Joseph Doherty
ae91e6b7f7
#816 finding: the SDK checks that the server certificate names the host only when a session is created with checkDomain:true. The driver, the AdminUI browser and Client.Shared all called the 8-argument DefaultSessionFactory.CreateAsync, which forwards checkDomain:false — so no host-name check ever ran (why a trusted NAT cert for *.invalid browsed fine over an IP in #813). When enabled the SDK (Session.OpenAsync -> ValidateDomains -> FindDomain) compares ConfiguredEndpoint.EndpointUrl.IdnHost — the CONFIGURED host, because OpcUaEndpointSelection/EndpointSelector rewrote the advertised one — against the cert's DNS/IP SANs; secured sessions only, and the auto-accept handler accepts a mismatch. Policy: certificateValidation.validateServerHostName, tri-state. Unset = OpcUaCertificateValidationOptions.DefaultValidateServerHostName = false, the pre-#816 behaviour, so nothing changes on upgrade; true = validate the configured host; false = explicit NAT/port-publish opt-out. Threaded into the driver, the AdminUI browser (same JSON) and the AdminUI form (a select that keeps "unset" unset), Client.Shared ConnectionSettings.ValidateServerHostName and the CLI --validate-host-name. A driver refusal names the opt-out. #818: the NAT fixture's /app/pki is on the opc-plc-nat-pki volume (verified: same thumbprint across --force-recreate), its PUBLIC cert is committed as Docker/nat/opc-plc-nat-server.der, and NatPublishedEndpointBrowseTests run every secure browse on a throwaway PKI (internal browser seam): refusal with nothing trusted, positive with the cert trusted (unset/false host check), and a BadCertificateHostNameInvalid refusal with the check on. The trusted cert is OPCUA_NAT_SERVER_CERT or the committed one (skip on thumbprint mismatch); OPCUA_NAT_SERVER_CERT_TRUSTED is retired. CI exports its throwaway NAT container's public cert. ServerHostNameValidationTests pin the driver against the plain opc-plc. MIN_EXECUTED not raised (needs a hosted run): +6 in v2-integration (440 -> 446), documented in scripts/ci/README.md.
107 lines
4.5 KiB
Markdown
107 lines
4.5 KiB
Markdown
# opc-plc Docker fixture
|
|
|
|
[Microsoft Industrial IoT's opc-plc](https://github.com/Azure-Samples/iot-edge-opc-plc)
|
|
— pinned Docker image that stands up an OPC UA server at
|
|
`opc.tcp://localhost:50000` with step-up counters, random nodes, alarm
|
|
simulation, and other canonical simulated shapes. Replaces the PowerShell
|
|
launcher pattern used by the Modbus / S7 fixtures — Docker is the launcher
|
|
here since opc-plc ships pre-containerized.
|
|
|
|
| File | Purpose |
|
|
|---|---|
|
|
| [`docker-compose.yml`](docker-compose.yml) | Service definition for `otopcua-opc-plc` — image pin, port map, command flags. |
|
|
| [`nat/docker-compose.yml`](nat/docker-compose.yml) | `otopcua-opc-plc-nat` — a SEPARATE stack (`/opt/otopcua-opcuaclient-nat` on the shared host): opc-plc advertising a private `.invalid` host on internal port 50000, published on 50010. For `NatPublishedEndpointBrowseTests` (`OPCUA_NAT_ENDPOINT=opc.tcp://10.100.0.35:50010`, #806/#813); see the compose file's header. Its PKI is on a volume (#818). |
|
|
| [`nat/opc-plc-nat-server.der`](nat/opc-plc-nat-server.der) | The NAT stack's **public** server certificate (no key), trusted by the positive secure / host-name NAT tests in a throwaway browse PKI. Refresh it when the stack's certificate is rolled (`docker compose down -v`); expires 2027-11-10. |
|
|
| (this file) | How to run it. |
|
|
|
|
## Install
|
|
|
|
Docker Desktop (Windows) or the docker CLI + daemon (Linux/macOS). Per
|
|
`CLAUDE.md` Phase 1 decision #134 the dev box already has Docker Desktop
|
|
configured with the WSL 2 backend — nothing new to install.
