node-opcua-server 2.75.0 → 2.76.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "node-opcua-server",
-    "version": "2.75.0",
+    "version": "2.76.0",
     "description": "pure nodejs OPCUA SDK - module -server",
     "scripts": {
         "build": "tsc -b",
@@ -13,63 +13,61 @@
     "types": "./dist/index.d.ts",
     "dependencies": {
         "@ster5/global-mutex": "^1.2.0",
-        "@types/underscore": "^1.11.4",
         "async": "^3.2.4",
+        "chalk": "4.1.2",
         "dequeue": "^1.0.5",
         "lodash": "4.17.21",
-        "node-opcua-address-space": "2.75.0",
-        "node-opcua-address-space-base": "2.75.0",
-        "node-opcua-assert": "2.74.0",
-        "node-opcua-basic-types": "2.74.0",
-        "node-opcua-binary-stream": "2.74.0",
-        "node-opcua-certificate-manager": "2.74.0",
-        "node-opcua-client": "2.75.0",
-        "node-opcua-client-dynamic-extension-object": "2.75.0",
-        "node-opcua-common": "2.75.0",
+        "node-opcua-address-space": "2.76.0",
+        "node-opcua-address-space-base": "2.76.0",
+        "node-opcua-assert": "2.76.0",
+        "node-opcua-basic-types": "2.76.0",
+        "node-opcua-binary-stream": "2.76.0",
+        "node-opcua-certificate-manager": "2.76.0",
+        "node-opcua-client": "2.76.0",
+        "node-opcua-client-dynamic-extension-object": "2.76.0",
+        "node-opcua-common": "2.76.0",
         "node-opcua-constants": "2.74.0",
         "node-opcua-crypto": "^1.11.0",
-        "node-opcua-data-access": "2.75.0",
-        "node-opcua-data-model": "2.75.0",
-        "node-opcua-data-value": "2.75.0",
-        "node-opcua-date-time": "2.74.0",
-        "node-opcua-debug": "2.74.0",
-        "node-opcua-enum": "2.74.0",
-        "node-opcua-extension-object": "2.75.0",
-        "node-opcua-factory": "2.75.0",
-        "node-opcua-hostname": "2.74.0",
-        "node-opcua-nodeid": "2.74.0",
-        "node-opcua-nodeset-ua": "2.75.0",
+        "node-opcua-data-access": "2.76.0",
+        "node-opcua-data-model": "2.76.0",
+        "node-opcua-data-value": "2.76.0",
+        "node-opcua-date-time": "2.76.0",
+        "node-opcua-debug": "2.76.0",
+        "node-opcua-extension-object": "2.76.0",
+        "node-opcua-factory": "2.76.0",
+        "node-opcua-hostname": "2.76.0",
+        "node-opcua-nodeid": "2.76.0",
         "node-opcua-nodesets": "2.74.0",
-        "node-opcua-numeric-range": "2.75.0",
-        "node-opcua-object-registry": "2.74.0",
-        "node-opcua-pki": "^2.17.0",
-        "node-opcua-secure-channel": "2.75.0",
-        "node-opcua-service-browse": "2.75.0",
-        "node-opcua-service-call": "2.75.0",
-        "node-opcua-service-discovery": "2.75.0",
-        "node-opcua-service-endpoints": "2.75.0",
-        "node-opcua-service-filter": "2.75.0",
-        "node-opcua-service-history": "2.75.0",
-        "node-opcua-service-node-management": "2.75.0",
-        "node-opcua-service-query": "2.75.0",
-        "node-opcua-service-read": "2.75.0",
-        "node-opcua-service-register-node": "2.75.0",
-        "node-opcua-service-secure-channel": "2.75.0",
-        "node-opcua-service-session": "2.75.0",
-        "node-opcua-service-subscription": "2.75.0",
-        "node-opcua-service-translate-browse-path": "2.75.0",
-        "node-opcua-service-write": "2.75.0",
-        "node-opcua-status-code": "2.74.0",
-        "node-opcua-transport": "2.75.0",
-        "node-opcua-types": "2.75.0",
-        "node-opcua-utils": "2.74.0",
-        "node-opcua-variant": "2.75.0"
+        "node-opcua-numeric-range": "2.76.0",
+        "node-opcua-object-registry": "2.76.0",
+        "node-opcua-secure-channel": "2.76.0",
+        "node-opcua-service-browse": "2.76.0",
+        "node-opcua-service-call": "2.76.0",
+        "node-opcua-service-discovery": "2.76.0",
+        "node-opcua-service-endpoints": "2.76.0",
+        "node-opcua-service-filter": "2.76.0",
+        "node-opcua-service-history": "2.76.0",
+        "node-opcua-service-node-management": "2.76.0",
+        "node-opcua-service-query": "2.76.0",
+        "node-opcua-service-read": "2.76.0",
+        "node-opcua-service-register-node": "2.76.0",
+        "node-opcua-service-secure-channel": "2.76.0",
+        "node-opcua-service-session": "2.76.0",
+        "node-opcua-service-subscription": "2.76.0",
+        "node-opcua-service-translate-browse-path": "2.76.0",
+        "node-opcua-service-write": "2.76.0",
+        "node-opcua-status-code": "2.76.0",
+        "node-opcua-types": "2.76.0",
+        "node-opcua-utils": "2.76.0",
+        "node-opcua-variant": "2.76.0",
+        "thenify": "^3.3.1"
     },
     "devDependencies": {
-        "node-opcua-leak-detector": "2.74.0",
+        "node-opcua-leak-detector": "2.76.0",
         "node-opcua-test-helpers": "2.74.0",
         "should": "^13.2.3",
-        "sinon": "^14.0.0"
+        "sinon": "^14.0.0",
+        "underscore": "^1.13.4"
     },
     "author": "Etienne Rossignon",
     "license": "MIT",
@@ -86,5 +84,5 @@
         "internet of things"
     ],
     "homepage": "http://node-opcua.github.io/",
-    "gitHead": "5ccb835ca480c2a8a591ae61b5949a9d8bad4017"
+    "gitHead": "75d9b8cf894c8fbadf77d2c4a48a730d055465e7"
 }

