Merge pull request open62541#8098 from o6-automation/merge_15_master

Author: jpfr

.github/workflows/build_windows.yml

@@ -26,7 +26,7 @@ jobs:
             cc_name: "Clang"
             cc_shortname: clang-mingw
             generator: "Ninja"
-    runs-on: windows-latest
+    runs-on: windows-2022
     env:
       CC_NAME: ${{ matrix.cc_name }}
       CC_SHORTNAME: ${{ matrix.cc_shortname }}

.github/workflows/doc_upload.yml

@@ -2,7 +2,7 @@ name: "Documentation Upload"
 
 on:
   push:
-    branches: [ main, master ]
+    branches: [ main, master, 1.5 ]
     tags:
       - v1.*
 
@@ -20,7 +20,7 @@ jobs:
       - name: Install Dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y -qq texlive-fonts-recommended texlive-latex-extra texlive-plain-generic texlive-latex-recommended latexmk texlive-fonts-extra
+          sudo apt-get install -y -qq texlive-fonts-recommended texlive-latex-extra texlive-plain-generic texlive-latex-recommended latexmk texlive-fonts-extra texlive-luatex graphviz
           pip install -r doc/requirements.txt
       - name: Build Documentation
         run: source tools/ci/linux/ci.sh && build_docs_pdf

CMakeLists.txt

@@ -1718,7 +1718,8 @@ install(DIRECTORY ${UA_SCHEMA_DIR}/
 set(UA_install_tools_files "tools/generate_bsd.py"
                            "tools/generate_datatypes.py"
                            "tools/generate_nodeid_header.py"
-                           "tools/generate_statuscode_descriptions.py")
+                           "tools/generate_statuscode_descriptions.py"
+                           "tools/generate_bsd.py")
 install(FILES ${UA_install_tools_files} DESTINATION ${open62541_install_tools_dir}
         PERMISSIONS OWNER_READ OWNER_EXECUTE GROUP_READ GROUP_EXECUTE)
 

SECURITY.md

@@ -2,30 +2,34 @@
 
 ## Supported Versions
 
-The following versions of open62541 are monitored for vulnerabilities and are part of our vulnerability handling and release process.
+The open62541 releases are organized into release families. The following table
+shows the current nomenclature concerning development and stable release
+families.
 
-| Version   | Community Support   | Commercial Support Available |
-| --------- | ------------------- | ---------------------------- |
-| master    | :heavy_check_mark:  | :heavy_check_mark:           |
-| v1.4.x    | :heavy_check_mark:  | :heavy_check_mark:           |
-| v1.3.x    | :last_quarter_moon: | :heavy_check_mark:           |
-| <= v1.2.x | :last_quarter_moon: | :heavy_check_mark:           |
-| <= v1.0.x | :x:                 | :last_quarter_moon:          |
+| Release Family | Status              | Branch      |
+| -------------- | ------------------- | ----------- |
+| -              | development         | master      |
+| v1.5.x         | stable              | 1.5         |
+| v1.4.x         | oldstable           | 1.4         |
+| v1.3.x         | oldoldstable        | 1.3         |
 
-## Reporting a Vulnerability
+Beyond the public Github, you can get professional support for open62541 from
+*o6 Automation GmbH* (https://www.o6-automation.com/services). This includes our
+**Vulnerability Management Process** and **Long-Term Support** for older stable
+release families. So software based on open62541 can be deployed and supported
+in the field for many years.
 
-Security vulnerabilities can be disclosed privately to the mailing list open62541-security@googlegroups.com.
+## Reporting a Vulnerability
 
-The disclosure triggers an evaluation of the vulnerability.
-Depending on the criticality, the follow-up comprises of the following steps:
+You are invited to disclose your findings privately with one of the following
+mechanisms. **DO NOT OPEN PUBLIC GITHUB ISSUES FOR POTENTIAL VULNERABILITIES.**
+This only gives the bad guys a head-start and does not speed up the
+vulnerability handling.
 
