UAAU,CACN,kIAAkI;gBAClI,uEAAuE;gBACvE,qBAAqB,eAAe,EAAE,CACzC,CAAC;YACF,UAAU,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,cAAc,CAAC,UAAU,EAAE,WAAW,CAAC;IAC3E,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,UAAU,CAAC,8EAA8E,eAAe,EAAE,CAAC,CAAC;IAChH,CAAC;SAAM,CAAC;QACJ,mHAAmH;QACnH,8BAA8B;QAC9B,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YACrD,UAAU,CACN,2FAA2F;gBAC3F,uEAAuE;gBACvE,qBAAqB,eAAe,EAAE,CACzC,CAAC;QACN,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,eAAe,CAAC,cAAc,CAAC,oBAAoB,CAAC,SAAS,GAAG,CAAC,CAAC;IAC1F,IAAI,eAAe,GAAG,IAAI,EAAE,CAAC;QACzB,QAAQ,CACJ,qGAAqG,eAAe,KAAK;YACzH,gEAAgE;YAChE,qBAAqB,eAAe,EAAE,CACzC,CAAC;IACN,CAAC;SAAM,IAAI,eAAe,GAAG,IAAI,EAAE,CAAC;QAChC,UAAU,CACN,sFAAsF,eAAe,IAAI;YACzG,qEAAqE;YACrE,qBAAqB,eAAe,EAAE,CACzC,CAAC;IACN,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,6BAA6B,CAC/C,YAA+B,EAC/B,cAAmC,EACnC,kBAA2C,EAC3C,cAAsB;IAEtB,mFAAmF;IACnF,MAAM,WAAW,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,EAAE,CAAC;IAChD,EAAE;IACF,IAAI,CAAC,IAAA,mCAA6B,EAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,2FAA2F,CAAC,CAAC;QACtG,QAAQ,CAAC,sEAAsE,CAAC,CAAC;QACjF,QAAQ,CAAC,kCAAkC,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;QAC1E,QAAQ,CAAC,kCAAkC,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC5E,QAAQ,CAAC,kCAAkC,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;QAC3E,MAAM,IAAI,KAAK,CACX,yHAAyH,CAC5H,CAAC;IACN,CAAC;IACD,iFAAiF;IACjF,MAAM,cAAc,GAAG,IAAA,uBAAiB,EAAC,UAAU,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1D,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC1B,UAAU,CACN,2HAA2H,eAAe,MAAM;YAChJ,2FAA2F;YAC3F,OAAO,cAAc,qEAAqE,CAC7F,CAAC;IACN,CAAC;IAED,MAAM,OAAO,GAA6B;QACtC,yBAAyB,EAAE,KAAK;QAChC,+BAA+B,EAAE,KAAK;QACtC,wBAAwB,EAAE,KAAK;KAClC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEhF,gEAAgE;IAChE,8DAA8D;IAC9D,2DAA2D;IAC3D,qCAAqC;IACrC,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,yBAAyB,EAAE,CAAC;QAC5D,UAAU,CAAC,wDAAwD,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;IAC3H,CAAC;IAED,6BAA6B,CAAC,WAAW,EAAE,YAAY,CAAC,eAAe,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;AAC7G,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "node-opcua-client",
3
- "version": "2.164.2",
3
+ "version": "2.165.0",
4
4
  "description": "pure nodejs OPCUA SDK - module client",
5
5
  "scripts": {
6
6
  "clean": "npx rimraf -g node_modules dist *.tsbuildinfo certificates",
@@ -16,54 +16,54 @@
16
16
  "@ster5/global-mutex": "^3.2.2",
17
17
  "async": "^3.2.6",
18
18
  "chalk": "4.1.2",
19
- "node-opcua-alarm-condition": "2.164.2",
19
+ "node-opcua-alarm-condition": "2.165.0",
20
20
  "node-opcua-assert": "2.164.0",
21
- "node-opcua-basic-types": "2.164.0",
22
- "node-opcua-buffer-utils": "2.164.0",
23
- "node-opcua-certificate-manager": "2.164.2",
24
- "node-opcua-client-dynamic-extension-object": "2.164.2",
25
- "node-opcua-common": "2.164.0",
21
+ "node-opcua-basic-types": "2.165.0",
22
+ "node-opcua-buffer-utils": "2.165.0",
23
+ "node-opcua-certificate-manager": "2.165.0",
24
+ "node-opcua-client-dynamic-extension-object": "2.165.0",
25
+ "node-opcua-common": "2.165.0",
26
26
  "node-opcua-constants": "2.157.0",
27
27
  "node-opcua-crypto": "5.3.0",
28
- "node-opcua-data-model": "2.164.0",
29
- "node-opcua-data-value": "2.164.0",
30
- "node-opcua-date-time": "2.164.0",
31
- "node-opcua-debug": "2.164.0",
32
- "node-opcua-extension-object": "2.164.0",
33
- "node-opcua-hostname": "2.164.0",
34
- "node-opcua-nodeid": "2.164.0",
35
