View Issue Details

IDProjectCategoryView StatusLast Update
0008318CTT UA Scripts1 - Script Issuepublic2023-05-12 14:44
ReporterMartin Herberg Assigned ToAlexander Allmendinger  
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionno change required 
Summary0008318: Security None / 007.js: Incorrect number of secure channel closures
Description

In the .js script (n-1) secure channels with sessions are opened, where n is the maximum number of supported secure channels. After 5 secure channels are opened, without any sessions. It is checked if at least the 5th is still open at the end of this test. The other 4 might be already deleted by the server.

The script not only removed the 4 sessions, which might be deleted, it removes 5 (for ( i = ( channels.length - 6 ); i < ( channels.length - 1 ); i++ ) ). This leads to a crash, if only one secure channel is supported. This is allowed in the Nano Profile.

The following lines should be updated, replacing both "6" by "5".

    // close all channels that did not have a session; all except the last should fail with BadSecureChannelIdInvalid
    addLog( &quot;Step 4: Remove all remaining SecureChannels, all-but-one should fail; the last channel should delete successfully.&quot; );
    for ( i = ( channels.length - 6 ); i &lt; ( channels.length - 1 ); i++ ) if ( !CloseSecureChannelHelper.Execute( { Channel: channels[i], ServiceResult: new ExpectedAndAcceptedResults( [StatusCode.BadSecureChannelIdInvalid, StatusCode.BadInvalidState], StatusCode.Good ) } ) ) result = false;
    if ( !CloseSecureChannelHelper.Execute( { Channel: channels[( channels.length - 1 )], ServiceResult: new ExpectedResults( { Expected: [StatusCode.Good] } ) } ) ) result = false;
    for ( i = 0; i &lt; ( channels.length - 6 ); i++ ) if ( !CloseSecureChannelHelper.Execute( { Channel: channels[i], ServiceResult: new ExpectedAndAcceptedResults( StatusCode.Good ) } ) ) result = false;
TagsNo tags attached.
Files Affected

Activities

Alexander Allmendinger

2023-05-03 08:43

developer   ~0019270

The specification describes that every OPC UA Server needs to support one more SecureChannel than Sessions. For a Nano Server the requirements are then 1 Session -> 2 SecureChannels in which case the script works fine.

For details regarding the SecureChannel requirement check this mantis:
https://mantis.opcfoundation.org/view.php?id=7497

Paul Hunkar

2023-05-12 14:44

administrator   ~0019350

reviewed in call - agree no change required - closed issue

Issue History

Date Modified Username Field Change
2022-09-12 13:19 Martin Herberg New Issue
2023-01-26 16:53 Paul Hunkar Assigned To => Alexander Allmendinger
2023-01-26 16:53 Paul Hunkar Status new => assigned
2023-01-26 16:53 Paul Hunkar Project Compliance Test Tool (CTT) Unified Architecture => CTT UA Scripts
2023-05-03 08:43 Alexander Allmendinger Status assigned => resolved
2023-05-03 08:43 Alexander Allmendinger Resolution open => no change required
2023-05-03 08:43 Alexander Allmendinger Note Added: 0019270
2023-05-12 14:44 Paul Hunkar Status resolved => closed
2023-05-12 14:44 Paul Hunkar Note Added: 0019350