Lack of proper validation in immudb

@@ -592,9 +592,28 @@ func NewImmuClient(options *Options) (*immuClient, error) {
 	}
 
 	stateProvider := state.NewStateProvider(serviceClient)
-	uuidProvider := state.NewUUIDProvider(serviceClient)
+	serverUUID, err := state.NewUUIDProvider(serviceClient).CurrentUUID(context.Background())
+	if err != nil {
+		return nil, logErr(l, "Unable to get server uuid: %s", err)
+	}
+
+	stateCache := cache.NewFileCache(c.Options.Dir)
+	if !c.Options.DisableIdentityCheck {
+		err = stateCache.ServerIdentityCheck(
+			fmt.Sprintf("%s:%d", c.Options.Address, c.Options.Port),
+			serverUUID,
+		)
+		if err != nil {
+			return nil, logErr(l, "Unable to validate server identity: %s", err)
+		}
+	}
 
-	stateService, err := state.NewStateService(cache.NewFileCache(options.Dir), l, stateProvider, uuidProvider)
+	stateService, err := state.NewStateServiceWithUUID(
+		stateCache,
+		l,
+		stateProvider,
+		serverUUID,
+	)
 	if err != nil {
 		return nil, logErr(l, "Unable to create state service: %s", err)
 	}

@@ -59,27 +59,30 @@ type Options struct {
 	StreamChunkSize     int    // Maximum size of a data chunk in bytes for streaming operations (directly affects maximum GRPC packet size)
 
 	HeartBeatFrequency time.Duration // Duration between two consecutive heartbeat calls to the server for session heartbeats
+
+	DisableIdentityCheck bool // Do not validate server's identity
 }
 
 // DefaultOptions ...
 func DefaultOptions() *Options {
 	return &Options{
-		Dir:                 ".",
-		Address:             "127.0.0.1",
-		Port:                3322,
-		HealthCheckRetries:  5,
-		MTLs:                false,
-		Auth:                true,
-		MaxRecvMsgSize:      4 * 1024 * 1024, //4Mb
-		Config:              "configs/immuclient.toml",
-		DialOptions:         []grpc.DialOption{grpc.WithInsecure()},
-		PasswordReader:      c.DefaultPasswordReader,
-		Metrics:             true,
-		PidPath:             "",
-		LogFileName:         "",
-		ServerSigningPubKey: "",
-		StreamChunkSize:     stream.DefaultChunkSize,
-		HeartBeatFrequency:  time.Minute * 1,
+		Dir:                  ".",
+		Address:              "127.0.0.1",
+		Port:                 3322,
+		HealthCheckRetries:   5,
+		MTLs:                 false,
+		Auth:                 true,
+		MaxRecvMsgSize:       4 * 1024 * 1024, //4Mb
+		Config:               "configs/immuclient.toml",
+		DialOptions:          []grpc.DialOption{grpc.WithInsecure()},
+		PasswordReader:       c.DefaultPasswordReader,
+		Metrics:              true,
+		PidPath:              "",
+		LogFileName:          "",
+		ServerSigningPubKey:  "",
+		StreamChunkSize:      stream.DefaultChunkSize,
+		HeartBeatFrequency:   time.Minute * 1,
+		DisableIdentityCheck: false,
 	}
 }
 
@@ -216,6 +219,11 @@ func (o *Options) WithHeartBeatFrequency(heartBeatFrequency time.Duration) *Opti
 	return o
 }
 
+func (o *Options) WithDisableIdentityCheck(disableIdentityCheck bool) *Options {
+	o.DisableIdentityCheck = disableIdentityCheck
+	return o
+}
+
 // String converts options object to a json string
 func (o *Options) String() string {
 	optionsJSON, err := json.Marshal(o)

