* reuse usertokenpolicy
* change assert not null to assert ignore when null
* reportauditevent -> Utils.Clone(session?.IdentityToken?.Token)
* use standard credentials
* only assign to endpoint when not null, in UpdateSession -> also update m_userTokenSecurityPolicyUri, change endpoint configuration only on cloned object
* keep using m_userTokenSecurityPolicyUri in Encrypt
* use 'cleaner clone'
* Refactor MonitoredItem.ValueChanged & cert validation
Refactored MonitoredItem.ValueChanged for correctness, performance, and comprehensive test coverage, including improved deadband and array handling. Rewrote equality logic for Variants and arrays. Made certificate validation thread-safe using ConcurrentDictionary and proper semaphore usage. Added extensive unit tests and benchmarks for value change detection.
* Implement DiagnosticsNodeManager using AsyncCustomNodeManager
* Implement CoreNodeManager using AsyncCustomNodeManager
* test(type-info): add failing test
* fix(type-info): require IEnumerable implementation before treating generic type as array
* test(type-info): add test for coverage
* add EncodeDataValueWithoutValueProperty
* adjust de and encoder for datavalue -> always handle sourcepico, etc.
* extend EncodeDataValueWithoutValueProperty test
* nullhandling is needed
* keep declaration as it was
* keep binarydecoder, adjust the test case
* add spec. comment
* keep binaryencoder
* fix client session error code for Endpoint does not support the user identity type provided.
* further places of BadIdentityTokenRejected
* adjust test expectation
Refactored MonitoredItem.ValueChanged for correctness, performance, and comprehensive test coverage, including improved deadband and array handling. Rewrote equality logic for Variants and arrays. Made certificate validation thread-safe using ConcurrentDictionary and proper semaphore usage. Added extensive unit tests and benchmarks for value change detection.
* [Client] Fixed freezing of Subscription with sequential publishing
- Fixed freezing of Subscription (messages were not moving from Subscription.m_incomingMessages to Subscription.m_messageCache). Was happening when sequentialPublishing is active and first received publish response had SequenceNumber greater when 1.
- Constant Subscription.kRepublishMessageTimeout was made public (Subscription.REPUBLISH_MESSAGE_TIMEOUT) so it can be used in tests.
- Added unit tests to cover fixed problem.
- Added unit test to cover invalid handling of reordered message queue for sequential publishing (UnorderedMessagesWouldBeLostForSequentialPublishingAsync). For now, test was made [Explicit].
* [PR] fix naming convention violation
* [PR] removed region in tests
* Add namespace index lookup for NamespaceMetadataState
Added GetNamespaceMetadataState(ushort) to ConfigurationNodeManager and interface for efficient lookup by namespace index. Switched to ConcurrentDictionary for thread safety. Updated AsyncCustomNodeManager to use index-based lookup. Cleared index cache in Clear method.
* Refactor Variant and ServiceResult handling for speed
- Use WrappedValue assignment for DataValue in MonitoredNode and NodeState to align with updated Variant usage.
- Return ServiceResult objects instead of raw StatusCodes for bad attribute IDs.
- Update ServiceResult exception handling: include stack trace only in DEBUG, message only in release.
- Optimize StatusCode to ServiceResult conversion by returning static Good/Bad instances.
* Add Read Limited load test
* Optimize MonitoredItem.IsReadToPublish
* Add Subscription unit tests and improve triggering logic
Added SubscriptionTests to verify PublishTimerExpired behavior, including timer expiry, monitored item readiness, keep-alive, and triggering scenarios. Updated Subscription.cs only process triggering if triggered items are configured, improving correctness and efficiency.
* CR feedback
* Use Interfaces Introduced with 1.5.378
Refactor to use interfaces for node managers and server
Replaced concrete types with interfaces (e.g., IMasterNodeManager, ICoreNodeManager, IDiagnosticsNodeManager, IConfigurationNodeManager, IServerBase) across method signatures, properties, and internal structures to improve abstraction and flexibility.
