async-opcua-core 0.19.0

//! These tests are specifically testing secure channel behaviour of signing, encrypting, decrypting and verifying
//! chunks containing messages

use opcua_crypto::SecurityPolicy;
use tracing::{error, trace};

use crate::{
    comms::{chunker::*, secure_channel::*, sequence_number::SequenceNumberHandle},
    tests::*,
    Message,
};

fn test_symmetric_encrypt_decrypt(
    message: impl Message + PartialEq + Debug,
    security_mode: MessageSecurityMode,
    security_policy: SecurityPolicy,
) {
    let (secure_channel1, secure_channel2) = make_secure_channels(security_mode, security_policy);

    let mut chunks = Chunker::encode(
        SequenceNumberHandle::new(true),
        1,
        0,
        0,
        &secure_channel1,
        &message,
    )
    .unwrap();
    assert_eq!(chunks.len(), 1);

    {
        let chunk = &mut chunks[0];

        let mut encrypted_data = vec![0u8; chunk.data.len() + 4096];
        let encrypted_size = secure_channel1
            .apply_security(chunk, &mut encrypted_data[..])
            .unwrap();
        trace!("Result of applying security = {}", encrypted_size);

        // Decrypted message should identical to original with same length and
        // no signature or padding
        let chunk2 = secure_channel2
            .verify_and_remove_security(encrypted_data[..encrypted_size].to_vec().into())
            .unwrap();

        assert_eq!(&chunk.data, &chunk2.data);
    }

    let message2 = Chunker::decode(&chunks, &secure_channel2, None).unwrap();
    assert_eq!(message, message2);
}

fn test_asymmetric_encrypt_decrypt(
    message: impl Message + PartialEq + Debug,
    security_mode: MessageSecurityMode,
    security_policy: SecurityPolicy,
) {
    // Do the test twice using a large key to a small key and vice versa so any issues with padding,
    // extra padding are caught in both directions.
    for i in 0..2 {
        // Create a cert and private key pretending to be us and them. Keysizes are different to shake out issues with
        // signature lengths. Encrypting key will be 4096 bits to test extra padding functionality.
        let (our_cert, our_key) = if i == 0 {
            make_test_cert_4096()
        } else {
            make_test_cert_2048()
        };
        //    let (our_cert, our_key) = make_test_cert_1024();
        let (their_cert, their_key) = if i == 0 {
            make_test_cert_2048()
        } else {
            make_test_cert_4096()
        };

        let mut secure_channel = SecureChannel::new_no_certificate_store();
        secure_channel.set_security_mode(security_mode);
        secure_channel.set_security_policy(security_policy);

        // First we shall sign with our private key and encrypt with their public.
        secure_channel.set_cert(Some(our_cert));
        secure_channel.set_remote_cert(Some(their_cert));
        secure_channel.set_private_key(Some(our_key));

        let mut chunks = Chunker::encode(
            SequenceNumberHandle::new(true),
            1,
            0,
            0,
            &secure_channel,
            &message,
        )
        .unwrap();
        assert_eq!(chunks.len(), 1);

        let chunk = &mut chunks[0];

        let mut encrypted_data = vec![0u8; chunk.data.len() + 4096];
        let encrypted_size = secure_channel
            .apply_security(chunk, &mut encrypted_data[..])
            .unwrap();
        trace!("Result of applying security = {}", encrypted_size);

        // Now we shall try to decrypt what has been encrypted by flipping the keys around
        let tmp = secure_channel.cert();
        let remote_cert = secure_channel.remote_cert();
        secure_channel.set_cert(remote_cert);
        secure_channel.set_remote_cert(tmp);
        secure_channel.set_private_key(Some(their_key));

        // Compare up to original length
        let chunk2 = secure_channel
            .verify_and_remove_security(encrypted_data[..encrypted_size].to_vec().into())
            .unwrap();
        assert_eq!(chunk.data.len(), chunk2.data.len());
        assert_eq!(&chunk.data, &chunk2.data);
    }
}

