# Description
When a client asked for history on more nodes than the session is
allowed to keep continuation points for (100 by default), the server
still handed out a continuation point for every node. To make room it
silently threw away the oldest point of the same request, so the client
received 101 points and the first one was already obsolete.
OPC 10000-4 §7.9 says the server may free points left over from earlier
requests, but once the current request has used up the limit, any
further operation must fail with Bad_NoContinuationPoints.
## Checklist
_Put an `x` in the boxes that apply. You can complete these step by step
after opening the PR._
- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [ ] I have added all necessary documentation.
- [ ] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.
## Proposed changes
Three spec alignment fixes for the 1.5.378 line.
- **Session AuthenticationToken** (`SessionManager`): CreateSession now
always assigns a random 32 byte opaque AuthenticationToken. Previously a
numeric, incrementing token was used for sessions created on a secured
endpoint. OPC 10000-6 7.4.1 requires a random token of at least 32 bytes
for HTTPS, and a single format keeps all transports consistent.
- **OpenSecureChannel response policy** (`UaSCBinaryClientChannel`,
`UaSCBinaryChannel.Asymmetric`): a client channel opened with a
SecurityPolicy other than None now requires the OpenSecureChannel
response to use the same SecurityPolicy and SecurityMode and to carry
the server certificate. Previously the response could switch the channel
to SecurityPolicy None (OPC 10000-4 5.6.2.1, OPC 10000-6 6.7.2.3).
Channels configured for None are unchanged.
- **Identity token decryption errors** (`Session`, `RsaUtils`): every
failure while decrypting a user identity token is now reported as
`Bad_IdentityTokenInvalid` without an inner result, as OPC 10000-4
7.40.2.1 specifies; the cause is logged on the server instead. An
invalid length prefix in RSA-decrypted data now fails the same way as
other decryption errors instead of `Bad_EndOfStream`.
## Behaviour changes
- AuthenticationTokens on secured endpoints are ByteString (opaque)
NodeIds instead of numeric NodeIds.
- ActivateSession with an undecryptable identity token returns
`Bad_IdentityTokenInvalid` in all cases, also when the client requests
inner diagnostics.
## Tests
- `ClientOpenSecureChannelDowngradeTests` (Core): secured client rejects
a None OpenSecureChannel response; None client still accepts it.
- `RsaUtilsDecryptTests` (Core): round trip; invalid length prefixes
fail with the same exception type as invalid padding.
- `SessionSecurityRegressionTests` (Server): opaque 32 byte tokens on a
shared secured channel id; uniform ActivateSession status for identity
token decryption failures.
Local results (net10.0): Core 7938 passed / 0 failed, Server 511 passed
/ 0 failed, Client 1063 passed / 3 failed. The three Client failures
(`TransferSubscriptionNativeAsync` x2, `ShortHaulStabilityTestAsync`)
pass when run in isolation on both this branch and unmodified master378.
The new tests also pass on net48 (Release).
## Types of changes
- [x] Bugfix (non-breaking change which fixes an issue)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Backports the browse continuation point limit fix from master (commit
1eb5e0c7f9, PR #4036) to `master378`.
## Problem
An off-by-one error in browse continuation-point retention allowed one
extra browse continuation point to remain active. The eviction check
only removed the oldest point when the count *exceeded*
`MaxBrowseContinuationPoints`, so a session could hold
`MaxBrowseContinuationPoints + 1` points.
## Fix
In `Session.SaveContinuationPoint`, evict the oldest point as soon as
the session *reaches* the configured limit (`>=` instead of `>`), so at
most `MaxBrowseContinuationPoints` points remain active.
## Tests
Adds
`SessionContinuationPointsTests.SaveContinuationPointEvictsOldestWhenCountReachesConfiguredLimit`,
a regression test that saves one more than the configured limit and
asserts the oldest point is evicted while exactly the configured number
are retained. Verified it fails against the pre-fix code and passes with
the fix.
> Note: The upstream commit modified the refactored
`SessionContinuationPoints` class, which does not exist on `master378`.
The equivalent change here is applied to
`Session.SaveContinuationPoint`, and the regression test is written
against the `master378` `Session`/`ISession` API.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This pull request modernizes the OPC UA .NET codebase and tests, removes .NET Standard 2.0 support from certificate/security code, and updates test code to use C# 12 and .NET 8+ features for clarity and maintainability.
