14 Commits

Author	SHA1	Message	Date
romanett	9b034f8291	Enable nullable reference types centrally; migrate all unset and annotations-only projects (#4700) ... # Description Nullable reference types are now enabled once, in `common.props`, and every project in the repository builds warning-clean with them. **Configuration** - `<Nullable>enable</Nullable>` lives in `common.props`. All per-project `<Nullable>` settings are removed: 178 project files (enable, annotations, and the `disable` in the three Aot test projects). - 419 per-file `#nullable enable`/`restore` directives and the 4 `#nullable disable` directives are removed. - Kept on purpose: - The 5 `<auto-generated>` schema files (`UANodeSet.cs`, `UA Type Dictionary.cs`, `OPCBinarySchema.cs`, `SecuredApplication.cs`, `PInvokeHelper.cs`) keep `#nullable enable`. The compiler ignores the project setting in generated code, so the directive is required there. - `tests/Opc.Ua.Interop.LegacyPeer` keeps `disable`. It builds against the 1.5.378 packages and does not import the repository props. - `docs/DeveloperGuide.md` and `.github/copilot-instructions.md` now describe the central setting. **Migration** (the 43 unset and 13 annotations-only projects, roughly 10k diagnostics) - **Production code: annotated at the declarations.** Covers `tools/Opc.Ua.SourceGeneration.Core`, `src/Opc.Ua.Lds.Server` and the LDS sample. - Members, parameters and returns are nullable where null actually flows. - Null-check helpers carry `[NotNullWhen]` (`IsNull`, `IsValidXmlName`, `IsMethodTypeDesign`). - `CoreUtils.Format`, `Utils.Format`, `ITemplateWriter.WriteLine` take `params object?[]`. `Template.AddReplacement` takes `string?` (rendering already skips null replacements). - `IRegisteredServerStore.RegisterAsync` returns `Task<RegistrationEntry?>`: it returns null when a registration is removed. - Dereferences backed by an invariant (for example, the validated model) use `!`, so runtime behaviour is unchanged. - **Behavioural changes in production code** (small, deliberate): - `NodeSetToModelDesign` throws `InvalidOperationException` when the file is not a NodeSet. Before, it threw a NullReferenceException on the next line. - `ModelDesignValidator` starts its lookup tables empty instead of null. A redundant `if (m_nodes == null) return;` guard is gone. - **Test code: minimal annotations.** - `?` on values that can be null, `!` where the test asserts non-null. - `= null!` for fixture members assigned in SetUp. - `TryGetStructure<T>(out T? x)` where the inferred `T?` broke the `IEncodeable` constraint. - A few redundant `== null` checks on structs (`NodeId`, `ArrayOf<T>`) folded into the adjacent `IsNull`/`Count` checks. **Notes for reviewers** - The diff is large (~1,500 files) but almost entirely mechanical: `?`, `!` and directive removal. The non-annotation changes are listed above. - Known follow-up, not done here: `IModelDesign.Namespaces/TargetNamespace/NamespaceUris` stay non-nullable even though the validator returns null before it loads a dictionary. Making them nullable would ripple through every generator call site. ## Related Issues - Fixes #4439 ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. The "no new warnings" box covers net10.0 and net48: full non-incremental builds of `UA.slnx`, `tools/SourceGeneration.slnx`, `tools/MigrationAnalyzer.slnx` and the Aot test projects finished with 0 warnings and 0 errors under the repository's warnings-as-errors settings. net9.0 and net8.0 also had no nullable diagnostics, but they were not rebuilt after the final fixes. Tests have not been run locally yet. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 08:48:13 +02:00
romanett	7212607f16	OPC UA Part 3 compliance: permissions, Write semantics, NodeManagement, NodeSet DataTypes, locales (#4675) ... # Description Fixes the High and Medium findings of an OPC UA Part 3 (OPC 10000-3, Address Space Model) compliance audit. Each finding was checked against the full spec text (Parts 3, 4, 5, 6, 14 and 18) before it was fixed. Every fix comes with regression tests that fail without it. ### Role permissions (Part 3 §8.55, Part 4 §5.12.2.2) - The type-hierarchy exemption in `MasterNodeManager.ValidateRolePermissions` / `ValidateAccessRestrictions` now covers only Browse, Read and ReadRolePermissions. Type nodes stay visible to generic clients, which was the intent of #3705; every other permission bit is now enforced on them. - `ReceiveEvents` is enforced on the EventType node. The standard NodeSet grants it on `AuditEventType` and its subtypes only to SecurityAdmin, so only SecurityAdmin sessions now receive audit events. - Call checks the `Call` permission and AccessRestrictions on the Object as well as on the Method. - When a Call's `methodId` is the Method declaration of the ObjectType, the Object's Method with the same BrowseName is permission-checked and invoked. The declaration is used only if the Object has no such Method. This applies to `AsyncCustomNodeManager`, `CustomNodeManager2` and the sample node manager. ### Write service (Part 3 §5.6.2, §8.40, §8.57; Part 4 §5.11.4) - The synchronous `OnWriteValue` path (fluent `OnWrite`) checks DataType and ValueRank first (`Bad_TypeMismatch`). After an IndexRange write it merges the slice into the cached value instead of replacing it. - StatusWrite / TimestampWrite are enforced (`Bad_WriteNotSupported`). - Undefined enumeration values and invalid OptionSet writes return `Bad_OutOfRange`. OptionSet writes merge only the valid bits into the stored value. - New `ReportPropertyValueChanged` / `ReportSemanticChange` let server code raise SemanticChangeEvents for changes it makes itself. - Required follow-up (Part 14 §6.2.11.1): if an external target rejects a timestamp, the PubSub subscriber's TargetVariables writer retries without it. ### NodeManagement and Call arguments (Part 3 §5.5.2, §5.7.3, §6.4.2; Part 4 §5.8, §5.12.2) - AddNodes creates the Mandatory InstanceDeclarations of the TypeDefinition and rejects abstract or Interface types (`Bad_TypeDefinitionInvalid`). - AddReferences, DeleteReferences and DeleteNodes bump NodeVersion and raise GeneralModelChangeEvents. - Clients may omit trailing optional input arguments (`HasOptionalInputArgumentDescription`). ### NodeSet DataTypes (Part 3 §5.8.3, §8.48; Part 6 Annex F.12) - `UANodeSet.Import` completes structure definitions with the base type's fields (base fields first). It creates definitions for structures without fields and sets `DefaultEncodingId`. `StructureDefinition.FirstExplicitFieldIndex` marks the subtype's own fields. - `DataTypeState` no longer mutates the stored definition on read. ### Locales (Part 3 §5.2.5, §8.5; Part 4 §5.4) - Read, Browse and data change notifications return the translation that best matches the session's LocaleIds, or all translations for `mul`. The selection lives in the server dispatcher and is built on `ResourceManager`: the new `TranslateValue` calls the overridable `Translate`. - Locale ids are matched case-insensitively, and fallback translations carry their real locale. ### Client complex types (Part 6 §5.1.7) - The Reflection.Emit builder encodes only `IsOptional` subtyped fields as ExtensionObject. It also supports OptionSet subtypes: an unsupported type is skipped instead of aborting the whole load. - `TypeInfo.GetXmlName` uses the data type's XML name for dynamic structures and OptionSets (the XML body element was `<Structure>`). Both builders now produce identical XML. ## Behaviour changes All are documented in `docs/MigrationGuide.md`. - **Audit events:** only SecurityAdmin receives them. The CTT "Auditing Connections" unit needs a SecurityAdmin user (e.g. sysadmin); `AuditingOperationTests` was updated. - **Write timestamps and status:** clients writing a SourceTimestamp or a non-Good StatusCode get `Bad_WriteNotSupported` unless the Variable has StatusWrite/TimestampWrite. No variable in `src/` sets these bits. - **AddNodes:** it rejects abstract types (including `BaseVariableType` and `BaseEventType`), and new instances now come with child nodes. - **Call:** the Object needs the Call permission. The Object's own Method runs even when the call names the type declaration. ## Not included - Low-severity findings: missing validation on optional services and author-side NodeSet rules. - LocalizedText nested inside structures or Variant arrays, and in HistoryRead or Call outputs. ## Testing net10.0, Debug, one suite at a time on the merged branch. All suites below pass: | Suite | Passed | |---|---| | Types | 11430 | | Core.Encoders | 2947 | | Core.Schema | 179 | | Core.Security | 558 | | Client | 2761 | | Server | 8210 | | InformationModel | 1080 | | Features | 145 | | History | 536 | | Di | 455 | | Machinery | 167 | | Robotics | 661 | | Robotics.Intent | 22 | | Pumps | 75 | | Scales | 122 | | Positioning | 69 | | ISA95 | 144 | | Vision | 484 | | PubSub | 1490 | | PubSub.Adapter | 151 | | PubSub.Server | 177 | | Redundancy.Server | 856 | | Lds | 173 | | Configuration | 241 | | WotCon | 1496 | - **Client.ComplexTypes:** one test wrote a SourceTimestamp to a variable without TimestampWrite. It is fixed in this PR, and the suite has not been re-run since. - **Core:** 6068 passed, 1 failure in `ActivityTraceFlags_Metrics_ShouldRecordMetricsOnly`. That telemetry test passed when re-run alone, so it looks flaky. - **Still running:** Sessions, Subscriptions (Classic, Durable, standard) and Interop. Results will follow on this PR. - `UA.slnx` builds with 0 errors for net10.0 and net48, with no new analyzer warnings in changed files. ## Related Issues - Part 3 compliance audit (no tracking issue) ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 12:43:59 +00:00
romanett	61edaa1ed0	Remove netstandard2.1 and net472 target frameworks (#4624) ... # Description Drops support for **netstandard2.1** and **.NET Framework 4.7.2**. Libraries now target `net48`, `net8.0`, `net9.0` and `net10.0`. `Opc.Ua.Types` and `Opc.Ua.SourceGeneration.Core` still also target `netstandard2.0`, but only because the Roslyn source generators load them. There is no general netstandard2.0 support. **Preprocessor directives** (112 files) - Every `#if`/`#elif` mentioning `NETSTANDARD2_1*`, `NET472*`, `NET_STANDARD_TESTS`, `SKIP_ECC_CERTIFICATE_REQUEST_SIGNING` or `NETSTANDARD*` was evaluated against the remaining TFM set (net48, net8/9/10, plus netstandard2.0 inside `Opc.Ua.Types`/`tools`) and simplified. Dead branches were removed. - Example: `NETSTANDARD2_1 || NET8_0_OR_GREATER` → `NET8_0_OR_GREATER`. - Example: `NET8_0_OR_GREATER || NET472_OR_GREATER` → removed (always true). - Netstandard-only code was removed: `UnixFileModeShim`, the CRDT reflection path in `ReplicatedGossipOptions.CreateReaderOptions`, and the netstandard2.1-only test variants. **Custom test logic** - `targets.props` drops the `net472`, `netstandard2.0` and `netstandard2.1` `CustomTestTarget` profiles, `NetStandardTests` and `SKIP_ECC_CERTIFICATE_REQUEST_SIGNING`. Supported values are now `net48`, `net8.0`, `net9.0`, `net10.0`. - The `NET_STANDARD_TESTS` define is removed from 29 test projects. - The "build netstandard shells as net10.0" overrides are removed from 18 projects. - `RestrictForLegacyTfm` now only applies to `net48`. - `tests/customtest.bat` is updated to the new values. **Build / packaging / CI** - MSBuild TFM conditions are simplified: Kestrel package choice, MQTTnet v4 (net48 only), BouncyCastle, Di/OpenUsd/Vision/Stress test excludes, and `System.IO.FileSystem.AccessControl` (dropped from Core). - The MigrationAnalyzer nuspec drops its net472/netstandard2.1 lib groups. The Azure signing lists are updated. - `get-ci-matrix.ps1` removes the net472/netstandard test profiles (including the PR-gating `linux-netstandard2.1`) and the matching build legs. **Breaking API change (2.0 preview):** removed `HttpsTransportListener.IsWssTransportSupported` and `ReplicatedGossipOptions.IsGossipStateDecodingSupported`. They only returned `false` on netstandard2.1 and are now always `true`. The test guards that used them were removed as well. **Docs** - NuGet READMEs, `README.md`, `DeveloperGuide.md`, `PubSub.md`, the certificate/ECC/identity docs and the 2.0 migration guide (plus its `.agents` skill mirror) are updated. - The migration guide notes that 4.7.2 consumers must move to 4.8 and netstandard2.1 consumers to net8.0+. ### Reviewer notes - The `System.IO.FileSystem.AccessControl` `PackageVersion` pin is left in `Directory.Packages.props`. It has no direct reference any more, but transitive pinning is on, so it was kept to avoid shifting resolved versions. - The `#if` rewrite was done mechanically by a truth-table evaluator. The diff in the `.cs` files is limited to directive lines, removed dead branches, and stale-comment updates. ### Verified locally - `dotnet build UA.slnx -p:CustomTestTarget=net48`: 0 errors. - `dotnet build UA.slnx -p:CustomTestTarget=net10.0`: 0 errors. - Default multi-target builds (no `CustomTestTarget`) of Opc.Ua.Types, Bindings.Https, PubSub.Mqtt and Redundancy.Server succeeded. - net10.0 tests: - Opc.Ua.Redundancy.Server.Tests: 840/840 passed. - Opc.Ua.Types.Tests: 11363 passed, 1 skipped. - ModelDependencyScanner tests: 20/20 passed. - The full test suite was **not** run locally. ## Related Issues - None ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-02 17:09:49 +02:00