* Refactor CoreNodeManager to be Based on CustomNodeManager2
* Add Test
* Add INodeManager3 with role permission validation
Introduce INodeManager3 interface extending INodeManager2, adding synchronous role permission validation methods. Update all node manager interfaces and classes to use INodeManager3. Extend IAsyncNodeManager with async permission validation methods and update adapters for sync/async bridging. Deprecate FindNodeInAddressSpace in favor of new async FindNodeInAddressSpaceAsync. Refactor MonitoredNode2 to use thread-safe collections and locking for monitored items. Enhance event reporting with security and permission checks. Update constructors and documentation to reflect new interfaces and best practices.
* Implement AsyncCustomNodeManager
* fix comment
* fix
* Add tests
* fix
* Implement better locking strategy
* fix
* Add more tests
* Add tests
* Add tests
* Add Tests
* cleanup
* cleanup
* Add tests that verifies for AnalogItemState the instrument range is checked brefore writing
* only assign new NodeID in default factory if NodeId isNull
* Run all tests also with sampling groups
* Add Docs
* cleanup
* Add chaos test
* fix test
* Use AsyncCustomNodeManager for ReferenceNodeManger & imrpove ReadAttributes method of NodeState
* fixes
* fixes and code review comments
* Use Interfaces Introduced with 1.5.378
Refactor to use interfaces for node managers and server
Replaced concrete types with interfaces (e.g., IMasterNodeManager, ICoreNodeManager, IDiagnosticsNodeManager, IConfigurationNodeManager, IServerBase) across method signatures, properties, and internal structures to improve abstraction and flexibility.
* Refactor CoreNodeManager to be Based on CustomNodeManager2
* Add Test
* Add INodeManager3 with role permission validation
Introduce INodeManager3 interface extending INodeManager2, adding synchronous role permission validation methods. Update all node manager interfaces and classes to use INodeManager3. Extend IAsyncNodeManager with async permission validation methods and update adapters for sync/async bridging. Deprecate FindNodeInAddressSpace in favor of new async FindNodeInAddressSpaceAsync. Refactor MonitoredNode2 to use thread-safe collections and locking for monitored items. Enhance event reporting with security and permission checks. Update constructors and documentation to reflect new interfaces and best practices.
* Implement AsyncCustomNodeManager
* fix comment
* fix
* Add tests
* fix
* Implement better locking strategy
* fix
* Add more tests
* Add tests
* Add tests
* Add Tests
* cleanup
* cleanup
* Add tests that verifies for AnalogItemState the instrument range is checked brefore writing
* only assign new NodeID in default factory if NodeId isNull
* Run all tests also with sampling groups
* Add Docs
* cleanup
* Add chaos test
* fix test
* Use Interfaces Introduced with 1.5.378
Refactor to use interfaces for node managers and server
Replaced concrete types with interfaces (e.g., IMasterNodeManager, ICoreNodeManager, IDiagnosticsNodeManager, IConfigurationNodeManager, IServerBase) across method signatures, properties, and internal structures to improve abstraction and flexibility.
* Refactor CoreNodeManager to be Based on CustomNodeManager2
* Add Test
* Add INodeManager3 with role permission validation
Introduce INodeManager3 interface extending INodeManager2, adding synchronous role permission validation methods. Update all node manager interfaces and classes to use INodeManager3. Extend IAsyncNodeManager with async permission validation methods and update adapters for sync/async bridging. Deprecate FindNodeInAddressSpace in favor of new async FindNodeInAddressSpaceAsync. Refactor MonitoredNode2 to use thread-safe collections and locking for monitored items. Enhance event reporting with security and permission checks. Update constructors and documentation to reflect new interfaces and best practices.
* fix comment
* fix
* Use Interfaces Introduced with 1.5.378
Refactor to use interfaces for node managers and server
Replaced concrete types with interfaces (e.g., IMasterNodeManager, ICoreNodeManager, IDiagnosticsNodeManager, IConfigurationNodeManager, IServerBase) across method signatures, properties, and internal structures to improve abstraction and flexibility.