-- Responsible disclosure of the vulnerability to critical professional users (with an embargo period)
-- Commit of the fix to the public repository
-- Backporting of the fix to past release families
-- Preparation of patch releases
-- Public disclosure of the vulnerability
+- Via email to the mailing list open62541-security@googlegroups.com
+- Via the Github disclosure mechanism at https://github.com/open62541/open62541/security/advisories
 
-You can send us encrypted email with PGP using this public key:
+You can encrypt emails to us with this PGP key:
 
 ```
 -----BEGIN PGP PUBLIC KEY BLOCK-----
@@ -43,3 +47,29 @@ tfp1v8HATMXKB65FmujmBg==
 =Juz6
 -----END PGP PUBLIC KEY BLOCK-----
 ```
+
+## Vulnerability Management Process
+
+The disclosure of a potential vulnerability triggers our Vulnerability
+Management Process. It comprises of the following steps:
+
+1. Evaluation of the disclosure (CVSS score)
+2. If relevant, preparation of mitigations (patches) for the impacted open62541
+   release families together with a non-public Vulnerability Advisory
+3. Dissemination to commercial users and operators of critical infrastructure
+4. Embargo time (typically 30 days)
+5. Merge of the mitigations into the impacted open62541 release family branches
+6. Preparation of open62541 patch releases for the impacted release families
+
+## Acknowledgement and Public CVE
+
+**We do not endorse public CVE advisories for open62541.** With todays AI-based
+coding tools, a public CVE has roughly the same impact as releasing a working
+exploit. Professional users and operators of critical installations receive
+non-public Vulnerability Advisories via the Professional Support Services. Then,
+after an embargo time to fix critical installations, we prepare public patch
+releases for the impacted versions of open62541.
+
+If the person disclosing a vulnerability wishes so, we can give a personal
+acknowledgement of the disclosure both in the non-public Vulnerability Advisory
+and in the commits that are eventually merged into the public git branches.

arch/posix/eventloop_posix_udp.c

@@ -1181,6 +1181,7 @@ UDP_openSendConnection(UA_POSIXConnectionManager *pcm, const UA_KeyValueMap *par
     if(!conn) {
         UA_LOG_WARNING(el->eventLoop.logger, UA_LOGCATEGORY_NETWORK,
                        "UDP\t| Error allocating memory for the socket, closing");
+        UA_freeaddrinfo(info);
         return UA_STATUSCODE_BADOUTOFMEMORY;
     }
 

doc/CMakeLists.txt

@@ -1,5 +1,6 @@
 find_package(Sphinx)
 find_package(LATEX)
+find_program(LUALATEX_COMPILER NAMES lualatex)
 
 set(DOC_LATEX_DIR ${PROJECT_BINARY_DIR}/doc_latex)
 set(DOC_HTML_DIR ${PROJECT_BINARY_DIR}/doc)
@@ -102,11 +103,11 @@ add_custom_target(doc_latex ${SPHINX_EXECUTABLE}
                   COMMENT "Building LaTeX sources for documentation with Sphinx")
 add_dependencies(doc_latex open62541)
 
-add_custom_target(doc_pdf ${PDFLATEX_COMPILER} -interaction=batchmode "open62541.tex"
+add_custom_target(doc_pdf ${LUALATEX_COMPILER} -interaction=batchmode "open62541.tex"
                   WORKING_DIRECTORY ${DOC_LATEX_DIR}
                   # compile it twice so that the contents pages are correct
-                  COMMAND ${PDFLATEX_COMPILER} -interaction=batchmode "open62541.tex"
-                  DEPENDS ${PDFLATEX_COMPILER}
+                  COMMAND ${LUALATEX_COMPILER} -interaction=batchmode "open62541.tex"
+                  DEPENDS ${LUALATEX_COMPILER}
                   COMMENT "Generating PDF documentation from LaTeX sources")
 add_dependencies(doc_pdf doc_latex)
 

doc/conf.py

@@ -35,6 +35,7 @@ def try_get_branch():
 
 extensions = [
     'sphinx_rtd_theme',
+    'sphinx.ext.graphviz',
 ]
 
 templates_path = ['_templates']
@@ -52,20 +53,22 @@ def try_get_branch():
 html_theme = 'sphinx_rtd_theme'
 html_static_path = ['_static']
 
-html_logo = 'open62541_html.png'
+html_logo = 'open62541_logo.svg'
 
 pygments_style = 'sphinx' # TODO makes code blocks ugly (overrides sphinx_rtd_theme)
 
 # -- Options for LaTeX output ---------------------------------------------
 # https://www.sphinx-doc.org/en/master/usage/configuration.html#options-for-latex-output
 
-latex_logo = 'open62541.png'
+latex_logo = 'open62541_logo.png'
 
 latex_documents = [
   # (startdocname,   targetname,      title,                     author, theme,    toctree_only)
     (master_doc,     'open62541.tex', 'open62541 Documentation', author, 'manual', False),
 ]
 
+latex_engine = 'lualatex'
+
 latex_elements = {
 # The paper size ('letterpaper' or 'a4paper').
 'papersize': 'a4paper',