romanett	ce88955f70	Harden encoders/decoders against untrusted input and align them with Part 6 / Part 14 (#4599) ... # Description Hardens the encoders and decoders against untrusted input and aligns them with OPC 10000-6 (1.05) and OPC 10000-14. This comes from an audit of every codec reachable from a peer: - Binary, JSON and XML decoders and encoders; - built-in and complex types; - UA-TCP/UASC framing; - PubSub UADP and PubSub JSON. The audit found 97 issues: 1 critical, 7 high, 39 medium and 50 low. They are all fixed here, one commit per finding (IDs B1-, J1-, X1-, T1-, S1-, U1-, P1-, E1-, E2- in the commit subjects). Every fix was then checked against the spec a second time, and the deviations that re-check found were fixed as well (`*-spec` commits). ## Security (decoders reachable from unauthenticated peers) - **Allocation from length prefixes (B1-1, B1-5, U1-1, U1-3).** - Array, string and byte-string lengths are checked against the bytes left in the message before anything is allocated. - Arrays read element by element grow as elements are decoded, so nested length prefixes can no longer multiply memory. - UADP discovery counts and chunk reassembly buffers are bounded the same way. - **Stack exhaustion.** Nesting is checked for remaining stack (`RuntimeHelpers.EnsureSufficientExecutionStack` mapped to `BadEncodingLimitsExceeded`), and the large Variant read/write methods were split into scalar, array and matrix methods. Measured on 1 MB and 256 KB threads, no codec overflows at the default limits any more. - **XML element depth (X1-1).** XmlElement values and raw ExtensionObject bodies are copied node by node with a depth limit, instead of with the recursive `InnerXml`, `ImportNode`, `InnerText` and `DeepEquals` calls. - **Limit bypasses:** - JSON NodeId, QualifiedName and opaque strings now respect MaxStringLength and MaxByteStringLength (J1-1). - Matrix rank is limited to 32. - Decimal size is bounded (T1-3). - XML base64 is checked before it is decoded. - XML arrays are checked before each element is read. - **CPU and algorithmic cost:** - UADP reassembly uses an O(1) overlap check with a per-message chunk cap (U1-2). - PubSub JSON matches fields to metadata through a name index (P1-2). - LocalizedText "mul" text is parsed lazily (T1-5). - Unknown SecurityTokenIds trigger a throttled background SKS refresh instead of an inline call per datagram (U1-9). - **PubSub metadata poisoning (P1-1).** Inbound metadata is registered only for identities a configured reader expects, is capped, and an unauthenticated message can no longer pin a version. - **Exception contract.** Decoders fail with `ServiceResultException` (BadDecodingError / BadEncodingLimitsExceeded) instead of letting ArgumentException, InvalidOperationException, TypeLoadException and similar escape. - **UASC (S1-*):** - OPN and CLO must be single final chunks. - The certificate of an unsigned OPN is ignored. - The padding and ExtraPadding bytes are validated. - A renewed token is activated only after a chunk has been verified with it. - A policy change on renewal is rejected before the channel certificate is touched. - Secured chunk length arithmetic is bounded. ## Wire-visible behaviour changes All follow the spec exactly; there is no reader for the old forms unless noted. - **UA Binary:** - Variant type ids 26-31 decode as ByteString. - Picoseconds without their timestamp are ignored, and values of 10000 and above are clamped to 9999. - A Null-type Variant with the array flag consumes its length and dimensions. - **UA JSON:** - Messages are ExtensionObjects with the body inline; there is no `UaBody` envelope any more (5.4.9 / 5.4.2.16). - The Variant `Value` is omitted exactly for NULLs of nullable types (Table 41). - RawData keeps nested UaType/UaTypeId and the StatusCode Symbol. - Duplicate member names are rejected. - `{}` decodes as a null ExtensionObject. - Numbers and identifiers are parsed strictly and culture-independently. - QualifiedName follows 5.4.2.14. - Opaque bodies of known types carry the DataType id. - Enumerations without a literal are written as the number. - **UA XML:** - The earliest DateTime is written as `0001-01-01T00:00:00Z`. - Null typed scalars and null array elements are written with `xsi:nil`. - An ExtensionObject without a body has no `Body` element. - Strings XML cannot represent are rejected. - Only the xs:dateTime and xs:date forms are accepted; a value without a zone is still read as UTC, because published model files use it. - Only the Part 6 Guid form is accepted. - Booleans are case-sensitive in XmlDecoder. - **UA-TCP:** - OPNC/OPNA/CLOC/CLOA fault the channel. Older releases that split a long-chain OPN into chunks are rejected, so this needs a release note. - The sender truncates the certificate chain to fit a single chunk. - The received certificate chain is sized from the chunk size. - Hello buffer sizes down to 1024 bytes are honoured; below that, an ERR with Bad_TcpInternalError is sent. - A 4096-byte Error reason is accepted, and the SecurityPolicyUri limit is 255 bytes. - **PubSub UADP:** - Chunk NetworkMessages use the Part 14 7.2.4.4.4 layout, and each chunk is secured on its own with its own sequence number. - The Sizes array is part of the secured payload. - Padded RawData keeps its length prefix, and null values are written as -1. - DataSetMessages with the valid bit clear are skipped. - Null discovery arrays are accepted. - **PubSub JSON:** - Variants use `UaType`/`Value`, with the 7.2.5.4.2 top-level collapse. The deprecated `Type`/`Body` form is still read. - Status is written as a `{Code,Symbol}` object; a numeric Status is still accepted. - Discovery messages follow Tables 188-192, with GUID MessageIds. - Enumeration fields are written as `Name_Value`. - Fields appended with a MinorVersion bump are accepted. ## Known deviations and limitations (documented, not changed) - A known type whose ExtensionObject XML body fails to decode fails the message, like a failing binary body. 5.2.2.15 only says the decoder *should* continue, and continuing reopens the log-flooding path. - Reserved Variant type ids 26-31 are passed to the application as ByteString without the raw type id. - JSON UaTypeId of an opaque body of an *unknown* type stays the encoding id, because no type system is available to map it. - PubSub JSON encoder: - Structure fields without a subtype are still wrapped with a UaType, and concrete multi-dimensional or abstract-rank fields still carry a UaType (Table 186). - Namespace-0 enumerations without EnumDataTypes are written as a numeric string. - Chunked transcoded frames have no writer group, so their sequence numbers continue from the source number. - Pre-existing and out of scope: the HTTPS JSON binding uses Content-Type `application/opcua+uajson`, while 1.05 7.4.5 requires `application/json`. ## Tests - Every fix has a regression test. - Tests that pinned non-conformant behaviour were updated, and their commit messages say so. - Fuzz seeds were regenerated where the wire changed. Local results: net10.0, 27 suites green (Types 11354, Core.Encoders 2933, Encoders.Fuzz 8112, Core 5955 + 1 known intermittent ActivityTraceFlags metrics test that passes alone, Client 2732, Server 7802, Sessions 790, GDS 1234, Subscriptions 641, SourceGeneration.Core 4266, PubSub 1490 and all PubSub transport suites). Full UA.slnx build 0 warnings / 0 errors on net10.0 and net48. ## Related Issues - Follow-up: #4598 (possible throughput regression of per-element binary array reads). ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. (net10.0 suites run; net48 build only) - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-01 05:12:47 +00:00
romanett	20c2d77d57	Fix Core/Types audit findings and conform them to the OPC UA spec (stacked on #4569) (#4573) ... > **Stacked on #4569.** The base branch is `romanett/practical-murdock-fd9c56`, so this diff shows only the commits of this PR. Retarget to `master` after #4569 merges. ## Summary Bug audit of `Opc.Ua.Core`, `Opc.Ua.Core.Types`, `Opc.Ua.Types` and `Opc.Ua.Core.Schema`, with the findings fixed and the fixes grounded against the OPC UA specification (reference.opcfoundation.org). 133 commits in four groups: 1. **Audit fixes** (`Fix <ID>: ...`): 116 findings from a read-only audit, each with a regression test. IDs follow the audit scopes: T1-T6 `Opc.Ua.Types`, C1-C4 `Opc.Ua.Core`, S1 `Opc.Ua.Core.Types` + `Opc.Ua.Core.Schema`. 2. **Review fixes** (`Fix review <ID>: ...`): issues a code review of group 1 found, plus lower-severity leftovers. 3. **Spec fixes** (`Spec: #<n> ...`): the 18 places where an earlier fix only partly matched the spec text. 4. Test and analyzer follow-ups. Where `master` (#4516, #4522, #4540, #4564) or #4569 already fixed the same issue, their version was kept and this PR only adds what they didn't cover. ## Behaviour and user-facing changes ### Wire format and interoperability (breaking) - **PubSub AES-CTR (Aes128-CTR / Aes256-CTR)** now follows Part 14 Tables 156/157: - The counter block is `KeyNonce[4] | MessageNonce[8] | BlockCounter[4]`, and the block counter starts at 1. - The SecurityHeader nonce is 8 bytes: `Random[4] | UInt32 SequenceNumber`, with the sequence number starting at 1. - SKS key data is split with a 4-byte KeyNonce, giving 52 / 68 bytes. - **Not interoperable with earlier releases of this stack**, but matches the spec. There is a test against the independent RFC 3686 vector. - **User token signature** (Part 4 6.1.8): - The signed data is now built from the user token policy's SecurityPolicy on both client and server. - It also supports the SecurityMode None layout `ServerNonce | HASH(ServerCertificate) | ClientNonce`. - New overload `SecurityPolicyInfo.GetUserTokenSignatureData(..., MessageSecurityMode)`. - **Secure channel:** - The ECC AEAD `LastSequenceNumber` is correct across the 32-bit sequence wrap (Part 6 6.8.1). - The incoming chunk counts against MaxChunkCount/MaxMessageSize. - The sender no longer lets a message through that is 24 bytes over MaxMessageSize. - The OPN response signature is verified without overrunning the buffer (RSA_DH with differing key sizes). ### Sessions (server) - **CreateSession nonce:** - The client nonce is kept on None channels, because the None-mode user token signature covers it. - A nonce over 128 bytes returns `Bad_NonceInvalid` on every channel (Part 4 5.7.2.3). - The duplicate-nonce check runs only on secured channels. - A non-empty nonce under 32 bytes is still accepted on None, for compatibility. - **ActivateSession:** an embedded `EccEncryptedSecret` signing certificate is validated with the server's peer certificate validator (Part 6 6.8.3). Byte equality with the client certificate is only the fallback when no validator is available. New opt-in interface `ICertificateValidatorProvider`. - **FindServers / GetEndpoints:** `GatewayServerUri` and `DiscoveryProfileUri` are no longer swapped. ### Write, Read and Call (NodeState / node managers) - **UserWriteMask:** - Enforced for non-value attributes and for VariableType Value writes (`ValueForVariableType`), returning `Bad_UserAccessDenied`. - An unconfigured UserWriteMask (0, no handler) is not enforced, and reads back as the WriteMask so Read and Write agree (Part 3 8.60). - A throwing or Bad `OnReadUserWriteMask` handler fails only that item. - **Index-range writes:** - Slices are merged into the cached value under the attribute lock, also for `OnWriteValueAsync` handlers. - A data-change notification is still produced when the cache cannot absorb the slice. - The slice must match the unclipped range, otherwise `Bad_IndexRangeDataMismatch` (new status code in `Opc.Ua.Types`). - A range past the target returns `Bad_IndexRangeNoData`. - A handler without index-range support returns `Bad_WriteNotSupported` (Part 4 7.27, 5.11.4.4). - **Index-range reads on matrices** return partial results clipped to the source, instead of allocating the requested size (a Read with `"0:40000,0:40000"` no longer allocates about 1.6e9 elements). - **DataTypeDefinition writes:** - A value that isn't a decoded DataTypeDefinition, or whose kind doesn't match the DataType category, returns `Bad_TypeMismatch`. - Null is rejected for concrete Structure/Enumeration/OptionSet types. - WriteMask is checked first (Part 3 5.8.3). - **AnalogItem:** a null write skips the InstrumentRange check again. - **Method call:** the async fallback passes the ObjectId to the method handlers. - **Redundancy:** `DistributedValueParticipation` merges index-range writes and applies the index range on reads. - **Change masks:** `ClearChangeMasks` takes the bits atomically, so concurrent changes are no longer lost. - **`AccessLevelEx`:** preserved by Clone/Export. ### Alarms & Conditions (Part 9) - **Acknowledge / Confirm / AddComment:** - Accept any EventId the condition or its branches reported while that state is still pending (5.7.3). - An unknown id returns `Bad_EventIdUnknown`. - An already handled state returns `Bad_ConditionBranchAlreadyAcked` / `...AlreadyConfirmed`. - AddComment on a branch no longer changes the trunk, and the branch table is re-keyed when a branch's EventId changes. - **Shelving:** - OneShotShelve without MaxTimeShelved no longer overflows the timer. - A timed shelve is measured on the monotonic clock, so wall-clock steps don't delay the unshelve. - The state is named `OneShotShelved`. - **Audit events:** - They report failure for rejected method calls. - `SelectedResponse` is a UInt32. - A rejected negative Respond leaves SelectedResponse unset. - **`ContentFilterElement.Validate`:** an unknown FilterOperator is reported per element as `Bad_FilterOperatorInvalid`, instead of failing the whole service call. ### ContentFilter evaluation (Part 4 7.7.3, on top of #4564) - **Bitwise operators:** - The result takes the size of the larger operand. - Boolean, numeric String and