* fix Sampling Group creating a new long running task for every Client Add MonitoredItems Method Call
* reset also on shutdown
* dispose shutdown event
* Generate ECC Certificates in Client Tests
* Add more tests
* reenable check of certificate
* fix tests
* Dont use random in test
* fix unsupported certificate types
* fix Hash algorithm for nistP384 curve on linux as the friendly name is ECDSA_P384 instead of nistP384
* use friendly name by default and add special case only for linux while taking care of nullability
* disable special casing for finding correct certificates
* fix tests on net 462
* update Certificate Identifier
* Correct identity token encryption by setting the correct security policy for the user token.
* Separate endpoint securityPolicyUri from UserToken tokenSecurityPolicyUri
* update ServerConfiguration Node to support multiple Application Certificates. Trust List Support for User Certificates & Https Certificates
* GDS ready for ECC Step1
* fix test
* fix build
* ensure hash algorithm is set
* update configurations to new format, fix minor ecc bugs
* implicitly set certificate type of certificate identifier
extend CertificateFactory to allow Revocation with ECC Issuer Certificate
* Revert "update configurations to new format, fix minor ecc bugs"
This reverts commit 9ee17f3aff.
* Allow GDS Certificate Group to have multiple CA Certificates with different Certificate Types
* fix minor bugs
* adress review feedback
* fix some issues
* fix creation of CA signed ECC Certificates
* Update configurations to new ApplicationCertificateFormat and add extra CA Certificates for ECC Certificates
* remove brainpool certs from configuration
* Generate ECC Certificates in Client Tests
* Revert "Generate ECC Certificates in Client Tests"
This reverts commit 90b395f4ff.
* fix crl tests on platforms not supporting ECC
* fix crl test
* Update READMEs for ECC
- Reduce memory allocations in JSON encoder by using stackalloc/ArrayPool
- Fix some new warnings in .NET9 code analyzers
- Fix fuzzing error in JsonDecoder
- do not use .NET9 libraries with .NET8 LTS builds #2931, #2940
- Bump langversion to 9 (max VS2019)
- Use official ASP.Net 2.3. libraries for .NET Framework (rel. Jan 15th)
* Add ECDSA support for reading private key from PEM
* Padded x, y EC point coordinates and the d private key with leading zeros to match keySize
* CreateCertificateWithPEMPrivateKey creates either ECDSA or RSA certificate depending on certificate type
* implicitly set certificate type of certificate identifier
extend CertificateFactory to allow Revocation with ECC Issuer Certificate
* Add Crl tests for ECC
* fix X509 PFXUtils VerifyECDsaKeyPair
Add the method SetHiResClockDisabled to IApplicationConfigurationBuilder
Fix the type of RejectedStore Created by the Builder to: CertificateStoreIdentifier
* #2896: Write output arguments for good and uncertain status code
When a method state's call method is invoked the output arguments should be written in case the status code is good or uncertain. This behavior would be conform with the current specification.
* #2896: The service result corresponds the method call result
The result of the Call method in the CustomNodeManager2 class represents the status of the CallMethodResult. It does not correspond to the ServiceResult of the CallResponse, thus returning Good as a general response is incorrect behavior.
Add the method SetHiResClockDisabled to IApplicationConfigurationBuilder
Fix the type of RejectedStore Created by the Builder to: CertificateStoreIdentifier
* Make NodeIdDictionary threadsafe by changing the underlying dict from `Dictionary` to `ConcurrentDictionary`
* reduce blocking in CustomNodeManager2 for GetManagerHandle & other uncritical supporting functions
* Use correctly and validate certificate ECDSA signature hash algorithm
* Added tests for validating length of EC certificate signature
* Improved invalidation condition of SignatureAlgorithm
* Changed result text
* Test fix
* Added helper method to set hash algorithm depending on key size;
Reverted ApplicationInstance code
* Fix test CreateSelfSignedForECDsaDefaultTest
* #2896: Write output arguments for good and uncertain status code
When a method state's call method is invoked the output arguments should be written in case the status code is good or uncertain. This behavior would be conform with the current specification.
* #2896: The service result corresponds the method call result
The result of the Call method in the CustomNodeManager2 class represents the status of the CallMethodResult. It does not correspond to the ServiceResult of the CallResponse, thus returning Good as a general response is incorrect behavior.
Fix server time source timestamp is not updated.
There are duplicate objects in generated code, on of which which holds the last timestamp was not updated.
Move all readerwriter locks outside of try/finally to avoid a SynchronizationLockException when a reader writer lock is disposed or is cancelled.
Currently there is no obvious fundamental bug in how the readerwriter locks are used, but outside the try/finally clause e.g. a disposed lock may not trigger a false exception.
In the read NodeId servcie call an enum is by default cast to Int32, so the cast to ushort is needed here to return the expected type for the AccessRestrictions.
A new configuration variable
<HttpsMutualTls>true</HttpsMutualTls>
enables the mutual TLS authentication support. The behavior of the TLS endpoint changes as the following:
HttpsMutualTls is true:
The server checks the trust on the certificate which is used by the client for TLS authentication. It must be a valid OPC UA application certificate which is trusted.
A client can still connect without providing a client certificate, but then it is only able to call discovery services.
In order to create a session, the client must use the same application certificate that was used for the TLS channel.
HttpsMutualTls is false:
- There is no application authentication. The server endpoint uses security None and there is no client application authentication.
Instead, only user authentication is used to secure the server, anonymous user authentication is disabled.
Discovery service calls are supported.
Co-authored-by: Martin Regen <mregen@microsoft.com>
An older OPC UA server returns well known extension object(811) which cannot be decoded by the client because the server doesn't set the length of the extension object.
Recently, based on fuzz testing, the length check has been changed to enforce an exact match, according to spec.
Workaround: Allow a value of -1 for the length, then allow to decode well known extension objects.
Also improve some internal calls to Safe Read functions by calling not via the interface.
romanett