* Refactor CoreNodeManager to be Based on CustomNodeManager2
* Add Test
* fix
ServerBase.StopAsync() calls Close() on each transport listener then
Clear() on the list. ServerBase.Dispose() later iterates
TransportListeners to call Dispose() on each — but the list is already
empty, so TcpTransportListener.Dispose() never runs.
Add Utils.SilentDispose() after Close() in StopAsync to ensure
TcpTransportListener.Dispose() executes before the list is cleared.
* add revoke sub ca possible ->
* cert group tests
* fix revoking for sub-cas
* do not use bouncycastle
add test for Test_Root_CA_throws_Exception + throw if applicable
use LoadCrlCreateEmptyIfNonExistantAsync
* remove allowance for initialcrl to be null
* unify with first check for self-signed certificate
* warning -> use StringComparison.Ordinal
* Use Interfaces Introduced with 1.5.378
Refactor to use interfaces for node managers and server
Replaced concrete types with interfaces (e.g., IMasterNodeManager, ICoreNodeManager, IDiagnosticsNodeManager, IConfigurationNodeManager, IServerBase) across method signatures, properties, and internal structures to improve abstraction and flexibility.
* [Server] Refactor CoreNodeManager to be based on CustomNodeManager2 (#3552)
* Refactor CoreNodeManager to be Based on CustomNodeManager2
* Add Test
* Revert "[Server] Refactor CoreNodeManager to be based on CustomNodeManager2 (#3552)"
This reverts commit bb1d868c81.
Generate stack and application code using source generators
Change built in types to readonly structs
Update localized text implementation to use JSON text serializer
Status code with symbolic names
Immutable node ids
No boxing for all built in types <= 8 bytes in Variant.
Split user identity token and token handling via token handler
Add migration guide for breaking changes
* Enforce numeric DataTypes for AnalogItem variables
Removed creation of non-numeric array AnalogItems and added a check to throw an exception if a non-numeric DataType is used. This ensures AnalogItems are restricted to numeric types, improving type safety and compliance.
* Set default description
This pull request modernizes the OPC UA .NET codebase and tests, removes .NET Standard 2.0 support from certificate/security code, and updates test code to use C# 12 and .NET 8+ features for clarity and maintainability.
- Certificate and BouncyCastle interop files (e.g., CertificateBuilder.cs, X509Extensions.cs, X509SignatureFactory.cs) are refactored to drop NETSTANDARD2_0 support and use modern .NET APIs and conditional compilation.
- Test code across the codebase is updated to use default, strongly-typed Parse methods, collection expressions, and improved async/await patterns.
- Exception handling and assertions in tests are modernized, and test method naming is made consistent with Async suffixes.
- The project and build files are updated to clarify Roslynator analyzer usage and remove obsolete netstandard tags.
- General code and test cleanup includes improved null safety, type safety, and removal of deprecated or unused code.
* Improve logging and fix UserNameIdentityToken to return BadIdentityTokenInvalid for failed verification
Refactor DataChangeQueueHandler to return overflow status from QueueValue and Enqueue, updating MonitoredItem to log overflows accurately. Update IDataChangeQueueHandler interface accordingly. Enhance ConsoleTelemetry logger configuration management and ensure proper disposal of old logger factories.
Change UserNameIdentityToken password/nonce failure to return BadIdentityTokenInvalid for more precise error reporting. To prevent the leakage of information useful to attackers, Servers shall ensure that the process of validating UserIdentityTokens completes in a fixed interval independent of whether an error occurs or not. The process of validation includes decrypting, check for padding and checking for a valid nonce. If any errors occur the return code is Bad_IdentityTokenInvalid.
* fix GDS ApplicationNames to include the Locale
* fix ctt testcase by allowing faster sampling for XmlNodeNode
* Add per-namespace NodeSet2 export and CLI option
Implemented ExportNodesToNodeSet2PerNamespaceAsync in ClientSamples to export nodes into separate NodeSet2 XML files per namespace, excluding OPC Foundation companion specs. Added a helper for safe filename generation. Introduced a new -e/--export command-line option in Program.cs to trigger this export after node fetching. Also added System.Xml.Linq import for potential XML handling.