one-element array operands are converted to integers implicitly. - Types without an implicit integer conversion give NULL. - **Strings:** ordering is ordinal, no longer culture dependent. - **Cast:** restricted to the Table 121 conversions, and QualifiedName to LocalizedText is added. The general `Variant.ConvertTo` keeps its wider set. - **Null and empty operands:** - `Like` with a NULL operand is NULL. - Empty arrays of the same DataType compare equal. - Null-string operands are NULL everywhere. ### Encoders and built-in types - **XML:** - Strings keep leading, trailing and whitespace-only content (Part 6 5.3.1.5). NodeSet import opts back into treating whitespace-only strings as empty with the new `XmlDecoder.TreatWhitespaceOnlyStringsAsEmpty`. - Layout whitespace around `<Identifier>` values is ignored, and trailing control characters are stripped from `s=` ids. - `XmlElement` ignores DTDs without expanding entities. - **JSON:** - A DateTime without an offset is read as UTC. - An unmappable `nsu=` NodeId and an unknown `svu=` ExpandedNodeId decode to a namespace-0 String NodeId (5.4.2.10 / 5.4.2.11). - `svr=` is rejected in a NodeId field. - Bad matrix dimensions return `BadDecodingError`. - The non-strict body stack stays balanced after an error. - The nesting limits match between encoder and decoder. - **Binary:** - `MaxByteStringLength` no longer applies to strings. - ExtensionObject bodies count toward the nesting limit on seekable streams (and in the XML encoder). - **Parsing:** - The NodeId parser requires `i=`/`s=`/`g=`/`b=`. - `ExpandedNodeId.Parse` rejects an empty `nsu=`/`svu=`. - NumericRange rejects a trailing `,` with `Bad_IndexRangeInvalid`. - RelativePath escapes `#`. - **Status codes:** `StatusCode.WithSubCode`/`WithCodeBits` keep the severity bits and look up the symbolic id for the new code. - **Variant / VariantHelper:** - `TryCastTo` returns false on a type mismatch. So `DataValue.GetValue<T>(default)` returns the default, and `GetValueOrDefault` / `CastTo` throw `BadTypeMismatch` as documented. - `System.DateTime` casts are supported. - Concrete encodeable arrays (e.g. `Argument[]`) no longer throw. - `ConvertTo` keeps one-element and empty arrays as arrays and checks the conversion is legal for empty arrays. - `CastFrom(object[])`, `CastFrom(Enum[])` and the obsolete `Variant(object)` constructors keep the array shape (previously a one-element array collapsed to a scalar and an empty one to Null). - `TypeInfo.Unknown` / `Variant.Null.TypeInfo` report `ValueRanks.Any`. - **Equality and hashing contracts fixed:** - Types: Matrix/MatrixOf, typed-null Variants, NodeId (the namespace index is now hashed), ExpandedNodeId, LocalizedText, DiagnosticInfo, StructureDefinition/EnumDefinition, CertificateIdentifier, UserIdentity and DateTimeUtc. - `MatrixOf.Dimensions` returns a copy. - Decimal equality and hashing now run in bounded time. - **Localized text:** a LocalizedText with locale `"mul"` and no usable translations, or null client locale ids, no longer throw. ### NodeSet, address space and utilities - **NodeSet export/import:** - Server index 0 is the local server on import and export, so local ids are no longer written as `svr=65535`. - `StructureDefinition.BaseDataType` is filled from the supertype on import. - **`NodeTable.Import`:** replaces duplicates, keeping the references neighbouring nodes hold. `TypeTable.Add` detaches a re-parented type from its old supertype, and `Node.Clone` gets its own ReferenceTable. - **`StringTable` / `NamespaceTable`:** capped at UInt16 indexes (`BadEncodingLimitsExceeded`) for Append and Update, instead of silently wrapping. - **Small fixes:** - `UnsecureRandom.Shared` is seeded randomly. - The peer's RetryAfterMs is clamped to one day. - The `CancelAsync` and `string.GetHashCode(StringComparison)` polyfills match BCL behaviour. - `CoreUtils.IsEqual` compares strings ordinally. ### Schema generation and ComplexTypeSystem - **JSON schema:** describes the 1.05 layout with the compact/verbose null rules, and now validates real `JsonEncoder` output. - **XSD:** - `EncodingMask` (`xs:unsignedLong`) only for StructureWithOptionalFields. - Guid and StatusCode are complex types. - Standard types are in the `Types.xsd` namespace. - **Structure-backed OptionSets** are described as `{Value, ValidBits}`. New `UaTypeDescription.IsStructureOptionSet` property and constructor overload. - **ComplexTypeSystem:** - A malformed type in a server dictionary is skipped per type instead of discarding the whole dictionary. - Cyclic supertype walks are bounded. - Declared definitions are no longer changed. - A dictionary validator is kept only if the dictionary parsed. ### Certificates and trust lists (Part 4 6.1.3, Part 12) - **Revocation:** - Checked for issuers supplied in the peer's chain and for inline-trusted issuers, against the CRLs in the trusted and issuer stores. - A store without CRL support no longer hides "revocation unknown". - `RejectUnknownRevocationStatus` is honoured for inline-trusted issuers unless the entry sets `SuppressRevocationStatusUnknown`. This changes the strict case of `ExplicitIssuerChainIsHonoredWithoutStorePathAsync`. - **Basic constraints / path length** violations fail with `Bad_CertificateInvalid`. - **`TreatAsInvalid`:** - Now yields `Bad_CertificateUntrusted`, which can't be suppressed or auto-accepted. - It is honoured on individual trust-list entries even when the certificate is also in a store. - **`EccEncryptedSecret`:** enforces the result of validating the sender certificate. - **`TrustListTransaction`:** - Routes each CRL to the store holding its issuer (TrustedCrls/IssuerCrls). - Validates staged CRLs, including the store's CRL support, before changing anything. - Applies certificates before CRLs. - **Other:** - One failing `CertificateChanges` observer no longer stops the others. - `InMemory:` stores share their contents per path, and `InMemoryStoreProvider` is `IDisposable`. ### WoT (`Opc.Ua.Types/Wot`) - **Projection security:** projection security schemes whose qualified names collide are refused. New diagnostic `WotDiagnosticCode.ProjectionSecurityConflict = 6063`. - **Input handling:** - Invalid Unicode (lone surrogates, bad UTF-8) is rejected as `JsonException`. - External-schema results are keyed per affordance. - A duplicate security-floor member is rejected. - `nsu=` ids are percent-encoded (Part 6 5.1.12). - The configured JSON depth is honoured on re-parse. - An oversized document is reported before it is parsed back. - **Performance and limits:** - Subtype-graph validation, `componentOf` linking and the namespace table are now linear. - Namespaces are capped at UInt16. ### New or changed public API - `ICertificateValidatorProvider` (server) - `SecurityPolicyInfo.GetUserTokenSignatureData(..., MessageSecurityMode)` overload - `XmlDecoder.TreatWhitespaceOnlyStringsAsEmpty` - `UaTypeDescription.IsStructureOptionSet` plus a constructor overload - `WotDiagnosticCode.ProjectionSecurityConflict` - `StatusCodes.BadIndexRangeDataMismatch` in the `Opc.Ua.Types` list - `InMemoryStoreProvider : IDisposable` ## Not changed / open - **Deferred:** - S1-14 (BSD OptionSet size needs the base type in `UaTypeDescription`, and BSD is deprecated). - C2-7 (restoring the own-certificate trust exemption would accept certificates the spec says to reject; removing the dead code is a separate decision). - A1-4 (config values keep surrounding whitespace, as the pre-April-2026 loader did). - H-2 (JsonDecoder has no real nesting counter). - A2-3 (the StringTable cap also applies to diagnostics tables; default `MaxArrayLength` already bounds them). - **Needs a product decision:** - The general `ConvertToString` writes a QualifiedName as `ns:Name`, while Table 121 drops the namespace. - Short (< 32 byte) client nonces are accepted on None channels. ## Verification - Every commit added a regression test that fails without its fix, where practical. - Before the rebases, with all audit and review fixes (before the `Spec: #…` commits): 0 build warnings and 16 test suites green on net10.0. The suites: Types, Core, Core.Encoders, Core.Security, Core.Schema, Client, Client.ComplexTypes, Server, Sessions, Gds, History, Features, Redundancy.Server, PubSub, WotCon and WotCon.Bindings. Core hit its known intermittent end-of-run hang once, and reruns were clean. - The `Spec: #…` fixes were verified per group on their own suites. Those include PubSub.Udp, Redundancy.PubSub, PubSub.Server, Configuration and SourceGeneration.Core. - **Not yet built or tested on this base.** It was rebased onto master (resolving overlaps with #4522, #4540 and #4564) and then onto #4569. This PR stays a draft until the full run on this base is green. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>	2026-09-29 11:14:15 +00:00
romanett	87c35b84b6	Fix Opc.Ua.Client audit findings (security fallback, reconnect, subscriptions, redundancy, browse, files, WebApi) (#4572) ... ## Summary Fixes the findings of a bug audit of `Opc.Ua.Client` and `Opc.Ua.Client.ComplexTypes`, done on master plus #4516 (now merged). - **Audit:** 82 findings across 12 areas, each checked against the OPC UA specification. Final severities: 2 High, 37 Medium, 43 Low. - **Fixes:** 76 fixed, 4 partial, 2 skipped (see [Not fixed](#not-fixed--partial)). - **Review:** a follow-up review of the fixes found 15 more defects in them, all fixed here. - **Tests:** every fix has a regression test, except a few races that cannot be reproduced deterministically; the commit messages say which. The finding IDs (`L<area>-<n>` for the audit, `G<n>` for the review) appear in the commit titles. ## Behaviour and user-facing changes ### Security and endpoint selection - **Reconnect no longer drops to weaker security (L3-1, High).** When the server rejects the configured security policy or mode during reconnect, `SessionReconnectHandler` no longer switches to whatever endpoint the server advertises, None included. It only picks an endpoint at least as strong as the configured one, judged by a locally computed security level. The server-advertised `SecurityLevel` is not trusted. If nothing qualifies, reconnect fails with the original error (new log event `SessionReconnectHandler + 13`) and keeps retrying with the original settings. - **`CoreClientUtils.SelectEndpoint(useSecurity: true)` never returns a SecurityMode None endpoint over opc.tcp (L9-9, High).** It now returns `null` when no secure endpoint matches. - When the discovery URL is `https`/`opc.https`, an HTTPS endpoint with SecurityMode None is still accepted as a last resort, because TLS protects it (Part 6 §7.4.1) (G17). - Endpoints with SecurityMode `Invalid` no longer count as secure. - `GlobalDiscoveryServerClient` and `ServerPushConfigurationClient` now throw `BadSecurityPolicyRejected` when no secure endpoint matches, instead of passing `null` on. The ConsoleReferenceClient sample reports this with a clear error. - **No Bearer/Basic credentials over `http://` (L12-2).** `WebApiClient.Create` and WebApi channel open/reconnect reject them with `BadSecurityChecksFailed`. The public `WebApiClient(HttpClient, …)` constructor also rejects them when the client's `BaseAddress` is not https, and every send checks the address it actually goes to (covers a `BaseAddress` set later). ### Session, keep-alive and identity - **Faster detection of a silent server (L1-1).** The keep-alive Read is now bounded by its `TimeoutHint` (2 × `KeepAliveInterval`), which is what Part 4 §7.32 says the client should do. It then fails with `BadNoCommunication`, so reconnect starts after about 2 × `KeepAliveInterval` instead of `OperationTimeout` (120 s by default). - **Operations fail fast during a channel-manager recovery (L1-2, G9).** `UpdateIdentityAsync`, `TransferSubscriptionsAsync` and `ReactivateSubscriptionsAsync` fail with `BadSecureChannelClosed` (retryable) instead of deadlocking. This covers the operation holding the reconnect lock and any queued behind it. - **Closing or disposing from a handler no longer waits on itself (L1-3, G5, G6).** - `Session` and `ManagedSession` Close/Dispose from a Notification handler no longer wait 30 s for their own background drain. - Disposing a `ManagedSession` from a keep-alive `PublishStatusChanged` handler no longer deadlocks. - Tasks spawned by a handler no longer count as "the handler" (the owner marker is scoped to the work item). - **Switching to an ECC user-token policy takes two ActivateSession calls (L1-4, G4).** This follows Part 6 §6.8.2 (fetch the ephemeral key, then activate). - If the server returns no key, the switch fails with `BadSecurityPolicyRejected`. - If the second activation is rejected, the old identity stays on the override policy with the key just fetched. Restoring the old key was tried: against the reference server the next reconnect then failed to decrypt the identity token. - **`ManagedSession.ConfiguredEndpoint` follows failover (L2-6).** It now reports the inner session's endpoint, so it changes after a failover or network-path rotation. - **An explicit identity update replaces the identity provider (L2-7).** `ManagedSession.UpdateSessionAsync(identity)` stops the provider's refresh loop and drops the provider for good. If the update fails, the loop is restarted. - **Reconnect waits for in-flight calls on a healthy channel (L2-3, G8a).