- Certificate and BouncyCastle interop files (e.g., CertificateBuilder.cs, X509Extensions.cs, X509SignatureFactory.cs) are refactored to drop NETSTANDARD2_0 support and use modern .NET APIs and conditional compilation.
- Test code across the codebase is updated to use default, strongly-typed Parse methods, collection expressions, and improved async/await patterns.
- Exception handling and assertions in tests are modernized, and test method naming is made consistent with Async suffixes.
- The project and build files are updated to clarify Roslynator analyzer usage and remove obsolete netstandard tags.
- General code and test cleanup includes improved null safety, type safety, and removal of deprecated or unused code.
* remove all usages of SoftwareCertificates
- Client
- Server
As per spec they are not relevant for security.
If an SDK User wants to use the SoftwareCertificates ActivateSession can be overriden
* remove from SessionClientBatchTests
This change adds a **new Opc.Ua.Types** nuget that contains core types that do not rely on generated code. Why the name? Because almost all code that was in the Types subfolder is part of it, and because we do not want to change the name of the Opc.Ua.Core nuget/assembly because code relies on it. Any other name like base or bootstrap felt out of place due to the current structure already defining the name "types". Key design is to depend on only a small set of libraries with limited transitive dependencies, that includes hashcode, logging.abstraction, and for non standard20 builds System.Text.Json (needed for localizedText mul parsing). Also, key is to support .netstd 2.0 to support source generators and to allow removal of EEC_SUPPORT defines by removing std2.0 from core and all libraries.
The changes are mostly restructuring, and thus small but contain some key changes:
- **Status code** struct now comes with a Symbol field, which is used to carry symbols in case the code is not generated. Currently (until generated) the status code struct must be manually created with a symbol or the ToSymbolicId extension must be called in the core project. Future will generate Status code constants just like NodeId that contain the symbol which also removes the reflection-based lookup. Several tests needed to be adjusted as they checked the status code symbol strings instead of the code.
- **Core identifiers** are copied as they were needed for code to compile, that includes attributes, a subset of status codes and node identifiers. These will never change so no need to generate them.
- The types folder now contains **encoders**, except for json which is still in core. Once the json encoder is ported to system.text.json it will also be included and Newtonsoft.Json dropped as dependency (-> #3329).
- Since types relies on **IOperationContext** and **ISystemContext**, and these export IUserIdentity which relies on crypto, these were split and extended in core with ISessionOperationContext and ISessionSystemContext, which mean changes to ServerSystemContext and introduction of SessionOperationContext and SessionSystemContext classes that extend OperationContext and SystemContext. Some runtime checks in the server are therefore needed to get at the session and auth info, however, those are anyway optional fields and are not on the critical paths, and thus a type check is in order (and was done in the past already, but against OperationContext class).
- **Manifest resources** are now split between Core (nodeset zip, some generated resoures) and Types (built in bsd/xsds). This needs to be revisited later if the bsd/xsd need to be regenerated during type generation. Note that the embedded resource names changed as a result. Since these are only used internally and do not constitute public API this feels reasonable vs duplication of resources in 2 assemblies.
- Reflection however now needs to load not just the built in **encodeables** from Opc.Ua.Types assembly, but also the generated encodeables from Opc.Ua.Core assembly. For this a new helper Utils method was added to get the Core assembly when linked against Opc.Ua.Core otherwise null.
- Whatever utils methods needed to be split out into the new Opc.Ua.Types assembly, they are now in **CoreUtils** static class in Opc.Ua.Types, and Utils.xxxx forwards to them to ensure minimal changes. Later we would want to obsolete them in favor of CoreUtils, although it might make sense to split them again into domain specific utilities, such as networking, files, etc
- Allow setting ReturnDiagnostics on the session factory to ensure the diagnostic settings are part of "Create" also. Set them to SymbolicIdAndText by default.
- Better logging in unit tests, now also logs to progress including exception traces, also prefixes SERVER and TEST on console to attach the logs to the server or client side.
- GDS client stability improvements to ensure client reliably reconnects between calls when connection is lost.
- Do not dispose the application certificate when it is updated from GDS client to avoid existing sessions to crash with CryptographicException. This needs more improvements later on because it is rather hacky today.
