e8afa4237b
Security hardening: 25-finding pass against SFI / SDL / OPC UA Part 2 baseline
...
Addresses 25 of 39 findings from a branch security review (assessment 5).
CRITICAL: F1 gate MCP key-disclosure tools, F2 0600 keylog/pcap files, F3 per-user BaseFolder, F16 ChannelKeyMaterial IDisposable + ZeroMemory, F17 PcapFileReader MaxPacketBytes (64MB) bound, F18 FlowBuffer MaxBufferBytes (256MB) cap, F19 NodeSet export path validation, F20 ReplaySession listenPort range.
HIGH: F4 IPcapAuditSink + LoggerPcapAuditSink + rate-limited frame-capture audit, F5 AES-256-GCM EncryptedKeyLogStream + SessionKeyManager (sibling .key file 0600), F14 IKeyEscrowProvider abstraction + DiskKeyEscrowProvider default (DI TryAddSingleton so consumers can route to KMS), F21 ChannelManagerOptions.MaxChannels (256) cap, F22 CaptureSessionManager.SessionFolder path-traversal guard, F23 PacketDecodeTools pcapPath/keyLogPath validation, F24 replay_pcap speed validation (NaN/Inf/<=0), F25 explicit permissions blocks on .github/workflows.
MEDIUM: F6 OnTokenActivated [EditorBrowsable(Never)] + key-disclosure doc, F7 IDiagnosticsChannelMutation accessor + stack-walk caller guard (replaces internal OfflineLoadTokens), F8 PcapOptions.AllowMockClientReplay + AllowedReplayEndpoints, F9 PcapFileWriter / UaKeyLog*Writer rotation (.NNN suffix) with MaxBytes / MaxArtifactsPerSession, F13 keylog-isolation gap acknowledgment doc, F15 HashChainedAuditFileSink (HMAC-chained JSONL ledger, VerifyChain), F11 replay URL scheme allow-list (opc.tcp/opc.tcps/opc.https).
LOW/INFO: F10 SBOM/CVE governance comments on PacketDotNet/SharpPcap + Docs/PacketCapture.md, F12 Security model section at top of PacketCapture.md.
Tests: 100+ new NUnit tests across Audit/, Capture/, Frame/, KeyLog/, McpServerTools/, Replay/, Stack/Tcp/, DependencyInjection/. All file-mode/HMAC-chain/encryption tests are [Platform(Linux,MacOSX)]-gated where Unix-specific.
Build: 0 warnings / 0 errors on Stack/Opc.Ua.Bindings.Pcap for net8.0 and net9.0. net10.0 build is environmentally blocked by a corrupted local SDK 10.0.300 workload manifest (microsoft.net.workload.mono.toolchain.net6 10.0.108 requires Emscripten.net6 >=10.0.108, only 9.0.17 installed); requires 'dotnet workload repair' from an elevated shell to validate the third TFM. No tests were run pending the SDK fix. 5 CA1508/CA2000 false positives suppressed with documented #pragma blocks (ownership transfer in escrow factory / IAsyncEnumerable iterator / unreachable catch path).
Deferred to follow-up GitHub issues: 9 MEDIUM (M-SEC-07/09/10/11/12/13/16/22/31 — exception sanitization, reconnect defaults, cert-rotation races, nonce-suppress deprecation, parser hardening) and 10 LOW/INFO (L-SEC-14/15/17/23/24/33/34/35/36/37 — handler cleanup, EventSource endpoint masking, key-log schema validation, EOL deps, SAST). Full reasoning in session plan.md Round 10.
2026-06-11 13:10:09 +02:00
b16c8020dd
Bump actions/checkout from 5 to 6 ( #3355 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-24 23:17:46 +02:00
35db52a7a6
Move from .net 9 to .net 10 SDK and build new target framework .net 10 ( #3333 )
2025-11-13 10:45:47 +01:00
f8042e445c
Check bounds for switched on values and roslyn cleanup ( #3264 )
2025-10-21 09:28:19 +02:00
234f5bac55
Bump github/codeql-action from 3 to 4 ( #3260 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3 to 4.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/v3...v4 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-14 16:03:57 +03:00
bdd1036127
Bump actions/setup-dotnet from 4 to 5 ( #3191 )
...
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet ) from 4 to 5.
- [Release notes](https://github.com/actions/setup-dotnet/releases )
- [Commits](https://github.com/actions/setup-dotnet/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/setup-dotnet
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-08 16:14:16 +03:00
f9cbb0c1bd
Bump actions/checkout from 4 to 5 ( #3165 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-18 19:51:50 +02:00
d831232616
Bump windows runners from 2019 to 2022 and from 2022 to 2025 ( #3086 )
2025-06-04 15:07:45 +03:00
ef9387b525
Enable Durable Subscriptions ( #2978 )
...
* Enable Durable Subscriptions (#9 )
* [Server] Durable Subscriptions (#2683 )
* Implement a system test for DurableSubscriptions (#2839 )
* Client Side
Co-authored-by: ALTERNATE-DEV\Archie <archie@dreamsandadventures.ca >
* make a static Method CalculateRevisedQueueSize
* Adress review feedback
* fix FilterRetainTests
* Add MonitoredItem Id to Queues
Use NodeIdDictionary where possible
2025-02-28 13:46:49 +02:00
deb3391b65
Bump microsoft/setup-msbuild from 1.3.2 to 2.0.0 ( #2502 )
...
Bumps [microsoft/setup-msbuild](https://github.com/microsoft/setup-msbuild ) from 1.3.2 to 2.0.0.
