ae91e6b7f7
#816 finding: the SDK checks that the server certificate names the host only when a session is created with checkDomain:true. The driver, the AdminUI browser and Client.Shared all called the 8-argument DefaultSessionFactory.CreateAsync, which forwards checkDomain:false — so no host-name check ever ran (why a trusted NAT cert for *.invalid browsed fine over an IP in #813). When enabled the SDK (Session.OpenAsync -> ValidateDomains -> FindDomain) compares ConfiguredEndpoint.EndpointUrl.IdnHost — the CONFIGURED host, because OpcUaEndpointSelection/EndpointSelector rewrote the advertised one — against the cert's DNS/IP SANs; secured sessions only, and the auto-accept handler accepts a mismatch. Policy: certificateValidation.validateServerHostName, tri-state. Unset = OpcUaCertificateValidationOptions.DefaultValidateServerHostName = false, the pre-#816 behaviour, so nothing changes on upgrade; true = validate the configured host; false = explicit NAT/port-publish opt-out. Threaded into the driver, the AdminUI browser (same JSON) and the AdminUI form (a select that keeps "unset" unset), Client.Shared ConnectionSettings.ValidateServerHostName and the CLI --validate-host-name. A driver refusal names the opt-out. #818: the NAT fixture's /app/pki is on the opc-plc-nat-pki volume (verified: same thumbprint across --force-recreate), its PUBLIC cert is committed as Docker/nat/opc-plc-nat-server.der, and NatPublishedEndpointBrowseTests run every secure browse on a throwaway PKI (internal browser seam): refusal with nothing trusted, positive with the cert trusted (unset/false host check), and a BadCertificateHostNameInvalid refusal with the check on. The trusted cert is OPCUA_NAT_SERVER_CERT or the committed one (skip on thumbprint mismatch); OPCUA_NAT_SERVER_CERT_TRUSTED is retired. CI exports its throwaway NAT container's public cert. ServerHostNameValidationTests pin the driver against the plain opc-plc. MIN_EXECUTED not raised (needs a hosted run): +6 in v2-integration (440 -> 446), documented in scripts/ci/README.md.
109 lines
4.0 KiB
C#
109 lines
4.0 KiB
C#
using Shouldly;
|
|
using Xunit;
|
|
using ZB.MOM.WW.OtOpcUa.Client.CLI.Commands;
|
|
using ZB.MOM.WW.OtOpcUa.Client.CLI.Tests.Fakes;
|
|
using ZB.MOM.WW.OtOpcUa.Client.Shared.Models;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.Client.CLI.Tests;
|
|
|
|
public class CommandBaseTests
|
|
{
|
|
/// <summary>Verifies that common options map to connection settings correctly.</summary>
|
|
[Fact]
|
|
public async Task CommonOptions_MapToConnectionSettings_Correctly()
|
|
{
|
|
var fakeService = new FakeOpcUaClientService();
|
|
var factory = new FakeOpcUaClientServiceFactory(fakeService);
|
|
var command = new ConnectCommand(factory)
|
|
{
|
|
Url = "opc.tcp://myserver:4840",
|
|
Username = "admin",
|
|
Password = "secret",
|
|
Security = "sign",
|
|
FailoverUrls = "opc.tcp://backup1:4840,opc.tcp://backup2:4840"
|
|
};
|
|
|
|
using var console = TestConsoleHelper.CreateConsole();
|
|
await command.ExecuteAsync(console);
|
|
|
|
var settings = fakeService.LastConnectionSettings;
|
|
settings.ShouldNotBeNull();
|
|
settings.EndpointUrl.ShouldBe("opc.tcp://myserver:4840");
|
|
settings.Username.ShouldBe("admin");
|
|
settings.Password.ShouldBe("secret");
|
|
settings.SecurityMode.ShouldBe(SecurityMode.Sign);
|
|
settings.FailoverUrls.ShouldNotBeNull();
|
|
settings.FailoverUrls!.Length.ShouldBe(3); // primary + 2 failover
|
|
settings.FailoverUrls[0].ShouldBe("opc.tcp://myserver:4840");
|
|
settings.AutoAcceptCertificates.ShouldBeTrue();
|
|
}
|
|
|
|
/// <summary>Gitea #816: --validate-host-name maps to the server host-name check, which is off without it.</summary>
|
|
[Theory]
|
|
[InlineData(false)]
|
|
[InlineData(true)]
|
|
public async Task ValidateHostNameOption_MapsToConnectionSettings(bool flag)
|
|
{
|
|
var fakeService = new FakeOpcUaClientService();
|
|
var factory = new FakeOpcUaClientServiceFactory(fakeService);
|
|
var command = new ConnectCommand(factory) { Url = "opc.tcp://localhost:4840", ValidateHostName = flag };
|
|
|
|
using var console = TestConsoleHelper.CreateConsole();
|
|
await command.ExecuteAsync(console);
|
|
|
|
fakeService.LastConnectionSettings!.ValidateServerHostName.ShouldBe(flag);
|
|
}
|
|
|
|
/// <summary>Verifies that encrypt option maps to SignAndEncrypt.</summary>
|
|
[Fact]
|
|
public async Task SecurityOption_Encrypt_MapsToSignAndEncrypt()
|
|
{
|
|
var fakeService = new FakeOpcUaClientService();
|
|
var factory = new FakeOpcUaClientServiceFactory(fakeService);
|
|
var command = new ConnectCommand(factory)
|
|
{
|
|
Url = "opc.tcp://localhost:4840",
|
|
Security = "encrypt"
|
|
};
|
|
|
|
using var console = TestConsoleHelper.CreateConsole();
|
|
await command.ExecuteAsync(console);
|
|
|
|
fakeService.LastConnectionSettings!.SecurityMode.ShouldBe(SecurityMode.SignAndEncrypt);
|
|
}
|
|
|
|
/// <summary>Verifies that none option maps to None.</summary>
|
|
[Fact]
|
|
public async Task SecurityOption_None_MapsToNone()
|
|
{
|
|
var fakeService = new FakeOpcUaClientService();
|
|
var factory = new FakeOpcUaClientServiceFactory(fakeService);
|
|
var command = new ConnectCommand(factory)
|
|
{
|
|
Url = "opc.tcp://localhost:4840",
|
|
Security = "none"
|
|
};
|
|
|
|
using var console = TestConsoleHelper.CreateConsole();
|
|
await command.ExecuteAsync(console);
|
|
|
|
fakeService.LastConnectionSettings!.SecurityMode.ShouldBe(SecurityMode.None);
|
|
}
|
|
|
|
/// <summary>Verifies that no failover URLs results in null FailoverUrls.</summary>
|
|
[Fact]
|
|
public async Task NoFailoverUrls_FailoverUrlsIsNull()
|
|
{
|
|
var fakeService = new FakeOpcUaClientService();
|
|
var factory = new FakeOpcUaClientServiceFactory(fakeService);
|
|
var command = new ConnectCommand(factory)
|
|
{
|
|
Url = "opc.tcp://localhost:4840"
|
|
};
|
|
|
|
using var console = TestConsoleHelper.CreateConsole();
|
|
await command.ExecuteAsync(console);
|
|
|
|
fakeService.LastConnectionSettings!.FailoverUrls.ShouldBeNull();
|
|
}
|
|
} |