Joseph Doherty
ae91e6b7f7
#816 finding: the SDK checks that the server certificate names the host only when a session is created with checkDomain:true. The driver, the AdminUI browser and Client.Shared all called the 8-argument DefaultSessionFactory.CreateAsync, which forwards checkDomain:false — so no host-name check ever ran (why a trusted NAT cert for *.invalid browsed fine over an IP in #813). When enabled the SDK (Session.OpenAsync -> ValidateDomains -> FindDomain) compares ConfiguredEndpoint.EndpointUrl.IdnHost — the CONFIGURED host, because OpcUaEndpointSelection/EndpointSelector rewrote the advertised one — against the cert's DNS/IP SANs; secured sessions only, and the auto-accept handler accepts a mismatch. Policy: certificateValidation.validateServerHostName, tri-state. Unset = OpcUaCertificateValidationOptions.DefaultValidateServerHostName = false, the pre-#816 behaviour, so nothing changes on upgrade; true = validate the configured host; false = explicit NAT/port-publish opt-out. Threaded into the driver, the AdminUI browser (same JSON) and the AdminUI form (a select that keeps "unset" unset), Client.Shared ConnectionSettings.ValidateServerHostName and the CLI --validate-host-name. A driver refusal names the opt-out. #818: the NAT fixture's /app/pki is on the opc-plc-nat-pki volume (verified: same thumbprint across --force-recreate), its PUBLIC cert is committed as Docker/nat/opc-plc-nat-server.der, and NatPublishedEndpointBrowseTests run every secure browse on a throwaway PKI (internal browser seam): refusal with nothing trusted, positive with the cert trusted (unset/false host check), and a BadCertificateHostNameInvalid refusal with the check on. The trusted cert is OPCUA_NAT_SERVER_CERT or the committed one (skip on thumbprint mismatch); OPCUA_NAT_SERVER_CERT_TRUSTED is retired. CI exports its throwaway NAT container's public cert. ServerHostNameValidationTests pin the driver against the plain opc-plc. MIN_EXECUTED not raised (needs a hosted run): +6 in v2-integration (440 -> 446), documented in scripts/ci/README.md.
70 lines
4.2 KiB
YAML
70 lines
4.2 KiB
YAML
# opc-plc behind a port NAT — the #806/#813 fixture for NatPublishedEndpointBrowseTests
|
|
# (tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.IntegrationTests, Fixture=opc-plc-nat).
|
|
#
|
|
# The point of this stack is what the server ADVERTISES, not what it simulates. opc-plc builds its
|
|
# GetEndpoints EndpointUrl from its PLC hostname (--ph; default = the container's short hostname) + its
|
|
# listen port, so with
|
|
# * a private hostname that cannot resolve from any client (named explicitly via --ph: `.invalid` is
|
|
# reserved by RFC 6761 and guaranteed never to resolve, so no resolver search domain or wildcard can make
|
|
# the premise pass; the container `hostname:` alone would advertise the bare short name), and
|
|
# * a published host port (50010) different from the internal listen port (50000),
|
|
# every advertised endpoint is opc.tcp://otopcua-opc-plc-nat-private.invalid:50000/ — unreachable on BOTH host
|
|
# and port. A client that follows the advertised URL fails DNS; one that keeps the operator-configured
|
|
# host:port (OpcUaEndpointUrlRewriter) reaches the server. The tests assert that premise first.
|
|
#
|
|
# A SEPARATE stack from ../docker-compose.yml (deployed to /opt/otopcua-opcuaclient-nat, not
|
|
# /opt/otopcua-opcuaclient) so bringing it up/down never touches the plain otopcua-opc-plc fixture.
|
|
#
|
|
# rsync -av tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/Docker/nat/ \
|
|
# dohertj2@10.100.0.35:/opt/otopcua-opcuaclient-nat/
|
|
# ssh dohertj2@10.100.0.35 'cd /opt/otopcua-opcuaclient-nat && docker compose up -d'
|
|
# OPCUA_NAT_ENDPOINT=opc.tcp://10.100.0.35:50010 dotnet test \
|
|
# tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.IntegrationTests --filter Fixture=opc-plc-nat
|
|
#
|
|
# #818: the server's PKI (/app/pki — own cert + private key, and the client certs --aa accepted) lives in the
|
|
# named volume `opc-plc-nat-pki`, so recreating the container keeps the SAME server certificate. Its PUBLIC half is
|
|
# committed next to this file (opc-plc-nat-server.der) and the secure tests trust it in a throwaway browse PKI. The
|
|
# private key never leaves the volume. To roll the certificate deliberately (e.g. at expiry, 2027-11-10):
|
|
# ssh dohertj2@10.100.0.35 'cd /opt/otopcua-opcuaclient-nat && docker compose down -v && docker compose up -d'
|
|
# ssh dohertj2@10.100.0.35 'docker exec otopcua-opc-plc-nat bash -c "cat /app/pki/own/certs/*.der"' \
|
|
# > tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/Docker/nat/opc-plc-nat-server.der
|
|
# (until the committed copy is refreshed the positive secure tests SKIP on a thumbprint mismatch — they never pass
|
|
# against a certificate other than the committed one).
|
|
services:
|
|
opc-plc-nat:
|
|
image: mcr.microsoft.com/iotedge/opc-plc:2.14.10
|
|
container_name: otopcua-opc-plc-nat
|
|
hostname: otopcua-opc-plc-nat-private
|
|
restart: unless-stopped
|
|
labels:
|
|
project: lmxopcua
|
|
ports:
|
|
# published 50010 -> internal 50000: the port half of the NAT. Do NOT make these equal.
|
|
- "50010:50000"
|
|
command:
|
|
- "--pn=50000"
|
|
# --ph: the host part of every advertised EndpointUrl (and the server cert's DNS name).
|
|
- "--ph=otopcua-opc-plc-nat-private.invalid"
|
|
# --ut: also advertise SecurityPolicy=None (the secure policies stay advertised; the secure test uses them).
|
|
- "--ut"
|
|
# --aa: accept the browser's self-signed client cert. Trust in the OTHER direction (the browser trusting
|
|
# this server's cert) is deliberately not automatic — that is what the secure test pins.
|
|
- "--aa"
|
|
volumes:
|
|
- opc-plc-nat-pki:/app/pki
|
|
# The image runs as uid 1654 ("app") and ships no /app/pki, so Docker creates the volume mount point root-owned
|
|
# and opc-plc could not write its certificate there. A throwaway test simulator: run it as root rather than add a
|
|
# chown init container.
|
|
user: "0"
|
|
healthcheck:
|
|
# The image ships no netstat (the sibling ../docker-compose.yml healthcheck was permanently "unhealthy" for that
|
|
# reason until #817 switched it to this probe too); bash's /dev/tcp is there.
|
|
test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/50000"]
|
|
interval: 5s
|
|
timeout: 2s
|
|
retries: 10
|
|
start_period: 10s
|
|
|
|
volumes:
|
|
opc-plc-nat-pki:
|