Joseph Doherty
ae91e6b7f7
#816 finding: the SDK checks that the server certificate names the host only when a session is created with checkDomain:true. The driver, the AdminUI browser and Client.Shared all called the 8-argument DefaultSessionFactory.CreateAsync, which forwards checkDomain:false — so no host-name check ever ran (why a trusted NAT cert for *.invalid browsed fine over an IP in #813). When enabled the SDK (Session.OpenAsync -> ValidateDomains -> FindDomain) compares ConfiguredEndpoint.EndpointUrl.IdnHost — the CONFIGURED host, because OpcUaEndpointSelection/EndpointSelector rewrote the advertised one — against the cert's DNS/IP SANs; secured sessions only, and the auto-accept handler accepts a mismatch. Policy: certificateValidation.validateServerHostName, tri-state. Unset = OpcUaCertificateValidationOptions.DefaultValidateServerHostName = false, the pre-#816 behaviour, so nothing changes on upgrade; true = validate the configured host; false = explicit NAT/port-publish opt-out. Threaded into the driver, the AdminUI browser (same JSON) and the AdminUI form (a select that keeps "unset" unset), Client.Shared ConnectionSettings.ValidateServerHostName and the CLI --validate-host-name. A driver refusal names the opt-out. #818: the NAT fixture's /app/pki is on the opc-plc-nat-pki volume (verified: same thumbprint across --force-recreate), its PUBLIC cert is committed as Docker/nat/opc-plc-nat-server.der, and NatPublishedEndpointBrowseTests run every secure browse on a throwaway PKI (internal browser seam): refusal with nothing trusted, positive with the cert trusted (unset/false host check), and a BadCertificateHostNameInvalid refusal with the check on. The trusted cert is OPCUA_NAT_SERVER_CERT or the committed one (skip on thumbprint mismatch); OPCUA_NAT_SERVER_CERT_TRUSTED is retired. CI exports its throwaway NAT container's public cert. ServerHostNameValidationTests pin the driver against the plain opc-plc. MIN_EXECUTED not raised (needs a hosted run): +6 in v2-integration (440 -> 446), documented in scripts/ci/README.md.
77 lines
3.1 KiB
C#
77 lines
3.1 KiB
C#
namespace ZB.MOM.WW.OtOpcUa.Client.Shared.Models;
|
|
|
|
/// <summary>
|
|
/// Settings for establishing an OPC UA client connection.
|
|
/// </summary>
|
|
public sealed class ConnectionSettings
|
|
{
|
|
/// <summary>
|
|
/// The primary OPC UA endpoint URL.
|
|
/// </summary>
|
|
public string EndpointUrl { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Optional failover endpoint URLs for redundancy.
|
|
/// </summary>
|
|
public string[]? FailoverUrls { get; set; }
|
|
|
|
/// <summary>
|
|
/// Optional username for authentication.
|
|
/// </summary>
|
|
public string? Username { get; set; }
|
|
|
|
/// <summary>
|
|
/// Optional password for authentication.
|
|
/// </summary>
|
|
public string? Password { get; set; }
|
|
|
|
/// <summary>
|
|
/// Transport security mode. Defaults to <see cref="Models.SecurityMode.None" />.
|
|
/// </summary>
|
|
public SecurityMode SecurityMode { get; set; } = SecurityMode.None;
|
|
|
|
/// <summary>
|
|
/// Session timeout in seconds. Defaults to 60.
|
|
/// </summary>
|
|
public int SessionTimeoutSeconds { get; set; } = 60;
|
|
|
|
/// <summary>
|
|
/// Whether to automatically accept untrusted server certificates. Defaults to true.
|
|
/// </summary>
|
|
public bool AutoAcceptCertificates { get; set; } = true;
|
|
|
|
/// <summary>
|
|
/// Gitea #816 — require the server certificate to list the host of the URL being connected (the operator's
|
|
/// host: discovery keeps it in place of the server-advertised one) among its subject-alternative names;
|
|
/// a mismatch fails the connect with <c>BadCertificateHostNameInvalid</c>. Defaults to <c>false</c>, the
|
|
/// behaviour before #816 (the SDK overload used never checked). Secured connections only. Leave it off behind
|
|
/// NAT / a port publish / when connecting by an IP the certificate does not name.
|
|
/// </summary>
|
|
public bool ValidateServerHostName { get; set; }
|
|
|
|
/// <summary>
|
|
/// Path to the certificate store. Defaults to <see cref="string.Empty"/>; the
|
|
/// consuming application configuration factory resolves the canonical path via
|
|
/// <see cref="ClientStoragePaths.GetPkiPath"/> lazily on first connect, so
|
|
/// constructing settings — including the throwaway copies built per failover
|
|
/// attempt — does not touch disk or run the legacy-folder migration probe.
|
|
/// </summary>
|
|
public string CertificateStorePath { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Validates the settings and throws if any required values are missing or invalid.
|
|
/// </summary>
|
|
/// <exception cref="ArgumentException">Thrown when settings are invalid.</exception>
|
|
public void Validate()
|
|
{
|
|
if (string.IsNullOrWhiteSpace(EndpointUrl))
|
|
throw new ArgumentException("EndpointUrl must not be null or empty.", nameof(EndpointUrl));
|
|
|
|
if (SessionTimeoutSeconds <= 0)
|
|
throw new ArgumentException("SessionTimeoutSeconds must be greater than zero.",
|
|
nameof(SessionTimeoutSeconds));
|
|
|
|
if (SessionTimeoutSeconds > 3600)
|
|
throw new ArgumentException("SessionTimeoutSeconds must not exceed 3600.", nameof(SessionTimeoutSeconds));
|
|
}
|
|
} |