** Reconnect/failover on a healthy channel (certificate or trust-list change, manual reconnect) waits for in-flight service calls. The wait is bounded (max(`KeepAliveInterval`, 1 s)) only once the channel is unhealthy (keep-alive stopped, channel not Ready), so a dead channel no longer holds recovery for `OperationTimeout`. - **Smaller fixes:** - Restore reads the server certificate as a chain; this failed on macOS (L1-5). - Session recovery can no longer run twice at once (L1-6). - Identity expiries more than 49.7 days out no longer throw (L2-2). - Keep-alive reconnect suppression is recalculated on a lease swap (L2-4). ### Reconnect state machine and reverse connect - **⚠ `MaxTotalReconnectTime = 0` now means "no time limit" (L3-7). Reviewer decision needed.** Before, 0 disabled reconnect entirely. Negative values other than `Timeout.InfiniteTimeSpan` now throw `ArgumentOutOfRangeException` when the state machine is constructed; before, they crashed the worker. The XML docs of `ReconnectPolicy`/`ReconnectPolicyOptions` are updated. If 0 should keep meaning "no reconnect", this is a one-line revert. - **A close racing the end of the reconnect budget is no longer lost (L3-4).** It goes through the normal close instead of switching to failover. - **The "reconnect worker" marker covers one step only (L2-1).** It lasts for a single connect/reconnect/failover/close step. Keep-alive, publish and identity loops started in a step no longer count as the worker afterwards. - **Reverse-connect strategies `Undefined` and `Any` alone are removed after the first callback (L8-1).** This matches the documentation; before, they behaved like `Always`. - **`AddEndpoint` for a URL that is already added disposes the replaced listener (L8-2).** ### Service calls - **Batched calls clean up after a failed later batch (L3-2).** When a later batch of `Browse`/`BrowseNext`/`HistoryRead`/`CreateMonitoredItems` fails, the continuation points and monitored items created by earlier batches are released or deleted before the exception is rethrown. This adds one request. `AddNodes`/`RegisterNodes` are not undone. - **Batched diagnostic infos point at the right strings (L3-3).** The string-table indexes are rebased when diagnostics are padded. - **`ReadBytesAsync` rejects oversized responses (L3-5).** It throws `BadUnknownResponse` when the server returns more bytes than requested, and `BadEncodingLimitsExceeded` beyond `int` range. - **`ReadByteStringInChunksAsync` handles an unknown server limit (L3-6).** When the server's `MaxByteStringLength` is 0 (absent) or larger than `int`, it falls back to the client's `MessageContext.MaxByteStringLength`. It throws only when both are unknown. ### Browse and NodeCache - **Empty browse pages with a continuation point are followed (L9-1, L9-4, L9-5, G16).** Part 4 §5.9.2.1 allows a server to return an empty page with a continuation point, so browsing keeps following it. After 10 consecutive empty rounds it gives up with `BadNoData` and releases the continuation point. - `BrowseAsync(NodeId)` now throws instead of silently returning a truncated list. - `BrowseStreamAsync` yields a `BadNoData` result for that node. - The same cap, through one shared helper, now also protects `RoleManagementClient.ListRolesAsync` and the FileSystem enumerate/empty-check loops. - **Continuation points are released on failure (L9-3).** `BrowseAsync(NodeId)` releases them on any exception, and `BrowseStreamAsync` releases all points of the current page when the consumer stops early. - **NodeCache lookups propagate cancellation (L9-6, L9-8).** `FindAsync`, `IsKnownAsync`, `FetchNodeAsync`, `FindReferenceTypeNameAsync`, the reference-table fill and the type-hierarchy search now let `OperationCanceledException` through. Before, a cancelled lookup looked like "node does not exist". - **A NodeClass mismatch fails only that node (L9-7).** It returns `BadNodeClassInvalid` for that node instead of throwing `KeyNotFoundException` for the whole batch. - **Smaller fixes:** - `MaxNodesPerBrowse` ≥ 2^31 no longer breaks the managed browse (L9-2). - Null discovery URLs are skipped (L9-10). - `ModelChangeTracker` no longer cancels a joined start (L9-11). - **Log changes:** `BrowserContinuationPointExistsButBrowse` (Browser + 0) was removed, and `BrowserServerReturnedEmptyReferencesBut` now includes the round count. ### Subscriptions (default engine) - **Recovery after a transfer delivers each message exactly once (L5-1, G22).** Messages already dispatched are acknowledged instead of republished and delivered again. Messages whose earlier republish failed are now republished and delivered, with the Republish flag and after newer messages, instead of being acknowledged and lost. - **A keep-alive that proves a gap triggers republish at once (L5-5, G23).** The dedup mark moves only past messages that were actually recovered, so a failed republish is retried by the next data message. - **Item changes that fail are retried with backoff (L5-3).** They are retried on the next apply pass after the state manager's 250 ms–5 s backoff, instead of six times back to back. The six attempts now span about 13 s. - **Extreme revised intervals no longer throw (L5-4, L6-1).** Very large or NaN intervals and counts revised by the server are capped (NaN falls back to the requested value). Before, the overflow could stop every publish worker. - **`SetTriggeringAsync` from a callback no longer hangs (L5-7, G21).** While the subscription is deleted, recreated or disposed, it returns `BadOperationAbandoned`. A cancelled reset no longer makes later calls fail. - **Publish responses for unknown subscription ids (L6-3, L6-4, G20).** The client no longer re-sends acknowledgements the server already processed. An unknown id seen while a creation is pending is left alone instead of being deleted. - **Smaller fixes:** - A null and an empty `IndexRange` are treated as equal, and restored snapshots use `null` (L5-6). - A failed partition attach during restore is rolled back (L6-2). - `StreamingSubscription` throws `ObjectDisposedException` after dispose (L6-6). ### Subscriptions (classic `Subscription`) - **Republish no longer abandons other missing messages (L7-1).** A Republish response no longer overwrites `AvailableSequenceNumbers`, so other missing messages are not given up while the server still holds them. - **Late copies are no longer delivered twice (L7-2).** Copies of already-processed sequence numbers are ignored, and creating a new server subscription resets the sequence state. - **Disposing from a keep-alive handler no longer deadlocks (L7-3).** `Dispose()` from a keep-alive `PublishStatusChanged` handler can return while that callback is still finishing. - **Transfer of a restored subscription (L7-4, G27).** - It succeeds even when some saved items were never created. - The server subscription is deleted only when this session's own TransferSubscriptions just moved it and adoption failed definitively (item count mismatch or a non-transient status). Transient errors and `ReactivateSubscriptionsAsync` never delete it. - The public `Subscription.TransferAsync` never deletes. - **Smaller fixes:** - Cloned items keep their triggering links (L7-5). - `CreateAsync` clears stale server ids (L7-6). - A `Good_SubscriptionTransferred` for the client's own transfer is ignored (L7-7). - An item removed while its create is in flight is deleted afterwards (L7-8). - The publish timeout for very long keep-alives no longer overflows (L7-9). - A negative `MaxMessageCount` is handled (L7-10). - `LastMessage` tolerates a wrong notification type (L7-11). - Pending acks exactly 2^31 away no longer throw (L4-1). - **Log changes:** new log events `Subscription + 68..70`. ### Redundancy - **Warm/Hot demotion (L4-2, G1, G3).** - Without token reuse, the demoted leader closes its session and reconnects as a fresh standby. - With token reuse, it abandons the shared server session locally, without CloseSession, so the new leader can reactivate it and keep its subscriptions. This uses the new internal methods `ManagedSession.AbandonServerSessionAsync` and `Session.AbandonServerSession`. - `RoleChanged(false)` is now raised before the standby connect and no longer depends on it, so `CurrentSession` can briefly be `null`. - Exceptions from `RoleChanged` handlers are logged and do not stop the teardown. - **Promotion (L4-3, G2).** A promoted standby that adopts the leader's session first closes its own server session. A retried promotion keeps the session it already adopted. - **Client failover takeover (L4-4, partial).** Subscriptions the backup prepared in advance (not yet created, `TransferId` set to the active client's id) are moved through the session's own transfer and keep publishing. `docs/HighAvailability.md` is updated. - **`ShouldFailover` through the interface (L4-6).** Calling it through `IServerRedundancyHandler` no longer fails over away from a server that is still Healthy. ### Fluent / dependency injection - **Shared DI session (L10-5).** The shared session from `AddClient` is reconnected after a caller disposes it, and is disposed with the container. After that the connect delegate throws `ObjectDisposedException`. - **New public API: `ManagedSessionBuilder.WithServerRedundancyOptions(ServerRedundancyOptions)` (L10-6).** This is additive. The `Session.ServerRedundancy` options are now actually applied. - **`AddDiscoveryAndConnect` rewrites the advertised address (L10-7).** It replaces the host and port the server advertises with those of the discovery URL (Part 4 §5.6.2.1, NAT/containers), and prefers endpoints with the same scheme. ### State machines and role management - **`GetSubStateMachineAsync` returns the instance's own sub-state machine (L10-1).** Before, it returned the type's placeholder. - **`WaitForStateAsync` reports failures with OPC UA status codes (L10-2).** It throws `BadNotFound` when `CurrentState/Id` cannot be resolved, and `BadInvalidState` when observation ends without reaching the state. Before, both surfaced as `OperationCanceledException`. - **`RoleManagementClient.ListRolesAsync` pages correctly (L10-3).** It follows continuation points, releases them on any failure, and throws on a Bad browse status instead of returning an empty list. - **Role properties are read into the right fields (L10-4).** Properties whose namespace cannot be resolved are skipped instead of shifting the other values. ### File system, temporary files and alias names - **Path escaping (L11-8, G12).** - Path segments escape `:` and `/` with `&`, and `&` itself as `&&` before those characters or at the end of a name. - `Format` and `Parse` round-trip all names. Typed input ending in `&/` now reads the slash as part of the name. - A segment without a namespace prefix also matches a namespace-0 child when nothing matches in the parent's namespace. - **Stale path cache (L11-1).** When a cached lookup fails, `GetInfoAsync` retries once from the server. `ExistsAsync` and `GetFileAsync` report "not found" instead of throwing. - **`GenerateFileForReadAsync` waits for the file (L11-2).** It waits until the file-generation state machine reaches ReadTransfer (`Idle` counts as not started yet), and throws `IOException` if it reports Error. The wait is bounded only by the caller's token. - **Non-recursive delete refuses hidden children (L11-3).** It refuses when the directory holds children that the subtype options hide from enumeration. Before, the server deleted them all. - **Alias names (L11-5, L11-6, L11-7).** - `BadMethodInvalid` maps to `NotSupportedException` for all alias calls, so `UseVerbose` falls back to `FindAlias`. - A duplicate alias name resolves to all its targets. - If the refresh strategy fails to start, the resolver logs a warning and keeps working without automatic invalidation. New log event block `AliasNameResolver = 560`. - **Null profile entries (L11-4).** Null `ServerProfileArray` entries no longer crash `GetConformanceInfoAsync`. ### WebApi transport - **Failures come back as `ServiceResultException` (L12-1).** - A timeout becomes `BadRequestTimeout`. - HTTP 429/503 becomes `BadServerTooBusy` with the Retry-After hint, on every target framework. `WebApiClient` checks the status itself (reusing `HttpsTransportChannel.CreateServerTooBusyException`), so callers of `WebApiClient` also get a `ServiceResultException` instead of an `HttpRequestException` for these two statuses (G15). - An IO error becomes `BadNotConnected`. - **Timeouts (L12-1, G14).** - `OperationTimeout` applies to each request. When `RequestTimeout` is unset, HttpClient's 100 s default no longer cuts off long Publish requests. - The GetEndpoints call at open is bounded by `OperationTimeout`, and cancelling the open now throws. - **Core change:** `HttpsTransportChannel.MapRequestFailure` went from private to internal so the WebApi channel can reuse it. ### ComplexTypes - **Out-of-range union selector (L12-3).** A union whose SwitchField is larger than its field count now fails with `BadDecodingError` when decoded and `BadEncodingError` when encoded (Part 6 §5.2.8). - **Verbose JSON unions (L12-4).** They now decode their selected field instead of `null`. ## Not fixed / partial - **L2-5 (skipped):** an identity provider combined with a caller-supplied reverse connection still can't connect to an undiscovered endpoint. Fixing it means choosing the identity after CreateSession, a design change. - **L4-5 (skipped):** the one-time KeyCredential token needs a fresh token on each reactivation. Today reactivation fails and the client falls back to a new session. - **L4-4 (partial):** only subscriptions the backup prepared in advance survive a takeover. - **L3-2 (partial):** `AddNodes`/`RegisterNodes` batches are not rolled back. - **L2-3 (partial):** service calls still hold the session lock for their whole round trip. - **Known from the review, not fixed here:** - G7: the batch cleanup request can't be cancelled. - G11: the DI session's close at host shutdown never reaches the server, and a closed session keeps being handed out. - G13: a file renamed by another client is still found under its old path. - G25: a clone-based transfer doesn't mark the original subscriptions. - G27b: the transfer item check matches by count, not by ID. - **Outside this PR:** the reference server ignores `ECDHPolicyUri` on ActivateSession (`SessionSecurityPolicyHelper`), which breaks Part 6 §6.8.2. As a result, the L1-4 two-step ECC switch ends in `BadSecurityPolicyRejected` against our own server. ## Testing All suites on net10.0, on the branch before the master merge. Every suite had 0 failures: | Suite | Passed | Skipped | |---|---|---| | Opc.Ua.Client.Tests | 2698 | 0 | | Opc.Ua.Redundancy.Client.Tests | 134 | 0 | | Opc.Ua.Subscriptions.Classic.Tests | 57 | 0 | | Opc.Ua.Bindings.Https.WebApi.Tests | 385 | 0 | | Opc.Ua.Sessions.Tests | 782 | 379 | | Opc.Ua.Subscriptions.Tests | 640 | 6 | | Opc.Ua.Client.ComplexTypes.Tests | 2858 | 0 | After merging current master (net10.0), every suite had 0 failures except one, a flaky new test fixed in 9f52952b2: | Suite | Passed | Skipped | Failed | |---|---|---|---| | Opc.Ua.Client.Tests | 2719 | 0 | 1 (the flaky test) | | Opc.Ua.Redundancy.Client.Tests | 134 | 0 | 0 | | Opc.Ua.Client.ComplexTypes.Tests | 2858 | 0 | 0 | | Opc.Ua.Subscriptions.Classic.Tests | 57 | 0 | 0 | | Opc.Ua.Bindings.Https.WebApi.Tests | 397 | 0 | 0 | | Opc.Ua.Sessions.Tests | 790 | 379 | 0 | | Opc.Ua.Subscriptions.Tests | 640 | 6 | 0 | The touched test projects also build on net48 with 0 warnings. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>	2026-09-29 09:34:03 +00:00
