ServerBase.StopAsync() calls Close() on each transport listener then
Clear() on the list. ServerBase.Dispose() later iterates
TransportListeners to call Dispose() on each — but the list is already
empty, so TcpTransportListener.Dispose() never runs.
Add Utils.SilentDispose() after Close() in StopAsync to ensure
TcpTransportListener.Dispose() executes before the list is cleared.
* Enforce numeric DataTypes for AnalogItem variables
Removed creation of non-numeric array AnalogItems and added a check to throw an exception if a non-numeric DataType is used. This ensures AnalogItems are restricted to numeric types, improving type safety and compliance.
* Set default description
This pull request modernizes the OPC UA .NET codebase and tests, removes .NET Standard 2.0 support from certificate/security code, and updates test code to use C# 12 and .NET 8+ features for clarity and maintainability.
- Certificate and BouncyCastle interop files (e.g., CertificateBuilder.cs, X509Extensions.cs, X509SignatureFactory.cs) are refactored to drop NETSTANDARD2_0 support and use modern .NET APIs and conditional compilation.
- Test code across the codebase is updated to use default, strongly-typed Parse methods, collection expressions, and improved async/await patterns.
- Exception handling and assertions in tests are modernized, and test method naming is made consistent with Async suffixes.
- The project and build files are updated to clarify Roslynator analyzer usage and remove obsolete netstandard tags.
- General code and test cleanup includes improved null safety, type safety, and removal of deprecated or unused code.
* Improve logging and fix UserNameIdentityToken to return BadIdentityTokenInvalid for failed verification
Refactor DataChangeQueueHandler to return overflow status from QueueValue and Enqueue, updating MonitoredItem to log overflows accurately. Update IDataChangeQueueHandler interface accordingly. Enhance ConsoleTelemetry logger configuration management and ensure proper disposal of old logger factories.
Change UserNameIdentityToken password/nonce failure to return BadIdentityTokenInvalid for more precise error reporting. To prevent the leakage of information useful to attackers, Servers shall ensure that the process of validating UserIdentityTokens completes in a fixed interval independent of whether an error occurs or not. The process of validation includes decrypting, check for padding and checking for a valid nonce. If any errors occur the return code is Bad_IdentityTokenInvalid.
* fix GDS ApplicationNames to include the Locale
* fix ctt testcase by allowing faster sampling for XmlNodeNode
* Add per-namespace NodeSet2 export and CLI option
Implemented ExportNodesToNodeSet2PerNamespaceAsync in ClientSamples to export nodes into separate NodeSet2 XML files per namespace, excluding OPC Foundation companion specs. Added a helper for safe filename generation. Introduced a new -e/--export command-line option in Program.cs to trigger this export after node fetching. Also added System.Xml.Linq import for potential XML handling.
* Add NodeSetExportOptions for flexible NodeSet2 export
Introduce NodeSetExportOptions to control which attributes and values are exported to NodeSet2 XML, with Default, Minimal, and Complete presets. Overload ExportNodesToNodeSet2 to accept these options and update internal logic accordingly. Update CreateNodeState to honor export preferences. Add comprehensive unit tests for all export modes and ensure backward compatibility. Update ClientSamples to use Complete export mode.
* Refactor NodeSet export options for minimal default output
- Change ExportValues default to false; values only for Complete option
- Remove ExportUserAccessLevel and ExportMethodDeclarationId options
- Always export MethodDeclarationId; export UserAccessLevel only if different from AccessLevel
- Remove Minimal option; Default now produces minimal schema output
- Update export logic and tests to reflect new option semantics
- Rename and revise unit test to verify new default and complete behaviors
* Remove unused BitVector32 import
* Add ExportUserContext option to NodeSet2 export
Introduce ExportUserContext to NodeSetExportOptions, allowing selective export of user context attributes (UserAccessLevel, UserExecutable, UserWriteMask, UserRolePermissions) in NodeSet2 files. Update export logic to honor this option and add unit tests to verify correct behavior. This enhances flexibility and control over exported user-specific metadata.
