Merge fix/816-opcuaclient-cert-host

src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI/CommandBase.cs

@@ -57,6 +57,13 @@ public abstract class CommandBase : ICommand
     [CommandOption("failover-urls", 'F', Description = "Comma-separated failover endpoint URLs for redundancy")]
     public string? FailoverUrls { get; init; }
 
+    /// <summary>
+    /// Gets a value indicating whether the server certificate must name the host given in <see cref="Url" /> (#816).
+    /// </summary>
+    [CommandOption("validate-host-name",
+        Description = "Require the server certificate to list the --url host (sign/encrypt only, never with --security none; off by default — leave off behind NAT)")]
+    public bool ValidateHostName { get; init; }
+
     /// <summary>
     /// Gets a value indicating whether verbose Serilog output should be enabled for troubleshooting.
     /// </summary>
@@ -88,7 +95,8 @@ public abstract class CommandBase : ICommand
             Username = Username,
             Password = Password,
             SecurityMode = securityMode,
-            AutoAcceptCertificates = true
+            AutoAcceptCertificates = true,
+            ValidateServerHostName = ValidateHostName
         };
 
         return settings;

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/DefaultSessionFactory.cs

@@ -18,6 +18,7 @@ internal sealed class DefaultSessionFactory : ISessionFactory
         string sessionName,
         uint sessionTimeoutMs,
         UserIdentity identity,
+        bool validateServerHostName,
         CancellationToken ct)
     {
         var endpointConfig = EndpointConfiguration.Create(config);
@@ -26,7 +27,10 @@ internal sealed class DefaultSessionFactory : ISessionFactory
         var created = await new Opc.Ua.Client.DefaultSessionFactory(ClientTelemetry.Context).CreateAsync(
             config,
             configuredEndpoint,
-            false,
+            false,                       // updateBeforeConnect
+            // #816: the overload without checkDomain hard-codes false. The endpoint URL here is the operator's host
+            // (EndpointSelector rewrote the advertised one), so that is the host the certificate is checked against.
+            validateServerHostName,      // checkDomain
             sessionName,
             sessionTimeoutMs,
             identity,

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/ISessionFactory.cs

@@ -15,6 +15,9 @@ internal interface ISessionFactory
     /// <param name="sessionName">The session name.</param>
     /// <param name="sessionTimeoutMs">Session timeout in milliseconds.</param>
     /// <param name="identity">The user identity.</param>
+    /// <param name="validateServerHostName">
+    ///     The SDK's <c>checkDomain</c>: require the server certificate to name the endpoint URL's host (#816).
+    /// </param>
     /// <param name="ct">Cancellation token.</param>
     /// <returns>A session adapter wrapping the created session.</returns>
     Task<ISessionAdapter> CreateSessionAsync(
@@ -23,5 +26,6 @@ internal interface ISessionFactory
         string sessionName,
         uint sessionTimeoutMs,
         UserIdentity identity,
+        bool validateServerHostName,
         CancellationToken ct = default);
 }

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Models/ConnectionSettings.cs

@@ -40,6 +40,17 @@ public sealed class ConnectionSettings
     /// </summary>
     public bool AutoAcceptCertificates { get; set; } = true;
 
+    /// <summary>
+    ///     Gitea #816 — require the server certificate to list the host of the URL being connected (the operator's
+    ///     host: discovery keeps it in place of the server-advertised one) among its subject-alternative names;
+    ///     a mismatch fails the connect with <c>BadCertificateHostNameInvalid</c>. Defaults to <c>false</c>, the
+    ///     behaviour before #816 (the SDK overload used never checked). Applied to Sign / SignAndEncrypt endpoints only
+    ///     — never passed for <see cref="Models.SecurityMode.None"/>, where SDK 2.0.1 would check the GetEndpoints
+    ///     certificate at channel creation anyway. Leave it off behind NAT / a port publish / when connecting by an IP
+    ///     the certificate does not name / for a zone-qualified IPv6 host (the SDK compares the zone too).
+    /// </summary>
+    public bool ValidateServerHostName { get; set; }
+
     /// <summary>
     ///     Path to the certificate store. Defaults to <see cref="string.Empty"/>; the
     ///     consuming application configuration factory resolves the canonical path via

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/OpcUaClientService.cs

@@ -777,6 +777,7 @@ public sealed class OpcUaClientService : IOpcUaClientService
             SecurityMode = settings.SecurityMode,
             SessionTimeoutSeconds = settings.SessionTimeoutSeconds,
             AutoAcceptCertificates = settings.AutoAcceptCertificates,
+            ValidateServerHostName = settings.ValidateServerHostName,
             CertificateStorePath = settings.CertificateStorePath,
             Username = settings.Username,
             Password = settings.Password
@@ -793,8 +794,12 @@ public sealed class OpcUaClientService : IOpcUaClientService
                 : new UserIdentity();
 
             var sessionTimeoutMs = (uint)(settings.SessionTimeoutSeconds * 1000);
+            // #816: never on a None endpoint — SDK 2.0.1 also checks the host at channel creation against the
+            // GetEndpoints certificate, before any security-mode test, and on an unauthenticated channel that proves
+            // nothing (same rule as OpcUaEndpointSelection.CheckDomainFor for the driver and the AdminUI browser).
+            var checkDomain = settings.ValidateServerHostName && endpoint.SecurityMode != MessageSecurityMode.None;
             return await _sessionFactory.CreateSessionAsync(config, endpoint, "OtOpcUaClient", sessionTimeoutMs, identity,
-                ct);
+                checkDomain, ct);
         }
         catch
         {