Joseph Doherty
ae91e6b7f7
#816 finding: the SDK checks that the server certificate names the host only when a session is created with checkDomain:true. The driver, the AdminUI browser and Client.Shared all called the 8-argument DefaultSessionFactory.CreateAsync, which forwards checkDomain:false — so no host-name check ever ran (why a trusted NAT cert for *.invalid browsed fine over an IP in #813). When enabled the SDK (Session.OpenAsync -> ValidateDomains -> FindDomain) compares ConfiguredEndpoint.EndpointUrl.IdnHost — the CONFIGURED host, because OpcUaEndpointSelection/EndpointSelector rewrote the advertised one — against the cert's DNS/IP SANs; secured sessions only, and the auto-accept handler accepts a mismatch. Policy: certificateValidation.validateServerHostName, tri-state. Unset = OpcUaCertificateValidationOptions.DefaultValidateServerHostName = false, the pre-#816 behaviour, so nothing changes on upgrade; true = validate the configured host; false = explicit NAT/port-publish opt-out. Threaded into the driver, the AdminUI browser (same JSON) and the AdminUI form (a select that keeps "unset" unset), Client.Shared ConnectionSettings.ValidateServerHostName and the CLI --validate-host-name. A driver refusal names the opt-out. #818: the NAT fixture's /app/pki is on the opc-plc-nat-pki volume (verified: same thumbprint across --force-recreate), its PUBLIC cert is committed as Docker/nat/opc-plc-nat-server.der, and NatPublishedEndpointBrowseTests run every secure browse on a throwaway PKI (internal browser seam): refusal with nothing trusted, positive with the cert trusted (unset/false host check), and a BadCertificateHostNameInvalid refusal with the check on. The trusted cert is OPCUA_NAT_SERVER_CERT or the committed one (skip on thumbprint mismatch); OPCUA_NAT_SERVER_CERT_TRUSTED is retired. CI exports its throwaway NAT container's public cert. ServerHostNameValidationTests pin the driver against the plain opc-plc. MIN_EXECUTED not raised (needs a hosted run): +6 in v2-integration (440 -> 446), documented in scripts/ci/README.md.
58 lines
2.4 KiB
C#
58 lines
2.4 KiB
C#
using Opc.Ua;
|
|
using Shouldly;
|
|
using Xunit;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests;
|
|
|
|
/// <summary>
|
|
/// Gitea #816 — <c>certificateValidation.validateServerHostName</c>. The wire behaviour (the SDK's checkDomain against
|
|
/// the CONFIGURED host) is pinned against real servers by <c>ServerHostNameValidationTests</c> (driver, plain opc-plc)
|
|
/// and <c>NatPublishedEndpointBrowseTests</c> (browser, NAT opc-plc); these pin the option contract.
|
|
/// </summary>
|
|
[Trait("Category", "Unit")]
|
|
public sealed class OpcUaClientServerHostNameOptionTests
|
|
{
|
|
[Fact]
|
|
public void Unset_resolves_to_off_so_existing_deployments_are_unchanged()
|
|
{
|
|
var o = new OpcUaClientDriverOptions();
|
|
o.CertificateValidation.ValidateServerHostName.ShouldBeNull();
|
|
o.CertificateValidation.EffectiveValidateServerHostName.ShouldBeFalse();
|
|
OpcUaCertificateValidationOptions.DefaultValidateServerHostName.ShouldBeFalse();
|
|
|
|
OpcUaClientDriverFactoryExtensions.ParseOptions("d", """{"endpointUrl":"opc.tcp://x:1"}""")
|
|
.CertificateValidation.EffectiveValidateServerHostName.ShouldBeFalse();
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("true", true)]
|
|
[InlineData("false", false)]
|
|
public void Factory_json_binds_the_explicit_choice(string json, bool expected)
|
|
{
|
|
var o = OpcUaClientDriverFactoryExtensions.ParseOptions("d",
|
|
$$$"""{"endpointUrl":"opc.tcp://x:1","certificateValidation":{"validateServerHostName":{{{json}}}}}""");
|
|
|
|
o.CertificateValidation.ValidateServerHostName.ShouldBe(expected);
|
|
o.CertificateValidation.EffectiveValidateServerHostName.ShouldBe(expected);
|
|
}
|
|
|
|
[Fact]
|
|
public void The_effective_value_is_not_serialised_back()
|
|
{
|
|
var json = System.Text.Json.JsonSerializer.Serialize(new OpcUaCertificateValidationOptions());
|
|
json.ShouldNotContain("Effective");
|
|
}
|
|
|
|
[Fact]
|
|
public void A_host_name_refusal_names_the_opt_out()
|
|
{
|
|
var hint = OpcUaClientDriver.HostNameRefusalHint(new ServiceResultException(
|
|
StatusCodes.BadCertificateHostNameInvalid, "The domain '10.1.2.3' is not listed in the server certificate."));
|
|
hint.ShouldContain("validateServerHostName=false");
|
|
|
|
OpcUaClientDriver.HostNameRefusalHint(new ServiceResultException(StatusCodes.BadCertificateUntrusted))
|
|
.ShouldBeEmpty();
|
|
OpcUaClientDriver.HostNameRefusalHint(new InvalidOperationException("x")).ShouldBeEmpty();
|
|
}
|
|
}
|