- enable CA3075 as warning (on windows)
- Dtd processing is by default not prohibited, only limited to 10000000 chars.
- ensure to only use safe defaults for all xml processing
- Use updated Modelcompiler code generator to produce code which has no dependency on System.Servicemodel
- breaking change, .NET stack which used the NET_STANDARD version have to fix dependencies on System.Servicemodel
- new codegenerator also provides stubs for async client API (NET_STANDARD_ASYNC), currently disabled
- latest V1.04.9 Nodeset
Thanks @MyLastAngel for your contribution!
- Solves an issue when MonitoredItems are lost, when system time is changed.
- Use HiResClock.TickCount64 when update nextSamplingTime.
- Update HiResClock class with method of TickCount64 for use as monotonic timer
- remove use of Bouncy Castle for .NET Core 3
- refactor CreateCertificate class to allow for an easier Create fluent model with respect to future extensions, e.g. ECC
- reimplement X509CRL and a couple of extension relevant for OPC UA based on the new System.Formats.Asn1 library
- use CertificateRequest on .NET Core 3.1
- refactor codebase to allow for a seperate library to handle all the ASN.1 encoding/decoding
- new package Opc.Ua.Security.Certificates with all ASN.1 encode/decode related code
breaking change: many X509 related util functions were moved to X509Utils class
Note: .NET 4.6.2 and .NET Core 2.1 versions still use BouncyCastle for Cert creation
* Removes assigning a new instance of CertificateValidator in ApplicationConfiguration.Validate method by assigning it on construction.
* Refactors the code to use 'using' statements for streams and LINQ expressions.
* Makes the CertificateValidator member readonly
* Removes read-only status of CertificateValidator and adds unit test to ensure it is assignable from outside the class.
* Implement the mitigation against weak nonce for CVE2019-19135.
* Suppress server nonce validation errors for user tokens in Client Session for encrypted channels.
* This change allows client interoperability with some legacy servers that do not comply with the specification for nonce usage of user token encryption.
* The workaround for servers which can not connect due to a weak nonce is to use an encrypted channel, then the token is protected and the threat is mitigated.
- no bug fixes, just documentation and formatting
- fix all warnings for xml in core libraries, except
-- protected members
-- suppressed warnings in Opc.Ua.Gds libraries (tbd)
- This improvement was tested with an aggregation server update on this branch:
Required for testing: https://github.com/mregen/UA-.NETStandard-Samples/tree/aggregationserver
Main changes:
- Support holding of reverse connections, then a client can connect faster on a hold connection instead of waiting for the next reverse hello.
- Simplify API to connect with or without reverseconnect manager.
- Reconnect handlers code path added, tested with SessionReconnectHandler
- some locks on lists were not correctly implemented.
- Support the reverse connections in the reference server
- fix an issue when the anonymous token is sent as a null value by the aggregation server
- fix docker build files
- The self signed certs should have the CA flag set
- small cleanup fixes for cert code
- make sure public key is always disposed
- breaking change: defaults for certs naming convention was not quite right and it should be a readonly, to make sure policy changes are reflected in calling code
- add test cases for validation of extension
- Ported from prototyping branch in .Net Legacy stack
- Client and server support
- Aggregation server sample
- .Net Core samples
more info in docs/ReverseConnect.md
* Update generated code and UA-nodeset files for 1.04.5 Errata
* Update UA-Nodeset files and generated code of Sample projects with latest version of ModelCompiler
* - Add Server nonce validation for duplicate nonces.
- Add configuration flag to bypass validation exceptions
* Add ITransportChannel.CurrentToken interface for nonce validation.
* Use nameof() where applicable
Category: Maintainability
https://github.com/JosefPihrt/Roslynator/blob/master/docs/analyzers/RCS1015.md
* Rethrow original exception
Preserves original stack trace of the exception, easier to diagnose
Category: Maintainability
https://github.com/JosefPihrt/Roslynator/blob/master/docs/analyzers/RCS1044.mdhttps://stackoverflow.com/a/178464
Remove variable from the catch if not logged (compiler warning).
* Combine Where->FirstOrDefault, use Find if applicable
Category: Performance
https://github.com/JosefPihrt/Roslynator/blob/master/docs/analyzers/RCS1077.md
In ApplicationConfiguration:
ServerSecurityPolicyCollection inherits from List<T>, so use List.Find (better performance than FirstOrDefault)
* Use List.Count rather than LINQ Any()
Category: Performance
https://github.com/JosefPihrt/Roslynator/blob/master/docs/analyzers/RCS1080.md
refsToRemove is a List<T>, which we know the count of (no need to iterate).
* Add [Flags] Attribute for OpenFileMode
Each enum is a bitflag here
Just noticed this is in the "Generated" folder... some prior commits had touched other "Generated" files -- see nameof commit.
* Minor performance behavior
- EventArgs.Empty instead of allocating a new blank EventArgs
It only really happens on Connect/Disconnect so it's not like a single allocation really matters
- Use array[0] instead of First()
https://stackoverflow.com/a/25607951
- Use !Any() instead of Count() == 0
If a dependent field is found, it will stop evaluating the rest and Add instead of Insert. Count() == 0 required evaluation of all
- Use All() instead of FirstOrDefault(any) == null
Clearer intent (all are not matching the group BrowseName => clear default)
Slightly faster as the first match found doesn't have to be compared against null
* Revert changes to generated files
* Fix mistake
fixes compile error
* fix schema validator and dictionary loader (only binary scheme)
# include some .bsd files for validation
* add check for some configuration fields, to return a meaningful error.
Add correction to UserAccessLevel at import time if it was not specified
Add correction to UserWriteMask at import time if it was not specified
Use MethodDeclarationId from an UANode at import time
* add the Aes128 and Aes256 profiles
* Aes profies were tested on IoP workshop against Ascolab, Softing, Matrikon, Milo, ProSys and others
* Pss padding is not supported on all platforms, so autodetect if it is supported and filter out Aes256 if not
* not a breaking change: not specifying the SecurityProfileUri in the config xml will automatically add all supported profiles but not deprecated profiles (e.g. Basic256Sha256, Aes128, Aes256). Aes256 is only added if the platform supports Pss padding. This will simplify the maintenance of config xml, since automatically all supported and secure profiles are exposed.
* X509store mac os (#31)
* Fix problem when X509Store CurrentUser\\UA_MachineDefault cannot be created on macOS with .NetStandard2.0
Fix: Use CurrentUser\My instead for all machine certs to make console apps portable.
* prep console sample apps for smoke test
* update travis image
* run sample server and client as smoke test
* ignore travis osx build failure until travis is fixed
Martin Regen