* Fix for ReadTrustList test failure.
* fix .NET4.8 GDS push
* include .NET 4.8 in test pipeline
* fix audit event that may throw exception when server is halted
Co-authored-by: Randy Armstrong <randy@sparhawksoftware.com>
-Enable package validation to catch API differences on target platforms
-Build and release .NET 4.8 assemblies in preparation of retirement of .NET 4.6.2. support
-.NET 4.8 does not rely on bouncy castle for cert creation and supports ECC certificates. Bouncy castle is only used on this platform to read and write PEM encoded certificates.
-Currently the server startup tries to load bindings for all known schemes, even if no baseaddress was specified.
Filter the required schemes to load only if necessary.
-Make GetDiscoveryUrl helper public
.NET7 introduces a X509AuthorityKeyIdentifierExtension datatype which causes some ambigous datatype build errors.
Tested on .NET7 rc2
Note: Targetframework as .NET7 has not been added yet. Fix just the build if somebody tries.
-Modelcompiler Update 1.04.11 generated files.
-Update of UANodeset.xsd with 1.05.02 version.
-Add generated templates for ISessionClientMethods
Co-authored-by: Randy Armstrong <randy@sparhawksoftware.com>
-Add Session.CloseAsync methods.
-Add missing Close signatures to ISession
-Mark the CloseSession service call as obsolete to prevent invalid usage
-fix UANodeSetHelper.Save(stream), to not close the stream
-fix a deadlock in the ref server app, due to the new default behavior of the cert validator not caching the approved certificates
Expose an 'ISession' interface as abstraction to ease unit testing.
Breaking changes are kept to minimal impact, but some changes maybe required to use ISession objects instead of Session.
Note: ISessionClientMethods is hand created, not yet by ModelCompiler
Currently, the validated certificates are stored in a dictionary for fast compare of the certificate validation when an application reconnects, until manually cleared by e.g. `ResetValidatedCertificates()`. After discussion it was decided to make this function an opt-in feature to avoid use cases where changes in the trusted store or CRL are not reflected in the list of validated certificates.
The runtime penalty of a full check can be avoided if needed with the 'Opt-In' by configuration or by application setting the property. After opt-in it is the application responsibility to clear the list of validated certificates if needed.
+++ Other cert validator improvements/fixes
- Setting the `ValidationOptions.SuppressRevocationStatusUnknown` on a trustlist (e.g. issuer) was ignored
- If another client/server connects with a chain, the whole chain is saved to the rejected store, not only the leaf certificate.
Improvements for complex types.
- Support to encode/decode complex type structures with multidimensional arrays.
- Perf improvements for type loader using new NodeCache fetch multiple interfaces.
- DataTypeDictionary validation when dependencies are used.
- interface for complex type resolver, to build custom types in code.
- improvements of console client to demonstrate browse/read of custom values
+++ Breaking changes +++
IDecoder interface change of the `ReadArray` method
- Return type is now `Array` for all types of arrays. Previously the method returned an array for 1-dim and a `Matrix` type for multidimensional arrays. In addition the convention in generated code is to use `Collection` for all 1-dim arrays, and so was built the `BaseComplexType`. The new convention is to expose the native `Array` type from a complex type, in all cases, hence the return type of `ReadArray` was changed to reflect that for a consistent programming model.
- `ReadArray` has a new parameter `systemType` to efficiently read encodeable types. Previously the `Type` of an encodeable was determined by the encodingid and lookup in the type factory, even when the Type is already known by the caller. The 'old' style is still supported.
- `ReadArray` supports to read encodeable type arrays which are directly encoded in structures. These arrays differ from standard encoding of arrays and they are handled when `BuiltInType.Null` is used as parameter.
* So far errors during startup of MasterNodeManager were consumed and only logged, so the app did not know there is an issue
* New behavior is to rethrow exception to retrieve it outside the NuGet package
* Update MasterNodeManager.cs
* change the Certificate domain validation to work also for the server case
* do not refuse a connection if the check fails, only trigger the audit event
* bump up test Nuget
* bump up VM versions
* Bump BenchmarkDotNet from 0.13.1 to 0.13.2
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Martin Regen <mregen@microsoft.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
-Issue: A server might return a much smaller send and receive buffer size than what was proposed in the hello message by a client. Given the current default max chunk count, which is based on the default buffer size, the response message size is also limited by the calculated max chunk count.