//

#[test]
#[cfg(not(coverage))]
fn asymmetric_sign_and_encrypt_message_chunk_basic128rsa15() {
    use crate::ResponseMessage;

    let _ = Test::setup();
    error!("asymmetric_sign_and_encrypt_message_chunk_basic128rsa15");
    let m: ResponseMessage = make_open_secure_channel_response().into();
    test_asymmetric_encrypt_decrypt(
        m,
        MessageSecurityMode::SignAndEncrypt,
        SecurityPolicy::Basic128Rsa15,
    );
}

#[test]
#[cfg(not(coverage))]
fn asymmetric_sign_and_encrypt_message_chunk_basic256() {
    use crate::ResponseMessage;

    let _ = Test::setup();
    error!("asymmetric_sign_and_encrypt_message_chunk_basic256");
    let m: ResponseMessage = make_open_secure_channel_response().into();
    test_asymmetric_encrypt_decrypt(
        m,
        MessageSecurityMode::SignAndEncrypt,
        SecurityPolicy::Basic256,
    );
}

#[test]
#[cfg(not(coverage))]
fn asymmetric_sign_and_encrypt_message_chunk_basic256sha256() {
    use crate::ResponseMessage;

    let _ = Test::setup();
    error!("asymmetric_sign_and_encrypt_message_chunk_basic256sha256");
    let m: ResponseMessage = make_open_secure_channel_response().into();
    test_asymmetric_encrypt_decrypt(
        m,
        MessageSecurityMode::SignAndEncrypt,
        SecurityPolicy::Basic256Sha256,
    );
}

/// Create a message, encode it to a chunk, sign the chunk, verify the signature and decode back to message
#[test]
fn symmetric_sign_message_chunk_basic128rsa15() {
    let _ = Test::setup();
    error!("symmetric_sign_message_chunk_basic128rsa15");
    test_symmetric_encrypt_decrypt(
        make_sample_message(),
        MessageSecurityMode::Sign,
        SecurityPolicy::Basic128Rsa15,
    );
}

#[test]
fn symmetric_sign_message_chunk_basic256() {
    let _ = Test::setup();
    error!("symmetric_sign_message_chunk_basic256");
    test_symmetric_encrypt_decrypt(
        make_sample_message(),
        MessageSecurityMode::Sign,
        SecurityPolicy::Basic256,
    );
}

#[test]
fn symmetric_sign_message_chunk_basic256sha256() {
    let _ = Test::setup();
    error!("symmetric_sign_message_chunk_basic256sha256");
    test_symmetric_encrypt_decrypt(
        make_sample_message(),
        MessageSecurityMode::Sign,
        SecurityPolicy::Basic256Sha256,
    );
}

/// Create a message, encode it to a chunk, sign the chunk, encrypt, decrypt, verify the signature and decode back to message
#[test]
fn symmetric_sign_and_encrypt_message_chunk_basic128rsa15() {
    let _ = Test::setup();
    error!("symmetric_sign_and_encrypt_message_chunk_basic128rsa15");
    test_symmetric_encrypt_decrypt(
        make_sample_message(),
        MessageSecurityMode::SignAndEncrypt,
        SecurityPolicy::Basic128Rsa15,
    );
}

/// Create a message, encode it to a chunk, sign the chunk, encrypt, decrypt, verify the signature and decode back to message
#[test]
fn symmetric_sign_and_encrypt_message_chunk_basic256() {
    let _ = Test::setup();
    error!("symmetric_sign_and_encrypt_message_chunk_basic256");
    test_symmetric_encrypt_decrypt(
        make_sample_message(),
        MessageSecurityMode::SignAndEncrypt,
        SecurityPolicy::Basic256,
    );
}

/// Create a message, encode it to a chunk, sign the chunk, encrypt, decrypt, verify the signature and decode back to message
#[test]
fn symmetric_sign_and_encrypt_message_chunk_basic256sha256() {
    let _ = Test::setup();
    error!("symmetric_sign_and_encrypt_message_chunk_basic256sha256");
    test_symmetric_encrypt_decrypt(
        make_sample_message(),
        MessageSecurityMode::SignAndEncrypt,
        SecurityPolicy::Basic256Sha256,
    );
}