Support family-only fingerprints with legacy public-key fallback

[gijzelaerr]

Problem

Some legacy PLCs return only a key-family identifier such as 00, 01 or 03 instead of the complete family:key-id fingerprint.

Our parser requires the complete fingerprint, so authentication is skipped even when the correct family keys are present. The active .NET implementation now tries known family candidates on fresh connections and caches the successful key.

Scope

• Distinguish complete fingerprints from family-only identifiers.
• Enumerate only public keys belonging to the reported family.
• Try each candidate on a fresh connection/session because a failed setup may invalidate the current one.
• Cache a confirmed mapping for subsequent connections.
• Provide an option to disable fallback where deterministic/no-probing behavior is required.
• Bound attempts and log key identifiers without exposing key material.

Acceptance criteria

• Existing complete-fingerprint selection remains unchanged.
• Family-only responses can authenticate using a matching catalog key.
• A failed candidate is never retried in the same invalidated session.
• Unknown families and exhausted candidates fail clearly.
• Tests cover complete, family-only, unknown-family, disabled-fallback and cached-success paths.

References

• Umbrella hardware issue: S7-1200 Session Setup Incomplete #710
• DotNetProjects/S7CommPlusDriver automatic legacy public-key fallback