romanett	442889cba5	Fix source generator audit findings; conform structure-field matrices and type metadata to OPC UA 1.05 (#4569) ... # Description This PR fixes a bug audit of the source generation projects (`tools/Opc.Ua.SourceGeneration*`: model loading, NodeSet import, all emitters, the Roslyn hosts and packaging). It also fixes a max-effort code review of those fixes, and a check of every spec-relevant change against the OPC UA 1.05 text. - **Scope:** about 85 audit findings, 48 review findings and 32 spec-grounding items were addressed. Each fix has a regression test that fails without it. - **Wire change:** it includes one deliberate, stack-wide wire change: **structure-field matrices now follow OPC 10000-6 5.2.5 Table 28**. Most changes are internal correctness fixes. The sections below list every change a user can observe: wire formats, generated code and API, generated address-space content, diagnostics and runtime behaviour. ## Behaviour / user-facing changes ### Wire format (encoders) - **Binary inline matrices** (OPC 10000-6 5.2.5 Table 28). - **Layout:** a multi-dimensional *structure field* is encoded as `Int32[] Dimensions`, then the values **without a length prefix**, with at least 2 dimensions. - **Empty and null:** any dimension <= 0 means no values follow, and a null matrix is `-1`. An empty matrix is written as `[0,0]`. - **Compatibility:** this is **not compatible with earlier builds of this SDK** for matrix fields. It applies to generated types, `[DataType]` types, `Structure`, client ComplexTypes and `WriteEncodeableMatrix`. - **Unchanged:** Variant matrices (5.2.2.16) keep their old encoding. - **Declared rank decides matrix vs array.** A 1-D `MatrixOf<T>` in an array field or a Variable value is written as an array again. Matrix-declared fields go through the new public `EncoderExtensions.WriteInlineMatrixValue`, which generated code also uses. A non-empty 1-D value in a matrix field throws `BadEncodingError`. - **Decoder hardening:** - Before allocating, the decoder bounds all matrix dimensions against overflow, `MaxArrayLength` and the remaining message length. - The decoder rejects: - a matrix with fewer than 2 dimensions; - a populated matrix whose rank differs from the field's declared rank; - a union SwitchField greater than the number of fields; - an EncodingMask with unassigned bits set. - **Encoder `MaxArrayLength`:** the encoder enforces `MaxArrayLength` for inline matrices, as it already did for arrays. - **XML structure fields** (5.3.1, 5.3.4, 5.3.5). - **Fields:** `Structure` and client ComplexTypes write fields like typed fields (`<A>1</A>`, array elements directly) instead of a Variant body. - **Matrix fields:** `Dimensions` and `Elements` go directly inside the field element, with no `<Matrix>` wrapper. - **Empty matrices:** written as nil, because XML dimensions must be greater than 0. - **Compatibility:** decoders still accept the old shapes. - **Enum fixes:** enum array elements with value 0 are no longer dropped, and enum array element names are fixed. - **Other encoding fixes:** - A null `DiagnosticInfo` structure field writes `0x00` instead of nothing. - A null scalar field in a runtime `Structure` is written as its default instead of zero bytes, which used to shift every following field. - A Variant holding an empty matrix encodes as an empty array instead of throwing. - `Variant.Copy` keeps the matrix identity of null and empty matrices. - **NodeSet export and the DataContract surrogate** write Variable values with the Variant rules again. A null or empty `MatrixOf` variable no longer produces invalid XML or unreadable NodeSets. - **`JsonEncoder.CanOmitFields`** is `true` only for Compact encoding. Verbose and RawData JSON include default-valued fields. ### `[DataType]` source-generated types - **Default-value handling** (OPC 10000-6 5.4.1, Table 1). - **Encode:** a field is omitted only when its value *and* its declared default are the type's default (0, false, null). Fields with a non-default initializer or constructor default, and empty strings, are always written, so configuration files get slightly larger. - **JSON decode:** a field missing from JSON decodes to the type default. - **XML decode:** a field missing from XML keeps its declared default, which older configuration files rely on. - **Why:** this fixes silent round-trip loss, for example `SamplingInterval = 0` read back as `-1`. - **Nested `[DataType]` types:** they are now generated inside their containing types. Without an explicit id, their default TypeId and XmlName are qualified (e.g. `s=Outer.Foo`); **wire identity change** for nested types. Colliding activator names get a `_2` suffix. - **Activators:** they are `internal` when the type, or any containing type, is not public (was CS0060). - **Matrix properties:** - `MatrixOf<T>` properties use the inline matrix encoding. - Matrices of non-sealed structures, or with `StructureHandling.ExtensionObject`, are written as ExtensionObjects. - Their published ValueRank is 2, because the rank can't be known from `MatrixOf<T>`. - **Published StructureDefinitions:** - They include base-class fields. - Nullable properties are no longer marked optional. - Inline structure fields name their concrete type. - **`[Flags]` enums:** they are published as plain enumerations with their member values, which matches how they are encoded. - **Other generated code:** - `Clone` deep-copies arrays and matrices of structures, Variants, ExtensionObjects and DataValues. - `IsEqual` and `GetHashCode` are consistent: EncodingMask, active union member and NaN handling agree. - Pooled `Reuse()` restores the freshly constructed state through the new `protected virtual ResetForReuse()`, and returns an instance to its runtime type's pool. - **Enum capture:** enum member values are captured culture-invariantly. Negative values were lost on cultures that use U+2212 as the minus sign. ### Model-driven generator: generated code, API and file names - **Removed API:** generated `*_Placeholder` proxy accessors (e.g. `PowerTrainTypeClient.GetMotorIdentifier_PlaceholderAsync`) and fluent `X_Placeholder()` accessors are removed; they could never resolve anything. - Proxy accessors now look children up by BrowseName with the right namespace. - `RoboticsClient` finds motors and gears by type and drives via `IsDrivenBy`. Its topology snapshots used to be empty. - **Renamed files:** generated files for a bound `[NodeManager]` are now named `{Namespace}.{Class}.NodeManager.g.cs` (also `.Factory` and `.FluentBuilders`). - **Generated NodeState code:** - Attributes are set through `baseState`/`nodeState` locals, so children named like base attributes (e.g. `DataType`, `EventNotifier`) compile. - Children that hide base members are declared `public new`, using names reflected from the runtime. - `global::` qualification is used throughout. - **Proxies and fluent builders:** a proxy whose supertype is excluded (e.g. Draft) derives from the nearest emitted ancestor. Fluent wrappers and NodeState factories fall back the same way; they used to fail with CS0246. - **Derived structures:** - The optional-field `EncodingMask` continues across inheritance. - A derived structure over a base type from another model no longer relies on `base.ResetForReuse`. - **Default values:** - NodeId, QualifiedName and ExpandedNodeId defaults resolve by namespace URI (`context.NamespaceUris.GetIndexOrAppend`) and server URI. - StatusCode, negative enum, `double`/`float` (shortest round-trip literal) and escaped string defaults now compile. - **Event records:** - Vendor event records have `Decoder.GetStandardFields(NamespaceTable)`, and their browse paths use the model's namespace. - A field whose namespace is unknown to the session no longer matches a namespace-0 field. - Companion `StandardFields` is `[Obsolete]`. - Vendor simple subtypes such as `Percent : Double` map to their built-in type. - **Other fixes:** - `MethodState.CallAsync` passes the real `objectId` to synchronous `OnCallMethod2` handlers; it used to pass `NodeId.Null`. - Enumeration fields with an explicit `Identifier` keep it, instead of taking a trailing `_<digits>`. - Explicit NumericIds are no longer reused by automatic numbering. - Dependencies are loaded in topological order. ### Generated address-space content - **Arguments:** - Methods without arguments no longer get empty `InputArguments`/`OutputArguments` properties (OPC 10000-3 5.7). - About 2,660 automatically assigned namespace-0 NodeIds of 15000 and above shift. Every NodeId in `StandardTypes.csv` is unchanged. - **Permissions:** type nodes and method declarations on types now carry the model's `RolePermissions`/`AccessRestrictions`. - **Restored nodes:** NodeSet import keeps nodes that were silently dropped before: - `NamespaceMetadata` objects and the NodeSet's own TypeDictionary variables; - ISA95 placeholders linked only non-hierarchically; - instances whose parent is in another namespace. - **Import details:** - ValueRank > 1 without ArrayDimensions keeps its rank. - `svr=` indexes map correctly. - Invalid MinimumSamplingInterval values import as -1, not 0. - Localized texts prefer the invariant or English translation. - **StructureDefinitions:** - They include inherited fields, including for subtypes without their own fields (e.g. `AnonymousIdentityToken` now publishes PolicyId). - The StructureType kind covers inherited AllowSubTypes fields. - Unions ignore IsOptional. - StructureFields never publish ValueRank 0; a OneOrMoreDimensions field without dimensions becomes rank 2. - Fields with ValueRank -2/-3 are published as scalar BaseDataType, which is what is on the wire. - **OptionSets:** - Implicit fields get the next free bit. - `OptionSetValues` uses null for undefined bits instead of "Reserved", and structure OptionSets publish all their bits (no 32/96-bit cap). - Numeric OptionSets are limited to their base type's width, and UInt64 bit 63 works. - **Schemas:** - Structures with inline-matrix fields are left out of the `.bsd` (5.2.5). - In the BSD, Variant-encoded and non-structure subtyped fields are described as `ua:Variant`. - In the `.xsd`, matrix fields are typed `ua:Matrix` with `Dimensions`/`Elements`, and `EncodingMask` is required. ### NodeSet / model input handling - **Model selection:** - The newest NodeSet of a model is chosen by `ModelVersion` (SemVer 2.0 precedence), then PublicationDate. The `Version` attribute, which Annex F says is not for comparison, is only a tie-break. - The order is total and does not depend on input order; referenced assemblies use the same rule. - **Default names:** - Invalid default Name/Prefix values are repaired (`201301ISA95` becomes `_201301ISA95`, `class` becomes `class_`). - Valid names are unchanged. - Sanitising no longer depends on the OS. - **`ModelUri` metadata** that doesn't match the NodeSet raises a warning instead of silently losing the model. - **Input detection:** - Only XML files whose root is `ModelDesign` or `UANodeSet` are treated as models. - A malformed NodeSet stays a NodeSet input, so it no longer breaks the ModelDesign pass. - **`IdentifierFile` paths:** they are normalized (`./`, `../`), and the suffix match requires a folder boundary. - **Dependency payloads** (`ModelDependencyV1`) carry field IsOptional, AllowSubTypes, ArrayDimensions and the producer's namespace tables in skippable trailers, so old and new readers stay compatible. ### Roslyn host, diagnostics, packaging - **New diagnostics:** - MODELGEN036: `[NodeManager]` target not supported (nested, generic, file-local or global namespace). - MODELGEN037: `[DataType]` target not supported (struct, generic, abstract, file-local or global namespace). - MODELGEN038: the definition of an encodeable base type can't be found. - **New validator errors:** - a structure with both optional and subtyped fields (OPC 10000-6 F.13); - multi-bit or duplicate OptionSet masks. - **Diagnostic locations:** `[DataType]`/`[NodeManager]` diagnostics point at real source locations again, so `#pragma` and `.editorconfig` apply. MODELGEN010 is the exception. - **Incremental caching:** pipeline values compare by value, so unrelated edits no longer regenerate the whole model or all `[DataType]`s. - **`ModelSourceGeneratorIgnore`** on a ModelDesign input is honoured; the design still resolves as a dependency. - **Cancellation:** a cancelled generation run propagates `OperationCanceledException` instead of reporting a MODELGEN003 error. - **Stack package:** the `Stack` NuGet package now ships `build/OPCFoundation.NetStandard.Opc.Ua.SourceGeneration.Stack.props`, so `StackSourceGeneratorMode` and `StackSourceGeneratorExclude` reach the compiler. ## Related Issues - No tracking issue. The audit, review and spec-grounding reports are available on request. Contains the matrix wire-format change discussed for D-5 (OPC 10000-6 5.2.5 Table 28). ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. (`docs/SourceGeneratedDataTypes.md`, `docs/NodeManagers.md`, generator readme) - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. (`UA.slnx` 0 warnings / 0 errors on net48 and net10.0) - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. The affected suites were run on net10.0: SourceGeneration Core/Roslyn/Stack, Types, Core.Encoders, Encoders.Fuzz, Client, Client.ComplexTypes, PubSub, Core, Server, GDS, Configuration, Di, Robotics, ISA95, Positioning, OpenUsd, XRegistry. net48 was built; its test legs, and the post-rebase verification, run in CI. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-29 00:47:40 +02:00