* Add NodeSetExportOptions for flexible NodeSet2 export
Introduce NodeSetExportOptions to control which attributes and values are exported to NodeSet2 XML, with Default, Minimal, and Complete presets. Overload ExportNodesToNodeSet2 to accept these options and update internal logic accordingly. Update CreateNodeState to honor export preferences. Add comprehensive unit tests for all export modes and ensure backward compatibility. Update ClientSamples to use Complete export mode.
* Refactor NodeSet export options for minimal default output
- Change ExportValues default to false; values only for Complete option
- Remove ExportUserAccessLevel and ExportMethodDeclarationId options
- Always export MethodDeclarationId; export UserAccessLevel only if different from AccessLevel
- Remove Minimal option; Default now produces minimal schema output
- Update export logic and tests to reflect new option semantics
- Rename and revise unit test to verify new default and complete behaviors
* Remove unused BitVector32 import
* Add ExportUserContext option to NodeSet2 export
Introduce ExportUserContext to NodeSetExportOptions, allowing selective export of user context attributes (UserAccessLevel, UserExecutable, UserWriteMask, UserRolePermissions) in NodeSet2 files. Update export logic to honor this option and add unit tests to verify correct behavior. This enhances flexibility and control over exported user-specific metadata.
---------
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
* Initial plan
* Add async callback support to TrustList implementation
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Fix redundant security check in OpenAsync
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Fix audit logging parameters in RemoveCertificateAsync
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Refactor TrustList to use async core implementation with sync wrappers
Based on feedback, changed approach:
- Make internal implementation async (OpenCoreAsync, etc.)
- Sync methods now wrap async using .AsTask().GetAwaiter().GetResult()
- Both OnCall and OnCallAsync handlers registered
- Eliminates .GetAwaiter().GetResult() in async paths
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Add ConfigureAwait(false) to sync wrapper methods
Prevents potential deadlocks by adding ConfigureAwait(false) before GetAwaiter().GetResult() in all sync wrapper methods. Also made the pattern consistent across all methods.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Add CancellationToken support to helper methods
Updated UpdateStoreCertificatesAsync and UpdateStoreCrlsAsync to properly propagate CancellationToken through all async operations. Ensures consistent async patterns throughout the implementation.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Initial plan
* Document certificate validation workflow in Certificates.md
- Add comprehensive Certificate Validation section
- Document validation workflow and steps
- List all configuration settings with defaults and examples
- Enumerate suppressible validation errors
- Provide examples for registering validation callbacks
- Show how to implement custom certificate validators
- Include best practices for certificate validation
Addresses the issue by documenting the CertificateValidator.cs
implementation including config settings and suppressible errors.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Fix trailing whitespace in Certificates.md per .editorconfig
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Add detailed chain building technical documentation
- Add comprehensive Chain Building Process section with diagram
- Include ASCII flowchart showing complete validation flow
- Add pseudocode for all chain building steps:
- Initialization and loop structure
- Three-tier issuer search (Trusted → Issuer → Untrusted)
- Issuer matching algorithm with criteria
- CRL checking logic with revocation handling
- X509Chain integration and validation
- Document search priority and trust anchoring behavior
- Add key behaviors section explaining design decisions
- Link from validation workflow to detailed section
Addresses feedback requesting more technical detail, diagram,
and pseudocode visualization of the chain building process.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Add certificate list configuration documentation
- Add Certificate List Configuration section (~190 lines)
- Document configuration sources (XML config and runtime API)
- Provide XML configuration structure with examples
- Explain certificate store types (Directory and X509Store)
- Detail certificate list population process:
- Initialization via ApplicationConfiguration
- Internal update process
- Certificate search behavior and priority
- Add runtime certificate management examples
- Document certificate store management (file operations)
- Explain dual-mode operation (explicit list + store)
- Include configuration best practices
- Link from Trust Check step to configuration section
Addresses feedback requesting details on where certificate
lists are configured and populated.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
KircMax