check Application URI of the server Certificate on OpenSecureChannel

[romanett]

Proposed changes

Implement OpenSecureChannel in compliance with
Spec Part 5.4.1

The ApplicationUri specified in the Server Certificate is the same as the ApplicationUri provided in the EndpointDescription.

Related Issues

• Fixes OPCUA client should check the application URI of the server certifiate #2032

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• Enhancement (non-breaking change which adds functionality)
• Test enhancement (non-breaking change to increase test coverage)
• Breaking change (fix or feature that would cause existing functionality to not work as expected, requires version increase of Nuget packages)
• Documentation Update (if none of the other choices apply)

Checklist

• I have read the CONTRIBUTING doc.
• I have signed the CLA.
• I ran tests locally with my changes, all passed.
• I fixed all failing tests in the CI pipelines.
• I fixed all introduced issues with CodeQL and LGTM.
• I have added tests that prove my fix is effective or that my feature works and increased code coverage.
• I have added necessary documentation (if appropriate).
• Any dependent changes have been merged and published in downstream modules.

Further comments

[codecov]

Codecov Report

Attention: Patch coverage is 30.76923% with 9 lines in your changes are missing coverage. Please review.

Project coverage is 54.59%. Comparing base (fb0fc44) to head (c925e68).
Report is 3 commits behind head on master.

Files	Patch %	Lines
Libraries/Opc.Ua.Client/Session.cs	25.00%	6 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2583      +/-   ##
==========================================
+ Coverage   54.52%   54.59%   +0.07%     
==========================================
  Files         342      342              
  Lines       65044    65054      +10     
  Branches    13331    13334       +3     
==========================================
+ Hits        35462    35517      +55     
+ Misses      25728    25679      -49     
- Partials     3854     3858       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[mregen]

technically the spec outlines to check the responses, but since the cert in the response is already binary compared to this one this is a good place to catch a misaligned application uri before connection! 👍🏼

[mregen]

lets check if a undefined application uri also throw and not be ignored.

[romanett]

To create a test you would need to override some methods of the session to be able to change the endpoint description, can someone provide a hint?

[romanett]

I did some additional manual testing both and cases disallow a new connection:

• server with Application Uri in Cert not matching the returned Endpoint Description
• EndPointDescription without specified ApplicationUri