- "node-opcua-numeric-range": "2.164.0",
36
- "node-opcua-object-registry": "2.164.0",
28
+ "node-opcua-data-model": "2.165.0",
29
+ "node-opcua-data-value": "2.165.0",
30
+ "node-opcua-date-time": "2.165.0",
31
+ "node-opcua-debug": "2.165.0",
32
+ "node-opcua-extension-object": "2.165.0",
33
+ "node-opcua-hostname": "2.165.0",
34
+ "node-opcua-nodeid": "2.165.0",
35
+ "node-opcua-numeric-range": "2.165.0",
36
+ "node-opcua-object-registry": "2.165.0",
37
37
  "node-opcua-pki": "6.8.2",
38
- "node-opcua-pseudo-session": "2.164.2",
39
- "node-opcua-schemas": "2.164.0",
40
- "node-opcua-secure-channel": "2.164.2",
41
- "node-opcua-service-browse": "2.164.0",
42
- "node-opcua-service-call": "2.164.0",
43
- "node-opcua-service-discovery": "2.164.0",
44
- "node-opcua-service-endpoints": "2.164.0",
45
- "node-opcua-service-filter": "2.164.0",
46
- "node-opcua-service-history": "2.164.0",
47
- "node-opcua-service-query": "2.164.0",
48
- "node-opcua-service-read": "2.164.0",
49
- "node-opcua-service-register-node": "2.164.0",
50
- "node-opcua-service-secure-channel": "2.164.0",
51
- "node-opcua-service-session": "2.164.0",
52
- "node-opcua-service-subscription": "2.164.2",
53
- "node-opcua-service-translate-browse-path": "2.164.0",
54
- "node-opcua-service-write": "2.164.0",
55
- "node-opcua-status-code": "2.164.0",
56
- "node-opcua-types": "2.164.0",
57
- "node-opcua-utils": "2.164.0",
58
- "node-opcua-variant": "2.164.0",
38
+ "node-opcua-pseudo-session": "2.165.0",
39
+ "node-opcua-schemas": "2.165.0",
40
+ "node-opcua-secure-channel": "2.165.0",
41
+ "node-opcua-service-browse": "2.165.0",
42
+ "node-opcua-service-call": "2.165.0",
43
+ "node-opcua-service-discovery": "2.165.0",
44
+ "node-opcua-service-endpoints": "2.165.0",
45
+ "node-opcua-service-filter": "2.165.0",
46
+ "node-opcua-service-history": "2.165.0",
47
+ "node-opcua-service-query": "2.165.0",
48
+ "node-opcua-service-read": "2.165.0",
49
+ "node-opcua-service-register-node": "2.165.0",
50
+ "node-opcua-service-secure-channel": "2.165.0",
51
+ "node-opcua-service-session": "2.165.0",
52
+ "node-opcua-service-subscription": "2.165.0",
53
+ "node-opcua-service-translate-browse-path": "2.165.0",
54
+ "node-opcua-service-write": "2.165.0",
55
+ "node-opcua-status-code": "2.165.0",
56
+ "node-opcua-types": "2.165.0",
57
+ "node-opcua-utils": "2.165.0",
58
+ "node-opcua-variant": "2.165.0",
59
59
  "thenify-ex": "4.4.0"
60
60
  },
61
61
  "devDependencies": {
62
62
  "dequeue": "^1.0.5",
63
- "node-opcua-address-space": "2.164.2",
64
- "node-opcua-binary-stream": "2.164.0",
65
- "node-opcua-factory": "2.164.0",
66
- "node-opcua-leak-detector": "2.164.0",
63
+ "node-opcua-address-space": "2.165.0",
64
+ "node-opcua-binary-stream": "2.165.0",
65
+ "node-opcua-factory": "2.165.0",
66
+ "node-opcua-leak-detector": "2.165.0",
67
67
  "node-opcua-nodesets": "2.163.1"
68
68
  },
69
69
  "eslintConfig": {
@@ -86,7 +86,7 @@
86
86
  "internet of things"
87
87
  ],
88
88
  "homepage": "http://node-opcua.github.io/",
89
- "gitHead": "eb76d34b885c7584785d8eff69ada66f95b55c2e",
89
+ "gitHead": "fe53ac03427fcb223996446c991f7496635ba193",
90
90
  "files": [
91
91
  "dist",
92
92
  "source"
package/source/verify.ts CHANGED
@@ -1,17 +1,12 @@
1
- import { OPCUACertificateManager } from "node-opcua-certificate-manager";
2
- import { OPCUASecureObject } from "node-opcua-common";
1
+ import type { OPCUACertificateManager } from "node-opcua-certificate-manager";
2
+ import type { OPCUASecureObject } from "node-opcua-common";
3
3
 