package/source/opcua_server.ts

@@ -1,3 +1,4 @@
+/* eslint-disable complexity */
 /**
  * @module node-opcua-server
  */
@@ -38,7 +39,8 @@ import {
     ISessionContext,
     UAView,
     EventTypeLike,
-    UAObjectType
+    UAObjectType,
+    PseudoVariantStringPredefined
 } from "node-opcua-address-space";
 import { getDefaultCertificateManager, OPCUACertificateManager } from "node-opcua-certificate-manager";
 import { ServerState } from "node-opcua-common";
@@ -146,13 +148,15 @@ import {
     MonitoredItemCreateResult,
     IssuedIdentityToken,
     BrowseResultOptions,
-    ServiceFault
+    ServiceFault,
+    ServerDiagnosticsSummaryDataType
 } from "node-opcua-types";
 import { DataType } from "node-opcua-variant";
 import { VariantArrayType } from "node-opcua-variant";
 import { matchUri } from "node-opcua-utils";
 
 import { UAString } from "node-opcua-basic-types";
+import { ObjectIds, ObjectTypeIds } from "node-opcua-constants";
 import { OPCUABaseServer, OPCUABaseServerOptions } from "./base_server";
 import { Factory } from "./factory";
 import { IRegisterServerManager } from "./i_register_server_manager";
@@ -262,11 +266,8 @@ async function _attempt_to_close_some_old_unactivated_session(server: OPCUAServe
 