@@ -18,6 +18,8 @@ package client
 
 import (
 	"testing"
+
+	"github.com/stretchr/testify/require"
 )
 
 func TestOptions(t *testing.T) {
@@ -43,30 +45,31 @@ func TestOptions(t *testing.T) {
 		WithUsername("some-username").
 		WithPassword("some-password").
 		WithDatabase("some-db").
-		WithStreamChunkSize(4096)
+		WithStreamChunkSize(4096).
+		WithDisableIdentityCheck(true)
+
+	require.Equal(t, op.LogFileName, "logfilename")
+	require.Equal(t, op.PidPath, "pidpath")
+	require.True(t, op.Metrics)
+	require.Equal(t, op.Dir, "clientdir")
+	require.Equal(t, op.Address, "127.0.0.1")
+	require.Equal(t, op.Port, 4321)
+	require.Equal(t, op.HealthCheckRetries, 3)
+	require.True(t, op.MTLs)
+	require.Equal(t, op.MTLsOptions.Servername, "localhost")
+	require.Equal(t, op.MTLsOptions.Certificate, "no-certificate")
+	require.Equal(t, op.MTLsOptions.ClientCAs, "no-client-ca")
+	require.Equal(t, op.MTLsOptions.Pkey, "no-pkey")
+	require.True(t, op.Auth)
+	require.Equal(t, op.MaxRecvMsgSize, 1<<20)
+	require.Equal(t, op.Config, "configfile")
+	require.Equal(t, op.TokenFileName, "tokenfile")
+	require.Equal(t, op.Username, "some-username")
+	require.Equal(t, op.Password, "some-password")
+	require.Equal(t, op.Database, "some-db")
+	require.Equal(t, op.StreamChunkSize, 4096)
+	require.True(t, op.DisableIdentityCheck)
+	require.Equal(t, op.Bind(), "127.0.0.1:4321")
+	require.NotEmpty(t, op.String())
 
-	if op.LogFileName != "logfilename" ||
-		op.PidPath != "pidpath" ||
-		!op.Metrics ||
-		op.Dir != "clientdir" ||
-		op.Address != "127.0.0.1" ||
-		op.Port != 4321 ||
-		op.HealthCheckRetries != 3 ||
-		!op.MTLs ||
-		op.MTLsOptions.Servername != "localhost" ||
-		op.MTLsOptions.Certificate != "no-certificate" ||
-		op.MTLsOptions.ClientCAs != "no-client-ca" ||
-		op.MTLsOptions.Pkey != "no-pkey" ||
-		!op.Auth ||
-		op.MaxRecvMsgSize != 1<<20 ||
-		op.Config != "configfile" ||
-		op.TokenFileName != "tokenfile" ||
-		op.Username != "some-username" ||
-		op.Password != "some-password" ||
-		op.Database != "some-db" ||
-		op.StreamChunkSize != 4096 ||
-		op.Bind() != "127.0.0.1:4321" ||
-		len(op.String()) == 0 {
-		t.Fatal("Client options fail")
-	}
 }

@@ -63,9 +63,20 @@ func (c *immuClient) OpenSession(ctx context.Context, user []byte, pass []byte,
 		}
 	}()
 
+	stateCache := cache.NewFileCache(c.Options.Dir)
+	if !c.Options.DisableIdentityCheck {
+		err = stateCache.ServerIdentityCheck(
+			fmt.Sprintf("%s:%d", c.Options.Address, c.Options.Port),
+			resp.GetServerUUID(),
+		)
+		if err != nil {
+			return err
+		}
+	}
+
 	stateProvider := state.NewStateProvider(serviceClient)
 
-	stateService, err := state.NewStateServiceWithUUID(cache.NewFileCache(c.Options.Dir), c.Logger, stateProvider, resp.GetServerUUID())
+	stateService, err := state.NewStateServiceWithUUID(stateCache, c.Logger, stateProvider, resp.GetServerUUID())
 	if err != nil {
 		return errors.FromError(fmt.Errorf("unable to create state service: %v", err))
 	}