Sender certificate shall be ignored in CreateSessionRequest for channel with SecurityPolicy None

[phuong-nm]

Description

In the "OPC UA Specification Part 4 V1.04, Section 5.6.2.2" it is stated that "If the securityPolicyUri is None, the Server shall ignore the
ApplicationInstanceCertificate".

Background Information / Reproduction Steps

• OPC Compliance Test Tool V1.04.506, test case 012 of Session Services / Session Base conformance unit. In this test a secure channel with SecurityPolicy None is created, following by a CreateSessionRequest with an invalid sender certificate which does not match ApplicationURI of the sender. According to the specification, verification of the sender certificate shall be ignored by the server.
• See also: https://opcfoundation.org/forum/opc-ua-standard/shall-server-reject-a-createsessionrequest-with-badly-formatted-applicationinstancecertificate-for-channel-with-securitypolicynone/#p5146

Suggested solution

/*
* File: src/server/ua_services_session.c
*/

void
Service_CreateSession(UA_Server *server, UA_SecureChannel *channel,
                      const UA_CreateSessionRequest *request,
                      UA_CreateSessionResponse *response) {

    /* ... */

    if(!UA_ByteString_equal(&channel->securityPolicy->policyUri,
                            &UA_SECURITY_POLICY_NONE_URI) &&
       request->clientNonce.length < 32) {
        response->responseHeader.serviceResult = UA_STATUSCODE_BADNONCEINVALID;
        return;
    }

    /*** Hilscher ***/
    /* "If the securityPolicyUri is None, the Server shall ignore the ApplicationInstanceCertificate".
     * See: "OPC UA Specification Part 4 V1.04, Section 5.6.2.2". */
    if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGN ||
       channel->securityMode == UA_MESSAGESECURITYMODE_SIGNANDENCRYPT) {
        if(request->clientCertificate.length > 0) {
            UA_CertificateVerification *cv = &server->config.certificateVerification;
            response->responseHeader.serviceResult =
                cv->verifyApplicationURI(cv->context, &request->clientCertificate,
                                        &request->clientDescription.applicationUri);
            if(response->responseHeader.serviceResult != UA_STATUSCODE_GOOD) {
                UA_LOG_WARNING_CHANNEL(&server->config.logger, channel,
                                    "The client's ApplicationURI did not match the certificate");
                server->serverDiagnosticsSummary.securityRejectedSessionCount++;
                server->serverDiagnosticsSummary.rejectedSessionCount++;
                return;
            }
        }
    }
    /*** Hilscher ***/

    /* ... */
}

Checklist

Please provide the following information:

• open62541 Version (release number or git tag): V1.3.6
• Other OPC UA SDKs used (client or server):
• Operating system:
• Logs (with UA_LOGLEVEL set as low as necessary) attached
• Wireshark network dump attached
• Self-contained code example attached
• Critical issue: Conformance Test failed