 function getRequiredEndpointInfo(endpoint: EndpointDescription) {
     assert(endpoint instanceof EndpointDescription);
-    // It is recommended that Servers only include the server.applicationUri,  endpointUrl, securityMode,
-    // securityPolicyUri, userIdentityTokens, transportProfileUri and securityLevel with all
-    // other parameters set to null. Only the recommended parameters shall be verified by
-    // the client.
-
+    // https://reference.opcfoundation.org/v104/Core/docs/Part4/5.6.2/
+    // https://reference.opcfoundation.org/v105/Core/docs/Part4/5.6.2/
     const e = new EndpointDescription({
         endpointUrl: endpoint.endpointUrl,
         securityLevel: endpoint.securityLevel,
@@ -275,14 +276,13 @@ function getRequiredEndpointInfo(endpoint: EndpointDescription) {
         server: {
             applicationUri: endpoint.server.applicationUri,
             applicationType: endpoint.server.applicationType,
-            applicationName: endpoint.server.applicationName
-            // ... to be continued after verifying what fields are actually needed
+            applicationName: endpoint.server.applicationName,
+            productUri: endpoint.server.productUri
         },
         transportProfileUri: endpoint.transportProfileUri,
         userIdentityTokens: endpoint.userIdentityTokens
     });
     // reduce even further by explicitly setting unwanted members to null
-    e.server.productUri = null;
     e.server.applicationName = null as any;
     // xx e.server.applicationType = null as any;
     e.server.gatewayServerUri = null;
@@ -299,10 +299,8 @@ function getRequiredEndpointInfo(endpoint: EndpointDescription) {
 function _serverEndpointsForCreateSessionResponse(server: OPCUAServer, endpointUrl: string | null, serverUri: string | null) {
     serverUri = null; // unused then
 
-    // The Server shall return a set of EndpointDescriptions available for the serverUri specified in the request.
-    // It is recommended that Servers only include the endpointUrl, securityMode,
-    // securityPolicyUri, userIdentityTokens, transportProfileUri and securityLevel with all other parameters
-    // set to null. Only the recommended parameters shall be verified by the client.
+    // https://reference.opcfoundation.org/v104/Core/docs/Part4/5.6.2/
+    // https://reference.opcfoundation.org/v105/Core/docs/Part4/5.6.2/
     return server
         ._get_endpoints(endpointUrl)
         .filter((e) => !(e as any).restricted) // remove restricted endpoints
@@ -1356,6 +1354,19 @@ export class OPCUAServer extends OPCUABaseServer {
         }
     }
 
+    public raiseEvent(eventType: "AuditSessionEventType", options: RaiseEventAuditSessionEventData): void;
+    public raiseEvent(eventType: "AuditCreateSessionEventType", options: RaiseEventAuditCreateSessionEventData): void;
+    public raiseEvent(eventType: "AuditActivateSessionEventType", options: RaiseEventAuditActivateSessionEventData): void;
+    public raiseEvent(eventType: "AuditCreateSessionEventType", options: RaiseEventData): void;
+    public raiseEvent(eventType: "AuditConditionCommentEventType", options: RaiseEventAuditConditionCommentEventData): void;
+    public raiseEvent(eventType: "AuditUrlMismatchEventType", options: RaiseEventAuditUrlMismatchEventTypeData): void;
+    public raiseEvent(eventType: "TransitionEventType", options: RaiseEventTransitionEventData): void;
+    public raiseEvent(eventType: "AuditCertificateInvalidEventType", options: RaiseAuditCertificateInvalidEventData): void;
+    public raiseEvent(eventType: "AuditCertificateExpiredEventType", options: RaiseAuditCertificateExpiredEventData): void;
+    public raiseEvent(eventType: "AuditCertificateUntrustedEventType", options: RaiseAuditCertificateUntrustedEventData): void;
+    public raiseEvent(eventType: "AuditCertificateRevokedEventType", options: RaiseAuditCertificateRevokedEventData): void;
+    public raiseEvent(eventType: "AuditCertificateMismatchEventType", options: RaiseAuditCertificateMismatchEventData): void;
+
     public raiseEvent(eventType: EventTypeLike | UAObjectType, options: RaiseEventData): void {
         /* istanbul ignore next */
         if (!this.engine.addressSpace) {
@@ -1496,6 +1507,8 @@ export class OPCUAServer extends OPCUABaseServer {
         }
 
         if (!userTokenSignature || !userTokenSignature.signature) {
+            this.raiseEvent("AuditCreateSessionEventType", {});
+
             return callback(null, StatusCodes.BadUserSignatureInvalid);
         }
 
