In the read NodeId servcie call an enum is by default cast to Int32, so the cast to ushort is needed here to return the expected type for the AccessRestrictions.
A new configuration variable
<HttpsMutualTls>true</HttpsMutualTls>
enables the mutual TLS authentication support. The behavior of the TLS endpoint changes as the following:
HttpsMutualTls is true:
The server checks the trust on the certificate which is used by the client for TLS authentication. It must be a valid OPC UA application certificate which is trusted.
A client can still connect without providing a client certificate, but then it is only able to call discovery services.
In order to create a session, the client must use the same application certificate that was used for the TLS channel.
HttpsMutualTls is false:
- There is no application authentication. The server endpoint uses security None and there is no client application authentication.
Instead, only user authentication is used to secure the server, anonymous user authentication is disabled.
Discovery service calls are supported.
Co-authored-by: Martin Regen <mregen@microsoft.com>
An older OPC UA server returns well known extension object(811) which cannot be decoded by the client because the server doesn't set the length of the extension object.
Recently, based on fuzz testing, the length check has been changed to enforce an exact match, according to spec.
Workaround: Allow a value of -1 for the length, then allow to decode well known extension objects.
Also improve some internal calls to Safe Read functions by calling not via the interface.
* Bug fix for: keep alive timer is not updated if the timing of a subscription is changed #2863
* Restart KeepAlive Timer with correct KeepAliveInterval on ModifySubscription, if the interval changed
For better client diagnostic it is important to have access to the channel token. Today tooling must monitor the channel token change to be aware of the current token, it is more efficient for the tooling to be called back when the token changes. This can be now accomplished in that the owner of a client (Discovery, Session) can retrieve the Transport channel after connect, read the current token and register a change callback.
* Add OnTokenActivated event for token change notifications
Added a new event `OnTokenActivated` to the `UaChannelBase` class in the `Opc.Ua` namespace to notify when a channel token is activated. Implemented this event in the `HttpsTransportChannel` class within the `Opc.Ua.Bindings` namespace. Introduced a protected internal `OnTokenActivated` event handler in the `UaSCBinaryChannel.Symmetric` class, invoked during token changes in the `ActivateToken` and `DiscardTokens` methods. Cleaned up the event handler in the `Dispose` method of the `UaSCBinaryClientChannel` class. Registered the event handler with the internal channel in the `UaSCBinaryTransportChannel` class. Added a new delegate `ChannelTokenActivatedEventHandler` in the `ITransportChannel` interface and updated the interface to include the `OnTokenActivated` event. Made minor formatting and comment adjustments for improved readability and consistency.
* Include channel in callback
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
For better client diagnostic it is important to have access to the channel token. Today tooling must monitor the channel token change to be aware of the current token, it is more efficient for the tooling to be called back when the token changes. This can be now accomplished in that the owner of a client (Discovery, Session) can retrieve the Transport channel after connect, read the current token and register a change callback.
* Add OnTokenActivated event for token change notifications
Added a new event `OnTokenActivated` to the `UaChannelBase` class in the `Opc.Ua` namespace to notify when a channel token is activated. Implemented this event in the `HttpsTransportChannel` class within the `Opc.Ua.Bindings` namespace. Introduced a protected internal `OnTokenActivated` event handler in the `UaSCBinaryChannel.Symmetric` class, invoked during token changes in the `ActivateToken` and `DiscardTokens` methods. Cleaned up the event handler in the `Dispose` method of the `UaSCBinaryClientChannel` class. Registered the event handler with the internal channel in the `UaSCBinaryTransportChannel` class. Added a new delegate `ChannelTokenActivatedEventHandler` in the `ITransportChannel` interface and updated the interface to include the `OnTokenActivated` event. Made minor formatting and comment adjustments for improved readability and consistency.
* Include channel in callback
- reduce EscapeString overhead in JSON encoder
- client monitored items: allocate queues only if needed
- replace SortedDictionary with Dictionary for perf reasons
- revert a change in padding and reduce a log level
Clients that are failing too often to pass the security validationin a certain interval of time with the Basic128 security profile are now tracked and blocked.
- Channels are not disposed (client and server)
- During long running tests an HMAC object leak was observed.
- The HMAC and SymmetricSign objects were not disposed after use, leading to a small incremental memory leak per key renewal.
- The channel token lifetime is calculated by the system clock, which can change. Instead use the continous HiResClock.TickCount to calculate the lifetimes.
- Token renewal and connection requests are not removed from the request dictionary
Improvements:
- Make ChannelToken disposable. Dispose channels.
- Dispose HMAC and SymmetricSign objects after use.
- Use TickCount to calculate key renewal and key expiry.
- Introduce a 5% jitter to the token renewal timer, to avoid token renewal storms.
- Reduce the allocation per use of the HMAC objects by using ReadOnlySpan and avoid MemoryStream.
* improve crl handling in certificate stores by not loading CRL with invalid or unsupported content. Hence the revocation check for such certificates may fail.
- Port support for ECC NIST/Brainpool profiles from prototyping_ecc branch
- Implement CertProvider to load certs per connection / profile
- Backward compatibility of configuration for existing apps
- SecurityConfiguration specifies app cert types for each profile
- Autodetect the ECC support for brainpool/nist based on platform (mac OS 10 doesn't support brainpool)
- ECC supported on net48 / net5.0 / net 6.0 / netstandard2.1
- ECC supported on windows / linux / macOS (brainpool not < macOS11)
- Self signed certs for each profile are created on start similar to RSA
- RSA only profiles are supported on .NET standard 2.0
Co-authored-by: Martin Regen <mregen@microsoft.com>
The server under test has a extension object with a complex type. Type id = {nsu=http://opcfoundation.org/UA/Machinery/Result/;i=5008}. This contains something with a variant array that is null though (-1). SetProperty should support setting a Array that is null. Therefore, test for null collection (case when length was encoded as -1) before dereferencing ahead of the ToArrray() conversion to Array.
-JSON Encoder Verbose and NonReversible encoding with WriteStatusCode may produce invalid JSON
-ExpandedNodeId.Format does not handle not well formed uri correctly, as in the previous implementation
It fixes#2656 by including in the SystemContext (taken as an argument to the OnMonitoredNodeChanged method) the Server session related to the current MonitoredItem that is going to be passed to the QueueValue.
Moved the modified reference server from the unit test to its own file.
Also moved the modified server side session, the modified session manager and the modified master node manager to the same file.
Check the Session included in the ISystemContext instance, if any, and compare it with those belonging to the monitored items.
If the ISystemContext instance contains a Session, the event will be appended only to the monitored items belonging to the same Session.
If the ISystemContext instance does not contain a Session, the event will be appended to all monitored items, regardless of their sessions.
dependabot[bot]