- fix: Calculate the default max chunk counts based on the TCP client min buffer size.
-Make the https callbacks fully async / code cleanup.
-Default https client to use MaxConnectionsToServer = 64 for #1550
-Fix https missing reconnect error code
other fixes unrelated to https:
- move trust list audit event to AuditEvents.cs, fix issue that the event is not filtered since reportAuditEvent cannot be used
- fix an issue when BrowseNext for multiple continuation tokens doesn't add the results array properly
- bump up .NET Core 3.1 Nuget dependencies
- improve .NET reference client app for use with https
*The EncodableFactory does not index the JSON DataTypeEncodingIds because they are not defined on the types.
As a result, a JSON document that complies with the specification (see https://reference.opcfoundation.org/Core/Part6/5.4.2/#5.4.2.16) cannot be parsed.
* This change creates the JSON encoding types ids from generated code using reflection, so the JSON documents which comply with the spec can be decoded.
* Fixes type id on a JSON encoded ExtensionObject that contains binary or xml encoded data.
Co-authored-by: Randy Armstrong <randy@sparhawksoftware.com>
- Move the auditing flag to server internal
- Hook up new configuration setting to the Auditing node
- A Security Admin can change the Audit setting.
- Refactor audit events to be extensions in one class.
- enable auditing and diagnostics by default for higher test coverage.
- refactor dependency of some events to bindings, e.g. TcpServerChannel should not be used as reportevent parameter
- Fix error in validating PermissionType.ReceiveEvents.
The specs state that "A Client only receives an Event if this bit is set on the Node identified by the EventTypeId field and on the Node identified by the SourceNode field.
This Permission is only valid for EventType Nodes or SourceNodes."
The previous code was only checking the Node id of event state instance.
- Add methods to support to Read/Browse multiple nodes in session and NodeCache.
- Add methods to find references of multiple nodes in NodeCache.
- By default the client fetches the operation limits from the server.
- Add operation limit object to client config, settings are overwritten by server limits if server limits are smaller.
- Split client service calls if operation limits are exceeded with an override of the SessionClient. All sync/async service calls are implemented, but not the servcie calls using the Begin/End pattern.
* Audit events; add methods for reporting Add/Delete nodes audit events and call these methods in CreateNode and DeleteNode methods
- fix values for AuditActivateSessionEventState.ClientSoftwareCertificates and AuditWriteUpdateEventState.IndexRange properties that were set to values of wrong type and generated exception when the client used filters for these properties.
* Add new methods for reading a set of nodes
* ReadNodes(NodeIdCollection, out DataValueCollection, out IList<ServiceResult>, bool optionalAttributes)
* (DataValueCollection, IList<ServiceResult>) ReadNodesAsync (NodeIdCollection, bool optionalAttributes)
to reduce the amount of attributes read from a server ReadNodes first reads only the NodeClass, then reads only the mandatory attributes per nodeclass to reduce the overall number of attributes to read.
If the NodeClass of all nodes is already known, the read can be further optimized to read only the attributes for a known class:
* ReadNodes(NodeIdCollection, NodeClass, out DataValueCollection, out IList<ServiceResult>, bool optionalAttributes)
* (DataValueCollection, IList<ServiceResult>) ReadNodesAsync (NodeIdCollection, NodeClass, bool optionalAttributes)
to complete async and collection operation, there is a:
* ReadNodeAsync and
* ReadValues/ReadValuesAsync
* An issue was fixed in the https async codepath, the security header was not properly set in async operation
sidenote: operation limits must be handled by caller!
Co-authored-by: Martin Regen <mregen@microsoft.com>
* Handle JWT and set the IssuedTokenType in the server based on the policy referenced by the PolicyId in the client supplied UserIdentityToken .
* Connect/Reconnect tests cases with JWT
* add resend data support to sample node manager
* After WG discussion, ensure after ResendData only a single value per monitored item is sent in the next publish (sync client cache)
* Seperate resend data state from ready to publish with IsResendData property
* Moved validation of RolePermission from MonitoredItem::Publish to MonitoredNode::OnReportEvent.
Refactor MasterNodeManager::GetManagerHandle to avoid calling other node manager's GetManagerHandle inside a lock statement
