fix connecting to new prosys opcua server (#1827)

* make prosys accept our certificate again in examples

* allow to send certificate without encryption or user identification as prosys now requires.
Had to fix a few new bugs that sudently appeared...

* clean imports

* remove leftover prints, less verbose when renaming struct

* remove unused variable

---------

Co-authored-by: Olivier <olivier@helitech>

Author: oroulet

asyncua/client/client.py

@@ -2,12 +2,13 @@
 import logging
 import socket
 import dataclasses
-from cryptography import x509
-from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
 from typing import Any, Dict, Iterable, List, Optional, Sequence, Tuple, Type, Union, cast, Callable, Coroutine
 from urllib.parse import urlparse, unquote, ParseResult
 from pathlib import Path
 
+from cryptography import x509
+from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
+
 import asyncua
 from asyncua import ua
 from .ua_client import UaClient
@@ -65,9 +66,9 @@ def __init__(self, url: str, timeout: float = 4, watchdog_intervall: float = 1.0
             if have_password:
                 self._password = unquote(password)
 
-        self.name = "Pure Python Async. Client"
+        self.name = "Pure Python Async Client"
         self.description = self.name
-        self.application_uri = "urn:freeopcua:client"
+        self.application_uri = "urn:example.org:FreeOpcUa:opcua-asyncio"
         self.product_uri = "urn:freeopcua.github.io:client"
         self.security_policy = security_policies.SecurityPolicyNone()
         self.secure_channel_id = None
@@ -497,10 +498,16 @@ async def create_session(self) -> ua.CreateSessionResult:
         desc.ApplicationName = ua.LocalizedText(self.name)
         desc.ApplicationType = ua.ApplicationType.Client
         params = ua.CreateSessionParameters()
+        params.ServerUri = f"urn:{self.server_url.hostname}{self.server_url.path.replace('/', ':')}"
         # at least 32 random bytes for server to prove possession of private key (specs part 4, 5.6.2.2)
         nonce = create_nonce(32)
         params.ClientNonce = nonce
-        params.ClientCertificate = self.security_policy.host_certificate
+        if self.security_policy.host_certificate:
+            params.ClientCertificate = self.security_policy.host_certificate
+        elif self.user_certificate:
+            params.ClientCertificate = uacrypto.der_from_x509(self.user_certificate)
+        else:
+            params.ClientCertificate = None
         params.ClientDescription = desc
         params.EndpointUrl = self.server_url.geturl()
         params.SessionName = f"{self.description} Session{self._session_counter}"
@@ -639,7 +646,7 @@ async def activate_session(
         """
         Activate session using either username and password or private_key
         """
-        user_certificate = certificate or self.user_certificate
+        user_certificate = certificate
         params = ua.ActivateSessionParameters()
         challenge = b""
         if self.security_policy.peer_certificate is not None:
@@ -652,7 +659,7 @@ async def activate_session(
             params.ClientSignature.Algorithm = security_policies.SecurityPolicyBasic256.AsymmetricSignatureURI
         params.ClientSignature.Signature = self.security_policy.asymmetric_cryptography.signature(challenge)
         params.LocaleIds = self._locale
-        if not username and not user_certificate:
+        if not username and not (user_certificate and self.user_private_key):
             self._add_anonymous_auth(params)
         elif user_certificate:
             self._add_certificate_auth(params, user_certificate, challenge)

asyncua/client/ua_file_transfer.py

@@ -219,7 +219,6 @@ async def create_file(self, file_name: str, request_file_open: bool) -> Tuple[No
         and shall be ignored by the caller.
         """
         _logger.debug("Request to create file %s in %s", file_name, self._directory_node)
-        print(f"Request to create file {file_name} in {self._directory_node}")
         create_file_node = await self._directory_node.get_child("CreateFile")
         arg1_file_name = Variant(file_name, VariantType.String)
         arg2_request_file_open = Variant(request_file_open, VariantType.Boolean)

asyncua/common/structures104.py

@@ -132,7 +132,7 @@ def clean_name(name):
         return name
     newname = re.sub(r"\W+", "_", name)
     newname = re.sub(r"^[0-9]+", r"_\g<0>", newname)
-    _logger.warning("renamed %s to %s due to Python syntax", name, newname)
+    _logger.info("renamed %s to %s due to Python syntax", name, newname)
     return newname
 