4
- import {
5
- Certificate,
6
- exploreCertificate,
7
- explorePrivateKey,
8
- publicKeyAndPrivateKeyMatches
9
- } from "node-opcua-crypto/web";
4
+ import { type Certificate, exploreCertificate, explorePrivateKey, publicKeyAndPrivateKeyMatches } from "node-opcua-crypto/web";
10
5
  import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
11
- import { VerifyCertificateOptions } from "node-opcua-pki";
6
+ import type { VerifyCertificateOptions } from "node-opcua-pki";
12
7
 
13
- const doDebug = checkDebugFlag(__filename);
14
- const debugLog = make_debugLog(__filename);
8
+ const _doDebug = checkDebugFlag(__filename);
9
+ const _debugLog = make_debugLog(__filename);
15
10
  const errorLog = make_errorLog(__filename);
16
11
  const warningLog = make_warningLog(__filename);
17
12
 
@@ -75,7 +70,7 @@ export function verifyIsOPCUAValidCertificate(
75
70
  }
76
71
  const keyUsage = certificateInfo.tbsCertificate.extensions?.keyUsage;
77
72
  if (!keyUsage) {
78
- warningLog(`[NODE-OPCUA-W15] The certificate keyUsage is missing\n` + `certificateFile = ${certificateFile}`);
73
+ warningLog(`[NODE-OPCUA-W15] The certificate keyUsage is missing\ncertificateFile = ${certificateFile}`);
79
74
  } else {
80
75
  // spec says that certificate shall include digitalSignature, nonRepudiation, keyEncipherment and dataEncipherment.
81
76
  // Other key uses are allowed.
@@ -90,7 +85,7 @@ export function verifyIsOPCUAValidCertificate(
90
85
  }
91
86
  const extKeyUsage = certificateInfo.tbsCertificate.extensions?.extKeyUsage;
92
87
  if (!extKeyUsage) {
93
- warningLog(`[NODE-OPCUA-W17] The certificate extKeyUsage is missing\n` + `certificateFile = ${certificateFile}`);
88
+ warningLog(`[NODE-OPCUA-W17] The certificate extKeyUsage is missing\ncertificateFile = ${certificateFile}`);
94
89
  } else {
95
90
  // spec says that certificate shall include digitalSignature, nonRepudiation, keyEncipherment and dataEncipherment.
96
91
  // Other key uses are allowed.
@@ -149,29 +144,21 @@ export async function performCertificateSanityCheck(
149
144
  `The ${serverOrClient} is operating at risk. `
150
145
  );
151
146
  }
152
- try {
153
- const _status1 = await certificateManager.trustCertificate(certificate);
154
- } catch (err: any) {
155
- if (err.code === "ENOENT" && err.syscall === "rename") {
156
- // Under heavily concurrent circumstances (e.g. 50 clients sharing the same CertificateManager connecting simultaneously),
157
- // a benign race condition occurs in node-opcua-pki's CertificateManager.trustCertificate where a client tries to rename
158
- // the missing (already trusted and thus renamed) rejected certificate. We can safely ignore this!
159
- debugLog("Swallowing benign ENOENT on concurrent trustCertificate");
160
- } else {
161
- throw err;
162
- }
163
- }
164
147
 
165
148
  const options: VerifyCertificateOptions = {
166
149
  acceptOutdatedCertificate: false,
167
150
  acceptOutDatedIssuerCertificate: false,
168
- acceptPendingCertificate: false,
151
+ acceptPendingCertificate: false
169
152
  };
170
153
 
171
154
  const status = await certificateManager.verifyCertificate(certificate, options);
172
155
 
173
- if (status !== "Good") {
174
- warningLog("[NODE-OPCUA-W04] Warning: the certificate status is = ", status, " file = ", secureObject.certificateFile);
156
+ // BadCertificateUntrusted is expected for the application's own
157
+ // certificate — it does not need to be in its own trust list.
158
+ // Only warn about genuinely problematic statuses (expired,
159
+ // revoked, invalid signature, etc.).
160
+ if (status !== "Good" && status !== "BadCertificateUntrusted") {
161
+ warningLog("[NODE-OPCUA-W35] Warning: the certificate status is = ", status, " file = ", secureObject.certificateFile);
175
162
  }
176
163
 
177
164
  verifyIsOPCUAValidCertificate(certificate, secureObject.certificateFile, serverOrClient, applicationUri);