Marc Schier	23be306c65	Update NuGet dependencies (#4536) ... ## Summary - update NuGet dependencies to their latest compatible stable releases while retaining documented compatibility, native, security, and mocking pins - align the nbgv CLI with the central `Nerdbank.GitVersioning` version (3.10.94) and fail explicitly on tool installation/update errors - update the synchronized OpenUSD family to `0.14.0-alpha`; adapt the Vision blank-frame fixture to the new `RenderDiagnosticsState` constructor argument - retain `Microsoft.CodeAnalysis` API packages at the existing 5.0/4.14 host bands: Roslyn 5.9 requires Immutable/Metadata 10.0.1+, while the retained older compiler-host closure is intentionally pinned to 9.0.0 ## Dependency updates - `Dekaf` 1.17.0 → 1.21.1 - legacy ASP.NET Core 2.3 dependencies → 2.3.13; net8/net9 authentication and WebApi test packages → 8.0.31/9.0.20 - `Microsoft.CodeAnalysis.Analyzers` 4.14.0 → 5.9.0 - `TUnit` 1.68.0 → 1.69.0 - `Avalonia` / `Avalonia.Desktop` 12.1.2 → 12.1.3 - schema-test `System.Collections.Immutable` overrides 10.0.11 → 10.0.12 - `AzureSignTool` 3.0.0 → 7.0.1 and `NuGetKeyVaultSignTool` 3.0.45 → 3.2.3 - eight direct OpenUSD packages 0.12.0-alpha → 0.14.0-alpha ## Validation - `dotnet restore UA.slnx --disable-parallel` - clean `UA.slnx` Release build with `CustomTestTarget=net10.0` - `UA.slnx` Release builds with `net48` and `netstandard2.1` - OpenUSD and Vision test suites on net8/net9/net10: 882/882/921 and 484 passed + 1 environment skip on each target - full `Opc.Ua.Tools.Tests` net10.0: 963 passed, 1 skipped - source-generator package validation against a locally packed release package set - updated signing tools installed in an isolated directory; existing `sign` CLI options verified without credentials - nbgv 3.10.94 bootstrap exercised in simulated GitHub CI; disposable committed fixture verified canonical and case-invalid release refs with a four-component version ## Limits No protected signing/publication, Linux/macOS native rendering, or full stress/nightly suites were run locally.	2026-09-24 14:19:09 +00:00
Marek Linka	4018bfec91	Allow GC to collect the dynamic assembly of complex types (#4520) ... # Description As already discussed in #3173, there is a significant memory leak in the way complex types are handled in the original, reflection-based `ComplexTypeSystem`. Even though there is now a newer version of this code that does not use reflection, the reflection code is still available for consumers, meaning the leak can still impact people out there. With a minimal repro (attached), I managed to isolate the issue a bit further than the original report. The leak was not just kernel handles for events or semaphores but the whole dynamic assembly - with the `AssemblyBuilderAccess.Run` flag set, the GC could never free that assembly. Changing the flag to `RunAndCollect` resolves that problem, allowing the dynamic assembly to be collected once all references to it are lost. My repro code proves that the assembly gets collected and memory no longer accumulates with each `complexTypeSystem.LoadAsync`. ### Repro Simple single-file C# project, should be pointed to a checkout of this repo via a project reference to allow compilation. It runs a loop of opening and closing a session, each session then uses `ComplexTypeBuilderFactory` to build the dynamic assembly of complex types. Each session is then disconnected and disposed. Every 100 iterations, the repro forces full GC and reports several statistics: current GC-managed memory, current proces private memory, number of the generated dynamic assemblies (counted via name), and total number of open handles. [repro.zip](https://github.com/user-attachments/files/32555109/repro.zip) ### Repro output `AssemblyBuilderAccess.Run`: ``` [Start] Memory consumption: [GC] 3641352, [Private] 36499456, [DynamicAssemblies] 0, [Handles] 381 [Step 0] Memory consumption: [GC] 10459408, [Private] 50515968, [DynamicAssemblies] 1, [Handles] 401 [Step 100] Memory consumption: [GC] 10568320, [Private] 75034624, [DynamicAssemblies] 101, [Handles] 614 [Step 200] Memory consumption: [GC] 10539488, [Private] 93138944, [DynamicAssemblies] 201, [Handles] 814 [Step 300] Memory consumption: [GC] 10933536, [Private] 113786880, [DynamicAssemblies] 301, [Handles] 1015 [Step 400] Memory consumption: [GC] 11031496, [Private] 140181504, [DynamicAssemblies] 401, [Handles] 1215 [Step 500] Memory consumption: [GC] 11064296, [Private] 161914880, [DynamicAssemblies] 501, [Handles] 1415 [Step 600] Memory consumption: [GC] 11094168, [Private] 180477952, [DynamicAssemblies] 601, [Handles] 1608 [Step 700] Memory consumption: [GC] 11127368, [Private] 207298560, [DynamicAssemblies] 701, [Handles] 1811 [Step 800] Memory consumption: [GC] 11160168, [Private] 228204544, [DynamicAssemblies] 801, [Handles] 2008 ... ``` As you can see, each iteration leads to a new dynamic assembly being created and they are all being retained, even though the sessions they belong to have been disposed. This also means increase in kernel handles and the process' private memory (about 200 kB per session, not a trivial amount). `AssemblyBuilderAccess.RunAndCollect`: ``` [Start] Memory consumption: [GC] 3641400, [Private] 36446208, [DynamicAssemblies] 0, [Handles] 379 [Step 0] Memory consumption: [GC] 10630800, [Private] 50372608, [DynamicAssemblies] 1, [Handles] 401 [Step 100] Memory consumption: [GC] 10982808, [Private] 53596160, [DynamicAssemblies] 1, [Handles] 410 [Step 200] Memory consumption: [GC] 11048288, [Private] 46280704, [DynamicAssemblies] 1, [Handles] 413 [Step 300] Memory consumption: [GC] 10956664, [Private] 45817856, [DynamicAssemblies] 1, [Handles] 417 [Step 400] Memory consumption: [GC] 10915352, [Private] 47124480, [DynamicAssemblies] 1, [Handles] 410 [Step 500] Memory consumption: [GC] 10914776, [Private] 44843008, [DynamicAssemblies] 1, [Handles] 410 [Step 600] Memory consumption: [GC] 10890776, [Private] 44810240, [DynamicAssemblies] 1, [Handles] 408 [Step 700] Memory consumption: [GC] 10916144, [Private] 46235648, [DynamicAssemblies] 1, [Handles] 408 [Step 800] Memory consumption: [GC] 10901248, [Private] 45531136, [DynamicAssemblies] 1, [Handles] 411 ... ``` This time, we only ever retain a single dynamic assembly, the one being used for the currently open session, which is expected. The memory footprint stays flat, as does the number of open handles. ## Related Issues Fixes #3173 ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. --------- Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>	2026-09-23 19:44:53 +00:00
Marc Schier	138086863b	Fix audit findings and review regressions across the OPC UA stack (#4503) ... ## Scope Audit fixes and review follow-ups across the OPC UA Core, Client, Server, transport, and redundancy components. This includes implemented Tier 1, Tier 2, and Tier 3 work; it does not claim that every item in the 244-finding audit backlog is complete. The review batch fixes mandatory full-key record protection and owned plaintext buffers; transactional pending-certificate claims; shared-channel nonce and certificate ownership; discovery and token-policy validation; reconnect/callback ordering without changing unbounded buffering defaults; server permissions, filters, monitored-item lifetime, and alarm topology; historian paging, retention, and annotations; atomic user/password metadata; and canonical file identities with bounded alias and role refresh workers. ## Review-batch verification at `ab686ccae` The following results come from fresh test builds using `dotnet test`, `--no-restore`, `-m:1`, and an explicit `CustomTestTarget`. They replace the earlier description's library-build/`--no-build` totals, which did not establish the state of the merged test sources. | Scope | Target | Passed | Skipped | |---|---|---:|---:| | Core review regressions | net10.0 | 827 | 0 | | Client and lifecycle regressions | net10.0 | 630 | 0 | | Server review regressions | net10.0 | 1970 | 0 | | Redundancy Server / Client / PubSub | net10.0 | 276 / 10 / 11 | 0 | | Sessions / file-and-alias / streaming / HTTPS-WSS integration | net10.0 | 8 / 21 / 30 / 20 | 0 | | Core review regressions | net48 | 786 | 39 | | Client recovery and policy regressions | net48 | 54 | 0 | | Server ownership, aliases, queues, and user-state regressions | net48 | 137 | 0 | Every listed run exited successfully. The 39 net48 skips are existing platform/capability cases. New key-agreement tests assert unavailable-policy behavior on unsupported targets rather than adding skips or pretending those targets performed an unsupported handshake. Additional exact node/permission/filter/alarm checks passed 13 Core and 46 Server cases. The PR-scoped formatter verification covers 26 projects and 389 non-generated C# files. A Roslyn syntax audit covers 53 changed interfaces and 263 members, with no missing parameter/type-parameter/return contracts and a 120-column limit for their declarations and documentation. No full-solution, all-target-framework, or NativeAOT matrix is claimed from these local runs; the new CI run must establish its own result. ## CI follow-up at `e1bc3ac3b` The follow-up fixes the failures reported by Azure build 18400. TLS certificates retain configured DNS names, including mixed-case URI schemes, without relaxing hostname validation. Reverse-WSS fixtures use the DNS identity in the client certificate. Reconnect completion is published only after cycle cleanup, so a subsequent reconnect cannot join an old completed cycle and retain old certificates. Certificate-alarm roots now support event subscriptions. The pump sample has one continuous notifier path, with no duplicate shortcut. Historian and aggregate fixtures share the provider's retention clock. Alarm collection lets the server expire idle Publish requests rather than canceling only the client wait. The corrected server, WoT, and managed-session fixtures exercise valid requests and initialized lifecycle contracts. Downlevel crypto tests preserve real credential and key-ownership assertions without enabling unsupported raw-ECDH policies or adding skips. Fresh local evidence after integration includes: | Scope | Target | Passed | Skipped | |---|---|---:|---:| | Client lifecycle / channel ownership / builder fixtures | net10.0 and net48, each | 96 / 103 / 123 | 0 | | Combined server lifecycle, events, aggregates, crypto, and contracts | net48 | 358 | 0 | | Full lifecycle plus certificate-alarm and aggregate fixtures | net10.0 | 116 | 0 | | Final server-contract and history-routing delta | net10.0 and net48, each | 84 | 0 | | Subscription / XRegistry / WoT event regressions | net10.0 | 7 / 2 / 3 | 0 | | Full Sessions project | net10.0 | 780 | 379 | | Full ComplexTypes project / downlevel resolver fixtures | net10.0 / net48 | 2854 / 15 | 0 | | Full WoT project / downlevel structured-write fixtures | net10.0 / net48 | 1496 / 27 | 0 | | TLS domain-name regressions | net10.0 and net48, each | 21 | 0 | All listed runs exited 0. The Sessions skips come from existing endpoint and policy capability guards; they are not counted as passes. No skip was added. Worker validation also covered full DI (426 passes), full History (540 passes, 21 existing skips), 38 exact downlevel event/history failures, and 60 repeated certificate-rotation race cases. The final crypto fixtures passed 73 cases on each target with the unchanged leak detector; a temporary premature-disposal mutation made all three borrower tests fail and was then removed. All 29 C# files in this follow-up pass included-file formatting at info severity across 12 projects. The complete PR interface audit now covers 54 interfaces and 271 members with zero missing contracts or line-width findings. No full-solution or NativeAOT matrix is claimed. New-head CI has started and remains authoritative for the remote result. ## Test-result gate follow-up at `4b6e1203a` Azure build 18401 reported the net48 