Files

T

Joseph Doherty ae91e6b7f7 feat(opcuaclient): opt-in server-certificate host-name check; NAT fixture keeps its PKI (#816 , #818 )

#816 finding: the SDK checks that the server certificate names the host only
when a session is created with checkDomain:true. The driver, the AdminUI
browser and Client.Shared all called the 8-argument
DefaultSessionFactory.CreateAsync, which forwards checkDomain:false — so no
host-name check ever ran (why a trusted NAT cert for *.invalid browsed fine
over an IP in #813). When enabled the SDK (Session.OpenAsync ->
ValidateDomains -> FindDomain) compares ConfiguredEndpoint.EndpointUrl.IdnHost
— the CONFIGURED host, because OpcUaEndpointSelection/EndpointSelector
rewrote the advertised one — against the cert's DNS/IP SANs; secured
sessions only, and the auto-accept handler accepts a mismatch.

Policy: certificateValidation.validateServerHostName, tri-state. Unset =
OpcUaCertificateValidationOptions.DefaultValidateServerHostName = false, the
pre-#816 behaviour, so nothing changes on upgrade; true = validate the
configured host; false = explicit NAT/port-publish opt-out. Threaded into the
driver, the AdminUI browser (same JSON) and the AdminUI form (a select that
keeps "unset" unset), Client.Shared ConnectionSettings.ValidateServerHostName
and the CLI --validate-host-name. A driver refusal names the opt-out.

#818: the NAT fixture's /app/pki is on the opc-plc-nat-pki volume (verified:
same thumbprint across --force-recreate), its PUBLIC cert is committed as
Docker/nat/opc-plc-nat-server.der, and NatPublishedEndpointBrowseTests run
every secure browse on a throwaway PKI (internal browser seam): refusal with
nothing trusted, positive with the cert trusted (unset/false host check), and
a BadCertificateHostNameInvalid refusal with the check on. The trusted cert is
OPCUA_NAT_SERVER_CERT or the committed one (skip on thumbprint mismatch);
OPCUA_NAT_SERVER_CERT_TRUSTED is retired. CI exports its throwaway NAT
container's public cert. ServerHostNameValidationTests pin the driver against
the plain opc-plc. MIN_EXECUTED not raised (needs a hosted run): +6 in
v2-integration (440 -> 446), documented in scripts/ci/README.md.

2026-11-11 01:33:00 -05:00

4.5 KiB

Raw Blame History

opc-plc Docker fixture

Microsoft Industrial IoT's opc-plc — pinned Docker image that stands up an OPC UA server at opc.tcp://localhost:50000 with step-up counters, random nodes, alarm simulation, and other canonical simulated shapes. Replaces the PowerShell launcher pattern used by the Modbus / S7 fixtures — Docker is the launcher here since opc-plc ships pre-containerized.

File	Purpose
`docker-compose.yml`	Service definition for `otopcua-opc-plc` — image pin, port map, command flags.
`nat/docker-compose.yml`	`otopcua-opc-plc-nat` — a SEPARATE stack (`/opt/otopcua-opcuaclient-nat` on the shared host): opc-plc advertising a private `.invalid` host on internal port 50000, published on 50010. For `NatPublishedEndpointBrowseTests` (`OPCUA_NAT_ENDPOINT=opc.tcp://10.100.0.35:50010`, #806/#813); see the compose file's header. Its PKI is on a volume (#818).
`nat/opc-plc-nat-server.der`	The NAT stack's public server certificate (no key), trusted by the positive secure / host-name NAT tests in a throwaway browse PKI. Refresh it when the stack's certificate is rolled (`docker compose down -v`); expires 2027-11-10.
(this file)	How to run it.

Install

Docker Desktop (Windows) or the docker CLI + daemon (Linux/macOS). Per CLAUDE.md Phase 1 decision #134 the dev box already has Docker Desktop configured with the WSL 2 backend — nothing new to install.

Run

From the repo root:

docker compose -f tests\Drivers\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests\Docker\docker-compose.yml up

Or from this folder:

docker compose up

First run pulls the image (~250 MB). Startup takes ~5-10 seconds; the healthcheck in the compose file surfaces ready state in docker ps (a bash /dev/tcp probe — the image has no netstat, which kept the old check permanently "unhealthy", #817).

To run detached (CI pattern):

docker compose up -d

Stop with docker compose down (removes the container) or docker compose stop (keeps it for fast restart).

Endpoint

Default: opc.tcp://localhost:50000
Override by setting OPCUA_SIM_ENDPOINT before dotnet test — e.g. point at a real OPC UA server in the lab, or at a different Docker host.

What opc-plc advertises

Command flags in docker-compose.yml enable:

--pn=50000 — OPC UA endpoint on port 50000
--ut — unsecured transport endpoint advertised (SecurityPolicy=None). Secured policies are still on the endpoint list; --ut just adds an unsecured option.
--aa — auto-accept client certs (opc-plc's cert trust store lives inside the container + resets each spin-up, so without this the driver's first contact would be rejected).
--alm — alarm simulation enabled; opc-plc publishes TripAlarmType, ExclusiveDeviationAlarmType, NonExclusiveLevelAlarmType, and DialogConditionType events.

Not turned on (but available via compose-file tweaks):

--daa — disable anonymous auth; forces username or cert tokens. Flip on when username-auth / cert-auth smoke tests land.
--fn / --fr / --ft — fast-node variants (100 / 1 000 / 10 000 Hz update rates) for subscription-stress coverage. Not needed for smoke.
--sn / --sr — slow-node / special-shape coverage.

Run the integration tests

In a separate shell, with the simulator running:

cd C:\Users\dohertj2\Desktop\lmxopcua
dotnet test tests\Drivers\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests

Tests auto-skip with a clear SkipReason when localhost:50000 isn't reachable within 2 seconds (OpcPlcFixture).

Known limitations

opc-plc uses the OPCFoundation.NetStandard stack internally — same as our driver. That means bugs common to the stack itself are not caught by this fixture; the follow-up to add open62541/open62541 as a second independent-stack image (task tracked in #215's follow-ups) would close that.

See docs/drivers/OpcUaClient-Test-Fixture.md for the full coverage map + what's still trusted from field deployments.

4.5 KiB Raw Blame History