Joseph Doherty
9aff90f884
SDK 2.0.1 checks the server host name in TWO places: Session.OpenAsync (after the chain is trusted) and DefaultSessionFactory.CreateChannelAsync, against the certificate in the GetEndpoints reply and before any security-mode test. opc-plc sends a certificate on its None endpoint, so `connect -u opc.tcp://10.100.0.35:50000 --validate-host-name` was refused on an unauthenticated channel, where a host check proves nothing. All three call sites now pass checkDomain only when the selected endpoint's SecurityMode != None: OpcUaEndpointSelection.CheckDomainFor for the driver (OpenSessionOnEndpointAsync, so the failover sweep too) and the AdminUI browser; the same expression in Client.Shared ConnectToEndpointAsync (shared by failover). New live tests: driver None + flag on vs :50000 reads; browser None + flag on vs the NAT fixture browses; the secure + flag refusals still hold. Docs: name both check sites; a zone-qualified IPv6 host never matches (FindDomain compares the zone too), so link-local needs validateServerHostName=false; the match is loose (first label alone, subject DC= parts count, no wildcards), which caveats the CA recommendation.
73 lines
3.3 KiB
C#
73 lines
3.3 KiB
C#
using Opc.Ua;
|
|
using Shouldly;
|
|
using Xunit;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests;
|
|
|
|
/// <summary>
|
|
/// Gitea #816 — <c>certificateValidation.validateServerHostName</c>. The wire behaviour (the SDK's checkDomain against
|
|
/// the CONFIGURED host) is pinned against real servers by <c>ServerHostNameValidationTests</c> (driver, plain opc-plc)
|
|
/// and <c>NatPublishedEndpointBrowseTests</c> (browser, NAT opc-plc); these pin the option contract.
|
|
/// </summary>
|
|
[Trait("Category", "Unit")]
|
|
public sealed class OpcUaClientServerHostNameOptionTests
|
|
{
|
|
[Fact]
|
|
public void Unset_resolves_to_off_so_existing_deployments_are_unchanged()
|
|
{
|
|
var o = new OpcUaClientDriverOptions();
|
|
o.CertificateValidation.ValidateServerHostName.ShouldBeNull();
|
|
o.CertificateValidation.EffectiveValidateServerHostName.ShouldBeFalse();
|
|
OpcUaCertificateValidationOptions.DefaultValidateServerHostName.ShouldBeFalse();
|
|
|
|
OpcUaClientDriverFactoryExtensions.ParseOptions("d", """{"endpointUrl":"opc.tcp://x:1"}""")
|
|
.CertificateValidation.EffectiveValidateServerHostName.ShouldBeFalse();
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("true", true)]
|
|
[InlineData("false", false)]
|
|
public void Factory_json_binds_the_explicit_choice(string json, bool expected)
|
|
{
|
|
var o = OpcUaClientDriverFactoryExtensions.ParseOptions("d",
|
|
$$$"""{"endpointUrl":"opc.tcp://x:1","certificateValidation":{"validateServerHostName":{{{json}}}}}""");
|
|
|
|
o.CertificateValidation.ValidateServerHostName.ShouldBe(expected);
|
|
o.CertificateValidation.EffectiveValidateServerHostName.ShouldBe(expected);
|
|
}
|
|
|
|
[Fact]
|
|
public void The_effective_value_is_not_serialised_back()
|
|
{
|
|
var json = System.Text.Json.JsonSerializer.Serialize(new OpcUaCertificateValidationOptions());
|
|
json.ShouldNotContain("Effective");
|
|
}
|
|
|
|
/// <summary>
|
|
/// Review of #816: SDK 2.0.1 also checks the host in <c>DefaultSessionFactory.CreateChannelAsync</c>, against the
|
|
/// GetEndpoints certificate and before any security-mode test, so checkDomain is never passed for a None endpoint.
|
|
/// </summary>
|
|
[Theory]
|
|
[InlineData(MessageSecurityMode.None, true, false)]
|
|
[InlineData(MessageSecurityMode.None, false, false)]
|
|
[InlineData(MessageSecurityMode.Sign, true, true)]
|
|
[InlineData(MessageSecurityMode.SignAndEncrypt, true, true)]
|
|
[InlineData(MessageSecurityMode.SignAndEncrypt, false, false)]
|
|
public void CheckDomain_is_passed_only_for_secured_endpoints(MessageSecurityMode mode, bool validate, bool expected)
|
|
{
|
|
OpcUaEndpointSelection.CheckDomainFor(new EndpointDescription { SecurityMode = mode }, validate).ShouldBe(expected);
|
|
}
|
|
|
|
[Fact]
|
|
public void A_host_name_refusal_names_the_opt_out()
|
|
{
|
|
var hint = OpcUaClientDriver.HostNameRefusalHint(new ServiceResultException(
|
|
StatusCodes.BadCertificateHostNameInvalid, "The domain '10.1.2.3' is not listed in the server certificate."));
|
|
hint.ShouldContain("validateServerHostName=false");
|
|
|
|
OpcUaClientDriver.HostNameRefusalHint(new ServiceResultException(StatusCodes.BadCertificateUntrusted))
|
|
.ShouldBeEmpty();
|
|
OpcUaClientDriver.HostNameRefusalHint(new InvalidOperationException("x")).ShouldBeEmpty();
|
|
}
|
|
}
|