BACnet/SC (Annex AB) Device UUID and VMAC identity claim to certificate - #1504

Adds opt-in certificate-to-UUID/VMAC authorization for BACnet/SC hub connections.

Changes:

• Extracts BACnet identities from certificate SAN URIs.
• Adds configurable hub identity policies and enforcement.
• Adds integration tests for UUID authorization and rejection.

• Files reviewed: 9/9 changed files
• Comments generated: 8
• Review effort level: Balanced

Suppressed comments (1)

src/bacnet/datalink/bsc/bsc-socket.c:865

• This lookup returns the first entry with the certificate identity before considering the claimed UUID/VMAC. Since the API does not require identities to be unique, a valid later entry for the same certificate identity is unreachable and authorization becomes array-order dependent. Either match identity, UUID, and optional VMAC together while scanning, or reject duplicate identities when the policy is installed.

    for (i = 0; i < c->ctx->identity_policy_num; i++) {
        if (bsc_cert_identity_matches(
                san_uri, c->ctx->identity_policy[i].identity)) {
            return &c->ctx->identity_policy[i];

• Files reviewed: 15/15 changed files
• Comments generated: 4
• Review effort level: Balanced

• Files reviewed: 15/15 changed files
• Comments generated: 7
• Review effort level: Balanced

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

test/bacnet/datalink/bsc-datalink/src/main.c:2671

• This early-return path leaks node_ev2.e, which was allocated by init_node_ev() above. It is the path exercised by the mbedTLS build, so release the event before returning just as the normal path does.

• Files reviewed: 15/15 changed files
• Comments generated: 2
• Review effort level: Balanced

• Files reviewed: 16/16 changed files
• Comments generated: 2
• Review effort level: Balanced

• Files reviewed: 14/14 changed files
• Comments generated: 2
• Review effort level: Balanced

Suppressed comments (3)

Previously missed (3) — in code that hasn't changed since the last review.

src/bacnet/datalink/bsc/bsc-hub-function.c:104

• Live revalidation repeats the 256-byte aggregate SAN limit. A connected peer with more BACnet URI SAN data than this is forcefully disconnected after any policy update, even if one URI authorizes its UUID/VMAC. Reuse an uncapped shared certificate matcher so initial authorization and revalidation have identical, order-independent behavior.
  src/bacnet/datalink/bsc/bsc-socket.c:905
• The authorization path is limited to 256 bytes of aggregate BACnet SAN URIs. bws_srv_get_peer_cert_identities() returns INVALID_OPERATION when multiple otherwise-valid entries exceed that buffer, so this rejects an authorized certificate even when an earlier URI matches the policy and makes acceptance depend on unrelated SAN count/order. Match while iterating the certificate names or size storage from the SAN extension instead of imposing this undocumented cap.
  test/bacnet/datalink/hub-sc/src/main.c:3179
• This test passes URI strings directly to the policy helper, so it does not exercise the new OpenSSL SAN extraction or the fixed-size packed buffer used by real connections. A regression in extraction or SAN ordering would still pass. Use a client certificate containing multiple BACnet URI SANs through an actual hub-connector connection, including the authorized URI after another entry.

• Files reviewed: 14/14 changed files
• Comments generated: 1
• Review effort level: Balanced

• Files reviewed: 15/15 changed files
• Comments generated: 1
• Review effort level: Balanced