Client job as successful despite a test-host crash after only 264 passing tests. Its old evaluator counted per-test failures but ignored the failed run verdict. This was a partial run, not a benign exit after the suite had completed. The shared result evaluator now rejects aborted, errored, incomplete, malformed, or inconsistent TRX reports. Each file must describe a completed run, so a passing file cannot mask another file's failure. It retains support for completed runs followed by a benign nonzero host exit, existing skipped-result conventions, and no-TRX MTP jobs. All 78 regression cases pass after integration using Windows PowerShell 5.1. Real completed Sessions and Client reports also pass. The process-test fixture follows the existing NET10_0-only tools-test pattern; its net48 build is not counted as a test run. Formatting passes for the added test file. The Client host crash itself has not reproduced locally. The isolated fixture passed 59 tests, and two fresh full fast-CI selections each completed with 2,392 passes and three existing skips, including a run with crash collection enabled. The CI merge tree is identical to the tested source tree. No speculative runtime change was made, and the original partial CI run is not claimed as a full-suite pass. Azure build 18402 has now completed the full net48 Client run: 2,392 passed, three existing console skips, and a successful test-host exit. The corrected evaluator independently validated outcome=Completed. Across the matrix, 119 test-project jobs succeeded; Sessions net10.0 was canceled when the remote provider deprovisioned its runner, so the overall Azure pipeline was canceled. That cancellation is not claimed as a code failure or a successful run. CodeQL and three Docker image jobs were still running at the latest check. The migration discovery failure remains separate. ## Documentation follow-up at `57ed02bea` The environment blocker has been removed by the maintainer. The three bundled migration references now exactly match the canonical documents after deterministic link rewriting; all 15 bundled documents pass `validate-migration-plugin.ps1`. The canonical migration prose was not rewritten. `FileSystemClient.md` now documents that extended Windows roots preserve literal trailing-dot names, completing the filesystem review follow-up. The filesystem thread has been replied to and resolved after publication. The review pass now has 108 of 110 threads resolved. The two explanation-only threads remain open as requested; no unfinished change request is being represented as resolved. ## Cross-platform follow-up at `0d9d936a8` With migration discovery restored, the Linux and macOS test matrix exposed two stale durable-subscription expectations. The expected value 83,442 encoded the old 32-bit overflow when converting 3,600 hours to milliseconds. The existing overflow-safe server correctly returns 14,400,000 lifetime intervals at a 900 ms publishing interval. Only those two expected constants changed; production behavior, negotiated-hour checks, and all other assertions remain unchanged. The exact local lifetime selection reproduced both failures before the correction. The full durable suite now passes 36 cases with 11 existing skips on each of net10.0 and net48. All four lifetime cases executed and passed on both targets, and included-file info-severity formatting passes. ## Session shutdown follow-up at `8daf7f091` A late net48 Sessions failure exposed a shutdown race. Canceling an in-flight keepalive read can produce a transport `ServiceResultException`. The retiring worker treated its own cancellation as proof that the peer was unavailable, so `CloseAsync` or `DisposeAsync` could skip the server-side `CloseSession` request. The worker now ignores that service error only when its own token is canceled; genuine peer errors still update liveness. The full integration fixture reproduced the original error-code mismatch. Four deterministic mock-transport cases then produced three failures and one passing genuine-error control before the fix. They verify successful close, returned server error, asynchronous disposal, and unchanged behavior for a real keepalive failure. Fresh related runs pass 75 client and 101 integration cases on each of net48 and net10.0, with no skips. Ten repetitions of the formerly flaky full net48 fixture pass all 1,010 cases. All three changed files pass info-severity formatting, and temporary diagnostic instrumentation was removed. ## Atomic listener snapshot follow-up at `82dc22b5d` Ubuntu Core CI exposed an unsafe formatter rewrite in TCP listener disposal: `ConcurrentDictionary.ToArray()` had become a collection spread. A concurrent channel removal between the spread's count and copy operations could leave a default entry, causing a null dereference during disposal. The listener now uses the dictionary's atomic `Values` snapshot and disposes those channels outside the listener lock. Deterministic regressions close zero, one, or all channels at the copy boundary. Before the fix, the one/all-removal cases reproduced the exact null dereference; the unchanged-count control passed. All 23 admission/listener cases now pass on net10.0 and net48, and the full fast Core net10.0 suite passes 5,267 cases with 88 existing platform skips. Both changed files pass info-severity formatting. A bounded audit of the formatter's other snapshot rewrites found no further verified unsafe concurrent-registry copies. ## Shutdown-test observation follow-up at `58403ee8b` The net48 shutdown-order test raced its own observation: it read `m_publishWorkerTask` after starting shutdown, which can legitimately drain the worker and clear that field immediately. The test now captures the worker before shutdown starts and confirms it is initially running. It still requires the worker to finish while shutdown remains blocked by the held manager semaphore. Production behavior is unchanged. A temporary scheduling perturbation reproduced the exact null-field failure. The corrected capture passed 100 perturbed iterations; both the temporary repeat and yield were then removed. The final 126 subscription/lifecycle cases pass on each of net48 and net10.0, and formatting passes. A complete local Sessions net10.0 run also passed 780 cases with 379 existing capability skips in 7m20s after the earlier keepalive correction. ## Retirement and alias-startup follow-up at `1a048ff39` The shadow-generation test now observes its documented asynchronous cleanup through the existing bounded helper. Removing the replacement does not join a background drain that already claimed the retired generation. The test still checks live-registration removal immediately and requires the old node to disappear; no timeout or production lifecycle behavior changed. All 81 lifecycle cases pass on each of net10.0 and net48. Initial alias-node materialization now retries one timed-out, read-only snapshot query before creating nodes for that root. The retry is logged through source-generated logging. Each query retains the original shared 100 ms deadline; repeated timeouts, other errors, and cancellation still abort startup. Client searches and live refresh do not gain this immediate retry. Fault-injection tests cover success after one timeout, a persistent timeout, a different store failure, and cancellation. All 187 related alias/hosting cases and the original certificate-rotation integration case pass on each target; the positive test records exactly one retry warning. The alias documentation now accurately describes the shared request budget. All changed C# files pass formatter checks, and the complete 54-interface/271-member documentation audit passes. Fresh CI is running on `1a048ff39`; the previous completed matrix exposed only the two failures corrected in this batch and their dependent summaries. ## Sample endpoint allocation follow-up at `d08a94925` The strong-cluster test harness allocated OPC UA and Raft endpoints in separate released-port batches. Uniqueness was enforced only inside each batch, so the same OS-assigned port could appear in both protocol groups. The harness now requests one distinct batch for both groups and splits it before launching any replicas. Deterministic one- and three-replica allocation cases reproduced overlapping groups with the old plan and pass with the corrected plan. The complete 17-case short-haul sample suite passes without skips; all failover, historian-continuation, and service assertions remain unchanged. Both changed files pass info-severity formatting. This prevents intra-cluster self-collisions but does not claim to reserve released ports against unrelated external processes. ## Code-review follow-up at `085fd9636` A review of the complete branch diff found five defects this PR introduced. All are now fixed, each in its own commit. `RelatedTo`'s recursive-to-iterative rewrite defaulted the optional `includeTypeDefinitionSubtypes` and `includeReferenceTypeSubtypes` operands to `false`. Part 4 §7.7.4 specifies both default to `true`, so a filter that omitted them silently stopped matching subtypes. Dynamically created key-credential nodes derived their namespace from the containing folder, which is the standard `i=18155` node in namespace 0 — the namespace reserved for the OPC UA standard address space; they now resolve the server-owned namespace and fail with `BadInternalError` rather than guessing index 1. The retained audience-less `CreateTokenData` overload produced tokens that verification always rejects, so it is now `[Obsolete]` and throws instead. A failed reference to a remote parent left the new node registered with a one-sided inverse reference, and is now rolled back. An existing `.pfx` is restricted before it is rewritten, rather than after its new key bytes are on disk. One further reported finding was rejected after investigation. `JwksIssuerKeyResolver` deliberately does not dispose retired key snapshots: `RetiredKeysAreCollectibleWhileResolverRemainsAliveAsync` proves the resolver retains no retired snapshot, and `ReturnedKeysSurviveRepeatedRefreshAndResolverDisposalAsync` requires already-returned keys to keep verifying across refreshes and resolver disposal. Adding disposal would have broken that tested contract, so the exploratory change was reverted. Validated on net10.0 and net48: 256 Core and 633 Server cases pass, with one pre-existing net48 skip. The build reports zero compiler and analyzer diagnostics, all eight included-file info-format checks pass, the contract audit covers 58 interfaces and 310 members with no findings, and the 15 bundled migration documents validate. All 122 review threads are resolved; the key-credential namespace thread was reopened to retract an earlier incorrect answer and then resolved against the real fix. ## Review-body follow-up at `da0d59cfb` The re-review at `8daf7f091 + 82dc22b5d` listed four items in its summary that had no inline thread of their own, so they had not been picked up. All four are now fixed. Both event-dispatch permission gates had been tightened from not-Bad to `IsGood`, which silently dropped events whose permission verdict is Uncertain; the data-change path in the same file still treated Uncertain as deliverable, so the two had diverged. `EventSourceRegistry` only cleared `ConsecutiveFailures` when a source was deactivated, so a source that had backed off to the 30-second cap kept that delay for the rest of the process even after starting successfully. `UserNameIdentityTokenHandler` built a temporary issuer chain whose `Add` calls take independent certificate references, and never released them. The fourth was the receiver-side sequence rollover, which the reviewer had correctly re-flagged as still open despite its thread being resolved. `m_sequenceRollover` was set permanently, so the second legal wrap on a long-lived channel was rejected and faulted the channel along with the transport-reconnect OPN. OPC 10000-6 does not cap a SecureChannel at one wrap. The flag is now cleared once an accepted number has traversed the normal range, which keeps rejecting a replayed low number that never left the rollover window. Validated on net10.0 and net48: 636 / 593 Core cases and 135 / 134 Server cases pass, including the new `UaSCBinaryChannelSequenceRolloverTests` and the Uncertain-permission delivery cases. The build reports zero compiler and analyzer diagnostics and the changed files pass included-file info-format checks on both targets. The previous head `085fd9636` was fully green: 279 checks passed and Azure build 18414 succeeded with 137 of 137 jobs, after the platform automatically retried a job whose NuGet tool download had hit a transient TLS error. ## Reported issues #4508 and #4509 at `6ad1ecf16` **#4508 (V2 subscription recreate deadlocks against a faulted transport) was not yet fixed and is now closed by `bac260a06`.** Both drain sites the report identifies were still unbounded. A publish worker that started its request before the quiesce parks inside the service call on the channel ready gate while holding an active publish request; the recreate that would make the channel ready is the very operation awaiting the drain, so the wait never ends. The drain now cancels in-flight attempts through a per-attempt token linked to the worker token. An aborted worker rolls its acknowledgements back, releases the request and returns to the paused park instead of terminating, so it resumes when the caller leaves the quiesce. Publish ingress stays quiesced for the caller's operation, so `DropPendingForSubscription` keeps the guarantee the report asks to preserve and no blind timeout is added. The new regression parks a worker on a cancellable gate that never completes on its own: it reproduces the hang for the full 30-second budget before the change and passes after it. **#4509 (identity provider fails the initial connect) was already fixed for its primary symptom.