|
|
|
|
## Run
|
|
|
|
From the repo root:
|
|
|
|
```powershell
|
|
docker compose -f tests\Drivers\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests\Docker\docker-compose.yml up
|
|
```
|
|
|
|
Or from this folder:
|
|
|
|
```powershell
|
|
docker compose up
|
|
```
|
|
|
|
First run pulls the image (~250 MB). Startup takes ~5-10 seconds; the
|
|
healthcheck in the compose file surfaces ready state in `docker ps` (a bash `/dev/tcp` probe —
|
|
the image has no `netstat`, which kept the old check permanently "unhealthy", #817).
|
|
|
|
To run detached (CI pattern):
|
|
|
|
```powershell
|
|
docker compose up -d
|
|
```
|
|
|
|
Stop with `docker compose down` (removes the container) or `docker compose stop`
|
|
(keeps it for fast restart).
|
|
|
|
## Endpoint
|
|
|
|
- Default: `opc.tcp://localhost:50000`
|
|
- Override by setting `OPCUA_SIM_ENDPOINT` before `dotnet test` — e.g. point
|
|
at a real OPC UA server in the lab, or at a different Docker host.
|
|
|
|
## What opc-plc advertises
|
|
|
|
Command flags in `docker-compose.yml` enable:
|
|
|
|
- `--pn=50000` — OPC UA endpoint on port 50000
|
|
- `--ut` — unsecured transport endpoint advertised (SecurityPolicy=None).
|
|
Secured policies are still on the endpoint list; `--ut` just adds an
|
|
unsecured option.
|
|
- `--aa` — auto-accept client certs (opc-plc's cert trust store lives
|
|
inside the container + resets each spin-up, so without this the driver's
|
|
first contact would be rejected).
|
|
- `--alm` — alarm simulation enabled; opc-plc publishes
|
|
`TripAlarmType`, `ExclusiveDeviationAlarmType`,
|
|
`NonExclusiveLevelAlarmType`, and `DialogConditionType` events.
|
|
|
|
Not turned on (but available via compose-file tweaks):
|
|
|
|
- `--daa` — disable anonymous auth; forces username or cert tokens. Flip
|
|
on when username-auth / cert-auth smoke tests land.
|
|
- `--fn` / `--fr` / `--ft` — fast-node variants (100 / 1 000 / 10 000 Hz
|
|
update rates) for subscription-stress coverage. Not needed for smoke.
|
|
- `--sn` / `--sr` — slow-node / special-shape coverage.
|
|
|
|
## Run the integration tests
|
|
|
|
In a separate shell, with the simulator running:
|
|
|
|
```powershell
|
|
cd C:\Users\dohertj2\Desktop\lmxopcua
|
|
dotnet test tests\Drivers\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests
|
|
```
|
|
|
|
Tests auto-skip with a clear `SkipReason` when `localhost:50000` isn't
|
|
reachable within 2 seconds (`OpcPlcFixture`).
|
|
|
|
## Known limitations
|
|
|
|
opc-plc uses the OPCFoundation.NetStandard stack internally — same as
|
|
our driver. That means bugs common to the stack itself are **not** caught
|
|
by this fixture; the follow-up to add `open62541/open62541` as a second
|
|
independent-stack image (task tracked in #215's follow-ups) would close
|
|
that.
|
|
|
|
See [`docs/drivers/OpcUaClient-Test-Fixture.md`](../../../docs/drivers/OpcUaClient-Test-Fixture.md)
|
|
for the full coverage map + what's still trusted from field deployments.
|
|
|
|
## References
|
|
|
|
- [opc-plc GitHub](https://github.com/Azure-Samples/iot-edge-opc-plc)
|
|
- [mcr.microsoft.com/iotedge/opc-plc tags](https://mcr.microsoft.com/v2/iotedge/opc-plc/tags/list)
|
|
- [`docs/drivers/OpcUaClient-Test-Fixture.md`](../../../docs/drivers/OpcUaClient-Test-Fixture.md)
|