---------
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
* Initial plan
* Add async callback support to TrustList implementation
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Fix redundant security check in OpenAsync
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Fix audit logging parameters in RemoveCertificateAsync
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Refactor TrustList to use async core implementation with sync wrappers
Based on feedback, changed approach:
- Make internal implementation async (OpenCoreAsync, etc.)
- Sync methods now wrap async using .AsTask().GetAwaiter().GetResult()
- Both OnCall and OnCallAsync handlers registered
- Eliminates .GetAwaiter().GetResult() in async paths
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Add ConfigureAwait(false) to sync wrapper methods
Prevents potential deadlocks by adding ConfigureAwait(false) before GetAwaiter().GetResult() in all sync wrapper methods. Also made the pattern consistent across all methods.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Add CancellationToken support to helper methods
Updated UpdateStoreCertificatesAsync and UpdateStoreCrlsAsync to properly propagate CancellationToken through all async operations. Ensures consistent async patterns throughout the implementation.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Initial plan
* Document certificate validation workflow in Certificates.md
- Add comprehensive Certificate Validation section
- Document validation workflow and steps
- List all configuration settings with defaults and examples
- Enumerate suppressible validation errors
- Provide examples for registering validation callbacks
- Show how to implement custom certificate validators
- Include best practices for certificate validation
Addresses the issue by documenting the CertificateValidator.cs
implementation including config settings and suppressible errors.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Fix trailing whitespace in Certificates.md per .editorconfig
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Add detailed chain building technical documentation
- Add comprehensive Chain Building Process section with diagram
- Include ASCII flowchart showing complete validation flow
- Add pseudocode for all chain building steps:
- Initialization and loop structure
- Three-tier issuer search (Trusted → Issuer → Untrusted)
- Issuer matching algorithm with criteria
- CRL checking logic with revocation handling
- X509Chain integration and validation
- Document search priority and trust anchoring behavior
- Add key behaviors section explaining design decisions
- Link from validation workflow to detailed section
Addresses feedback requesting more technical detail, diagram,
and pseudocode visualization of the chain building process.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Add certificate list configuration documentation
- Add Certificate List Configuration section (~190 lines)
- Document configuration sources (XML config and runtime API)
- Provide XML configuration structure with examples
- Explain certificate store types (Directory and X509Store)
- Detail certificate list population process:
- Initialization via ApplicationConfiguration
- Internal update process
- Certificate search behavior and priority
- Add runtime certificate management examples
- Document certificate store management (file operations)
- Explain dual-mode operation (explicit list + store)
- Include configuration best practices
- Link from Trust Check step to configuration section
Addresses feedback requesting details on where certificate
lists are configured and populated.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Initial plan
* Fix ObjectDisposedException in SubscriptionManager background tasks
Add ObjectDisposedException handling in PublishSubscriptionsAsync and ConditionRefreshWorkerAsync to gracefully handle shutdown race condition where semaphore/events are disposed while background tasks are still running.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* Update log messages to differentiate normal and disposed shutdown paths
Added clarification in log messages to indicate when tasks exit due to ObjectDisposedException during shutdown, making it easier to distinguish from normal shutdown in logs.
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
- Fix bug in MonitoredItem.Publish (for loop was never executed)
- MonitoredItem.CacheQueueSize property was not serialized
- Add unit tests for MonitoredItems
Refactor to make OPC UA server subscription and monitored item management fully asynchronous, improving scalability and responsiveness. All key methods in ISubscription, ISubscriptionManager, and related classes are now async, with synchronous counterparts removed.
* remove all usages of SoftwareCertificates
- Client
- Server
As per spec they are not relevant for security.
If an SDK User wants to use the SoftwareCertificates ActivateSession can be overriden
* remove from SessionClientBatchTests
Rico Suter