- [Release notes](https://github.com/microsoft/setup-msbuild/releases )
- [Changelog](https://github.com/microsoft/setup-msbuild/blob/main/building-release.md )
- [Commits](https://github.com/microsoft/setup-msbuild/compare/v1.3.2...v2.0.0 )
---
updated-dependencies:
- dependency-name: microsoft/setup-msbuild
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-05 18:51:05 +01:00
5afbd81dd6
Bump microsoft/setup-msbuild from 1.3.1 to 1.3.2 ( #2480 )
...
Bumps [microsoft/setup-msbuild](https://github.com/microsoft/setup-msbuild ) from 1.3.1 to 1.3.2.
- [Release notes](https://github.com/microsoft/setup-msbuild/releases )
- [Changelog](https://github.com/microsoft/setup-msbuild/blob/main/building-release.md )
- [Commits](https://github.com/microsoft/setup-msbuild/compare/v1.3.1...v1.3.2 )
---
updated-dependencies:
- dependency-name: microsoft/setup-msbuild
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-01 14:00:16 +01:00
9c5219372b
Bump github/codeql-action from 2 to 3 ( #2434 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 2 to 3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/v2...v3 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-22 10:53:22 +01:00
2b0d7ff7da
Bump actions/setup-dotnet from 3 to 4 ( #2418 )
...
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet ) from 3 to 4.
- [Release notes](https://github.com/actions/setup-dotnet/releases )
- [Commits](https://github.com/actions/setup-dotnet/compare/v3...v4 )
---
updated-dependencies:
- dependency-name: actions/setup-dotnet
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-11 13:50:40 +01:00
343f7b0fbc
Add custom test targets to the build process, support for .NET 8. ( #2410 )
...
The goal is to reduce the overall number of builds, stop using end of life platforms in the build pipeline and to support
build of future/deprecated build targets in a custom build step, which is also triggered weekly in the ci builds.
In addition:
- added a doc which describes the release and versioning strategy of this project
- produce the Nuget packges with .NET 8 assemblies.
- produce a Docker build based on a .NET 8 based container.
- add custom test targets to test outdated platforms. Need a manual step to enable for VS or command line.
- bug fixes: the latest move to an alternate crypto library for Bouncy Castle, which is only used for the GDS support and .NET Framework 4.6.2./netstandard2.0, revealed already a few issues which were previously not found.
- only .NET8/.NET6/.NET Framework 4.8 are tested in Pull requests. Remaining builds in weekly scheduled builds.
2023-12-07 12:03:37 +01:00
2276c43b61
Bump actions/checkout from 3 to 4 ( #2305 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v3...v4 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-09-13 15:41:58 +03:00
043a56c3f2
Deprecate .NET framework 4.6.2 support, sync with samples repo ( #2165 )
...
- Deprecate support for Nuget package support of .NET Framework 4.6.2
- Bump sample applications to 4.8
- update some copyright headers / supporting files (editorconfig etc.)
- fix a few warnings
- fix an issue with `SessionReconnectHandler`, in certain combination of reconnect period and exponential backoff the .NET sample app never reconnected.
2023-05-31 18:53:56 +02:00
4325cd7223
Bump microsoft/setup-msbuild from 1.1.3 to 1.3.1 ( #2101 )
...
Bumps [microsoft/setup-msbuild](https://github.com/microsoft/setup-msbuild ) from 1.1.3 to 1.3.1.
- [Release notes](https://github.com/microsoft/setup-msbuild/releases )
- [Changelog](https://github.com/microsoft/setup-msbuild/blob/main/building-release.md )
- [Commits](https://github.com/microsoft/setup-msbuild/compare/v1.1.3...v1.3.1 )
---
updated-dependencies:
- dependency-name: microsoft/setup-msbuild
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-17 15:32:46 -07:00
23cd8f11a0
Fix CodeQL build ( #2093 )
...
- autobuild stopped working, add build steps for main solutions
- switch to windows build system
2023-03-07 15:28:01 +01:00
61a61081f6
Improve ref server docker build ( #2035 )
...
- complete build in Dockerfile, not in ci pipeline
- Use recommended build tasks for github actions
- build multiarch with linux/amd64,linux/arm64
- docker signing support with cosign (yet disabled)
2023-01-05 16:10:17 +01:00
8c0291b554
Bump Microsoft.NET.Test.Sdk from 17.3.2 to 17.4.0 and github actions ( #1985 )
...
* Bump Microsoft.NET.Test.Sdk from 17.3.2 to 17.4.0
Bumps [Microsoft.NET.Test.Sdk](https://github.com/microsoft/vstest ) from 17.3.2 to 17.4.0.
- [Release notes](https://github.com/microsoft/vstest/releases )
- [Commits](https://github.com/microsoft/vstest/compare/v17.3.2...v17.4.0 )
---
updated-dependencies:
- dependency-name: Microsoft.NET.Test.Sdk
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: Martin Regen <mregen@microsoft.com >
2022-11-14 21:04:45 +01:00
5a77423265
Update codeql action script to v2 ( #1894 )
...
* bump up abstraction logging 3.1.27, add references to solve some warnings
2022-08-08 05:38:24 +02:00
a147eb55c5
Tracing and Logging improvements for the UA Core and libraries ( #1631 )
...
- support for Microsoft.Extensions.Logger.ILogger in Opc.Ua.Core as the new logging interface
- backward compatible with config and TraceEvents
- new API Utils.SetLogger allows to set ILogger
- updated Console samples to demonstrate ILogger support with Serilog
- support for EventSource logging
- see Docs/Logging.md for more info
2021-12-16 00:20:08 +01:00
25e0998081
Create codeql-analysis.yml ( #1345 )
...
-Add CodeQL code scanner
-EnableNetAnalyzers
-small tweak for .editorconfig
2021-04-01 08:55:42 +02:00
Marc Schier