@@ -1525,6 +1538,45 @@ export class OPCUAServer extends OPCUABaseServer {
             if (err) {
                 return callback(err);
             }
+            if (this.isAuditing) {
+                switch (certificateStatus) {
+                    case StatusCodes.Good:
+                        break;
+                    case StatusCodes.BadCertificateUntrusted:
+                        this.raiseEvent("AuditCertificateUntrustedEventType", {
+                            certificate: { dataType: DataType.ByteString, value: certificate },
+                            sourceName: { dataType: DataType.String, value: "Security/Certificate" }
+                        });
+                        break;
+                    case StatusCodes.BadCertificateTimeInvalid:
+                    case StatusCodes.BadCertificateIssuerTimeInvalid:
+                        this.raiseEvent("AuditCertificateExpiredEventType", {
+                            certificate: { dataType: DataType.ByteString, value: certificate },
+                            sourceName: { dataType: DataType.String, value: "Security/Certificate" },
+                            comment: { dataType: DataType.String, value: certificateStatus.toString() }
+                        });
+                        break;
+                    case StatusCodes.BadCertificateRevoked:
+                    case StatusCodes.BadCertificateRevocationUnknown:
+                    case StatusCodes.BadCertificateIssuerRevocationUnknown:
+                        this.raiseEvent("AuditCertificateRevokedEventType", {
+                            certificate: { dataType: DataType.ByteString, value: certificate },
+                            sourceName: { dataType: DataType.String, value: "Security/Certificate" },
+                            comment: { dataType: DataType.String, value: certificateStatus.toString() }
+                        });
+                        break;
+                    case StatusCodes.BadCertificateIssuerUseNotAllowed:
+                    case StatusCodes.BadCertificateUseNotAllowed:
+                    case StatusCodes.BadSecurityChecksFailed:
+                        this.raiseEvent("AuditCertificateMismatchEventType", {
+                            certificate: { dataType: DataType.ByteString, value: certificate },
+                            sourceName: { dataType: DataType.String, value: "Security/Certificate" },
+                            comment: { dataType: DataType.String, value: certificateStatus.toString() }
+                        });
+                        break;
+                    
+                }
+            }
             if (
                 StatusCodes.BadCertificateUntrusted === certificateStatus ||
                 StatusCodes.BadCertificateTimeInvalid === certificateStatus ||
@@ -1538,6 +1590,7 @@ export class OPCUAServer extends OPCUABaseServer {
                 StatusCodes.Good !== certificateStatus
             ) {
                 debugLog("isValidX509IdentityToken => certificateStatus = ", certificateStatus?.toString());
+
                 return callback(null, StatusCodes.BadIdentityTokenRejected);
             }
             if (StatusCodes.Good !== certificateStatus) {
@@ -3642,6 +3695,87 @@ export interface RaiseEventTransitionEventData extends RaiseEventData {}
 export interface RaiseEventAuditUrlMismatchEventTypeData extends RaiseEventData {
     endpointUrl: PseudoVariantString;
 }
+
+/**
+ * The SourceName for Events of this type shall be “Security/Certificate”.
+ */
+export interface RaiseAuditCertificateEventData extends RaiseEventData {
+    certificate: PseudoVariantByteString;
+    sourceName: PseudoVariantStringPredefined<"Security/Certificate">;
+}
+
+/**
+ * This EventType inherits all Properties of the AuditCertificateEventType.
+ * Either the InvalidHostname or InvalidUri shall be provided.
+ */
+export interface RaiseAuditCertificateDataMismatchEventData extends RaiseAuditCertificateEventData {
