Repository navigation
server: tcp+tls with client certificates (--tls-cert, --tls-key, --tls-ca) - #6
Merged
Merged
Conversation
…s-ca) server static and server replay serve Modbus/TCP Security when given --tls-cert: the server presents its certificate and requires a client certificate signed by the --tls-ca bundle, which is therefore required. The flags read MODBUSCTL_TLS_CERT, MODBUSCTL_TLS_KEY and MODBUSCTL_TLS_CA, like the client. Bad or incomplete TLS files are invalid input before the server binds. The listener line names tcp+tls when it is on. End-to-end tests record over tcp+tls, serve the capture over tcp+tls with both servers and read it back with the modbusctl TLS client, and check that untrusted and plain-TCP clients are rejected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
server staticandserver replayserve Modbus/TCP Security (tcp+tls) when given--tls-cert. They served plain Modbus TCP only.--tls-cert,--tls-key,--tls-ca(MODBUSCTL_TLS_CERT,MODBUSCTL_TLS_KEY,MODBUSCTL_TLS_CA, the variables the client reads) inconfig.ServerTLSConfig, embedded inStaticServerConfigandReplayServerConfig.--tls-certturns TLS on;--tls-keydefaults to the--tls-certfile.--tls-cais required: the CA bundle that signs client certificates. go-modbus requires and verifies a client certificate on every connection.validate.CheckStaticServerConfig/CheckReplayServerConfigload the files. A missing/unreadable file, mismatched key,--tls-certwithout--tls-ca, or--tls-key/--tls-cawithout--tls-certis invalid input (exit 3), before the server binds or prints anything.🚀 Serving Modbus TCP Security (tcp+tls, client certificates required) on … port N.Tests:
internal/modbus/e2e_tls_server_test.go: record over tcp+tls, replay over tcp+tls withServeReplayand read back with the modbusctl TLS client until the last value;ServeStaticover tcp+tls (FC03 and FC17); server key in the certificate file; both servers reject a client cert of another CA, a server cert used as a client cert, a client that does not trust the server, and a plain TCP client (📊 Served 0 requests); bad server TLS files → invalid input with nothing printed.TestE2ETLS_recordAndReplaynow serves the capture back over TLS with the realserver staticinstead of a go-modbus stand-in.cmd/server/tls_test.go: same through the CLI flags, plus help and validation exit codes.README (new "Serving over Modbus/TCP Security" section, env table, features), command help examples and RELEASE.md (v3.2.0, unreleased) updated.
make checkpasses: 0 lint issues,-racetests green, coverage 96.4%.🤖 Generated with Claude Code