- Remove the certificate cache in CertificateFactory (as per discussion and agreement) which allowed re-enabling the older UserIdentity API
- Logging improvements here and there to analyze issues in unit tests better
* make Server return BadIdentityTokenInvalid if use of anonymous identity token is not allowed
* Change Response Code on Client side also to be consistent
* change response code ro BadIdentityTokenRejected
- Port support for ECC NIST/Brainpool profiles from prototyping_ecc branch
- Implement CertProvider to load certs per connection / profile
- Backward compatibility of configuration for existing apps
- SecurityConfiguration specifies app cert types for each profile
- Autodetect the ECC support for brainpool/nist based on platform (mac OS 10 doesn't support brainpool)
- ECC supported on net48 / net5.0 / net 6.0 / netstandard2.1
- ECC supported on windows / linux / macOS (brainpool not < macOS11)
- Self signed certs for each profile are created on start similar to RSA
- RSA only profiles are supported on .NET standard 2.0
Co-authored-by: Martin Regen <mregen@microsoft.com>
Added a new method ManagedBrowse to the UA client, which takes care of calling browse next after calling browse, when necessary. It also handles the status codes BadNoContinuationPoint and BadInvalidContinuationPoint.
Added support for the new method in ISession, TraceableSession, Session and SessionAsync.
Use the new methods in the NodeCache and other API that use browse (FetchRefrences etc).
Added unit tests which verify correct behavior of the new methods.
* Added MaxChannelCount and detect and cleanup "stale" channels based on ChannelLifetime
* Add Environment.TickCount as time reference
* Set a socket backlog value to avoid socket open overflow
* Added a ChannelKeepAlive to signal when a session is still active
* Add options to console client to leak channels and run connect loop forever
Co-authored-by: Martin Regen <mregen@microsoft.com>
Currently, due to some internal cloning of sessions, subscriptions and monitored items it is not possible to use subclassed variants which are properly recreated after a session reconnect.
- Add a `ISessionInstantiator` interface to allow to subclass a `Session` and override virtual function.
- Add a `Subscription.CloneSubscription` and `MonitoredItem.CloneMonitoredItem` virtual method to recreate those with event handlers and client handles.
- A sample implementation with `TestableXXX` classes is provided to test the BadInvalidTimestamp fix by injecting modified timestamps in the session class.
- Remove duplicate `IDisposable` with `Session`. `IClientBase` is disposable already.
- adds `knownTypes` parameter to `Session.Load` and `Session.Save` to support save and restore of custom Subscriptions and Monitored items.
bug fixes:
- IOP: an empty DataTypeDictionary throws an exception when loaded by the complex type system, server are allowed to leave it empty to save memory.
- BadInvalidTimestamp should not be returned when the timestamp in the requestheader is out of sync. #2364
- Support Client.Session API to save and restore session configuration information as xml or in a serializable data structure.
- Support to reactivate a session using a new secure channel.
- API tests
* Handle JWT and set the IssuedTokenType in the server based on the policy referenced by the PolicyId in the client supplied UserIdentityToken .
* Connect/Reconnect tests cases with JWT
* Fixed casting of event snapshot handler.
* Added Server Session property EndpointDescription ;
* Limited reporting and corrected the filtering of Audit events;
- Implement client and server side of Transfersubscription service calls.
- New Transcription service has been tested with CTT 1.04.9.398
- Unit tests for native service calls and client SDK
- Client implements multiple ways to transfer sessions:
- Client saves subscriptions to xml stream, restarts, loads subscriptions from stream and transfers on server.
- Client creates a new sessions and transfers into new session, while the old session is still active.
- Client closes old session with `DeleteSubscriptionsOnClose = false`, creates new session and transfers subscriptions to new session.
- `SessionReconnectHandler` tries to transfer subscription before recreating the subscriptions.
- breaking change: INodeManager got a new TransferMonitoredItems method
Co-authored-by: Alexander Koepke <alexander.koepke@microsoft.com>
Co-authored-by: Peter Bryntesson <pbrynt@microsoft.com>
- support for Microsoft.Extensions.Logger.ILogger in Opc.Ua.Core as the new logging interface
- backward compatible with config and TraceEvents
- new API Utils.SetLogger allows to set ILogger
- updated Console samples to demonstrate ILogger support with Serilog
- support for EventSource logging
- see Docs/Logging.md for more info
- Support the reverse connections in the reference server
- fix an issue when the anonymous token is sent as a null value by the aggregation server
- fix docker build files
Suciu Mircea Adrian