Request to enable encryption (OpenSSL) specific features

[ndchandar]

Hello,
Thank you for providing Rust bindings for open62541. We have a need to use features with UA_ENABLE_ENCRYPTION (OpenSSL based). I was wondering if HMIProject/open62541-sys#32 is ready to be merged. I do see build failures currently. If we can merge, I can help test it if required.

Regards
Dinesh Narayanan

[sgoll]

Unfortunately, no, that PR and the other ones related to the encryption feature of open62541 are not ready to be merged. We got stuck when we had problems building with OpenSSL support (or Mbed TLS) for several of our target platforms.

We will look into possibly supporting a limited set of target platforms with encryption (GNU Linux comes to mind where we got CI runs to build successfully). Unfortunately, supporting Windows or musl libc or even non-amd64 platforms is much harder.

What platform (CPU architecture and operating system) would you be targeting?

[ndchandar]

@sgoll ,
Thank you for your response. We plan to run our OPC UA server on x86-64 architecture. It will run Ubuntu 22.04 (GNU based). I see that the build that's of interest to us is passing https://github.com/HMIProject/open62541-sys/actions/runs/10699834414/job/29662264179?pr=32. Is there any way to promote/publish a version of that we can use to test on our side

Regards
Dinesh

[sgoll]

@ndchandar Please take a look at #170. We were able to integrate Mbed TLS which turned out easier than trying to dynamically link to OpenSSL. In any case, this opens the door for possibly integrating the OpenSSL backend support of open62541 at a later time as well.

[ndchandar]

@sgoll,
Thank you for the update. I will give this a go for our use case and let you know if I find any issues.

[ndchandar]

@sgoll,
I tested mbedTLS based encryption today. It works ok when i use ServerBuilder::default_with_security_policies. With ServerBuilder::default_with_secure_security_policies I see these errors

# client side error logs
[2024-11-25T02:35:18Z ERROR open62541_sys] TCP 5	| SC 0	| Received an ERR response with StatusCode BadInternalError and the following reason:

# server side logs
[2024-11-25T03:27:00Z WARN  open62541_sys] TCP 9	| SC 1	| Processing the message failed with error BadInternalError

I could simulate this issue with both my own test project and server_encryption/client_encryption example. In both cases, I was testing with the self signed certificate (for both server and client). Any ideas on what I could be missing.

[sgoll]

Please excuse the late response.

Unfortunately, I am not quite familiar with what exactly UA_ServerConfig_setDefaultWithSecureSecurityPolicies() does behind the scenes when compared to UA_ServerConfig_setDefaultWithSecurityPolicies(). Our methods on ServerBuilder call these functions from the C library and nothing more.

Perhaps, if you find out where the problem is coming from, can you let us know if we are using these functions incorrectly?

[sgoll]

I am closing this. For now, OpenSSL support is not planned (although pull requests are welcome). We support basic encryption with Mbed TLS starting with release v0.6.4 of our crate.