+    /**
+     * InvalidHostname is the string that represents the host name passed in as part of the URL
+     * that is found to be invalid. If the host name was not invalid it can be null.
+     */
+    invalidHostname: PseudoVariantString;
+    /*
+     * InvalidUri is the URI that was passed in and found to not match what is contained in
+     * the certificate. If the URI was not invalid it can be null.
+     */
+    invalidUri: PseudoVariantString;
+}
+export interface RaiseAuditCertificateUntrustedEventData extends RaiseAuditCertificateEventData {}
+/**
+ * This EventType inherits all Properties of the AuditCertificateEventType.
+ *
+ * The SourceName for Events of this type shall be “Security/Certificate”.
+ *
+ * The Message Variable shall include a description of why the certificate was expired
+ * (i.e. time before start or time after end).
+ *
+ * There are no additional Properties defined for this EventType.
+ *
+ */
+export interface RaiseAuditCertificateExpiredEventData extends RaiseAuditCertificateEventData {}
+/**
+ * This EventType inherits all Properties of the AuditCertificateEventType.
+ *
+ * The SourceName for Events of this type shall be “Security/Certificate”.
+ *
+ * The Message shall include a description of why the certificate is invalid.
+ *
+ * There are no additional Properties defined for this EventType.
+ */
+export interface RaiseAuditCertificateInvalidEventData extends RaiseAuditCertificateEventData {}
+/**
+ * This EventType inherits all Properties of the AuditCertificateEventType.
+ *
+ * The SourceName for Events of this type shall be “Security/Certificate”.
+ *
+ * The Message Variable shall include a description of why the certificate is not trusted.
+ * If a trust chain is involved then the certificate that failed in the trust chain should be described.
+ * There are no additional Properties defined for this EventType.
+ */
+export interface RaiseAuditCertificateUntrustedEventData extends RaiseAuditCertificateEventData {}
+/**
+ * This EventType inherits all Properties of the AuditCertificateEventType.
+ *
+ * The SourceName for Events of this type shall be “Security/Certificate”.
+ *
+ * The Message Variable shall include a description of why the certificate is revoked
+ * (was the revocation list unavailable or was the certificate on the list).
+ *
+ *  There are no additional Properties defined for this EventType.
+ */
+export interface RaiseAuditCertificateRevokedEventData extends RaiseAuditCertificateEventData {
+    sourceName: PseudoVariantStringPredefined<"Security/Certificate">;
+}
+/**
+ * This EventType inherits all Properties of the AuditCertificateEventType.
+ *
+ * The SourceName for Events of this type shall be “Security/Certificate”.
+ *
+ * The Message Variable shall include a description of misuse of the certificate.
+ *
+ * There are no additional Properties defined for this EventType
+ */
+export interface RaiseAuditCertificateMismatchEventData extends RaiseAuditCertificateEventData {}
 export interface OPCUAServer {
     /**
      * @internal
@@ -3661,6 +3795,12 @@ export interface OPCUAServer {
     raiseEvent(eventType: "AuditUrlMismatchEventType", options: RaiseEventAuditUrlMismatchEventTypeData): void;
 
     raiseEvent(eventType: "TransitionEventType", options: RaiseEventTransitionEventData): void;
+
+    raiseEvent(eventType: "AuditCertificateInvalidEventType", options: RaiseAuditCertificateInvalidEventData): void;
+    raiseEvent(eventType: "AuditCertificateExpiredEventType", options: RaiseAuditCertificateExpiredEventData): void;
+    raiseEvent(eventType: "AuditCertificateUntrustedEventType", options: RaiseAuditCertificateUntrustedEventData): void;
+    raiseEvent(eventType: "AuditCertificateRevokedEventType", options: RaiseAuditCertificateRevokedEventData): void;
+    raiseEvent(eventType: "AuditCertificateMismatchEventType", options: RaiseAuditCertificateMismatchEventData): void;
 }
 
 export interface OPCUAServer extends EventEmitter {