** `HandleConnectAsync` materializes the provider's identity through `CreateIdentitySelectionContext` before the first `CreateAsync`, so Anonymous is no longer substituted against a UserName-only endpoint. `6ad1ecf16` adds the two remaining details from the report: the enabled-policy set now includes the negotiated channel policy, so a client cannot reject the policy it already accepted as `NotEnabledByClient`; and when discovery has not populated the endpoint's token policies the connect keeps the configured identity so the attempt fails at the transport layer for the reconnect policy to retry, instead of failing at the identity layer. Validated on net10.0 and net48: 477 / 473 client session and subscription cases pass, the build is free of compiler and analyzer diagnostics, and the changed files pass included-file info-format checks on both targets. The full `Opc.Ua.Sessions.Tests` suite also passes locally on net10.0 with 782 passed and 379 pre-existing capability skips. GitHub checks are green on this head: Build and Test .NET 10.0, Docker Sample Images CI, and NuGet Publish all succeeded. Azure build 18417 completed 134 of its 135 jobs successfully; its net10.0 Sessions job was cancelled by the hosted-agent provider ("Received request to deprovision"), the same infrastructure flake that hit build 18409 earlier on a head predating these changes. That job is not claimed as passing, and the local full-suite run above covers the same project. The previous head `da0d59cfb` completed Azure build 18415 with every job succeeded. ## Review follow-up at `a08f0c12b` Eleven new review threads arrived, nearly all documentation. Before acting on each "this is new in 2.0" remark I checked the API against `master378` rather than assuming, because a genuine 1.5 API still needs its migration entry. `ManagedSession`'s server-redundancy refresh had two hard-coded two-second bounds. The new `ServerRedundancyOptions` exposes `RefreshTimeout` for the metadata read and `PeerDiscoveryTimeout` for each peer lookup, defaults both to the previous two seconds, validates that a bound is positive or `Timeout.InfiniteTimeSpan`, and flows through `ManagedSessionOptions`, `ManagedSession.CreateAsync`, the fluent builder, and `DefaultServerRedundancyHandler`. `AsyncCustomNodeManager` and `KeyCredentialBridgeAuthenticator` are both absent from `master378`, so their obsolete members had no compatibility constraint and are removed rather than carried: `AsyncCustomNodeManager.ReadInitialValue`, the audience-less `CreateTokenData` that only threw, and the audience-less `CreateProof` that produced a proof no server accepts. `CustomNodeManager2.ReadInitialValue` and the `MonitoredNode2` migration section are genuine 1.5 APIs and are untouched. The documentation now states master's behaviour instead of the delta from 1.5.378, with each moved item already covered under `docs/migrate/2.0.x/`. `IHistorianAnnotationProvider` is described by its annotation-time key rather than as "legacy" — it is new in 2.0, so the label implied a compatibility constraint that does not exist. The KeyCredential bridge payload's `"version"` field is explained as a vendor-extension format version with no OPC UA counterpart, and its version-1 upgrade narrative is gone. `CertificateManager.md`'s migration walkthrough is replaced by the resolver API it targets. `NodeManagers.md`, `Sessions.md`, `AsyncServerSupport.md`, `Certificates.md`, and `Profiles.md` no longer announce features relative to 1.5. `Benchmarks.md`, `WhatsNewIn2.0.md`, `DeveloperGuide.md`, and `docs/migrate/` keep their 1.5.378 references, which are their subject. CI then exposed a defect this batch introduced: five fixtures resolve `ManagedSession`'s private constructor by its exact positional parameter types, so the added parameter compiled cleanly but made `GetConstructor` return `null` at run time. `7df1d5c40` updates every site; `Redundancy.Client` passes 126 of 126 and the affected client fixtures 112 of 112. The BouncyCastle question is answered and tracked in #4510: `Opc.Ua.Core` already project-references `Opc.Ua.Security.Certificates`, which already carries the conditional BouncyCastle reference, so the raw-ECDH polyfill belongs there rather than as a new Core dependency. The `IUserDatabase` metadata question is addressed to another maintainer and is deliberately left open. ## Reported issue #4509 follow-up at `5d4d13d63` The reporter verified `6ad1ecf16` and found one case still failing, correctly. The empty-token-policies branch kept the configured identity so a server that is down surfaces a transport failure rather than an identity error. A provider-only configuration has no configured identity, so it kept `null`: `OpenCoreAsync` turned that into Anonymous and `OpenValidateIdentity` rejected it with `BadIdentityTokenInvalid`, silently ignoring the configured provider. The branch now requires a configured identity to defer to. Without one the provider is consulted, so its own `BadIdentityTokenRejected` names the offered and rejected policy set instead. Two regression tests cover both configurations; the first fails against the previous behaviour by reaching the session factory with a `null` identity, which is the exact step that produced the reported error. That branch had shipped without a test, which is why the case was missed. ## Review and CI status at `5d4d13d63` **All actionable review threads are resolved: 132 of 133.** The single open thread is a question the reviewer addressed to another maintainer about moving user metadata into `IUserDatabase`; it is left open for them rather than resolved silently. Every resolved thread carries a reply naming its fix commit. **Latest-head CI is green on `5d4d13d63`: 279 checks passed, zero failed, zero pending**, with one conditional signed-package publishing job skipped. Local validation for this batch: the full `Opc.Ua.Client.Tests` suite passes 2,430 of 2,430 on net10.0, `Opc.Ua.Redundancy.Client.Tests` 126 of 126, and `Opc.Ua.Server.Tests` 590 of 590 for the affected selections. Both net10.0 and net48 build clean for `Opc.Ua.Client`, `Opc.Ua.Server`, and the changed test projects, and all changed files pass included-file info-severity formatting on both targets. The PR remains open; no merge was performed. As stated at the top, this does not claim that every item in the 244-finding audit backlog is complete. ## Latest CI follow-up at `b6f2dfa43` Azure build 18442 exposed a net48 compile regression in the Kafka adapter: `RuntimeHelpers.GetUninitializedObject` is unavailable on .NET Framework. Commit `2cf1e0eed` now uses normal `ProducerMessage` construction on `NETFRAMEWORK` while retaining reflection-based construction for modern targets that can load a different Dekaf runtime asset. The exact net48 CI selection passes 92 of 92 tests, and the netstandard2.1 adapter guard selection passes 11 of 11. After merging the latest `master`, GitHub Actions run 35643592139 is green. The initial Ubuntu Core.Schema job built successfully and passed 160 of 160 tests, then hit an external 403 while finalizing its test-result artifact; its failed-job rerun completed successfully. Azure build 18451 was canceled when its remote provider deprovisioned the net10.0 Sessions runner (`Received request to deprovision: The request was cancelled by the remote provider`). Azure attached no test task log or source error, and the canceled parent left that child check stale as in-progress. No source workaround, test skip, or check relaxation was made for either infrastructure failure. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 68f26810-22b8-476f-abcd-0a8c82d6e208	2026-09-22 09:10:58 +02:00
Cristi Pogacean	8889ffee0e	Fix connector migration type handling and transfer recovery (#4496) ... Preserve null enumeration arrays while restoring enum metadata, reconstruct concrete structure collections, and schedule transferred notifications for immediate republish. Add regression coverage for issue #4494. # Description _Describe the changes here to communicate to the maintainers why they should accept this pull request. By default - this will become the Commit message after merging and thus define history._ ## Related Issues _Reference all GitHub issues this PR addresses. If there is no issue yet, open one and link it here._ _If this is a relatively large or complex change, a design must have been discussed in the related tracking issue and signed off (which becomes the Architectural Decision Record (ADR))._ - Fixes #github-issue-number, ... ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>	2026-09-18 04:15:34 +00:00
Marc Schier	b17007bd55	Stop the encoder tests flooding the VSTest channel with per-test output (#4219) ... # Description The `Core.Encoders` test job of run [`31249610490`](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/31249610490) printed nothing for 57 minutes and was killed by the 60-minute job timeout. Issue #4213 recorded that as "hung at or before the first test" — that reading was wrong, and the evidence to disprove it was already in the job's own artifact. The blame collector *had* written a hang dump and it *was* uploaded, inside the ordinary `dotnet-results-Core.Encoders-*` artifact (11 MB of it was the dump), where nobody looked for it. Opening it names the cause precisely. ## What the dump shows 522 threads (408 background) in a process that finishes in 25 seconds when healthy. Every test had already run; NUnit was in `OneTimeTearDown` waiting on its event pump: - the **event pump thread** is blocked in `NUnitEventListener.TestFinished` → `TestRunEventsHandler.HandleLogMessage` → `LengthPrefixCommunicationChannel.Send` → `Socket.Send`, on a socket that never drained. That send holds the channel's lock; - `TestRunCache.SendResults` is blocked on that channel lock, and it holds the cache lock; - `TestRunCache`'s **one-second timer** then fired repeatedly into that held cache lock, and the thread pool injected a fresh worker for each — **399 threads** parked in `Monitor.Enter_Slowpath` behind a single lock; - the NUnit run thread sits in `EventPump.Stop()` → `Thread.Join()`, so the run can never complete. ## What put the socket under that much pressure Volume of test output. Every encoder case dumps its input, its encoded payload and its decoded result, the NUnit adapter forwards each captured line to the runner as an individual message over that socket, and the suite has 2929 cases. This is not marginal: | | Before | After | | --- | --- | --- | | `Core.Encoders` TRX, green local run | **496 MB** | **4 MB** | | `Core.Encoders` published CI artifact | **156 MB** | ~3 MB | | Next-largest test job's artifact, for scale | 15 MB | 15 MB | | `Client.ComplexTypes` TRX | 74 MB | 40 MB | So the suite was shipping half a gigabyte of text through a socket, one message per line, on every run and on every OS — and paying for it in artifact storage even when nothing went wrong. ## The change `EncoderCommon` gains a buffered `TestOutput` writer. The dumps are collected per test and handed to `TestContext.Out` in `TearDown` **only when the test did not pass** — which is the only time anyone reads them. Nothing is lost: a failing test still reports its full input/encoded/decoded dump under *Standard Output Messages*, verified by injecting a deliberate failure. Explicit opt-ins (`PrettifyAndValidateJson(..., outputFormatted: true)`) and the static helpers keep writing immediately. The same base class is shared by the `Client.ComplexTypes` fixtures, so those are moved over too rather than left with half-buffered, half-immediate output. Two supporting changes: - **`.github/workflows/buildandtest.yml`** — `timeout-minutes: 30` on the `Test` step. The blame collector did its job here (dump at +50 min, once the run went quiet), but the run still had not unwound 7 minutes later when the *job* timeout cancelled everything, so the step needs a bound below the job's. `Upload test results` already runs `if: always()`, so the dump is still published. - **`docs/DeveloperGuide.md`** — a "Test output" convention under *Running tests*, so the next data-driven fixture does not re-introduce this. ## Notes for reviewers - `[Parallelizable]` on these fixtures is `ParallelScope.Self`, i.e. fixture-level; tests inside a fixture stay sequential, so the per-fixture buffer is as safe as the existing per-fixture `RandomSource`/`DataGenerator` state that is already reset in `SetUp`. - I separately confirmed that `--blame-hang-timeout` *does* fire on a hang before the first test (minimal NUnit repro, dump at exactly the configured timeout), which is what rules out the original "hung during startup/discovery" theory independently of the dump. - Local verification was scoped to the two affected suites rather than the whole solution: `Opc.Ua.Core.Encoders.Tests` 2929/2929 on **net10.0** *and* **net48**, `Opc.Ua.Client.ComplexTypes.Tests` 2773/2773 on net10.0, all building with 0 warnings. The full `UA.slnx` run is left to CI. ## Related Issues - Fixes #4213 ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: da92151a-3da2-4caf-a39c-5556e56f0506	2026-08-09 21:49:05 +02:00
Marc Schier	8538f531e7	Update paths for the consolidated repository layout	2026-07-16 06:26:05 +02:00
Marc Schier	7cec2d614d	Move repository files to the consolidated layout	2026-07-16 06:25:54 +02:00