 
@@ -363,7 +363,8 @@ def __add_recursion(sdef, desc):
             if parent_sdef:
                 for sfield in reversed(parent_sdef.Fields):
                     sdef.Fields.insert(0, sfield)
-            dtypes.append(DataTypeSorter(desc.NodeId, name, desc, sdef))
+            if isinstance(sdef, ua.StructureDefinition):
+                dtypes.append(DataTypeSorter(desc.NodeId, name, desc, sdef))
             return _recursive_parse(
                 server,
                 server.get_node(desc.NodeId),

asyncua/crypto/permission_rules.py

@@ -1,5 +1,8 @@
+from enum import Enum
+from dataclasses import dataclass
+from typing import Optional
+
 from asyncua import ua
-from asyncua.server.users import UserRole
 
 ADMIN_TYPES = [
     ua.ObjectIds.RegisterServerRequest_Encoding_DefaultBinary,
@@ -37,6 +40,22 @@
 ]
 
 
+class UserRole(Enum):
+    """
+    User Roles
+    """
+
+    Admin = 0
+    Anonymous = 1
+    User = 3
+
+
+@dataclass
+class User:
+    role: UserRole = UserRole.Anonymous
+    name: Optional[str] = None
+
+
 class PermissionRuleset:
     """
     Base class for permission ruleset

asyncua/crypto/truststore.py

@@ -139,9 +139,8 @@ def is_trusted(self, certificate: x509.Certificate) -> bool:
             store_ctx.verify_certificate()
             _logger.debug("Use trusted certificate : '%s'", _certificate.get_subject().CN)
             return True
-        except crypto.X509StoreContextError as exp:
-            print(exp)
-            _logger.warning('Not trusted certificate used: "%s"', _certificate.get_subject().CN)
+        except crypto.X509StoreContextError:
+            _logger.exception('Not trusted certificate used: "%s"', _certificate.get_subject().CN)
         return False
 
     async def _load_trust_location(self, location: Path):

asyncua/server/address_space.py

@@ -33,8 +33,8 @@
     ]  # FIXME Check, if there are missing attribute types.
 
 from asyncua import ua
+from asyncua.crypto.permission_rules import User, UserRole
 
-from .users import User, UserRole
 
 _logger = logging.getLogger(__name__)
 

asyncua/server/internal_server.py

@@ -20,7 +20,7 @@
 from .address_space import NodeData, AddressSpace, AttributeService, ViewService, NodeManagementService, MethodService
 from .subscription_service import SubscriptionService
 from .standard_address_space import standard_address_space
-from .users import User, UserRole
+from asyncua.crypto.permission_rules import User, UserRole
 from .internal_session import InternalSession
 from .event_generator import EventGenerator
 from ..crypto.validator import CertificateValidatorMethod

asyncua/server/internal_session.py

@@ -10,7 +10,7 @@
 from ..common.utils import create_nonce, ServiceError
 from ..crypto.uacrypto import x509
 from .address_space import AddressSpace
-from .users import User, UserRole
+from asyncua.crypto.permission_rules import User, UserRole
 from .subscription_service import SubscriptionService
 
 if TYPE_CHECKING:

asyncua/server/user_managers.py

@@ -3,7 +3,7 @@
 from typing import Union
 
 from asyncua.crypto import uacrypto
-from asyncua.server.users import User, UserRole
+from asyncua.crypto.permission_rules import User, UserRole
 
 
 class UserManager: