Access control

See merge request nexedi/osie!11

coupler/opc-ua-server/server.c

@@ -22,6 +22,7 @@
 #include <signal.h>
 #include "open62541.h"
 #include <argp.h>
+#include <string.h>
 
 // The default port of OPC-UA server
 const int DEFAULT_OPC_UA_PORT = 4840;
@@ -38,6 +39,8 @@ static struct argp_option options[] = {
     { "slave-address-list", 's', "0x58", 0, "Comma separated list of slave I2C addresses."},
     { "mode", 'm', "0", 0, "Set different modes of operation of coupler. Default (0) is set attached \
 	                  I2C's state state. Virtual (1) which does NOT set any I2C slaves' state."},
+    { "username", 'u', "", 0, "Username."},
+    { "password", 'w', "", 0, "Password."},
     { 0 } 
 };
 
@@ -46,6 +49,8 @@ struct arguments {
     int  port;
     char *device;
     char *slave_address_list;
+    char *username;
+    char *password;
 };
 
 static error_t parse_opt(int key, char *arg, struct argp_state *state) {
@@ -53,19 +58,22 @@ static error_t parse_opt(int key, char *arg, struct argp_state *state) {
     switch (key) {
     case 'p': 
 	    arguments->port = arg ? atoi (arg) : DEFAULT_OPC_UA_PORT; 
-	    //printf("got arg port=%s\n", arg);
 	    break;
     case 'd': 
 	    arguments->device = arg; 
-	    //printf("got arg device=%s\n", arg);
 	    break;
     case 's': 
 	    arguments->slave_address_list = arg; 
-	    //printf("got arg slave_address_list=%s\n", arg);
 	    break;
     case 'm': 
 	    arguments->mode = arg ? atoi (arg) : DEFAULT_MODE; 
 	    break;
+    case 'u': 
+	    arguments->username = arg; 
+	    break;
+    case 'w': 
+	    arguments->password = arg; 
+	    break;   
     case ARGP_KEY_ARG: 
 	    return 0;
     default: 
@@ -457,6 +465,8 @@ int main(int argc, char **argv) {
     arguments.mode = DEFAULT_MODE;
     arguments.device = DEFAULT_I2C_BLOCK_DEVICE_NAME;
     arguments.slave_address_list = DEFAULT_I2C_0_ADDR;
+    arguments.username = "";
+    arguments.password = "";
     argp_parse(&argp, argc, argv, 0, 0, &arguments);
     printf("Mode=%d\n", arguments.mode);
     printf("Listening port=%d\n", arguments.port);
@@ -489,11 +499,24 @@ int main(int argc, char **argv) {
     UA_ServerConfig* config = UA_Server_getConfig(server);
     config->verifyRequestTimestamp = UA_RULEHANDLING_ACCEPT;
 
+    // add variables representing physical relarys / inputs, etc
     addVariable(server);
     addValueCallbackToCurrentTimeVariable(server);
 
+    /* Disable anonymous logins, enable two user/password logins */
+    if (strlen(arguments.username) > 0 && strlen(arguments.password) > 0){
+      char *username = arguments.username;
+      char *password = arguments.password;
+      UA_UsernamePasswordLogin logins[1] = {
+          {UA_STRING(arguments.username), UA_STRING(arguments.password)},
+      };
+
+      config->accessControl.clear(&config->accessControl);
+      UA_StatusCode retval1 = UA_AccessControl_default(config, false, NULL,
+               &config->securityPolicies[config->securityPoliciesSize-1].policyUri, 1, logins);
+    }
+    // run server
     UA_StatusCode retval = UA_Server_run(server, &running);
-
     UA_Server_delete(server);
 
     // always leave attached slaves to a known safe shutdown state

slapos/software/osie-coupler/buildout.hash.cfg

@@ -3,7 +3,7 @@ filename = instance-modbus.cfg.in
 md5sum = 8637c6b714a0bb9f27c86f3928049b98
 
 filename = instance-opc-ua.cfg.in
-md5sum = b6cf47dc85a0c1086cca5e3edcf969ab
+md5sum = 38e19f425129df64066f34e5ac06f5dd
 
 filename = instance-opc-ua-virtual.cfg.in
-md5sum = 49f84a499d258771651983dec90e98c1
+md5sum = 6277def85d4b602bba40c868e2daa779

slapos/software/osie-coupler/instance-opc-ua-virtual.cfg.in

@@ -21,7 +21,7 @@ extends = {{ template_monitor }}
 recipe = slapos.cookbook:wrapper
 # start with defaults
 command-line =
-    {{ buildout['bin-directory'] }}/server -d ${instance-parameter:configuration.coupler_block_device} -s ${instance-parameter:configuration.coupler_i2c_slave_list} -m 1 -p ${instance-parameter:configuration.opc_ua_port}
+    {{ buildout['bin-directory'] }}/server -d ${instance-parameter:configuration.coupler_block_device} -s ${instance-parameter:configuration.coupler_i2c_slave_list} -m 1 -p ${instance-parameter:configuration.opc_ua_port} -u ${instance-parameter:username} -w ${instance-parameter:password}
 
 wrapper-path = ${directory:service}/coupler-opc-ua-virtual
 
@@ -49,6 +49,8 @@ configuration.coupler_i2c_slave_list = 0x58
 # In our use case, we are expecting from the user to specify one (optional) parameter: "name". We put the default value here if he doesn't specify it, so that it doesn't crash.
 configuration.interface = 0.0.0.0
 configuration.opc_ua_port = 4840
+configuration.username = 
+configuration.password =
 # If our use case requires that the user can specify a mail address so that his instance can mail to him (for example), we can do:
 # configuration.mail-address =
 # If the user doesn't specify it, it won't break and the recipe can handle it (i.e don't send any mail for example).

slapos/software/osie-coupler/instance-opc-ua.cfg.in

@@ -21,7 +21,7 @@ extends = {{ template_monitor }}
 recipe = slapos.cookbook:wrapper
 # start with defaults
 command-line =
-    {{ buildout['bin-directory'] }}/server -d ${instance-parameter:configuration.coupler_block_device} -s ${instance-parameter:configuration.coupler_i2c_slave_list} -p ${instance-parameter:configuration.opc_ua_port}
+    {{ buildout['bin-directory'] }}/server -d ${instance-parameter:configuration.coupler_block_device} -s ${instance-parameter:configuration.coupler_i2c_slave_list} -p ${instance-parameter:configuration.opc_ua_port} -u ${instance-parameter:username} -w ${instance-parameter:password}
 
 wrapper-path = ${directory:service}/coupler-opc-ua
 
@@ -42,6 +42,8 @@ cert = ${slap-connection:cert-file}
 
 configuration.coupler_block_device = /dev/i2c-1
 configuration.coupler_i2c_slave_list = 0x58
+configuration.username =
+configuration.password =
 
 # Define default parameter(s) that will be used later, in case user didn't
 # specify it.